In simple English
This tool helps you check who has access to your company apps and servers. It connects to services like GitHub or cloud providers and reads their user lists and permissions. You can see who is an admin, spot changes over time, and export the findings into reports. It saves you from checking dozens of settings pages by hand. It costs your time to write code and run commands, but the software itself is free and open source.
What it is
Baton SDK is a collection of libraries for the Go programming language (a compiled language used to build fast backend services and command-line tools) that lets developers write custom plugins for auditing permissions. It includes a command-line tool to inspect, compare, and export the identity data those plugins collect.
What it is good for
Solo builders and small IT teams who need to audit infrastructure access, track down permissions sprawl, or build automated compliance checks across multiple SaaS and IaaS tools.
- Extracts complex user permissions into a standard format.
- Includes a command-line utility to search and diff access rights.
- Open source toolkit backed by an active identity company.
- Requires writing code in Go to build custom connectors.
- Relies on third-party connectors for each service you want to audit.
- High number of open issues on GitHub means you may hit edge cases.
manual spreadsheets and taking screenshots of admin settings
jq
- prowler-cloud/prowler15k stars
An open source security tool for AWS, GCP, and Azure that checks cloud posture and compliance settings.
- duo-labs/cloudmapper6.3k stars
Analyzes Amazon Web Services environments to visualize infrastructure and spot overly permissive access.
- michelp/pgsodium614 stars
A PostgreSQL extension that brings libsodium's encryption functions into SQL, with a root key the database cannot read back.
- pgaudit/pgaudit1.7k stars
A PostgreSQL extension that records what was done to the database, in the database's own log.
- openbao/openbao8.6k stars
A secrets manager that stores keys and passwords, hands them out on request, and can revoke them.
brew install conductorone/baton/baton conductorone/baton/baton-github