Kata 0: Find & Tour a k9 Access Inventory Report

Let’s prepare for the k9 Security Katas by finding and touring a k9 resource access inventory in Excel format.

The Excel report format (sample) is very useful for both the structured and ad-hoc analysis new users perform of their accounts.

k9 Security delivers access inventory reports to the S3 bucket created during setup

k9 organizes reports in the bucket using a structure that looks like:


Each element of the key path in {braces} is replaced with the relevant information for a given report:

  • k9_customer_id: your k9 customer id, e.g. C123456
  • aws_account_id: the analyzed AWS account id, e.g. 012345678912
  • year: the year component of the analysis start time (UTC), e.g. 2021
  • month: the year component of the analysis start time (UTC), e.g. 04

Two important things about time:

  • k9 uses UTC time for all reports
  • k9 starts analysis at UTC-7 to maximize utility for daily analysis in North & South America.

So the Excel report generated on April 9th, 2021 at 07:28 UTC is stored at:


Now find and open an Excel formatted report for today. 

When you open the spreadsheet, you will start at the ‘Audit Summary’ worksheet, which reports audit context and summary statistics:

Audit Summary

The Excel report contains the following worksheets:

  • Audit Summary: reports aggregate statistics about IAM principals
  • Principals: Reports details of each IAM principal, when it was last used, its credentials, and tags
  • Principal Access Summary: Reports each principals access capabilities to supported AWS APIs and data resources
  • Resources: Details about each supported data resource, S3 buckets & KMS encryption keys
  • Resource Access Summaries: A resource-oriented view of what access each principal has to data resources
  • k9 Access Capability Mapping: the mapping of AWS API actions to k9 Access Capabilities used to generate the report

k9 delivers each analysis in three forms: xslx, csv, and json. These formats enable use by: people, SIEMs, and custom analysis tools.

If you have any trouble opening your reports or other questions, please contact [email protected]. We are happy to help.