Analyze AWS IAM permissions with the k9 CLI

Often Cloud teams are left in the dark with no way of confidently knowing who can administer IAM, what permissions are actually granted to principals and data resources, whether that access has changed recently.

If you are dealing with this, I feel your pain.

I know from my own experience how frustrating it can be when you don’t have the correct tools and/or processes to manage IAM effectively (in fact I wrote a book about it). But I also know how effective command-line tools can be for finding information quickly and automating repetitive analysis with a simple script. Tools like this can save you precious time while simultaneously improving the security of your cloud environment when used purposefully.

Introducing: The new k9 CLI

The k9 CLI is the perfect companion for your next security audit or automated security check, optimized for your command shells and delivery pipelines.

Whether you are a Cloud/Cloud Security/DevOps/Site Reliability Engineer or a Consultant, the k9 CLI helps you identify critical risks quickly.

In addition to identifying risks, the k9 CLI can also be used to show access capability differences in an account between two points in time. You can use the k9 CLI to determine what has changed in an account by generating a diff report between a historical analysis date and the latest report. This cli supports:

• both absolute and relative time periods
• filtering to particular APIs, service types, or resources with certain tags with standard command-line tools like grep and jq

And it is easy to get started! Just download one of the released binaries, rename the file to k9 or k9.exe and place it in your execution path.

Start by listing the AWS accounts monitored by k9 with k9 list, then synchronize the reports to your local environment using k9 sync. Now you’re ready to:

• query for risks like IAM admins
• show which principals have access to critical AWS APIs and data
• diff changes to principals and resources over time

Tour the k9-cli in this 5-min demo:

Meaningful AWS IAM security isn’t realistic without the help of usable tools and effective, repeatable processes. However, you can achieve a much clearer picture of your security posture using the k9 CLI.

Full usage of the k9 CLI is documented in the k9securityio/k9-cli README on GitHub. The k9 CLI v0.1.0 preview release is available on GitHub for OS X, Linux, and Windows.

p.s. Check out k9’s other repositories at https://github.com/k9securityio where you can find our recently released data security policy library for CDK v2.

Think k9 right is the right CIEM to help scale your security? Set up a demo!