#🛡️ AEGIS-IAM DASHBOARD

#👾 Authors

Nisarg Chasmawala · HEAVEN Pen-Tester / Cybersecurity Engineer

Jatin Kumar Cybersecurity & Full-Stack Engineer

Santhakumar Parivalla Cybersecurity Engineer

#📋 Table of Contents

#🎯 Project Summary

Aegis-IAM Dashboard is an enterprise-grade IAM risk-analysis HUD built for blue teams who need a fast, visual second-opinion on real-world identity exports — without standing up a full data pipeline.

Drop in any AWS aws iam get-account-authorization-details JSON and the engine immediately returns:

• Privilege escalation chains — graph-traversed user → role → admin pathways with severity scoring.
• Over-privileged principals — wildcard, admin-equivalent, and dangerous IAM/STS verb detection.
• Separation-of-Duties conflicts — six-pair conflict matrix flags audit-bypass and rogue-trust conditions.
• MITRE ATT&CK heatmap — 57-verb mapping across all 10 ATT&CK enterprise tactics.
• Composite posture score — 0–100 with letter-grade (A+ → F) and transparent factor breakdown.
• Dynamic remediation playbooks — auto-generated CLI patches and strategic guidance per finding.

The entire HUD is single-binary Flask + Jinja with a Tailwind CDN frontend. No build step. No database. No cloud dependency.

#💡 Core Idea

Most cloud security tools are heavy: agents, ingestion pipelines, query languages, paid SaaS dashboards. The first 5 minutes of incident-response triage rarely needs any of that — the responder just wants to point at an IAM JSON dump and ask:

Aegis treats the IAM export as the only source of truth for a single shot of analysis. Stateless, self-contained, runs offline. Useful as a SOC analyst's pocket scanner, an interview takehome, a security-class lab, or a quick Friday-afternoon audit.

#🔁 Complete Pipeline

┌──────────────────┐    ┌─────────────────┐    ┌────────────────────┐    ┌──────────────────┐
│  IAM JSON Upload │ →  │  Schema Detect  │ →  │  Normalized Model  │ →  │  Graph Builder   │
│  (AWS / Simple)  │    │  + Validation   │    │  (users / roles /  │    │  (NetworkX)      │
│  ≤ 2 MB          │    │                 │    │   actions / trust) │    │                  │
└──────────────────┘    └─────────────────┘    └────────────────────┘    └────────┬─────────┘
                                                                                  │
        ┌─────────────────────────────────────────────────────────────────────────┘
        │
        ▼
┌────────────────────────────────────────────────────────────────────────────────────────┐
│  ANALYSIS LAYER — runs in parallel for every loaded dataset                            │
├────────────────────────────────────────────────────────────────────────────────────────┤
│  • Escalation paths (DiGraph traversal: user → role → admin, severity by edge depth)   │
│  • Over-privileged detection (wildcards, admin-equivalent ARNs, dangerous verbs)       │
│  • SoD conflict matrix (six write+read pairs out of the box)                           │
│  • MITRE ATT&CK tag resolution (case-insensitive, multi-tactic decomposition)          │
│  • Posture scoring (weighted negative deltas, A+ to F grading, factor breakdown)       │
│  • Heatmap aggregation (per-tactic technique rollup with principal counts)             │
└────────────────────────────────────────────────────────────────────────────────────────┘
        │
        ▼
┌──────────────────┐    ┌─────────────────┐    ┌────────────────────┐    ┌──────────────────┐
│  Cyberpunk HUD   │ ⇄  │  Detail Drawer  │ ⇄  │  Cmd+K Palette     │ ⇄  │  PDF / JSON / CSV│
│  (Tailwind+SVG)  │    │  (per-finding)  │    │  (fuzzy launcher)  │    │  Export          │
└──────────────────┘    └─────────────────┘    └────────────────────┘    └──────────────────┘

#✨ Key Features

#🗺️ MITRE ATT&CK Coverage

Every IAM/STS verb in the map is tagged with one or more ATT&CK tactics. Compound tactics (e.g. Lateral Movement / Privilege Escalation / Persistence) decompose across all matching tactic columns in the heatmap.

#📊 Posture Scoring Engine

Posture Score is a transparent, deterministic composite. Score starts at 100 and each detected risk subtracts a weighted delta:

Final score is floored at zero. Each contributing factor surfaces in the Posture Score Breakdown module, so teams can see exactly which findings drove the grade.

#🖥️ Dashboard Modules

Plus secondary views: Trust Graph (vis-network), Dynamic Playbook (per-finding remediation), Intel Retrieval Lab (cloud export instructions).

#⚡ Tech Stack

#🌐 API Endpoints

#⌨️ Keyboard Shortcuts

#📁 Project Structure

Cyber-Security-Aegis-IAM-Dashboard/
│
├── 🐍 app.py                          ← Flask backend — ingestion · analysis · scoring · exports
├── 🗺️ mitre_map.json                  ← Permission → MITRE technique map (57 entries)
├── 📋 requirements.txt                ← Python dependencies
├── 📖 README.md                       ← You are here
│
├── 📊 data/
│   ├── demo_aws_auth_details.json     ← Demo dataset (Initialize Simulation)
│   └── sample_aws_realworld.json      ← Realistic AWS fixture (5 users · 4 roles)
│
├── 🎨 static/
│   ├── css/hud.css                    ← Cyberpunk component layer (920 lines)
│   └── js/hud.js                      ← Particles · drawer · palette · toasts · charts (655 lines)
│
├── 🖼️ templates/
│   ├── base.html                      ← Tailwind CDN · fonts · particles · overlay containers
│   ├── index.html                     ← Main HUD (posture · heatmap · stats · findings)
│   ├── graph.html                     ← vis-network IAM relationship graph
│   ├── playbook.html                  ← Per-finding remediation playbooks
│   └── intel_lab.html                 ← AWS / Azure / GCP export instructions
│
└── 📁 uploads/                        ← Runtime: user-uploaded JSON (auto-cleaned)

#⚙️ Installation

#Prerequisites

Python 3.9+
pip
A modern browser (Chrome 111+ · Firefox 113+ · Safari 16.2+ · Edge 111+)

#Quick Start

# 1. Clone
git clone https://github.com/nishu2402/Cyber-Security-Aegis-IAM-Dashboard.git
cd Cyber-Security-Aegis-IAM-Dashboard

# 2. Virtual environment
python -m venv venv

# Windows
venv\Scripts\activate
# macOS / Linux
source venv/bin/activate

# 3. Install dependencies
pip install -r requirements.txt

# 4. Run
python app.py

Open http://127.0.0.1:5000 in your browser.

flask>=3.0.0
werkzeug>=3.0.0
networkx>=3.2
gunicorn>=21.2.0

#🚀 Usage Guide

#1 — Pre-Built Simulations (Instant Demos)

The dashboard ships with 7 pre-built simulation scenarios. Click any card in the Simulation Library section to load it instantly.

#2 — Upload a Real AWS Export

# Generate the export
aws configure
aws iam get-account-authorization-details --output json > iam_auth.json

Then click + Choose JSON (auto-uploads) in the dashboard. The HUD repaints automatically — no extra confirm step. Client-side guards reject non-.json files and files over 2 MB before upload starts.

A bundled real-world fixture lives at data/sample_aws_realworld.json for offline testing — five users, four roles, three groups, federated SAML trust, NotAction wildcard, cross-account assume-role.

#3 — Other Cloud Exports

(See Intel Retrieval Lab in the dashboard for full reference.)

#4 — Generate an Intelligence Report

Click Export PDF for a branded dark-mode report. Or pull raw findings via:

curl http://127.0.0.1:5000/api/export/json   > findings.json
curl http://127.0.0.1:5000/api/export/csv    > findings.csv

#☁️ Deployment

The app is a standard WSGI Flask application — runs anywhere Python runs.

#Render / Railway / Fly.io / Heroku

# Procfile
web: gunicorn app:app

Set environment variable AEGIS_SECRET_KEY to a long random string in production.

#Docker

FROM python:3.11-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt gunicorn
COPY . .
ENV PORT=5000
EXPOSE 5000
CMD ["gunicorn", "-b", "0.0.0.0:5000", "app:app"]

docker build -t aegis-iam .
docker run -p 5000:5000 -e AEGIS_SECRET_KEY=$(openssl rand -hex 32) aegis-iam

#🔒 Security Notes

⚠️ Use only in authorized environments — for blue-team analysis of your own organization's IAM exports.

#🧪 Verified Test Coverage

#🛣️ Future Roadmap

#⚠️ Disclaimer

Aegis-IAM Dashboard is a defensive blue-team analysis tool. It is intended exclusively for use on IAM exports from systems you own or are explicitly authorized to assess. The authors, maintainers, and contributors accept no liability for misuse.

The MITRE ATT&CK mappings, severity weights, and posture scoring are heuristic and educational — they are not a substitute for a full security audit, a CSPM platform, or qualified human review. Findings should be validated by a security engineer before remediation actions are taken in production.

All trademarks (AWS, MITRE ATT&CK, Azure, GCP, etc.) belong to their respective owners.

#📜 License

Distributed under the MIT License. See LICENSE for full text.

Owned and Developed by Nisarg Chasmawala (HEAVEN), Jatin Kumar, and Santhakumar Parivalla.
© 2026 All Rights Reserved.

⭐ If this project helped you, give it a star — it genuinely helps.