tarekcheikh/iam-security-scanner repository overview

⁠IAM Security Scanner

A comprehensive AWS IAM security scanner with 44 security checks across 7 categories and compliance mapping for 10 frameworks (128 controls). It includes privilege-escalation and confused-deputy detection, multi-threaded scanning, credential-report analysis, and interactive HTML dashboards. The scanner is read-only and never modifies AWS resources.

• Source and full docs: https://github.com/TocConsulting/iam-security-scanner⁠
• License: MIT
• Image runs as root so a mounted host ~/.aws is readable (see Credentials).

⁠Quick Start

docker pull tarekcheikh/iam-security-scanner:latest

# Show help
docker run --rm tarekcheikh/iam-security-scanner --help

# Run a scan with mounted AWS credentials, writing reports to ./output
docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v "$(pwd)/output:/app/output" \
  tarekcheikh/iam-security-scanner security

The image ENTRYPOINT is iam-security-scanner, so arguments after the image name are passed straight to the CLI (for example security, --help).

⁠Credentials

The container reads AWS credentials either from a mounted profile directory or from environment variables. The image intentionally runs as root so that a host ~/.aws/credentials file (mode 0600, owned by your user) is readable inside the container.

Mounted profile (supports --profile):

docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v "$(pwd)/output:/app/output" \
  tarekcheikh/iam-security-scanner security --profile production

Environment variables (including temporary/assumed-role credentials):

docker run --rm \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  -e AWS_SESSION_TOKEN \
  -e AWS_DEFAULT_REGION=us-east-1 \
  -v "$(pwd)/output:/app/output" \
  tarekcheikh/iam-security-scanner security

Note: IAM Identity Center (SSO) sessions do not resolve inside the container. Export process credentials first (for example aws configure export-credentials --format env) and pass them as environment variables.

⁠What It Checks

44 checks across 7 categories:

• A. User and Credential Security (12): root access keys, MFA enforcement (hardware vs virtual), key rotation, unused credentials, console access without MFA, direct admin attachment.
• B. Password Policy (8): minimum length, complexity, reuse prevention, maximum age.
• C. Managed Policy Security (5): full admin policies, wildcard service actions, iam:PassRole on *, NotAction with Allow, unused policies.
• D. Role Security (4): admin roles, wildcard trust principals, overly-permissive inline policies, unused roles.
• E. Group Security (3): admin groups, empty groups, users not in any group.
• F. Account Settings (7): IAM Access Analyzer (external, unused-access, findings), support role, expired certificates, CloudShell access, IAM server certificates.
• G. Privilege Escalation and Trust (5): 22 documented privesc paths (managed and inline), permissive sts:AssumeRole *, confused-deputy and cross-account trust (organization-aware).

⁠Compliance Frameworks

128 controls mapped across 10 frameworks:

• AWS Foundational Security Best Practices (FSBP)
• CIS AWS Foundations Benchmark v5.0.0
• PCI DSS v4.0.1
• HIPAA Security Rule
• SOC 2
• ISO 27001:2022
• ISO 27017:2015
• ISO 27018:2019
• GDPR (EU) 2016/679
• NIST SP 800-53 Rev. 5

⁠Output

Each scan produces a 0-100 security score and reports in the mounted output directory (default /app/output in the container, mapped to ./output):

• JSON: full results with summary and per-check detail
• CSV: flattened findings for spreadsheets
• HTML: interactive dashboard with score, findings table, and compliance grid
• Compliance JSON: per-framework pass/fail breakdown

Select the format with -f json|csv|html|all (default all).

⁠Required IAM Permissions

The scanner needs read-only access only. Attach a policy granting iam:Get*, iam:List*, iam:GenerateCredentialReport, access-analyzer:List*, access-analyzer:Get*, and sts:GetCallerIdentity. The full minimal policy is in the repository README. The scanner performs no write or delete actions.

⁠Tags

• latest: most recent release
• 1.0.0: pinned version

Images are published for linux/amd64 and linux/arm64.

⁠Links

• Repository: https://github.com/TocConsulting/iam-security-scanner⁠
• Issues: https://github.com/TocConsulting/iam-security-scanner/issues⁠
• PyPI (pip install): https://pypi.org/project/iam-security-scanner/⁠