{"repo":"TocConsulting/iam-activity-tracker","free":true,"listed":false,"github":"https://github.com/TocConsulting/iam-activity-tracker","clone":"git clone https://github.com/TocConsulting/iam-activity-tracker.git","description":"A comprehensive serverless AWS solution for tracking and auditing IAM, STS, and AWS Console signin activities across all regions","language":"Python","stars":10,"topics":["audit","aws","cloudtrail","iam","monitoring","security","serverless","aws-security","cloud-security","compliance"],"license":"MIT","category":"analytics","readme_excerpt":"IAM Activity Tracker A comprehensive serverless AWS solution for tracking and auditing IAM, STS, and AWS Console signin activities across all regions. Features real-time collection via free CloudTrail event history, advanced analytics with S3 + Athena, and automated security alerting. Built with AWS SAM, Lambda, DynamoDB, and optional Parquet analytics. Overview IAM Activity Tracker provides comprehensive monitoring of authentication and authorization activities across your AWS account, helping you: - Track who created, modified, or deleted IAM resources - Monitor role assumptions and credential usage - Detect suspicious authentication patterns and failed login attempts - Monitor AWS Console login activity including root account usage - Build compliance reports and audit trails - Maintain event data beyond CloudTrail's 90-day limit - Real-time security alerts for suspicious activities Features Event Collection - Multi-Region Support : Automatically tracks IAM events (us-east-1), STS events (all regions), Console signin events (global), and SSO/Identity Center events - Complete Coverage : Monitors IAM, STS, signin.amazonaws.com, and sso.amazonaws.com event sources - SSO Tracking : Full support for AWS SSO/Identity Center administrative events (permission sets, account assignments, policy attachments) - Incremental Processing : Only processes new events since last run with checkpoint management - Initial Collection : First run collects up to 90 days of historical events from Cl","default_branch":null,"files":null,"tree":[],"storefront":"/r/TocConsulting","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/TocConsulting/iam-activity-tracker/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}