Repokid

Repokid uses Access Advisor provided by Aardvark to remove permissions granting access to unused services from the inline policies of IAM roles in an AWS account.

Getting Started

Install

mkvirtualenv repokid
git clone [email protected]:Netflix/repokid.git
cd repokid
pip install -e .
repokid config config.json

DynamoDB

You will need a DynamoDB table called repokid_roles (specify account and endpoint in dynamo_db in config file).

The table should have the following properties:

• RoleId (string) as a primary partition key, no primary sort key
• A global secondary index named Account with a primary partition key of Account and RoleId and Account as projected attributes
• A global secondary index named RoleName with a primary partition key of RoleName and RoleId and RoleName as projected attributes

For development, you can run dynamo locally.

To run locally:

docker-compose up

The endpoint for DynamoDB will be http://localhost:8000. A DynamoDB admin panel can be found at http://localhost:8001.

If you run the development version the table and index will be created for you automatically.

IAM Permissions

Repokid needs an IAM Role in each account that will be queried. Additionally, Repokid needs to be launched with a role or user which can sts:AssumeRole into the different account roles.

RepokidInstanceProfile:

• Only create one.
• Needs the ability to call sts:AssumeRole into all of the RepokidRoles.
• DynamoDB permissions for the repokid_roles table and all indexes (specified in assume_role subsection of dynamo_db in config) and the ability to run dynamodb:ListTables

RepokidRole:

• Must exist in every account to be managed by repokid.
• Must have a trust policy allowing RepokidInstanceProfile.
• Name must be specified in connection_iam in config file.
• Has these permissions:

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Action": [
       "iam:DeleteInstanceProfile",
       "iam:DeleteRole",
       "iam:DeleteRolePolicy",
       "iam:GetAccountAuthorizationDetails",
       "iam:GetInstanceProfile",
       "iam:GetRole",
       "iam:GetRolePolicy",
       "iam:ListInstanceProfiles",
       "iam:ListInstanceProfilesForRole",
       "iam:ListRolePolicies",
       "iam:PutRolePolicy",
       "iam:UpdateRoleDescription"
     ],
     "Effect": "Allow",
     "Resource": "*"
   }
 ]
}

So if you are monitoring n accounts, you will always need n+1 roles. (n RepokidRoles and 1 RepokidInstanceProfile).

Editing config.json

Running repokid config config.json creates a file that you will need to edit. Find and update these fields:

• dynamodb: If using dynamo locally, set the endpoint to http://localhost:8010. If using AWS hosted dynamo, set the region, assume_role, and account_number.
• aardvark_api_location: The location to your Aardvark REST API. Something like https://aardvark.yourcompany.net/api/1/advisors
• connection_iam: Set assume_role to RepokidRole, or whatever you have called it.

Optional Config

Repokid uses filters to decide which roles are candidates to be repoed. Filters may be configured to suit your environment as described below.

Blocklist Filter

Roles may be excluded by adding them to the Blocklist filter. One common reason to exclude a role is if the corresponding workload performs occasional actions that may not have been observed but are known to be required. There are two ways to exclude a role:

• Exclude role name for all accounts: add it to a list in the config filter_config.BlocklistFilter.all
• Exclude role name for specific account: add it to a list in the config filter_config.BlocklistFilter.<ACCOUNT_NUMBER>

Blocklists can also be maintained in an S3 blocklist file. They should be in the following form:

{
  "arns": ["arn1", "arn2"],
  "names": {"role_name_1": ["all", "account_number_1"], "role_name_2": ["account_number_2", "account_number_3"]}
}

Exclusive Filter

If you prefer to repo only certain roles you can use the Exclusive Filter. Maybe you want to consider only roles used in production or by certain teams. To select roles for repo-ing you may list their names in the configuration files. Shell style glob patterns are also supported. Role selection can be specified per individual account or globally. To activate this filter put "repokid.filters.exclusive:ExclusiveFilter"in the section active_filters of the config file. To configure it you can start with the autogenerated config file, which has an example config in the "filter_config" section:

"ExclusiveFilter": {
                   "all": [
                     "<GLOB_PATTERN>"
                     ],
                   "<ACCOUNT_NUMBER>": [
                     "<GLOB_PATTERN>"
                    ]
                   }

Age Filter

By default the age filter excludes roles that are younger than 90 days. To change this edit the config setting: filter_config.AgeFilter.minimum_age.

Active Filters

New filters can be created to support internal logic. At Netflix we have several that are specific to our use cases. To make them active make sure they are in the Python path and add them in the config to the list in the section active_filters.

Extending Repokid

Hooks

Repokid is extensible via hooks that are called before, during, and after various operations as listed below.

Hook name	Context
AFTER_REPO	role, errors
AFTER_REPO_ROLES	roles, errors
BEFORE_REPO_ROLES	account_number, roles
AFTER_SCHEDULE_REPO	roles
DURING_REPOABLE_CALCULATION	role_id, arn, account_number, role_name, potentially_repoable_permissions, minimum_age
DURING_REPOABLE_CALCULATION_BATCH	role_batch, potentially_repoable_permissions, minimum_age

Hooks must adhere to the following interface:

from repokid.hooks import implements_hook
from repokid.types import RepokidHookInput, RepokidHookOutput

@implements_hook("TARGET_HOOK_NAME", 1)
def custom_hook(input_dict: RepokidHookInput) -> RepokidHookOutput:
    """Hook functions are called with a dict containing the keys listed above based on the target hook.
    Any mutations made to the input and returned in the output will be passed on to subsequent hook funtions.
    """
    ...

Examples of hook implementations can be found in repokid.hooks.loggers.

Filters

Custom filters can be written to exclude roles from being repoed. Filters must adhere to the following interface:

from repokid.filters import Filter
from repokid.types import RepokidFilterConfig
from repokid.role import RoleList