search

turbot / steampipe-plugin-aws

Use SQL to instantly query AWS resources across regions and accounts. Open source CLI. No DB required.
https://hub.steampipe.io/plugins/turbot/aws
Apache License 2.0
194 stars 104 forks source link

multi-account scenario #1115

Closed andushow closed 2 years ago

andushow commented 2 years ago

Hello, My (IAM) AWS user can connect to all accounts part of an OU (defined under AWS Organizations); The user needs MFA to log in to the residency account, but has no programmatic access key. Once authN, the login (user) can assumeRole to (read data from) all accounts under the OU. Is there a way I can use steampipe to query data from all accounts in the OU using said user/authN ? Thanks,

misraved commented 2 years ago

Thanks @andushow for using Steampipe. Really excited to see your use case for AWS Organization 👍 .

Few questions to understand your use case first:

Looking at the constraints that you mentioned in the issue, I believe you could use this configuration - https://hub.steampipe.io/plugins/turbot/aws#assumerole-credentials-with-mfa to query the data in your accounts.

There are several other scripts which help in the auto-generation of your config/aws.spc file. You could refer https://github.com/happy240/steampipe-conn-generator-for-aws-organization for more information.

If you are using SSO for authentication, we do have a slack thread which provides some great insight - https://steampipe.slack.com/archives/C01TFE9SU1F/p1653071981235759

Meanwhile, I will try to replicate the login method that you have specified above and see if I can provide you with more insights 👍 .

andushow commented 2 years ago

Thanks @misraved for the reply; we currently have 100+ accounts in an OU (let's call it OU 1), part of the AWS Organizations (with many other OUs). We connect (using user/pwd+2FA) to a predefined account, which is defined to allow a certain assumeRole that can connect to any AWS account under the said OU 1. It would be nice if we could use steampipe somehow with this setup. Thanks!

cbruno10 commented 2 years ago

@andushow I believe this issue is closely related to https://github.com/turbot/steampipe-plugin-aws/issues/969, so I'll be closing this issue, but will reference back to this issue, as the requirements and suggestions from @misraved are helpful for the larger conversation.

If you have any other questions or comments, feel free to add them in https://github.com/turbot/steampipe-plugin-aws/issues/969, thanks!