Nexuvius / Vizhi

விழி

Vizhi

An eye on who can reach what in AWS.

Vizhi reads your AWS access policies and reports the ones that allow more than they should, with a plain-English reason and a fix for each. It is a small command-line tool that runs on your own machine.

Talk to us about Vizhi What it checks
vizhi
Sample output with made-up policy names.

Features

What Vizhi does

  • Finds access that is too widePublic buckets, wildcard admin rights, roles anyone can assume, and access from other accounts with no condition attached.
  • Catches the subtle onesPaths to more privilege through PassRole, the confused-deputy pattern in vendor roles, and guardrail policies that could lock you out.
  • Explains itselfEvery finding says what was found, why it matters and how to fix it. Findings are flagged for a person to review, not issued as final verdicts.
  • Reports that fit your workMarkdown for a quick read, PDF for a client, JSON for scripts, and SARIF for code scanning in GitHub, GitLab or Azure DevOps.
  • Shows what changedSave a snapshot and compare the next scan against it. The report opens with what is new, what was fixed and what is still open.
  • Reads onlyVizhi works from policy files you already have. It can also read them from an AWS account using read-only permissions.

Coverage

23 kinds of policy

Access in AWS is not only set in IAM. Buckets, keys, queues and many other resources carry their own policies, and Vizhi checks each of these.

  • IAM identity policies
  • S3 buckets
  • IAM role trust
  • KMS keys
  • Service control policies
  • Lambda functions
  • VPC endpoints
  • ECR repositories
  • SNS topics
  • Secrets Manager
  • EFS file systems
  • SQS queues
  • S3 Access Points
  • API Gateway
  • OpenSearch domains
  • EventBridge buses
  • CloudWatch Logs
  • SES identities
  • CodeArtifact
  • Backup vaults
  • DynamoDB tables
  • Glacier vaults
  • Glue Data Catalog

How it works

From policies to a report

  1. Point it at your policiesGive Vizhi folders of policy JSON, or a config file listing them.
  2. It checks each one against its rulesEach kind of policy has its own rules, written down with what they detect and why it matters.
  3. Read the summary firstThe report starts with counts by severity and a short list of the critical findings to review first.
  4. Scan again laterCompare against your last snapshot to see what was fixed and what is new.

Where Vizhi stands today

Working build
All 23 checks, comparing scans, and every report format run end to end, backed by more than 400 automated tests.
Reading from an account
Reading policies straight from an AWS account is built and tested against simulated responses. It is still waiting on its first run against a real account.
A second pair of eyes
Vizhi points at what deserves attention. A person still decides what is acceptable for their setup.
Availability
Not publicly released yet. Get in touch if you would like a scan of your own policies.

The rest of the family

Curious what Vizhi would find?

Send us a note about your AWS setup. We can walk you through a sample report and what a scan involves.

Email [email protected]