Using PMapper to map cross-account roles

[nccgroup]

Using PMapper to map cross-account roles

[ncc-erik-steringer]

I want to fully support this in the next iteration of PMapper. It's mostly ready in the v1.1.0-dev branch, you'll want to use search_authorization_with_resource_policy_for in principalmapper.query_interface which will consider both the calling principal's authorization and the resource policy (trust doc) of the assumed role.

[christophetd]

Sounds good! But how does that play with data collection? Do I need to create one graph per account, and then query the proper principal in the correct graph?

[ncc-erik-steringer]

You'd need one graph per account, then query against account1/user while pulling in the trust doc from account2/role.

[ncc-erik-steringer]

Branch v1.1.0-dev has a new module principalmapper.graphing.cross_account_edges with a function named get_edges_between_graphs that does all the legwork of building all Edge objects when given two Graph objects. Closing this issue.