Free AWS Security Whitepaper
    Toc Consulting Logo
    Back to all tools

    awsmount

    Browse your AWS account like a read-only folder.

    awsmount is a free, open-source tool (MIT license, Python 3.11+) maintained by KloudSec. It shows an AWS account as a folder: every resource is a directory and every API response is a describe.json file, so ls, cat, grep, find, jq and diff work on it. It runs on macOS and Linux as an interactive shell, a real mount (WebDAV on macOS, FUSE on Linux) or one-shot commands. A guard before every request blocks anything that is not a read, and secret-looking values such as Lambda environment values and EC2 user data are shown as <hidden> by default (masking is name-based, so review exports before you share them). It covers 28 services and 63 resource types, not every AWS service. Version 1.0.0 is meant for evaluation on non-production accounts.

    View on GitHub

    Features

    Layout

    • Account, then region, then service, then resource type, then one directory per resource
    • describe.json in every resource directory: the raw API data
    • links/ symlinks between resources (text files on a macOS mount), and referenced-by/ on security groups (network interfaces, instances, load balancers, Lambda functions, RDS instances, VPC endpoints and other groups)
    • 28 services and 63 resource types; it does not cover every AWS service

    Safety

    • Read-only: every boto3 call is checked inside awsmount before it is sent, against an allow-list, a read-prefix check and a deny-list (GetSecretValue, GetObject, Decrypt and others); also use credentials with a read-only IAM policy
    • Secret-looking values masked by default (Lambda and ECS environment values, EC2 user data, CloudFormation values); the rules are name-based and not complete, and tag values are not hidden
    • --reveal turns masking off: every process running as your user can then read those files
    • awsmount secrets is a separate command and the only one that can read secret values

    Usage

    • --max-api-calls limits calls per 10-minute window by default (--budget-window 0 for the whole session)
    • export is deterministic for most files, so diff -r shows real changes (a few lists, such as some policy documents, can still come back in a different order)
    • Walking a large account (find, tree, du) can cost thousands of API calls: narrow it with --services
    • Not tested on real AWS in 1.0.0: CloudFront, Organizations data, cross-account trust, accounts with thousands of resources

    Installation & Usage

    Install (Python 3.11+, macOS or Linux)

    pipx install awsmount            # or: python3 -m pip install awsmount
awsmount doctor

    Look Around (interactive shell, nothing to mount)

    awsmount -p myprofile -r us-east-1 shell
# then: ls /, cd, cat, grep, find, tree, help

    Mount the Account as a Folder

    mkdir -p ~/aws
awsmount -p myprofile -r us-east-1 mount ~/aws
# in a second terminal:
grep -rl '0.0.0.0/0' ~/aws/<account>/us-east-1/vpc/security-groups
awsmount umount ~/aws

    Snapshots and Diffs

    awsmount -p myprofile -r us-east-1 --services vpc,ec2 export /<account> ~/snap/monday
# ... later ...
awsmount -p myprofile -r us-east-1 --services vpc,ec2 export /<account> ~/snap/tuesday
diff -r -x .awsmount-export -x _meta ~/snap/monday ~/snap/tuesday

    CLI Options

    OptionDescription
    shellInteractive shell with ls, cd, cat, grep, find, tree, get and tab completion
    mount MOUNTPOINTMount the account read-only (macOS: built-in WebDAV client, Linux: FUSE)
    umount MOUNTPOINTUnmount
    ls | cat | find | grep | tree | getOne-shot commands for scripts
    export PATH DEST [--clean] [--links keep|skip|file]Write part of the tree into a normal directory
    serveServe the tree over WebDAV on 127.0.0.1 only
    secrets mount | shellThe separate command that can read secret values
    doctor [--check-credentials]Report which mount methods work on this machine
    services [--short|--markdown|--json]List supported services and resource types
    -p PROFILE -r REGION --services LIST --reveal --ttl --max-api-callsGlobal options: profile, region (or all), services, masking off, cache TTL, API call budget

    Need Help Implementing?

    We can help you deploy and customize this tool for your specific needs, or build custom solutions.

    Contact Us