duo-labs / cloudtracker

CloudTracker helps you find over-privileged IAM users and roles by comparing CloudTrail logs with current IAM policies.
BSD 3-Clause "New" or "Revised" License
887 stars 111 forks source link

[Cloudtracker] JSONDecodeError: Expecting value: line 1 column 1 #68

Closed CaseyLabs closed 4 years ago

CaseyLabs commented 4 years ago

Hi there, I'm really excited to try out Cloudtracker! I've completed the setup config steps, but I've ran into the following error message when running my first command (cloudtracker --account demo --list users):

Python version: 3.6.9 Ubuntu version: 18.04

(venv) ~$ cloudtracker --account demo --list users --start 2020-06-01

/home/username/venv/lib/python3.6/site-packages/cloudtracker/cli.py:97: YAMLLoadWarning: calling yaml.load() without Loader=... is deprecated, as the default Loader is unsafe. Please read https://msg.pyyaml.org/load for full details.

  config = yaml.load(args.config)
INFO     Source of CloudTrail logs: s3://cloudtrail-bucket/
INFO     Using AWS identity: arn:aws:iam::339389476548:user/my_iam_user
INFO     Using output bucket: s3://aws-athena-query-results-account-number-us-west-2
INFO     Account cloudtrail log path: s3://cloudtrail-bucket/AWSLogs/account-number/CloudTrail
INFO     Checking if all partitions for the past 12 months exist
INFO     Partition groups remaining to create: 12
INFO     Partition groups remaining to create: 11
INFO     Partition groups remaining to create: 10
INFO     Partition groups remaining to create: 9
INFO     Partition groups remaining to create: 8
INFO     Partition groups remaining to create: 7
INFO     Partition groups remaining to create: 6
INFO     Partition groups remaining to create: 5
INFO     Partition groups remaining to create: 4
INFO     Partition groups remaining to create: 3
INFO     Partition groups remaining to create: 2
INFO     Partition groups remaining to create: 1

Traceback (most recent call last):
  File "/home/username/venv/bin/cloudtracker", line 11, in <module>
    sys.exit(main())
  File "/home/username/venv/lib/python3.6/site-packages/cloudtracker/cli.py", line 104, in main
    run(args, config, args.start, args.end)
  File "/home/username/venv/lib/python3.6/site-packages/cloudtracker/__init__.py", line 436, in run
    account_iam = get_account_iam(account)
  File "/home/username/venv/lib/python3.6/site-packages/cloudtracker/__init__.py", line 162, in get_account_iam
    return json.load(open(account['iam']))
  File "/usr/lib/python3.6/json/__init__.py", line 299, in load
    parse_constant=parse_constant, object_pairs_hook=object_pairs_hook, **kw)
  File "/usr/lib/python3.6/json/__init__.py", line 354, in loads
    return _default_decoder.decode(s)
  File "/usr/lib/python3.6/json/decoder.py", line 339, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib/python3.6/json/decoder.py", line 357, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError:   ( (char 0)

This is using my default AWS CLI user, with the appropriate IAM permissions assigned to that access key.

Thanks!

0xdabbad00 commented 4 years ago

Does the IAM data file exist? By which I mean did you run:

aws iam get-account-authorization-details > account-data/demo_iam.json

and configure your account info?

CaseyLabs commented 4 years ago

Confirmed, and it's populated with statements like:

STATEMENT       [u'organizations:DescribeAccount', u'organizations:DescribeOrganization', u'organizations:DescribeOrganizationalUnit', u'o
rganizations:ListAccounts', u'organizations:ListAccountsForParent', u'organizations:ListAWSServiceAccessForOrganization', u'organizations:
ListChildren', u'organizations:ListDelegatedAdministrators', u'organizations:ListOrganizationalUnitsForParent', u'organizations:ListParent
s', u'organizations:ListRoots'] Allow   *
CaseyLabs commented 4 years ago

Ahhh, I see what's going on: my AWS CLI output is defaulted to text instead of json for output. I changed the default output to json, and re-created the IAM data file. We're all set to go now. Thank you!