A tool for quickly evaluating IAM permissions and identifying security risks in AWS accounts through graph-based analysis.
Principal Mapper (PMapper) is an open-source security tool for analyzing AWS IAM configurations to identify risks and privilege escalation paths. It models IAM Users and Roles as a directed graph, enabling comprehensive security assessments through local simulation of AWS authorization behavior. The tool helps security teams and cloud administrators proactively find misconfigurations that could be exploited by attackers.
Cloud security engineers, DevOps professionals, and AWS administrators responsible for securing IAM configurations and conducting security audits in AWS environments.
PMapper provides a unique graph-based approach to IAM analysis, uncovering indirect access paths and privilege escalation risks that traditional tools might miss. Its local simulation capability allows for safe, offline querying without impacting production environments.
A tool for quickly evaluating IAM permissions in AWS.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Models IAM principals as a directed graph to uncover indirect access paths and privilege escalation risks, as highlighted in the visualization examples showing complex relationships.
Uses a local simulation of AWS's authorization behavior, enabling safe, offline querying without making live API calls during analysis, which reduces risk in production environments.
Includes predefined queries for common checks like privilege escalation ('preset privesc *'), allowing quick security assessments without custom query writing.
Generates SVG visualizations of IAM relationships and privilege escalation paths, aiding in understanding complex access structures, as shown in the README's example images.
Requires separate installation of graphviz and Python libraries like pydot, which can be a hurdle for users unfamiliar with system dependencies, as noted in the installation requirements.
Limited to AWS IAM analysis, making it unsuitable for organizations using multiple cloud providers or needing cross-platform security tools, unlike more versatile cloud security suites.
Primarily operated via command-line interface with no built-in GUI, which may not be accessible for teams preferring graphical dashboards or integrated workflows.
Identifies security risks but does not provide automated fixes or remediation steps, requiring manual intervention to address findings, which can slow down response times.