How can I traverse the graph to find identities that have root-like privileges?

crystralRamirez

I’m trying to identify all human users that have the ability to become a root user in an AWS production account. How can I traverse the graph of trust to also find identities that have root-like privileges (e.g. admin or impersonation) on those admin accounts, and identities that have permission to those indirect admin accounts, etc.? (I’m using “root” imprecisely here, but hopefully you understand the intent.)

Tony

You can try this to show admin policies:

find * 
that assigned AccessPolicy 
that allows aws_account 
where allows.admin=true

 If you want only full control policies:

find * 
that assigned AccessPolicy 
that allows aws_account 
where allows.permission='FULL_CONTROL'

To query for assume role trusts:

find * 
that assigned aws_iam_role
that assigned AccessPolicy 
that allows aws_account 
where allows.admin=true