search

duo-labs / cloudtracker

CloudTracker helps you find over-privileged IAM users and roles by comparing CloudTrail logs with current IAM policies.
BSD 3-Clause "New" or "Revised" License
887 stars 111 forks source link

Usage of --start option #48

Closed z0ph closed 4 years ago

z0ph commented 5 years ago

Hey Scott,

Thanks for the amazing work, as usual.

Do you confirm that if I'm using : cloudtracker --account myaccount --user myuser --show-used --start 2019-04-25

The --start option is not used?

I was trying to identify the last used actions on a specific user after a specific date. (forensic, and least privilege building for a new policy)

Thanks,

0xdabbad00 commented 5 years ago

It should be used. You can see here: https://github.com/duo-labs/cloudtracker/blob/master/cloudtracker/datasources/athena.py#L140

The start value makes it's way to that function, though I don't actually use the day.

z0ph commented 5 years ago

Do you mean that the whole month is used? so for me 04 last month/current month.

It will make sense as when using the current day (25), the actions used are very large...

0xdabbad00 commented 5 years ago

It basically chops off the day from the date, so 2019-04-25 should end up being the same as 2019-04, so it should show everything in the past 25 days.

z0ph commented 5 years ago

Ok thanks!

0xdabbad00 commented 4 years ago

Closing as having been resolved. I should better clarify what data actually gets used though.