{"repo":"zoph-io/aws-trustline","free":true,"listed":false,"github":"https://github.com/zoph-io/aws-trustline","clone":"git clone https://github.com/zoph-io/aws-trustline.git","description":"Trustline: Check external access on your AWS account","language":"Python","stars":138,"topics":["aws","cloudsecurity","security","access-analyzer","iam"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"AWS Trustline Map and audit third-party trust relationships in your AWS account. AWS Trustline analyzes IAM Role trust policies and S3 bucket policies to identify who has access to your AWS resources. It cross-references AWS account IDs found in these policies against a community-maintained list of known AWS accounts from fwd:cloudsec to automatically identify the vendors behind those accounts. Features - Two analysis backends : - Policy scanner (default) : scans IAM role trust policies and S3 bucket policies directly with the AWS SDK. - Access Analyzer backend ( --use-access-analyzer ) : consumes findings from AWS IAM Access Analyzer (external access, free tier ) for provable, all-resource-type coverage: S3, IAM roles, KMS, Lambda, SNS, SQS, Secrets Manager, EFS, EBS/RDS snapshots, ECR, DynamoDB. - Account or Organization scope : pick --scope account for a single-account analyzer, --scope organization to consume findings from an org-wide analyzer (run from the management or AA delegated-admin account). - Multi-region : --regions us-east-1,eu-west-1 or --all-regions (enumerated via ec2:DescribeRegions ). - Vendor Identification : matches external account IDs against 500+ known AWS vendor accounts from fwd:cloudsec. - Confused Deputy Detection : flags IAM roles missing the ExternalId condition on cross-account trust (works in both backends). - Public access detection : the Access Analyzer backend surfaces resources shared with the world in a dedicated section. - AWS Organizati","default_branch":null,"files":null,"tree":[],"storefront":"/r/zoph-io","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/zoph-io/aws-trustline/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}