Video: AWS Query for Unvalidated External Trust
This is one in a series of short, simple J1 queries that will help you interrogate your AWS environments. The JupiterOne platform used to run these queries is free.
A common use case is to understand the external account trust that your AWS account has, and whether or not they are legitimate. What we’re looking for in this query is unvalidated external trust. Akash will also show how to use JupiterOne to use the return results as a true, problematic list that you can set an alert on.
Cut-and-Paste Query
Here’s the query you can use to cut-and-paste into your J1 instance. Watch JupiterOne technical expert, Akash Ganapathi, walk through the example query and then display the results in real time. If you find this useful, give us some contact info at the bottom of this page and we’ll send you twice a month updates as we continue to explore various environments with JupiterOne.
FIND aws_account as aws THAT HAS aws_iam THAT HAS aws_iam_role AS role THAT TRUSTS (AccessRole|User|Account) WITH _source='system-mapper' and validated!=true AS ext RETURN TREE
Contribute your J1 Query to the Community
We will frequently be adding cut-and-paste J1 queries to our gallery. Join the community and every two weeks we’ll send you a list of new queries. You can contribute your own queries for inclusion and examination in an upcoming article. Use the form below to join us.
Get updates from JupiterOne Mission Control
Fresh content and cool cybersecurity news alerts delivered to your inboxat least 2x a month! Just let us know where to send it.