Enterprise SQL task catalog.

Are there users with access keys that were created during setup but never used?

Do any active access keys have a creation date older than 90 days?

Which active access keys are older than 90 days?

Is the AWSSupportAccess AWS managed policy attached to at least one principal (user, group, or role)?

Are there users who do not belong to the common IAM group?

Do any IAM users have both a console password and one or more active API keys?

Which IAM users have console passwords enabled but no MFA?

Do any customer-managed policies allow a specific service:action on all resources (*)?

Are there customer-managed policies with no attachments?

Do any attached customer-managed policies grant permissions other than sts:AssumeRole?

Do any customer-managed IAM policies use NotAction in Allow statements?

Are there EC2 service roles that are not attached to any running EC2 instances?

Do any IAM groups have inline policies attached?

Is a hardware MFA device enabled on the root account?

List high-privilege non-human identities by type (AWS execution roles, AWS cross-account roles).

Do any human IAM users have policies attached directly (inline or managed)?

Are there users with inline or managed policies attached directly?

Do any user inline policies allow actions other than sts:AssumeRole?

Do any inline policies in IAM identities use NotAction with an Allow effect?

Are there any managed policies that allow Action = "*" and Resource = "*"?

Is MFA enabled on the root account?

Do any users have more than one active access key?

Do all password-enabled IAM users have MFA enabled?

Is password expiration enabled in the IAM password policy?

Does the account password policy enforce password expiration and set MaxPasswordAge ≤ 90 days?

Does the password policy prevent the reuse of previous passwords?

Is the IAM password policy configured to require at least 14 characters?

Does the IAM password policy require at least one lowercase letter?

Does the password policy require at least one numeric character?

Does the password policy require at least one special character?

Does the IAM password policy require at least one uppercase letter?

Are there any users with passwords or access keys that have not been used in over 90 days and are still enabled?

Do any policies deny user actions on group resources rather than on the users themselves?

Do any IAM roles allow an AWS principal to perform the sts:AssumeRole action without requiring MFA in their trust policies?

Do any IAM roles have inline policies that allow a specific service:action on all resources (*)?

Do any IAM roles have inline policies attached?

Which roles have inline policies attached?

Which IAM roles trust external accounts (not in AWS Organizations)?

Do any IAM roles have trust policies that allow principals from other accounts without requiring MFA or an External ID?

Are there IAM roles whose trust policies allow any AWS principal (e.g., Principal set to "*")?

Does the root account have any active X.509 certificates?

Does the root account have any active access keys?

Is root MFA enforced?

Has the root account been used within the last 90 days?

List secrets in AWS per resource and per owner type (root, IAM user, role).

Do any service users (identified by membership in a service-user group) have console passwords enabled?

Which users have AWS SSO access but don't have a corresponding employee record in our BambooHR system?

According to BambooHR, do any employees classified as contractors, external, or freelancers have AWS SSO account?

Are there any Google Workspace accounts still active for employees who have been terminated?

Are there any Okta accounts that don't match a current employee or contractor in BambooHR?

List AWS IAM Users who have an active Access Key (Secret) older than 90 days but have never logged into Okta.

Are there any active GitHub accounts for users who have been disabled in Azure AD?

List all users who have an active account in Google Workspace but are synced through Okta.

Which active Okta users who are GitHub organization members have two-factor authentication disabled on GitHub, broken down by their organization role (MEMBER vs ADMIN)?

Which active Okta users that also have an AWS IAM Identity Store identity have no phishing-resistant MFA factor enrolled?

Which active Okta users are provisioned in AWS Identity Store, hold ADMIN permission on at least one GitHub repository, and have a Google Workspace administrator role?

Which active Google Workspace users have role assignments, and do they have a matching Okta identity (including Okta status)?

Who has admin access in Mongo that wasn't provisioned through Okta?

Which AWS SSO users with admin-level access have an inactive or missing Okta account?

Which Google Workspace administrators also hold a primitive Owner or Editor role in GCP?

Who are the Google Workspace admins that aren't listed as admins in Okta?

Who are the Azure AD admins that aren't listed as admins in Okta?

Can anyone without MFA can access our production systems S3 Buckets or AWS Databases?

Are there any AWS IAM credentials whose owning IAM user cannot be traced back to an active BambooHR employee through Okta?

Are there any users that are deactivated in Okta but still active in AWS?

Are there deprovisioned users in Okta with admin access in GitHub?

Are there any disabled Okta users who still have active Google Workspace accounts?

Which former employees still own Google Workspace documents (private or shared drives) after their termination?

Which employees have active admin role assignments in Okta and what is their department in BambooHR?

Which employees marked as terminated in BambooHR have authored commits in GitHub after their recorded termination date?

Which users exist in both EntraID and GWS but don't have 2SV enforced in Google Workspace?

Are there any external email addresses with access to any shared GWS files that are not managed through Okta?

Which GitHub organization members without MFA enabled also have AWS admin-level permissions or MongoDB Atlas admin roles (ORG_OWNER, ORG_BILLING_ADMIN, GROUP_OWNER)?

Which AWS SSO users haven't logged into Okta in 90 days but are still active in Okta?

Which users haven't used GWS for 90 days but still listed as active in Okta?

List high-privilege human identities by type (AWS IAM, Okta).

Show me users who left the company but still have GitHub access.

Are any marketing or finance users granted write access to our code base?

Which Okta users have the most publicly accessible files in Google Workspace?

Do any non-IT or non-R&D employees have super admin access to Google Workspace?

Do any offboarded employees still have active AWS accounts?

Are there any GitHub org members with no matching BambooHR employee record?

Are there any GitHub org members not provisioned through Okta?

Which GitHub organization members have no corresponding identity in Azure AD?

Which GitHub organization members hold GCP primitive roles (Owner or Editor), and what is their GitHub role?

Which GitHub organization members with two-factor authentication disabled also hold direct user-level IAM role bindings in GCP, and what privileged roles do they have?

Which GitHub users are Organization Owners but do not have a corresponding active account in Okta?

Which Google Workspace users with GCP IAM permissions can bypass MFA?

Which Azure AD users registered only with weak MFA methods (SMS or phone call) are also GitHub organization members?

List all Super Admins (for periodic review).

Are there any MongoDB Atlas users who are terminated in BambooHR or deactivated in Okta?

Which terminated employees still have AWS SSO access?

Are there any terminated employees who have both an active Google Workspace account and direct user-level IAM role bindings in our GCP projects?

Which terminated employees have not been fully offboarded from all connected systems (Okta, Google Workspace, Azure AD, or AWS SSO)?

Do any terminated employees own publicly accessible files in their Google Drive personal storage?

Which terminated external workers (non-Osbench Labs employees) in BambooHR still have an active Okta account or GitHub organization membership?

Which terminated users still have read permissions to any shared GWS documents not owned by them?

Which terminated users still have write permissions to any shared GWS documents not owned by them?

Which Google Workspace admin users are missing 2-Step Verification?

Are all domains configured to restrict third-party applications and disallow less-secure apps?

Are Google Workspace domains configured with Single Sign-On ensuring that post-SSO verification is enabled for the primary SSO profile?

Are all users labeled as sensitive enrolled in Google's Advanced Protection Program?

Are there any users whose MFA method is configured as SMS or voice call?

Is the minimum password length configured to 15 characters or more?

Is the minimum password length at least 12 characters?

Is the new user 2-Step Verification enrollment period configured between 1 and 7 days for each organization unit?

Is the number of Google Workspace Super Admin users between 2 and 8 inclusive?

Are password expiration policies disabled for all organizational units?

Is the password policy configured to be enforced at the next sign-in for all organizational units?

Is password reuse disabled for all organizational units?

Do all privileged accounts (Super Admins and other high-privilege roles) authenticate with Google credentials and use phishing-resistant MFA?

Are account recovery options disabled for all users who are not Super Admins?

Are self-service account recovery options disabled for users assigned the Super Admin role?

Which Okta users are active but have not signed in for over 90 days?

Are there any active users who are no longer members of any group assigned through an Application or IdP?

Which active Okta users have not signed in for more than 90 days?

Which applications' default access rules do not require MFA?

Which applications have mfa_required set to FALSE or NULL?

Which Okta connections lack signed and encrypted SAML assertions?

Do any identity providers (IdPs) lack signed or encrypted SAML assertions?

Are any legacy authentication factors (SMS, voice, email, OTP) enabled?

Are MFA policies missing phishing-resistant authenticators?

Does the password policy enforce a minimum length of at least 12 characters and require uppercase letters, lowercase letters, numbers and symbols?

Which sign-on policies exceed a 120-minute session lifetime?

Which sign-on policies have a reauthentication interval greater than 480 minutes (8 hours) or have no reauthentication interval set?

Are there any sign-on policies where the maximum session lifetime (max_session_lifetime_minutes) exceeds 120 minutes (2 hours)?

Are there any sign-on policies where require_mfa_each_signin is FALSE or NULL?