[DC] IAM Connector

[alldoami]

Tested with python:

import src.connectors.aws_inventory as aws_inventory
options = {"connection_type": "IAM", "aws_access_key": "xxxx", "aws_secret_key": "xxxx", "accounts_connection_name": "AWS_ACCOUNTS_DEFAULT_CONNECTION"}
print([x for x in aws_inventory.ingest("AWS_ASSET_INV_IAM_DEFAULT_CONNECTION", options)])

[edulop91]

Collect AWS EC2, SG, ELB assets using an Access Key or privileged Role

At the top of the file. You probably also want to update that to reflect you can capture IAM users as well

[sfc-gh-gbutzi]

This looks good to me; can you add a note describing how you tested it?

[edulop91]

python:

import src.connectors.aws_inventory as aws_inventory
options = {"connection_type": "IAM", "aws_access_key": "xxxx", "aws_secret_key": "xxxx", "accounts_connection_name": "AWS_ACCOUNTS_DEFAULT_CONNECTION"}
print([x for x in aws_inventory.ingest("AWS_ASSET_INV_IAM_DEFAULT_CONNECTION", options)])

[sfc-gh-afedorov]

lgtm, although I think this is doubling up with our AWS Config ingestion, which contains IAM changes, as well. there's also a config snapshot API call we could use, but with other APIs this has been the most thorough approach.

since there isn't anything super urgent on the release line right now, I think we can include this in v1.8.7 and push back the release a week (leaving next week for testing)?

[sfc-gh-osinger]

@andrey-snowflake actually this is information that is not brought back by Config. As I was working on CIS AWS Benchmark last week I saw we were missing important details like MFA and last login for users. This was a story in our upcoming sprint so we'll definitely want this one in the next release (pushing it back a week sounds fine to allow for testing). Thank you @alldoami and @edulop91 for putting this one together! I'll share the CIS compliance rules when we have them working with this data.