Skip to content

Add --visualize option to admin assignments - #134

Open
saimeda32 wants to merge 2 commits into
61418:masterfrom
saimeda32:feat/admin-assignments-visualize
Open

Add --visualize option to admin assignments#134
saimeda32 wants to merge 2 commits into
61418:masterfrom
saimeda32:feat/admin-assignments-visualize

Conversation

@saimeda32

Copy link
Copy Markdown

The CSV that admin assignments prints is complete, but it gets hard to review once an org has more than a few accounts. Ours is around 230 rows, and answering a question like "what can this group reach" means grepping.

This adds a --visualize option that writes the same results as an interactive HTML page, next to the normal CSV output:

aws-sso-util admin assignments --visualize

Access graph with a group selected

What the page does:

  • three columns (principals, permission sets, accounts) with a line per assignment, line weight reflects assignment count
  • hover to preview, click to pin a node and trace its full paths; the side panel lists them and every name in it is clickable, so you can jump from a group to an account to another group
  • search with a result picker, or trace all matches together
  • plain table view for when you just want rows, dark mode via prefers-color-scheme

Implementation notes:

  • the template ships as package data next to the module; rendering is a placeholder replacement in visualize.py, no new runtime dependencies
  • the JSON is escaped when injected (< and the JS line separators), so a hostile principal or account name cannot break out of the script element
  • accounts are keyed by account id rather than name, since account names are not unique
  • all existing filters (--group, --permission-set, --ou, and so on) apply to the graph too; the CSV output is unchanged; the filename is optional and defaults to access-graph.html

Testing:

  • pytest suite for the renderer under cli/tests (9 tests); pytest added as a dev dependency
  • ran it against a real Identity Center instance with about 230 assignments across 13 accounts, and exercised hover, pin, search, trace all, table view, dark mode, and keyboard input in a browser
  • the screenshot above uses made up example data

Docs: new section in docs/lookup.md plus a pointer in the README.

Happy to adjust naming, restructure the template, or drop the screenshot from the repo if you prefer to keep images out of it.

Writes the assignment list as a self-contained interactive HTML page in
addition to the normal CSV output. The page shows principals, permission
sets, and accounts as three columns with a line per assignment. You can
hover a node to preview its access, click it to pin the full paths,
search by name or account id, or switch to a plain table view. Dark mode
follows the OS setting.

The file makes no network requests and embeds the data directly, so it
can be opened offline. Values are escaped when injected so a hostile
principal or account name cannot break out of the script tag.

The filename is optional; plain --visualize writes access-graph.html.
All existing filters apply to the graph as well, and the CSV output is
unchanged.

Includes tests for the renderer and docs with a screenshot generated
from example data.
The completion message was a log line that only appears with -v. Print
it in green to stderr instead, with a file:// link that most terminals
make clickable. Goes to stderr so piping the CSV output stays clean.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant