badpeople.sh

#!/bin/bash -e

# This script finds IAM users who have passwords but no MFA.
# Deal with them accordingly.

# Generate a report
aws iam generate-credential-report > /dev/null

# Download report.
REPORT=$(aws iam get-credential-report)

# Parse the good stuff from the JSON
DATA=$(echo ${REPORT}|jq ".Content" -r)


echo ${DATA} | \
  # Decode the CSV
  base64 --decode | \
  # Look at PW enabled and MFA enabled fields
  cut -d, -f1,4,8 | \
  # Find people with PW but not MFA
  grep "true,false$" | \
  # Print their beautiful usernames
  cut -d, -f1