,
3 tweets,
1 min read
Read on Twitter
One of the best, but not well documented or appreciated, things about CloudMapper is the ability to easily collect data. It has pagination and (recently) solid error reporting, but the jq syntax in collect_commands.yaml is something novel and powerful. 1/3
Ex. to get the Access Advisor info, you need to iterate through every user and role and call iam:GenerateServiceLastAccessedDetails which returns a jobid, which you then need to use with a call to iam:GetServiceLastAccessedDetails. That ends up being about a dozen lines. 2/3
First, it calls iam:GetAccountAuthorizationDetails, then it uses jq to extract out the parameters needed to call the generate calls. Then it extracts the jobid for the `get` call, checking the result and retrying as needed. github.com/duo-labs/cloud… 3/3
