AMA: Iterate and return total count of iam users per account


AMA is an ongoing series published each Thursday, highlighting questions the community has asked in our support and how-to channels on Slack. If you haven't already done so, please join us on Slack 

"How do I iterate over all the accounts and return total count of iam users per account?

I'd like to see it like this:"

accountid iam users
11111111 5
22222222 2
------- ----


--Question from Self Learning on the J1 Community Slack

Answer from J1 Community Member,
Adam Youngberg

Assuming you're using account tagging with your integrations, you can do...

FIND aws_iam_user AS u
u.accountId AS AccountId,
u.tag.AccountName AS AccountName,

(If you're not using account tagging, you can simply omit the line u.tag.AccountName AS AccountName and it will work as originally shown, but I find it's nice to have names with the account IDs.)

Also of possible (mild) interest. When you are only querying one thing, you don't actually have to alias using the AS u-type statement. You can just reference the _type of the thing in the return. It's more verbose, but interesting to know ... so the above would be:

FIND aws_iam_user
aws_iam_user.accountId AS AccountId,
aws_iam_user.tag.AccountName AS AccountName,
COUNT(aws_iam_user) AS IAMUsers

I prefer the original approach above to this one.

Articles in this Series

  1. AMA: JupiterOne and PagerDuty WebHooks
  2. AMA: Export YAML Files for Vendors Pulled from SSO Providers
  3. AMA: Map Controls and Frameworks Relationships
  4. AMA: How to Track Professional Associations, Security Forums, and Threat Intel Sources
  5. AMA: Find AWS Instances by their Private IP Address
  6. AMA: SSO Integrated Authentication, Move to Another Role
  7. AMA: send-mail action to map two properties
  8. AMA: Setup the Policy Accept Button
  9. AMA: Match a blank field in J1QL
  10. AMA: Track and Alert Using Firewall Rules Matrix
  11. AMA: AWS Roles not used for 90 days, and date related queries
  12. AMA: Manage Alerts for Jira through J1 Terraform Provider
  13. AMA: Filter Results from Specific AWS Accounts
  14. AMA: Iterate and return total count of iam users per account
  15. AMA: Search for security groups by tag
  16. AMA: Identify S3 Buckets Open to Cross-Account Attacks

Resources for this AMA


Modern Visibility in Cyberseccurity




Posted By JupiterOne Team

The JupiterOne Team is a diverse set of engineers and developers who are working on the next generation of cyber asset visibility and monitoring.

To hear more from the JupiterOne Team, get our newsletter. No spam, just the good stuff once or twice a month. Sign up below.



You can manage alerts from Jira in the J1 platform

There are 7 properties that can be included

Other properties can be passed directly to the JIRA API

cyber-security 1

Ad Title Placeholder

Lorem ipsum dolor sit amet, consectetur adipiscing elit.