# nccgroup/PMapper

A tool for quickly evaluating IAM permissions in AWS.

Repository: https://github.com/nccgroup/PMapper
Canonical: https://ross.abutalabs.com/products/pmapper
Language: Python
License: AGPL-3.0
License Family: copyleft
Topics: aws, iam, python, botocore, cloudsecurity
Last push: 2024-08-02T15:38:29+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 3025, "days_push": 761, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1576, forks 197 (observed 2026-08-28T04:05:05.880116+00:00)

## What it is
Principal Mapper (PMapper) is a Python CLI tool and library that models AWS IAM users and roles as a directed graph to identify privilege escalation risks and unintended access paths. It simulates AWS authorization locally to answer queries about which principals can perform actions or access resources.

## Use cases
- audit AWS IAM permissions for an account or organization
- find privilege escalation paths in AWS IAM configuration
- check which IAM users or roles can perform a specific action
- identify alternate attack paths to access an AWS resource
- generate a graph visualization of IAM relationships
- run preset queries for common IAM misconfigurations

## When to choose
- you need to audit IAM privilege escalation risks in an AWS account
- you want to simulate AWS authorization locally without making live calls
- you need to trace indirect access paths through role assumption chains
- you want a scriptable CLI or Python library for IAM analysis

## When to avoid
- you need continuous cloud security monitoring rather than point-in-time analysis
- you need multi-cloud IAM auditing beyond AWS
- you want automated remediation of IAM issues rather than detection

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, developer-tools
- domain: cloud-computing, security, infrastructure-as-code
- platform: python, cli, cross-platform
- tags: aws, iam, privilege-escalation, cloud-security, graph-analysis, botocore, docker

## Member repositories
- nccgroup/PMapper (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:05.880116+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:57:25.608662+00:00, confidence not recorded.
  - readme: https://github.com/nccgroup/PMapper (fetched 2026-08-28T04:05:05.880116+00:00, sha 37b471fe4f42)
- Data as of 2026-08-30T08:39:29.467469+00:00.