AWS Shadow Access Scanner - IAM & Server Privilege Detection

AWS Shadow Access Scanner is the first tool to comprehensively detect ALL privileged access mechanisms in AWS environments. While traditional tools focus only on IAM policies, this scanner goes deeper -- detecting server-level privilege backdoors that PAM solutions like CyberArk and BeyondTrust cannot see. WHAT IT DETECTS (47+ finding types across 15 categories): - IAM policy analysis: wildcard permissions, unused access (90+ days), cross-account roles, overprivileged policies - SSH authorized keys: orphaned keys, suspicious patterns, recent additions, service account keys across /home, /root, /var/lib, /opt - Sudo/sudoers misconfigurations: NOPASSWD entries, GTFOBins dangerous commands (vim, find, docker, kubectl), service account privilege escalation - Shadow accounts: UID=0 duplicates, empty passwords, duplicate password hashes, passwd/shadow sync errors - LD_PRELOAD injection: malicious shared libraries in /etc/ld.so.preload and environment variables - Unauthorized setuid binaries: custom root-executing binaries in non-standard locations - Dangerous Linux capabilities: cap_setuid, cap_sys_admin, cap_dac_override on non-standard binaries - Insecure sshd_config: PermitRootLogin, PermitEmptyPasswords HOW IT WORKS: 1. One-click CloudFormation deployment in YOUR AWS account 2. Lambda + Systems Manager (SSM) for agentless scanning -- no agents to install on instances 3. Scans complete in 2-5 minutes for up to 100 EC2 instances 4. Results stored in your S3 bucket with automated email notifications 5. Automated daily/weekly scheduling via EventBridge 6. Built-in finding suppression API for managing known-good configurations ZERO TRUST ARCHITECTURE: - All scanning runs in your AWS account -- no credentials shared with vendor - Read-only operations only -- never modifies your infrastructure - Customer owns all scan data - Minimal IAM permissions (least-privilege) - Encrypted results storage