mhausenblas / rbiam

A unified IAM+Kubernetes RBAC access control exploration tool

rbIAM

A unified AWS IAM & Kubernetes RBAC access control exploration tool.

rbiam's Issues

Building rbIAM on fresh ubuntu container fails

Error:

root@b723326f86f9:/# go get github.com/mhausenblas/rbIAM
# github.com/mhausenblas/rbIAM
root/go/src/github.com/mhausenblas/rbIAM/iam.go:55:12: cannot use res (type *sts.GetCallerIdentityResponse) as type *sts.GetCallerIdentityOutput in assignment

Steps to reproduce:

• Dockerfile:

FROM ubuntu

RUN apt-get update
RUN apt-get install -y golang git
RUN go get github.com/mhausenblas/rbIAM

ENTRYPOINT "bash"

• Building the Dockerfile leads to the following error:

$ docker build .
[...]
---> d2ea1f41b7ca
Step 4/5 : RUN go get github.com/mhausenblas/rbIAM
 ---> Running in c4afde336f0f
# github.com/mhausenblas/rbIAM
root/go/src/github.com/mhausenblas/rbIAM/iam.go:55:12: cannot use res (type *sts.GetCallerIdentityResponse) as type *sts.GetCallerIdentityOutput in assignment
The command '/bin/sh -c go get github.com/mhausenblas/rbIAM' returned a non-zero code: 2

Starting rbIAM locally fails

Starting rbIAM locally fails:

$ rbiam
Gathering info from IAM and Kubernetes. This may take a bit, please stand by ...
Can't get user: ValidationError: Must specify userName when calling with non-User credentials
	status code: 400, request id: 05xxxx5d-xxxx-4xxa-bxx8-1faxxxxb8fd8%

• Using federated temporary credentials, so the following values are present in ~/.aws/credentials: aws_access_key_id, aws_secret_access_key, aws_session_token

Can also be reproduced using aws-cli:

$ aws iam get-user

An error occurred (ValidationError) when calling the GetUser operation: Must specify userName when calling with non-User credentials

Make available as a krew plugin?

This tool is really great, especially compared to some of the other rbac auditing tools I've worked with.

It might help ease setup and discovery if it was made available as a krew plugin.

Are there any plans for this?

rbIAM and assumedRoles

We are leveraging assumed Roles and don't authenticate using IAM users. I get this error - not sure which user I should be specifying?

Gathering info from IAM and Kubernetes. This may take a bit, please stand by ...
Can't get user: ValidationError: Must specify userName when calling with non-User credentials
        status code: 400,