### Setup Local Development Environment

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/python.md

Run this Makefile command to set up your local development environment. This typically includes installing dependencies and configuring necessary tools.

```bash
make setup-env
```

--------------------------------

### Install using Pip3

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/user-guide/installation.md

Install cloudsplaining using pip3 for user-specific installation.

```bash
pip3 install --user cloudsplaining
```

--------------------------------

### Install using Homebrew

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/user-guide/installation.md

Use Homebrew to tap the salesforce/cloudsplaining repository and install the cloudsplaining package.

```bash
brew tap salesforce/cloudsplaining https://github.com/salesforce/cloudsplaining
brew install cloudsplaining
```

--------------------------------

### Compare Example Reports

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/plans/2026-05-29-pathfinding-onboarding-implementation-plan.md

A command-line recipe to compare old and new example reports using the 'just' task runner. It takes paths to the old and new example IAM data files as arguments.

```bash
just compare-reports OLD NEW
```

--------------------------------

### Generate Example Report

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/report.md

Run this command from the root directory to generate an example report. This is useful for testing the report generation functionality without performing a full scan.

```bash
make generate-report
```

--------------------------------

### Generate Example Report

Source: https://github.com/salesforce/cloudsplaining/blob/master/CLAUDE.md

Generates example IAM data and an HTML report using the Cloudsplaining tool.

```bash
just generate-report
```

--------------------------------

### Install Project Dependencies

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/javascript.md

Installs all necessary packages for the project using npm. This command should be run from the root directory of the project.

```bash
npm install
```

--------------------------------

### Install Required Python Packages

Source: https://github.com/salesforce/cloudsplaining/blob/master/examples/jira-tickets/README.md

Installs the 'jira' and 'click' Python packages required for the script. Ensure you have pip3 installed.

```bash
pip3 install jira
pip3 install click
```

--------------------------------

### Clone Repository and Set Up Environment

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/documentation.md

Clone the Cloudsplaining repository and set up a virtual environment with necessary dependencies. Use this for initial setup or when working on documentation changes.

```bash
git clone git@github.com:salesforce/cloudsplaining.git

# Set up the virtual environment
python3 -m venv ./venv && source venv/bin/activate
uv sync --frozen
```

--------------------------------

### Generate Example Report Script

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/results-json-schema.md

This bash script generates the example report without requiring a full Cloudsplaining scan. It is used to update the static example report with the latest changes.

```bash
./utils/generate_example_report.py
```

--------------------------------

### Serve Vue.js Report UI (Development)

Source: https://github.com/salesforce/cloudsplaining/blob/master/CLAUDE.md

Starts a development server for the Vue.js report user interface.

```bash
just serve-js
```

--------------------------------

### Install Dependencies with uv

Source: https://github.com/salesforce/cloudsplaining/blob/master/CLAUDE.md

Installs project dependencies using uv, ensuring a frozen lock file for reproducible builds.

```bash
uv sync --frozen
```

--------------------------------

### Example Multi-Account Configuration File

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/user-guide/scan-multiple-accounts.md

This is an example of the `multi-account-config.yml` file. Edit the `account_name: accountID` pairs to match your AWS environment.

```yaml
accounts:
  default_account: 123456789012
  prod: 123456789013
  test: 123456789014
```

--------------------------------

### Serve Local Development Version

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/javascript.md

Starts a local development server to view the report application. Access the application at http://localhost:8080. Two options are provided: using npm scripts or the Makefile.

```bash
# Option 1: npm, as defined in package.json
npm run serve
# Option 2: Makefile
make serve-js
```

--------------------------------

### Example cloudsplaining scan-policy-file Output

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/user-guide/scan-policy-file.md

This is an example of the output generated when scanning a policy file, showing identified issues and the associated IAM actions.

```console
Issue found: Data Exfiltration
Actions: s3:GetObject

Issue found: Resource Exposure
Actions: ecr:DeleteRepositoryPolicy, ecr:SetRepositoryPolicy, s3:BypassGovernanceRetention, s3:DeleteAccessPointPolicy, s3:DeleteBucketPolicy, s3:ObjectOwnerOverrideToBucketOwner, s3:PutAccessPointPolicy, s3:PutAccountPublicAccessBlock, s3:PutBucketAcl, s3:PutBucketPolicy, s3:PutBucketPublicAccessBlock, s3:PutObjectAcl, s3:PutObjectVersionAcl

Issue found: Unrestricted Infrastructure Modification
Actions: ecr:BatchDeleteImage, ecr:CompleteLayerUpload, ecr:CreateRepository, ecr:DeleteLifecyclePolicy, ecr:DeleteRepository, ecr:DeleteRepositoryPolicy, ecr:InitiateLayerUpload, ecr:PutImage, ecr:PutImageScanningConfiguration, ecr:PutImageTagMutability, ecr:PutLifecyclePolicy, ecr:SetRepositoryPolicy, ecr:StartImageScan, ecr:StartLifecyclePolicyPreview, ecr:TagResource, ecr:UntagResource, ecr:UploadLayerPart, s3:AbortMultipartUpload, s3:BypassGovernanceRetention, s3:CreateAccessPoint, s3:CreateBucket, s3:DeleteAccessPoint, s3:DeleteAccessPointPolicy, s3:DeleteBucket, s3:DeleteBucketPolicy, s3:DeleteBucketWebsite, s3:DeleteObject, s3:DeleteObjectTagging, s3:DeleteObjectVersion, s3:DeleteObjectVersionTagging, s3:GetObject, s3:ObjectOwnerOverrideToBucketOwner, s3:PutAccelerateConfiguration, s3:PutAccessPointPolicy, s3:PutAnalyticsConfiguration, s3:PutBucketAcl, s3:PutBucketCORS, s3:PutBucketLogging, s3:PutBucketNotification, s3:PutBucketObjectLockConfiguration, s3:PutBucketPolicy, s3:PutBucketPublicAccessBlock, s3:PutBucketRequestPayment, s3:PutBucketTagging, s3:PutBucketVersioning, s3:PutBucketWebsite, s3:PutEncryptionConfiguration, s3:PutInventoryConfiguration, s3:PutLifecycleConfiguration, s3:PutMetricsConfiguration, s3:PutObject, s3:PutObjectAcl, s3:PutObjectLegalHold, s3:PutObjectRetention, s3:PutObjectTagging, s3:PutObjectVersionAcl, s3:PutObjectVersionTagging, s3:PutReplicationConfiguration, s3:ReplicateDelete, s3:ReplicateObject, s3:ReplicateTags, s3:RestoreObject, s3:UpdateJobPriority, s3:UpdateJobStatus
```

--------------------------------

### Serve Javascript Report Locally

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/python.md

Serve the example Javascript report locally for development purposes. This allows you to preview the report in a development environment.

```bash
make serve-js
```

--------------------------------

### Serve Local Report with npm

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/results-json-schema.md

Commands to install dependencies and serve the local report using npm. This is used to preview changes to the HTML report.

```bash
npm install
npm serve
```

--------------------------------

### Generate Example IAM Data Script

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/results-json-schema.md

This bash script updates the example IAM data JSON files used by Cloudsplaining. It modifies both a local example file and the file used by the JavaScript front-end.

```bash
./utils/generate_example_iam_data.py
```

--------------------------------

### Check Node Version

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/javascript.md

Verify that the installed Node.js version matches the project's requirement of v14.5.0. This is a crucial first step for ensuring compatibility.

```bash
node --version

# should return:
# v14.5.0
```

--------------------------------

### Privilege Escalation Methods with STS AssumeRole

Source: https://github.com/salesforce/cloudsplaining/blob/master/research/pathfinding-cloud/INTEGRATION-ANALYSIS.md

Example of how privilege escalation methods should be defined to include `sts:assumerole`.

```python
"AttachRolePolicy": ["iam:attachrolepolicy", "sts:assumerole"],
"PutRolePolicy":    ["iam:putrolepolicy", "sts:assumerole"],
"UpdateRolePolicyToAssumeIt": ["iam:updateassumerolepolicy", "sts:assumerole"]
```

--------------------------------

### Least Privilege IAM Policy Example

Source: https://github.com/salesforce/cloudsplaining/blob/master/README.md

This JSON policy demonstrates least privilege by restricting the s3:GetObject action to a specific S3 bucket ARN. This is an example of a well-formed IAM policy with resource constraints.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}
```

--------------------------------

### Run Jira Ticket Automation Script

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/appendices/jira-ticket-automation.md

Execute the `open_jira_ticket.py` script to create a Jira ticket. Ensure you have generated your Cloudsplaining report and installed the necessary dependencies.

```bash
python open_jira_ticket.py \
    --project PROJ \
    --auth-file authz.json \
    --report-file report.html \
    --triage-file triage.csv \
    --data-file data.json \
    --server http://myserver.atlassian.net
```

--------------------------------

### Example JSON Output for Authorization Details

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/user-guide/scan-account.md

This JSON structure represents a sample entry from the raw JSON data file generated by cloudsplaining. It details IAM policy information, including account ID, policy name, ARN, and counts of actions and services.

```json
{
    "example-authz-details": [
        {
            "AccountID": "012345678901",
            "ManagedBy": "Customer",
            "PolicyName": "InsecureUserPolicy",
            "Arn": "arn:aws:iam::012345678901:user/userwithlotsofpermissions",
            "ActionsCount": 2,
            "ServicesCount": 1,
            "Actions": [
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Services": [
                "s3"
            ]
        }
    ]
}
```

--------------------------------

### Build and Serve Documentation

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/documentation.md

Build the HTML documentation files and serve them locally to preview changes. This command opens the built documentation in your browser.

```bash
make build-docs
make serve-docs
```

--------------------------------

### Build Documentation Locally

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/python.md

Create the documentation files locally and open them. This command is useful for previewing documentation changes before committing them.

```bash
make build-docs
```

--------------------------------

### Set up Virtual Environment

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/python.md

Use this command to set up the virtual environment for Python package management. It creates a new virtual environment and activates it, followed by synchronizing dependencies.

```bash
python3 -m venv ./venv && source venv/bin/activate
uv sync --frozen
```

--------------------------------

### Generate New Sample Report

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/javascript.md

Execute this command to generate a new sample report. The report will be created at the root index.html file.

```bash
python3 ./utils/generate_example_report.py
```

--------------------------------

### Serve Documentation Locally

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/python.md

Serve the documentation files locally as you edit them. This provides a live-reloading development server for documentation.

```bash
make serve-docs
```

--------------------------------

### Overly Permissive IAM Policy Example

Source: https://github.com/salesforce/cloudsplaining/blob/master/README.md

This JSON policy allows the IAM principal to run s3:PutObject on any S3 bucket in the AWS account. This is an example of a policy that lacks resource constraints and violates the principle of least privilege.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject"
      ],
      "Resource": "*"
    }
  ]
}
```

--------------------------------

### Create Custom Guidance and Appendices HTML Files

Source: https://github.com/salesforce/cloudsplaining/blob/master/README.md

Use echo commands to create custom HTML files for guidance and appendices. These files will be used to customize the Cloudsplaining HTML report.

```bash
# Create custom guidance
 echo '<h1>Company Security Guidelines</h1>
<p>Follow these organization-specific steps:</p>
<ul>
  <li>Review with security team</li>
  <li>Document in JIRA ticket</li>
  <li>Get approval before remediation</li>
</ul>' > custom-guidance.html

# Create custom appendices  
echo '<h1>Internal Resources</h1>
<p>Additional company resources:</p>
<ul>
  <li><a href="https://internal.company.com/security">Security Portal</a></li>
  <li><a href="https://wiki.company.com/iam">IAM Best Practices</a></li>
</ul>' > custom-appendices.html
```

--------------------------------

### Create Git Branch

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/plans/2026-05-29-pathfinding-onboarding-implementation-plan.md

Creates a new Git branch for the fix. Use this command to start working on the issue.

```bash
git checkout -b fix/580-privesc-without-assumerole
```

--------------------------------

### Build JavaScript Bundle

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/javascript.md

Creates the production-ready JavaScript bundle for deployment. Two options are provided: using npm scripts or the Makefile.

```bash
# Option 1: npm, as defined in package.json
npm build
# Option 2: Makefile
make build-js
```

--------------------------------

### Serve JavaScript Application Locally

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/javascript.md

Run this command to serve the application locally for testing. You can then access it via http://localhost:8080.

```bash
npm serve
# You can then access the application over http://localhost:8080
```

--------------------------------

### Commit Changes

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/plans/2026-05-29-pathfinding-onboarding-implementation-plan.md

Stages and commits the modified files, including constants, tests, examples, and generated data, with a descriptive message referencing the closed issue.

```bash
git add cloudsplaining/shared/constants.py test/ examples/ utils/example-iam-data.json cloudsplaining/output/src/sampleData.js
git commit -m "fix: detect AttachRolePolicy/PutRolePolicy/UpdateAssumeRolePolicy privesc without sts:AssumeRole

Closes #580"
```

--------------------------------

### Cloudsplaining Report Configuration Variables

Source: https://github.com/salesforce/cloudsplaining/blob/master/cloudsplaining/output/public/index.html

Defines various configuration variables for a Cloudsplaining report. These include flags for local examples, account identifiers, report timestamps, Cloudsplaining version, and content settings for guidance and appendices.

```javascript
var isLocalExample = true;
var account_id;
var account_name;
var report_generated_time;
var cloudsplaining_version;
var iam_data;
var guidance_content = "default";
var appendices_content = "default";
var show_guidance_nav = "True";
var show_appendices_nav = "True";
```

--------------------------------

### Create Multi-Account Configuration File

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/user-guide/scan-multiple-accounts.md

Use this command to generate a template for your multi-account configuration file. This file will list the AWS account IDs you intend to scan.

```bash
cloudsplaining create-multi-account-config-file \
    -o multi-account-config.yml
```

--------------------------------

### Download Account Authorization Details

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/user-guide/download.md

Run this command to download account authorization details. Ensure you are authenticated to AWS and have the necessary IAM permissions.

```bash
cloudsplaining download
```

--------------------------------

### Add Python Binaries to PATH

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/user-guide/troubleshooting.md

If you encounter issues executing Cloudsplaining commands, your PATH environment variable might not include the installed binary packages. This command adds the Python 3.7 binary directory to your PATH on macOS.

```bash
export PATH=$HOME/Library/Python/3.7/bin/:$PATH
```

--------------------------------

### Run Unit Tests

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/javascript.md

Executes the project's unit tests to ensure code quality and functionality. Two options are provided: using npm scripts or the Makefile.

```bash
# Option 1: npm, as defined in package.json
npm run test
# Option 2: Makefile
make test-js
```

--------------------------------

### Run Pre-Push Checks

Source: https://github.com/salesforce/cloudsplaining/blob/master/CLAUDE.md

Executes a full local CI-equivalent gate, intended to be run before every push to ensure code quality and consistency.

```bash
just pre-push
```

--------------------------------

### Build Vue.js Frontend

Source: https://github.com/salesforce/cloudsplaining/blob/master/CLAUDE.md

Builds the Vue.js frontend for the HTML report, generating necessary assets.

```bash
just build-js
```

--------------------------------

### Build Python Package

Source: https://github.com/salesforce/cloudsplaining/blob/master/CLAUDE.md

Builds the Cloudsplaining Python package for distribution.

```bash
just build-package
```

--------------------------------

### Cloudsplaining Cheatsheet - Download Authorization Details

Source: https://github.com/salesforce/cloudsplaining/blob/master/README.md

Commands for downloading authorization details. Use the --profile flag to specify a particular AWS profile.

```bash
# Download authorization details
cloudsplaining download
# Download from a specific AWS profile
cloudsplaining download --profile someprofile
```

--------------------------------

### Checkout Master and Create New Branch

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/plans/2026-05-29-pathfinding-onboarding-implementation-plan.md

Initial Git commands to ensure the local master branch is up-to-date and to create a new feature branch for the pathfinding onboarding machinery.

```bash
git checkout master && git pull
git checkout -b feat/pathfinding-onboarding-machinery
```

--------------------------------

### Add Low-Level Unit Test for Policy Document

Source: https://github.com/salesforce/cloudsplaining/blob/master/research/pathfinding-cloud/INTEGRATION-ANALYSIS.md

Write a minimal policy granting specific actions and assert the expected privilege escalation list. Include a negative test case.

```python
policy_document.allows_privilege_escalation
```

--------------------------------

### Run Linting and Formatting Hooks

Source: https://github.com/salesforce/cloudsplaining/blob/master/CLAUDE.md

Runs CI's format and lint hooks, automatically fixing formatting issues in place across the repository.

```bash
just lint
```

--------------------------------

### Create Cloudsplaining Exclusions File

Source: https://github.com/salesforce/cloudsplaining/blob/master/cloudsplaining/output/src/assets/2-triage-guidance.md

Use the `create-exclusions-file` command to generate a default `exclusions.yml` file. This file serves as a template for defining custom exclusions.

```bash
cloudsplaining create-exclusions-file
```

--------------------------------

### Download Account Authorization Details with Specific Profile

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/user-guide/download.md

Use this command to download account authorization details when using a specific profile from your `~/.aws/credentials` file. Ensure you are authenticated to AWS and have the necessary IAM permissions.

```bash
cloudsplaining download --profile myprofile
```

--------------------------------

### Write Policy with Policy Sentry

Source: https://github.com/salesforce/cloudsplaining/blob/master/cloudsplaining/output/src/assets/how-do-i-validate-results.md

After populating the YAML template with resource ARNs, use this command to generate the final IAM policy file with Policy Sentry.

```bash
policy_sentry write-policy --input-file crud.yml
```

--------------------------------

### Enable Zsh Shell Completion

Source: https://github.com/salesforce/cloudsplaining/blob/master/README.md

Add the provided command to your .zshrc file to enable Zsh completion for cloudsplaining.

```bash
eval "$(_CLOUDSPLAINING_COMPLETE=zsh_source cloudsplaining)"
```

--------------------------------

### Generate Cloudsplaining Report

Source: https://github.com/salesforce/cloudsplaining/blob/master/cloudsplaining/output/src/assets/2-triage-guidance.md

Execute this command to generate the Cloudsplaining report, which includes an HTML report and a raw JSON data file. Provide the input account details and the custom exclusions file.

```bash
cloudsplaining scan --input-file default-account-details.json --exclusions-file exclusions.yml
```

--------------------------------

### Build JavaScript Bundle Files

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/javascript.md

This command builds new JavaScript bundle files using webpack. It generates bundled application code and dependency files.

```bash
npm build
```

--------------------------------

### Download Account Authorization Details

Source: https://github.com/salesforce/cloudsplaining/blob/master/cloudsplaining/output/src/assets/2-triage-guidance.md

Use this command to download the account authorization details JSON file, which is necessary for generating Cloudsplaining reports. Ensure you specify the correct AWS profile.

```bash
cloudsplaining download --profile default --output default-account-details.json
```

--------------------------------

### Run Javascript Unit Tests

Source: https://github.com/salesforce/cloudsplaining/blob/master/docs/contributing/python.md

Execute unit tests for the Javascript/UI components. This command is used to verify the functionality of the frontend code.

```bash
make test-js
```

--------------------------------

### Enable Bash Shell Completion

Source: https://github.com/salesforce/cloudsplaining/blob/master/README.md

Add the provided command to your .bashrc file to enable Bash completion for cloudsplaining.

```bash
eval "$(_CLOUDSPLAINING_COMPLETE=bash_source cloudsplaining)"
```

--------------------------------

### Generate Report with Custom Content

Source: https://github.com/salesforce/cloudsplaining/blob/master/README.md

Run the cloudsplaining scan command with input file and output directory to generate a report that includes custom content if specified.

```bash
# Generate report with custom content
cloudsplaining scan --input-file account-data.json --output reports/
```