Having an issue with the CloudTracker output. According to the documentation CloudTracker shows a diff of the privileges granted vs used. The symbols mean the following:
"No symbol" means this privilege is used, so leave it as is.
- A minus sign means the privilege was granted, but not used, so you should remove it.
? A question mark means the privilige was granted, but it is unknown if it was used because it is not recorded in CloudTrail.
+ A plus sign means the privilege was not granted, but was used. The only way this is possible is if the privilege was previously granted, used, and then removed, so you may want to add that privilege back.
I just needed to understand something about the output.
For eg, the output to check the privileges for "X" role, lets say I got "+ iam:createrole" which means that privilege was previously granted and used but later removed, according to the documentation. But the "X" role has the permission to create roles, so the output should have been "no symbol" instead of "+" to iam:createrole. Am i right? Can anyone clarify this?
Having an issue with the CloudTracker output. According to the documentation CloudTracker shows a diff of the privileges granted vs used. The symbols mean the following:
"No symbol" means this privilege is used, so leave it as is.
- A minus sign means the privilege was granted, but not used, so you should remove it.
? A question mark means the privilige was granted, but it is unknown if it was used because it is not recorded in CloudTrail.
+ A plus sign means the privilege was not granted, but was used. The only way this is possible is if the privilege was previously granted, used, and then removed, so you may want to add that privilege back.
I just needed to understand something about the output.
For eg, the output to check the privileges for "X" role, lets say I got "+ iam:createrole" which means that privilege was previously granted and used but later removed, according to the documentation. But the "X" role has the permission to create roles, so the output should have been "no symbol" instead of "+" to iam:createrole. Am i right? Can anyone clarify this?