Permission enumeration with compromised AWS keys

We can now extend the script from the previous section to use the collected data to determine what exact permissions your current user has by correlating the data stored in the different files. To do this, we will first need to find our current user in the list of users we pulled down.

Determining our level of access

In an attack scenario, it is possible that you don't know the username of your current user, so we will add this line of code that uses the iam:GetUser API to determine that information (note that this call will fail if your credentials belong to a role):

   username = client.get_user()['User']['UserName'] 

Then we will iterate through the...