cliam for Mac

cliam Multi cloud iam permissions enumeration tool. Currently covers: [x] AWS [x] GCP [x] Azure [] Oracle

? WIP

Description Cliam is a simple cloud permissions identifier. There are two main components to the CLI. Most of the enumerated permissions are list, describe or get permissions. enumerate which can be used to enumerate specific permissions (recommended) Some service providers have service groups that can check for permissions for a specific subset of services/resources.

Installation Download the latest release. DEV tags are current, but not stable.

In order to build the binary locally, cd into the cli directory and run make dev

Usage Cliam works with credentials obtained from the services well known envars or from passing the commonly required flags from the cli.

It is highly recommond that command completions are set as most of the enumerate options have to be specific. To generate completions, use cliam completion [shell] and set according to your shells completion directory.

AWS Uses the AWS rest api to make a signed request using the passed in credentials. This greatly adds speed, but makes it a bit more challenging to keep up with adding new permissions. The issue of scale is that AWS uses 3 - 4 variety of requests at the service level

Supports obtaining credentials from AWS profile, flags, or default AWS environment variables like AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and optionally AWS_SESSION_TOKEN.

Known resources Cliam for AWS also supports enumerating certain permissions which requires a known value. For instance, when using awscli, we can get a function using aws lambda get-function --function-name .

This maps directly to cliam where we can use:

This will enumerate all permissions for lambda which takes function-name as a valid argument. This will work with other AWS resources as well.

Examples Bruteforce all serverless resources from an AWS profile

Use temporary session tokens obtained to check all ec2 permissions

Enumerate permissions for s3, iam and ec2

GCP GCP supports enumerating from a specific service account json file. ~Credentials from the GCP environment variables GOOGLE_APPLICATION_CREDENTIALS and CLOUDSDK_CORE_PROJECT are also supported~.

Because there are two modes for GCP enumeration, use enumerate if cloudresourcemanager is enabled or use rest to enumerate specific permissions.

Azure Azure enumeration supports various authentication methods inlcuding service principals (via client id and secret), certificate MSI (via MSI token), or default auth. It also supports all the common azure environment variables AZURE_CLIENT_ID : client id or usrname AZURE_CLIENT_SECRET : client secret AZURE_SUBSCRIPTION_ID : subscription id AZURE_CLIENT_CERTIFICATE_PATH : path to certificate AZURE_TENANT_ID : tenant id CLIAM_AZURE_OAUTH_TOKEN : existing oauth token

Debug cliam supports two environment variables to show debug output DEBUG=true (shows status codes of requests) VERBOSE=true (shows body of requests)