This will show the membership of IAM Users in a list of AWS IAM Groups. #Public #AWS #Security #IAM #Inventory #Utility #Audit

membership_of_AWS_IAM_Groups.ps1

# membership_of_AWS_IAM_Groups.ps1
<#
Description: This will show the membership of IAM Users in a list of AWS IAM Groups.
For Password_LastUsed, if the account does not have a password, which means no access to AWS Console, or if the password was never used, it outputs "1/1/0001 12:00:00 AM", I capture this and replace with a blank.
Written: Ed Walsh
PowerShell.Core tested: Not Tested
Version: 1.0.0
Create Date: 11/3/2021
Revised Date: 11/3/2021
#>

$timestamp = get-date -format yyyyMMddHHmmss
$subfolder = if (($PSVersionTable.PSEdition) -eq "Core") { if ( $True -eq $iswindows ) { "\Documents\" } Else { "" } } Else {"\Documents\"}
$mydocuments = $home + $subfolder
$fileName = "AWS-IAM-Groups-Memberships-"+[string]$timestamp + ".csv"
$filePath = Join-Path $mydocuments $fileName

$output = @()

$Groups = "Acct_Disabled", "Admin"
$MFAusers = (Get-IAMVirtualMFADevice).user.arn
foreach ($group in $groups) {
$results = (Get-IAMGroup -GroupName $group).users

Foreach( $result in $results) {


$o = New-Object -TypeName System.Management.Automation.PSObject -Property ([ordered]@{
        "IAM_Group" = $Group;
        "Date_Data-Pulled" = get-date -format  "MM/dd/yyyy HH:mm K";
        "arn" = $result.arn;
        "User" = $result.UserName;
        "Account_Create_Date" = $result.CreateDate;
        "Has_MFA" = if($(Get-IAMMFADevice -UserName $result.UserName) -ne $null -or $result.arn -in $MFAusers) {"Yes"} Else {"No"};
        "Has_Password_Now" = try {If ( $(Get-IAMLoginProfile -UserName $result.UserName) -ne $null) {"Yes"} } Catch{"No"};
        "Password_LastUsed" = if ($result.PasswordLastUsed -eq "1/1/0001 12:00:00 AM") {""} Else {$result.PasswordLastUsed};
 
        
})
$output += $o
}
}


$output  | Export-Csv -NoTypeInformation -Append -Path $filepath

Write-Output "Exported to:  $filePath"
 Write-Output "\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\|||||||////////////////////////////////////"