如何使用Cliam测试云端环境IAM权限安全

git clone https://github.com/securisec/cliam.git
cd cliam
make dev

❯❯ cliam --help
Cloud Enumerate is a tool to enumerate cloud credentials for their permissions.
 
Usage:
  cliam [command]
 
Available Commands:
  aws         枚举目标AWS凭证的权限
  completion   生成自动化Shell脚本
  gcp         枚举目标GCP服务账号的权限
  help         查看工具帮助信息
 
Flags:
  -h, --help   查看工具帮助信息
 
Additional help topics:
  cliam azure      枚举目标Azure凭证的权限
 
Use "cliam [command] --help" for more information about a command.

cliam aws --help
Enumerate AWS credentials for their permissions.
 
Usage:
  cliam aws [command]
 
Available Commands:
  common      枚举常见AWS资源的权限
  compute      枚举常见计算AWS资源的权限
  databases    枚举常见AWS数据库资源的权限
  enumerate    枚举指定AWS资源的权限
  serverless    枚举常见无服务AWS资源的权限
  storage      枚举常见存储AWS资源的权限
 
Flags:
      --access-key-id string       AWS访问密钥ID
  -h, --help                       AWS帮助信息
      --profile string               AWS账号信息
      --region string              AWS Region (默认为"us-east-1")
      --secret-access-key string   AWS敏感信息访问密钥
      --session-token string       AWS会话令牌
 
Global Flags:
      --max-threads int       使用的最大线程数量 (默认为5)
      --request-timeout int    每次请求的间隔秒数 (默认为10)

❯❯ cliam aws serverless --profile=my-profile

❯❯ cliam aws enumerate ec2 --session-json=creds.json
 
Where creds.json has
{
  "Type" : "AWS-HMAC",
  "AccessKeyId" : "ASIA...",
  "SecretAccessKey" : "...",
  "Token" : "...",
}

❯❯ cliam aws enumerate s3 iam ec2