AWS Account Info Script

A Python script designed to run in AWS CloudShell that gathers key account information and displays it in a plain-text, email-friendly format.

Usage

Open AWS CloudShell and paste the following commands:

git clone https://github.com/apserdev/apser-check_account.git
cd apser-check_account
python3 check_account.py

Report Sections

The script generates a report with the following sections:

1. Account ID — The 12-digit AWS account ID.
2. Root MFA Status — Whether the root account has MFA enabled.
3. IAM Users with Administrator Access — Active IAM users with AdministratorAccess policy (directly or via groups) and their MFA status.
4. Organization Membership — Whether the account belongs to an AWS Organization, and the management account details.
5. Organization Accounts — A table listing all accounts in the organization (Name, Id, Email). Only shown when AWS Organizations is enabled.
6. IAM Identity Center Status — Whether IAM Identity Center (SSO) is enabled and in which region.
7. Past Due Payments — Any past due invoices on the account.

AWS API Calls Made

The script makes the following read-only API calls. No data is modified.

Section	API Call	Purpose
Account ID	sts:GetCallerIdentity	Get the 12-digit account ID
Root MFA	iam:GetAccountSummary	Check if root account has MFA enabled
Admin Users	iam:ListUsers	List all IAM users
Admin Users	iam:GetLoginProfile	Check if user has console access
Admin Users	iam:ListAccessKeys	Check if user has active access keys
Admin Users	iam:ListAttachedUserPolicies	Check for directly attached AdministratorAccess
Admin Users	iam:ListGroupsForUser	Get user's group memberships
Admin Users	iam:ListAttachedGroupPolicies	Check groups for AdministratorAccess
Admin Users	iam:ListMFADevices	Check if admin user has MFA enabled
Organization	organizations:DescribeOrganization	Get org membership and management account info
Organization Accounts	organizations:ListAccounts	List all accounts in the organization
Identity Center	sso-admin:ListInstances	Check if IAM Identity Center is enabled
Past Due Payments	invoicing:ListInvoiceSummaries	Check for past due invoices

Minimum IAM Policy Required

The following IAM policy grants the minimum permissions needed to run this script:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AccountInfo",
            "Effect": "Allow",
            "Action": [
                "sts:GetCallerIdentity"
            ],
            "Resource": "*"
        },
        {
            "Sid": "RootMFACheck",
            "Effect": "Allow",
            "Action": [
                "iam:GetAccountSummary"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AdminUsersCheck",
            "Effect": "Allow",
            "Action": [
                "iam:ListUsers",
                "iam:GetLoginProfile",
                "iam:ListAccessKeys",
                "iam:ListAttachedUserPolicies",
                "iam:ListGroupsForUser",
                "iam:ListAttachedGroupPolicies",
                "iam:ListMFADevices"
            ],
            "Resource": "*"
        },
        {
            "Sid": "OrganizationCheck",
            "Effect": "Allow",
            "Action": [
                "organizations:DescribeOrganization",
                "organizations:ListAccounts"
            ],
            "Resource": "*"
        },
        {
            "Sid": "IdentityCenterCheck",
            "Effect": "Allow",
            "Action": [
                "sso:ListInstances"
            ],
            "Resource": "*"
        },
        {
            "Sid": "BillingCheck",
            "Effect": "Allow",
            "Action": [
                "invoicing:ListInvoiceSummaries"
            ],
            "Resource": "*"
        }
    ]
}

Example Output

Below is an example of the report output using fictitious data:

========================================
AWS ACCOUNT REPORT - 111122223333
Generated: 2025-07-15 10:32:45 UTC
========================================

ACCOUNT ID
---
111122223333


ROOT MFA STATUS
---
Root MFA: Enabled


IAM USERS WITH ADMINISTRATOR ACCESS
---
admin-user - MFA: Enabled
deploy-bot - MFA: Not Enabled


ORGANIZATION MEMBERSHIP
---
Management Account: org-admin@example.com
Management Account ID: 444455556666


ORGANIZATION ACCOUNTS
---
+---------------------+--------------+-------------------------------+
| Name                | Id           | Email                         |
+---------------------+--------------+-------------------------------+
| prod-workloads      | 111122223333 | prod@example.com              |
| dev-sandbox         | 222233334444 | dev@example.com               |
| staging-env         | 333344445555 | staging@example.com           |
| management-account  | 444455556666 | org-admin@example.com         |
+---------------------+--------------+-------------------------------+


IAM IDENTITY CENTER STATUS
---
IAM Identity Center: Enabled
Region: eu-west-1


PAST DUE PAYMENTS
---
No past due payments

If the account is not part of an AWS Organization, the "Organization Membership" section will show Account is not part of an AWS Organization and the "Organization Accounts" section will be omitted entirely.

Notes

• All API calls are read-only — the script does not create, modify, or delete any resources.
• The script handles errors gracefully per section — if one check fails due to missing permissions, the rest still execute.
• sts:GetCallerIdentity does not actually require any IAM permissions (it always works for any authenticated caller), but is listed for transparency.
• The billing check (invoicing:ListInvoiceSummaries) may require that billing access is enabled for IAM users in the account's billing settings.
• Identity Center check queries multiple AWS regions to find the instance.
• The Organization Accounts table is only displayed when the account belongs to an AWS Organization. It requires organizations:ListAccounts permission.