collect_commands.yaml

# Put this first so the report can be downloaded later
- Service: iam
  Request: generate-credential-report
- Service: sts
  Request: get-caller-identity
- Service: iam
  Request: get-account-authorization-details
- Service: iam
  # Generate the access reports for all roles, and collect them later
  Request: generate-service-last-accessed-details
  Parameters:
    - Name: Arn
      Value: iam-get-account-authorization-details.json|.RoleDetailList[]?|.Arn
- Service: iam
  # Generate the access reports for all roles, and collect them later
  Request: generate-service-last-accessed-details
  Parameters:
    - Name: Arn
      Value: iam-get-account-authorization-details.json|.UserDetailList[]?|.Arn
- Service: iam
  Request: get-role # Need to get IAM boundaries
  Parameters:
  - Name: RoleName
    Value: iam-get-account-authorization-details.json|.RoleDetailList[]?|.RoleName
- Service: iam
  Request: get-user # Needed to get IAM boundaries
  Parameters:
  - Name: UserName
    Value: iam-get-account-authorization-details.json|.UserDetailList[]?|.UserName
- Service: iam
  Request: get-account-password-policy
- Service: iam
  Request: get-account-summary
- Service: iam
  Request: list-account-aliases
- Service: iam
  Request: get-credential-report
- Service: iam
  Request: get-service-last-accessed-details
  Parameters:
    - Name: JobId
      Value: iam-generate-service-last-accessed-details/*|.JobId
  Check:
    - Name: JobStatus
      Value: "COMPLETED"
- Service: iam
  Request: list-saml-providers
- Service: iam
  Request: get-saml-provider
  Parameters:
  - Name: SAMLProviderArn
    Value: iam-list-saml-providers.json|.SAMLProviderList[]?|.Arn
- Service: iam
  Request: list-open-id-connect-providers
- Service: iam
  Request: get-open-id-connect-provider
  Parameters:
  - Name: OpenIDConnectProviderArn
    Value: iam-list-open-id-connect-providers.json|.OpenIDConnectProviderList[]?|.Arn
- Service: s3control
  Request: get-public-access-block
  Parameters:
  - Name: AccountId
    Value: sts-get-caller-identity.json|.Account
- Service: s3
  Request: list-buckets
- Service: s3
  Request: get-bucket-acl
  Parameters:
  - Name: Bucket
    Value: s3-list-buckets.json|.Buckets[]?|.Name
- Service: s3
  Request: get-bucket-policy
  Parameters:
  - Name: Bucket
    Value: s3-list-buckets.json|.Buckets[]?|.Name
- Service: route53
  Request: list-hosted-zones
- Service: route53
  Request: list-resource-record-sets
  Parameters:
  - Name: HostedZoneId
    Value: route53-list-hosted-zones.json|.HostedZones[]?|[.Id,.Name]
- Service: route53domains
  Request: list-domains
- Service: ec2
  Request: describe-vpcs
- Service: ec2
  Request: describe-availability-zones
- Service: ec2
  Request: describe-subnets
- Service: ec2
  Request: describe-instances
- Service: ec2
  Request: describe-addresses
- Service: cloudtrail
  Request: describe-trails
- Service: cloudtrail
  Request: get-event-selectors
  Parameters:
  - Name: TrailName
    Value: cloudtrail-describe-trails.json|.trailList[].TrailARN
- Service: rds
  Request: describe-db-instances
- Service: rds
  Request: describe-db-snapshots
- Service: rds
  Request: describe-db-snapshot-attributes
  Parameters:
  - Name: DBSnapshotIdentifier
    Value: rds-describe-db-snapshots.json|.DBSnapshots[]?|.DBSnapshotIdentifier
- Service: elb
  Request: describe-load-balancers
- Service: elb
  Request: describe-load-balancer-policies
- Service: elbv2
  Request: describe-load-balancers
- Service: redshift
  Request: describe-clusters
- Service: sqs
  Request: list-queues
- Service: sqs
  Request: get-queue-attributes
  Parameters:
  - Name: QueueUrl
    Value: sqs-list-queues.json|.QueueUrls[]?
  - Name: AttributeNames
    Value: [All]
- Service: sns
  Request: list-topics
- Service: sns
  Request: get-topic-attributes
  Parameters:
  - Name: TopicArn
    Value: sns-list-topics.json|.Topics[]?|.TopicArn
- Service: ec2
  Request: describe-security-groups
- Service: ec2
  Request: describe-network-interfaces
- Service: ec2
  Request: describe-vpc-peering-connections
- Service: directconnect
  Request: describe-connections
- Service: autoscaling
  Request: describe-policies
- Service: autoscaling
  Request: describe-auto-scaling-groups
- Service: cloudformation
  Request: describe-stacks
- Service: cloudformation
  Request: get-template
  Parameters:
  - Name: StackName
    Value: cloudformation-describe-stacks.json|.Stacks[]?|.StackName
- Service: cloudformation
  Request: describe-stack-resources
  Parameters:
  - Name: StackName
    Value: cloudformation-describe-stacks.json|.Stacks[]?|.StackName
- Service: cloudfront
  Request: list-distributions
- Service: cloudsearch
  Request: describe-domains
- Service: cloudsearch
  Request: describe-service-access-policies
  Parameters:
  - Name: DomainName
    Value: cloudsearch-describe-domains.json|.DomainStatusList[]?|.DomainName
- Service: cloudwatch
  Request: describe-alarms
- Service: config
  Request: describe-config-rules
- Service: config
  Request: describe-configuration-recorders
- Service: config
  Request: describe-delivery-channels
- Service: ec2
  Request: describe-images
  Parameters:
  - Name: Owners
    Value:
    - "self"
- Service: ec2
  Request: describe-network-acls
- Service: ec2
  Request: describe-route-tables
- Service: ec2
  Request: describe-flow-logs
- Service: ec2
  Request: describe-snapshots
  Parameters:
  - Name: OwnerIds
    Value:
    - "self"
- Service: ec2
  Request: describe-snapshot-attribute
  Parameters:
  - Name: SnapshotId
    Value: ec2-describe-snapshots.json|.Snapshots[]?|.SnapshotId
  - Name: Attribute
    Value: 'createVolumePermission'
- Service: ec2
  Request: describe-vpc-endpoint-connections
- Service: ec2
  Request: describe-vpn-connections
- Service: ec2
  Request: describe-vpn-gateways
- Service: ecr
  Request: describe-repositories
- Service: ecr
  Request: get-repository-policy
  Parameters:
  - Name: repositoryName
    Value: ecr-describe-repositories.json|.repositories[]|.repositoryName
- Service: elasticache
  Request: describe-cache-clusters
- Service: elasticbeanstalk
  Request: describe-applications
- Service: efs
  Request: describe-file-systems
- Service: es
  Request: list-domain-names
- Service: es
  Request: describe-elasticsearch-domain
  Parameters:
  - Name: DomainName
    Value: es-list-domain-names.json|.DomainNames[]?|.DomainName
- Service: events
  Request: describe-event-bus
- Service: events
  Request: list-rules
- Service: firehose
  Request: list-delivery-streams
- Service: firehose
  Request: describe-delivery-stream
  Parameters:
  - Name: DeliveryStreamName
    Value: firehose-list-delivery-streams.json|.DeliveryStreamNames[]?
- Service: glacier
  Request: list-vaults
  Parameters:
  - Name: accountId
    Value: "-"
- Service: glacier
  Request: get-vault-access-policy
  Parameters:
  - Name: vaultName
    Value: glacier-list-vaults.json|.VaultList[]?|.VaultName
  - Name: accountId
    Value: "-"
- Service: kms
  Request: list-keys
- Service: kms
  Request: list-grants
  Parameters:
  - Name: KeyId
    Value: kms-list-keys.json|.Keys[]?|.KeyId
- Service: kms
  Request: list-key-policies
  Parameters:
  - Name: KeyId
    Value: kms-list-keys.json|.Keys[]?|.KeyId
- Service: kms
  Request: get-key-policy
  Parameters:
  - Name: KeyId
    Value: kms-list-keys.json|.Keys[]?|.KeyId
  - Name: PolicyName
    Value: 'default'
- Service: kms
  Request: get-key-rotation-status
  Parameters:
  - Name: KeyId
    Value: kms-list-keys.json|.Keys[]?|.KeyId
- Service: lambda
  Request: list-functions
- Service: lambda
  Request: get-policy
  Parameters:
  - Name: FunctionName
    Value: lambda-list-functions.json|.Functions[]?|.FunctionName
- Service: logs
  Request: describe-destinations
- Service: logs
  Request: describe-log-groups
- Service: logs
  Request: describe-resource-policies
- Service: lightsail
  Request: get-instances
- Service: lightsail
  Request: get-load-balancers
- Service: apigateway
  Request: get-rest-apis
- Service: apigateway
  Request: get-resources
  Parameters:
  - Name: restApiId
    Value: apigateway-get-rest-apis.json|.items[]?|.id
- Service: apigateway
  Request: get-deployments
  Parameters:
  - Name: restApiId
    Value: apigateway-get-rest-apis.json|.items[]?|.id
- Service: apigateway
  Request: get-stages
  Parameters:
  - Name: restApiId
    Value: apigateway-get-rest-apis.json|.items[]?|.id
- Service: guardduty
  Request: list-detectors
- Service: guardduty
  Request: get-detector
  Parameters:
  - Name: DetectorId
    Value: guardduty-list-detectors.json|.DetectorIds[]?|.