vault-token-inventory.sh -> vault-token-audit.sh

export VAULT_USER=${LOGNAME:-$USER}

set -u

echo "VAULT ADDR: $VAULT_ADDR"

echo "VAULT_ADDR: $VAULT_ADDR"

if ! vault token lookup > /dev/null 2>&1; then

    echo "Hey $VAULT_USER: Please login VAULT with DUO device ready. Waiting...:"

if vault token capabilities auth/tokens/accessors | grep -q deny; then

     >&2 "ERROR: no permission to list auth/tokens/accessors" && false

else

    vault list -format=json auth/token/accessors | jq -r '.[]' | tee /tmp/token-accessors.$$

    vault list -format=json auth/token/accessors | jq -r '.[]' > /tmp/token-accessors.$$

    for i in `cat /tmp/token-accessors.$$`

    do

      echo

      echo Look up with token accessor $i

      vault token lookup --accessor $i

      vault token lookup --format=json --accessor $i | tee -a /tmp/tokens-$$.json

    done

fi

rm -rf /tmp/token-accessors.$$

echo Token data is saved in /tmp/tokens.$$.json

echo Usefull jq filter

echo "cat /tmp/tokens-$$.json | jq [.data] | jq '.[] | select(.meta.username==\"sfeng\")'"

echo "cat /tmp/tokens-$$.json | jq [.data] | jq '.[] | select(.meta.username==\"sfeng\").policies'"