You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I have a role with administrative privileges (let's call it privileged-role) and it has a permission boundary attached to it denying iam actions. However when I run the following query: pmapper --account ACC# query -s 'who can do iam:*'
I get results like this:
role/rdkLambdaRole-KOQRA8051N84 CAN call action iam:* for resource * THRU role/privileged-role
role/rdkLambdaRole-KOQRA8051N84 can access via sts:AssumeRole role/cdk-hnb659fds-deploy-role
role/cdk-hnb659fds-deploy-role can create a stack in CloudFormation to access role/privileged-role
role/privileged-role IS authorized to call action iam:* for resource *
I also tried using conditions to take permission boundaries into account, but the results are the same. Sample query: pmapper --account ACC# query -s 'who can do iam:* with * when iam:PermissionsBoundary=arn:aws:iam::ACC#:policy/perm_boundary'
Did the Wiki Have an Answer?
I did not find any answers in Wiki. Not a lot of information can be found on using conditions with queries. I'd add the answer in "Query Reference".
The text was updated successfully, but these errors were encountered:
Question
I have a role with administrative privileges (let's call it privileged-role) and it has a permission boundary attached to it denying iam actions. However when I run the following query:
pmapper --account ACC# query -s 'who can do iam:*'
I get results like this:
I also tried using conditions to take permission boundaries into account, but the results are the same. Sample query:
pmapper --account ACC# query -s 'who can do iam:* with * when iam:PermissionsBoundary=arn:aws:iam::ACC#:policy/perm_boundary'
Did the Wiki Have an Answer?
I did not find any answers in Wiki. Not a lot of information can be found on using conditions with queries. I'd add the answer in "Query Reference".
The text was updated successfully, but these errors were encountered: