Package: iam-builder
IAM BuilderA python script to generate an IAM policy based on a yaml or json configuration.To install:# Most stable
pip install iam-builder

# OR directly from github
pip install git+git://github.com/moj-analytical-services/iam_builder.git#egg=iam_builderTo use the command line interface:iam_builder -c examples/iam_config.yaml -o examples/iam_policy.json-cis the path to your iam configuration (either a yaml or json file).-ois the path to your output iam policy (needs to be a json file).Or to do the same thing in python:importyamlimportjsonfromiam_builder.iam_builderimportbuild_iam_policywithopen('examples/iam_config.yaml')asf:config=yaml.load(f,Loader=yaml.FullLoader)iam_policy=build_iam_policy(config)withopen('examples/iam_policy.json',"w+")asf:json.dump(iam_policy,f,indent=4,separators=(',',': '))Both scripts will create the output iam_policy seen in theexamplesfolder. You can also seemore example configsby looking in the unit tests.Your config file can be either a yaml or json file.The example yaml (iam_config.yaml) looks this:iam_role_name:iam_role_nameathena:write:falseglue_job:truesecrets:trues3:read_only:-test_bucket_read_only/*write_only:-test_bucket_write_only/*-test_bucket_read_only/write_only_folder/*read_write:-test_bucket_read_write/*-test_bucket_read_only/write_folder/*deny:-test_bucket_read_write/sensitive_table/*Whilst the example json (iam_config.json) looks like this:{"iam_role_name":"iam_role_name","athena":{"write":false},"glue_job":true,"secrets":true,"s3":{"read_only":["test_bucket_read_only/*"],"write_only":["test_bucket_write_only/*","test_bucket_read_only/write_only_folder/*"],"read_write":["test_bucket_read_write/*","test_bucket_read_only/write_folder/*"]}}iam_role_name:The role name of your airflow job; required if you want to run glue jobs or access secrets.athena:Can have two keys.write: Eithertrueorfalse. Iffalsethen only read access to Athena (cannot create, delete or alter tables, databases and partitions). Iftruethen the role will also have the ability to do stuff like CTAS queries,DROP TABLE,CREATE DATABASE, etc.dump_bucket: The location in S3 (either an S3 path or a list of S3 paths) for temporarily storing the results of queries. This defaults tomojap-athena-query-dumpand should not normally need changing.glue_job:Boolean; must be set totrueto allow role to run glue jobs. Iffalseor absent role will not be able to run glue jobs.secrets:Boolean or string; must be set totrueor"read"to allow role to access secrets from AWS Parameter Store, andreadwriteto provide read/write access. Iffalseor absent role will not be able to access secrets.s3:Can have up to 4 keys:read_only,write_only,read_write, anddeny. Each key describes the level of access you want your iam policy to have with each s3 path. More details below:read_only:A list of s3 paths that the iam_role should be able to access (read only). Each item in the list should either be a path to a object or finish with/*to denote that it can access everything within that directory.Note the S3 paths don't start withs3://in the config.write_only:A list of s3 paths that the iam_role should be able to access (write only). Each item in the list should either be a path to a object or finish with/*to denote that it can access everything within that directory.Note the S3 paths don't start withs3://in the config.read_write:A list of s3 paths that the iam_role should be able to access (read and write). Each item in the list should either be a path to a object or finish with/*to denote that it can access everything within that directory.Note the S3 paths don't start withs3://in the config.deny:A list of s3 paths that the iam_role shouldnotbe able to access. This should be used to add exceptions to wildcarded access to folders, for example excluding sensitive tables in order to provide basic access to a database. Each item in the list should either be a path to a object or finish with/*to denote that it can access everything within that directory.Note the S3 paths don't start withs3://in the config.How to updateWhen updating IAM builder, make sure to change the version number inpyproject.tomland describe the change inCHANGELOG.md.If you have changed any dependencies inpyproject.yaml, runpoetry updateto updatepoetry.lock.Once you have created a release in GitHub, a Github Action will run to publish the release on PyPI automatically.