Package: iamscan
iamscaniamscan is a command line tool that reads your code and generates an AWS IAM policy with your needed permissions. Keeping track of AWS IAM permissions is annoying and timeconsuming. How often have you seen an update deployed to the cloud followed byThe provided execution role does not have permissions to call CreateSomething on SomeService? This problem is either solved by manually reading through code or worse by blanketly opening up permissions to speed up the process (lambda:*,s3:*, etc.). IAM policies should alwaysgrant least privilegeand iamscan can help you accomplish this.Installationiamscan is easiest install via pip for Python versions 3.8+$pipinstalliamscanSupported File TypesCurrently iamscan can parse JavaScript Files, Python Files and Shell Scripts, thus the filename extension must be one of .js, .py or .shFor JavaScript files iamscan will recongizeAWS SDK for JavaScript v2commands but will not recognizeAWS SDK for JavaScript v3commandsFor Python files iamscan recognizesboto3Low Level Clientcommands but will not recognizeResourcebased commandsFor Shell Scripts allaws-clicommands are recognizedBasic UsageCall iamscan from the command line and pass in your file or a directory containing multiple files using the--pathkeyword$iamscan--pathiamscan-ptests/py/awsec2instances.py{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ec2:DescribeInstances","ec2:RebootInstances","ec2:RunInstances","ec2:StartInstances","ec2:StopInstances","ec2:TerminateInstances"],"Resource":"*"}]}Passing in a directory will parse all files in the directory and add their permissions to the policy$iamscan--pathiamscan-ptests/py/{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ec2:DescribeInstances","ec2:RebootInstances","ec2:RunInstances","ec2:StartInstances","ec2:StopInstances","ec2:TerminateInstances","lambda:CreateFunction","lambda:DeleteFunction","lambda:GetFunctionConfiguration","lambda:UpdateFunctionCode","lambda:UpdateFunctionConfiguration","s3api:CreateBucket","s3api:DeleteBucket","s3api:DeleteObject","s3api:ListBuckets","s3api:ListObjectsV2"],"Resource":"*"}]}Use the--output-formatto change the output to YAML for use with AWS CloudFormation$iamscan--pathiamscan-ptests/py/awsec2instances.py--output-formatyaml
Statement:
-Effect:AllowAction:-ec2:DescribeInstances-ec2:RebootInstances-ec2:RunInstances-ec2:StartInstances-ec2:StopInstances-ec2:TerminateInstancesResource:'*'Command Line ReferenceCommandDescription-p, --pathThe path to a file or directory [REQUIRED]-v, --versionDisplays the current version-h, --helpDisplays the help message-o, --output-formatThe format of the output IAM policy (json | yaml) defaults to json-i, --idAn Id to add to the IAM policy-r, --resourceOne or multiple ARNs to add to the IAM Policy-s, --seperate-statementsUsable when passing a directory as a path, seperates permissions into seperate Statements based on fileContributingThe iamscan repo makes use of aMakefilewithpytestfor local development. First create a virtual environment using therequirements.txtfile then after any changes are made runmake testto ensure all the tests pass. If you're change warrants tests add them to thetest_code.pyfile. After all tests pass please make a Pull Request into themainbranchLicenseiamscan is released under the MIT License. See the bundledLICENSEfile for details.Creditsalfonsof/aws-python-examplesswoodford/awsawsdocs/aws-doc-sdk-examples