# Track Footprint of XAccount Roles

This doc guides you how to parse the footprint of the xaccount roles.

## Steps

### Creating CloudTrail

Create a trail on the AWS console. For more information, please see the [official AWS documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html).

The trail should be multi-regional and collects all the APIs that you'd like to parse.

### Playing

Run your tests, play with the controllers or do whatever you want with the XAccount roles.

### Run Athena Query

Running the query specified in `query.sql`. 

Download the CSV result to your local machine.


### Parse Results

```bash
# Install CLoader
sudo apt-get install libyaml-cpp-dev

# Run the script
python3 parse.py result.csv | jq >result.json

# If you'd like to parse the resources as well
NORESOURCE=false python3 parse.py result.csv | jq >result.json
```

The results will be looked like the following file. 
```json
{
    "arn:aws:iam:::role/tidbcloud-assume": [
        "eks.amazonaws.com:ListClusters:",
        "iam.amazonaws.com:GetRole:",
        "iam.amazonaws.com:ListAttachedRolePolicies:",
        "eks.amazonaws.com:DescribeNodegroup:",
        "sts.amazonaws.com:GetCallerIdentity:",
        "eks.amazonaws.com:CreateNodegroup:",
        "eks.amazonaws.com:UpdateNodegroupConfig:",
        "eks.amazonaws.com:UpdateClusterConfig:",
        "eks.amazonaws.com:DescribeCluster:",
        "ec2.amazonaws.com:DescribeSubnets:",
        "eks.amazonaws.com:DeleteNodegroup:",
        "ec2.amazonaws.com:DescribeVpcEndpoints:",
        "lambda.amazonaws.com:GetFunction20150331v2:",
        "lambda.amazonaws.com:UpdateFunctionConfiguration20150331v2:",
        "lambda.amazonaws.com:UpdateFunctionCode20150331v2:"
    ],
    "arn:aws:iam:::role/tidbcloud-eks": [
        "ec2.amazonaws.com:AttachVolume:",
        "ec2.amazonaws.com:DescribeRouteTables:",
        "elasticloadbalancing.amazonaws.com:DescribeTargetGroups:",
        "elasticloadbalancing.amazonaws.com:DescribeLoadBalancers:",
        "ec2.amazonaws.com:DescribeVpcs:",
        "elasticloadbalancing.amazonaws.com:DescribeListeners:",
        "elasticloadbalancing.amazonaws.com:CreateListener:",
        "ec2.amazonaws.com:DescribeSubnets:",
        "ec2.amazonaws.com:CreateVolume:",
        "elasticloadbalancing.amazonaws.com:CreateLoadBalancer:",
        "ec2.amazonaws.com:DescribeSecurityGroups:",
        "ec2.amazonaws.com:DescribeVolumes:",
        "ec2.amazonaws.com:DescribeNetworkInterfaces:",
        "elasticloadbalancing.amazonaws.com:RegisterTargets:",
        "elasticloadbalancing.amazonaws.com:DescribeLoadBalancerAttributes:",
        "ec2.amazonaws.com:DescribeAccountAttributes:",
        "ec2.amazonaws.com:DetachVolume:",
        "ec2.amazonaws.com:DescribeInternetGateways:",
        "elasticloadbalancing.amazonaws.com:ModifyLoadBalancerAttributes:",
        "ec2.amazonaws.com:DescribeInstances:",
        "elasticloadbalancing.amazonaws.com:CreateTargetGroup:",
        "ec2.amazonaws.com:AuthorizeSecurityGroupIngress:",
        "elasticloadbalancing.amazonaws.com:AddTags:"
    ],
    "arn:aws:iam:::role/tidbcloud-nodes": [
        "ecr.amazonaws.com:BatchGetImage:[]",
        "ecr.amazonaws.com:GetDownloadUrlForLayer:[]",
        "ec2.amazonaws.com:DetachNetworkInterface:",
        "ec2.amazonaws.com:AssignPrivateIpAddresses:",
        "ecr.amazonaws.com:GetDownloadUrlForLayer:[]",
        "ec2.amazonaws.com:CreateNetworkInterface:",
        "ecr.amazonaws.com:GetAuthorizationToken:",
        "sts.amazonaws.com:GetCallerIdentity:",
        "ec2.amazonaws.com:DescribeInstances:",
        "kms.amazonaws.com:GenerateDataKey:"
    ]
}
```