dagrz

AWSServiceRoleForAccessAnalyzer
AWSServiceRoleForCertificateManager
AWSServiceRoleForAmazonMWAA
AWSServiceRoleForAppIntegrations
AWSServiceRoleForAppFabric
AWSServiceRoleForAppMesh
AWSServiceRoleForAppMeshPreview
AWSServiceRoleForAppRunner
AWSServiceRoleForAppSync
AWSServiceRoleForArtifact

dagrz

#!/usr/bin/env python3

"""
AWS Trust Graph Analyzer

This script analyzes AWS IAM trust relationships across accounts, roles, users, and SSO principals.
It builds a graph of `sts:AssumeRole` relationships, identifies roles with admin-level privileges,
and traces trust chains to help you understand who really has root-equivalent access in your AWS environment.

The tool supports multiple output formats, including:

dagrz

#!/usr/bin/env python3


"""
AWS Identity Collector: Extract Trust and Privilege Data Across Accounts

This script collects identity and access metadata from one or more AWS accounts,
including IAM roles, IAM users, SSO (AWS IAM Identity Center) users, and their policies.
It’s used as a precursor for analyzing trust relationships and admin-equivalent access
across AWS environments.

dagrz

#!/usr/bin/env python3

import json, time, requests, re, argparse, os, boto3

def main(args):
    print("> Started...")
    if args.verbose:
        print(f"^ Args: {args}")
        s3_bucket = None
    if args.s3_bucket:

dagrz

#!/usr/bin/env python3

import requests, argparse
import xml.etree.ElementTree as ET

SITEMAP_URI = 'https://docs.aws.amazon.com/sitemap_index.xml'

def main():
    get_sitemap_and_parse(SITEMAP_URI)

dagrz

#!/usr/bin/env python
from __future__ import print_function
import boto3
import base64

client = boto3.client(service_name='ec2', region_name='us-east-1')
for region in client.describe_regions()['Regions']:
    ec2 = boto3.resource(service_name='ec2', region_name=region['RegionName'])
    for instance in ec2.instances.all():
        response = instance.describe_attribute(Attribute='userData')

dagrz

#!/usr/bin/env python
from __future__ import print_function
import boto3
import json
import random

# A list of Role, User, and account ARNs to allow 
# assumption from at random.
BACKDOOR_ROLES = [
    'your-arn-here'

dagrz

import json
import urllib
import boto3

s3 = boto3.client('s3')

def lambda_handler(event, context):
    bucket = event['Records'][0]['s3']['bucket']['name']
    key = urllib.unquote_plus(event['Records'][0]['s3']['object']['key']).decode('utf8')
    try:

dagrz

#!/usr/bin/env python
from __future__ import print_function
import json
import boto3
import random

# A list of rules to add at random to security groups.
BACKDOOR_RULES = [
    { 'FromPort': 0, 'ToPort': 65535, 'CidrIp': '127.0.0.1/32', 'IpProtocol': '-1'}
]

dagrz

#!/usr/bin/env python
from __future__ import print_function
import boto3
from botocore.exceptions import ClientError
import json
import argparse


def main(args):
    for line in args.key_file.readlines():