steampipe plugin install awssteampipe plugin install aws

Table: aws_iam_user

An AWS Identity and Access Management (IAM) user is an entity that you create in AWS to represent the person or application that uses it to interact with.

Examples

Basic IAM user info

select
  name,
  user_id,
  path,
  create_date,
  password_last_used
from
  aws_iam_user;

Groups details to which the IAM user belongs

select
  name as user_name,
  iam_group ->> 'GroupName' as group_name,
  iam_group ->> 'GroupId' as group_id,
  iam_group ->> 'CreateDate' as create_date
from
  aws_iam_user
  cross join jsonb_array_elements(groups) as iam_group;

List all the users having Administrator access

select
  name as user_name,
  split_part(attachments, '/', 2) as attached_policies
from
  aws_iam_user
  cross join jsonb_array_elements_text(attached_policy_arns) as attachments
where
  split_part(attachments, '/', 2) = 'AdministratorAccess';

List all the users for whom MFA is not enabled

select
  name,
  user_id,
  mfa_enabled
from
  aws_iam_user
where
  not mfa_enabled;

List the policies attached to each IAM user

select
  name as user_name,
  split_part(attachments, '/', 2) as attached_policies
from
  aws_iam_user
  cross join jsonb_array_elements_text(attached_policy_arns) as attachments;

Find users that have inline policies

select
  name as user_name,
  inline_policies
from
  aws_iam_user
where
  inline_policies is not null;

Query examples

Control examples

.inspect aws_iam_user

AWS IAM User

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
arn	text	The Amazon Resource Name (ARN) that identifies the user.
attached_policy_arns	jsonb	A list of managed policies attached to the user.
create_date	timestamp with time zone	The date and time, when the user was created.
groups	jsonb	A list of groups attached to the user.
inline_policies	jsonb	A list of policy documents that are embedded as inline policies for the user.
inline_policies_std	jsonb	Inline policies in canonical form for the user.
login_profile	jsonb	Contains the user name and password create date for a user.
mfa_devices	jsonb	A list of MFA devices attached to the user.
mfa_enabled	boolean	The MFA status of the user.
name	text	The friendly name identifying the user.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
password_last_used	timestamp with time zone	The date and time, when the user's password was last used to sign in to an AWS website.
path	text	The path to the user.
permissions_boundary_arn	text	The ARN of the policy used to set the permissions boundary for the user.
permissions_boundary_type	text	The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
region	text	The AWS Region in which the resource is located.
tags	jsonb	A map of tags for the resource.
tags_src	jsonb	A list of tags that are attached to the user.
title	text	Title of the resource.
user_id	text	The stable and unique string identifying the user.

turbot/aws