Package: policyuniverse
PolicyUniverseThis package provides classes to parse AWS IAM and Resource Policies.Additionally, this package can expand wildcards in AWS Policies using permissions obtained from the AWS Policy Generator.See theService and Permissions data.This package can also minify an AWS policy to help you stay under policy size limits. Avoid doing this if possible, as it creates ugly policies.💩Install:pip install policyuniverseUsage:ARN classPolicy classStatement classAction CategoriesExpanding and MinificationReading ARNsfrompolicyuniverse.arnimportARNarn=ARN('arn:aws:iam::012345678910:role/SomeTestRoleForTesting')assertarn.error==Falseassertarn.tech=='iam'assertarn.region==''# IAM is universal/globalassertarn.account_number=='012345678910'assertarn.name=='role/SomeTestRoleForTesting'assertarn.partition=='aws'assertarn.root==False# Not the root ARNassertarn.service==False# Not an AWS service like lambda.amazonaws.comarn=ARN('012345678910')assertarn.account_number=='012345678910'arn=ARN('lambda.amazonaws.com')assertarn.service==Trueassertarn.tech=='lambda'IAM and Resource PoliciesPolicy with multiple statements# Two statements, both with conditionspolicy05=dict(Version='2010-08-14',Statement=[dict(Effect='Allow',Principal='arn:aws:iam::012345678910:root',Action=['s3:*'],Resource='*',Condition={'IpAddress':{'AWS:SourceIP':['0.0.0.0/0']}}),dict(Effect='Allow',Principal='arn:aws:iam::*:role/Hello',Action=['ec2:*'],Resource='*',Condition={'StringLike':{'AWS:SourceOwner':'012345678910'}})])frompolicyuniverse.policyimportPolicyfrompolicyuniverse.statementimportConditionTuple,PrincipalTuplepolicy=Policy(policy05)assertpolicy.whos_allowed()==set([PrincipalTuple(category='principal',value='arn:aws:iam::*:role/Hello'),PrincipalTuple(category='principal',value='arn:aws:iam::012345678910:root'),ConditionTuple(category='cidr',value='0.0.0.0/0'),ConditionTuple(category='account',value='012345678910')])# The given policy is not internet accessible.# The first statement is limited by the principal, and the condition is basically a no-op.# The second statement has a wildcard principal, but uses the condition to lock it down.assertpolicy.is_internet_accessible()==FalseInternet Accessible Policy:# An internet accessible policy:policy01=dict(Version='2012-10-08',Statement=dict(Effect='Allow',Principal='*',Action=['rds:*'],Resource='*',Condition={'IpAddress':{'AWS:SourceIP':['0.0.0.0/0']}}))policy=Policy(policy01)assertpolicy.is_internet_accessible()==Trueassertpolicy.internet_accessible_actions()==set(['rds:*'])StatementsA policy is simply a collection of statements.statement12=dict(Effect='Allow',Principal='*',Action=['rds:*'],Resource='*',Condition={'StringEquals':{'AWS:SourceVPC':'vpc-111111','AWS:Sourcevpce':'vpce-111111','AWS:SourceOwner':'012345678910','AWS:SourceAccount':'012345678910'},'StringLike':{'AWS:userid':'AROAI1111111111111111:*'},'ARNLike':{'AWS:SourceArn':'arn:aws:iam::012345678910:role/Admin'},'IpAddressIfExists':{'AWS:SourceIP':['123.45.67.89','10.0.7.0/24','172.16.0.0/16']}})frompolicyuniverse.statementimportStatementfrompolicyuniverse.statementimportConditionTuple,PrincipalTuplestatement=Statement(statement12)assertstatement.effect=='Allow'assertstatement.actions==set(['rds:*'])# rds:* expands out to ~88 individual permissionsassertlen(statement.actions_expanded)==88assertstatement.uses_not_principal()==Falseassertstatement.principals==set(['*'])assertstatement.condition_arns==set(['arn:aws:iam::012345678910:role/Admin'])assertstatement.condition_accounts==set(['012345678910'])assertstatement.condition_userids==set(['AROAI1111111111111111:*'])assertstatement.condition_cidrs==set(['10.0.7.0/24','172.16.0.0/16','123.45.67.89'])assertstatement.condition_vpcs==set(['vpc-111111'])assertstatement.condition_vpces==set(['vpce-111111'])assertstatement.is_internet_accessible()==Falseassertstatement.whos_allowed()==set([PrincipalTuple(category='principal',value='*'),ConditionTuple(category='cidr',value='123.45.67.89'),ConditionTuple(category='account',value='012345678910'),ConditionTuple(category='userid',value='AROAI1111111111111111:*'),ConditionTuple(category='vpc',value='vpc-111111'),ConditionTuple(category='arn',value='arn:aws:iam::012345678910:role/Admin'),ConditionTuple(category='cidr',value='172.16.0.0/16'),ConditionTuple(category='vpce',value='vpce-111111'),ConditionTuple(category='cidr',value='10.0.7.0/24')])Action Categoriespolicy={"Statement":[{"Action":["s3:put*","sqs:get*","sns:*"],"Resource":"*","Effect":"Allow"}]}frompolicyuniverse.policyimportPolicyp=Policy(policy)fork,vinp.action_summary().items():print(k,v)>>>('s3',set([u'Write',u'Permissions',u'Tagging']))>>>('sqs',set([u'List']))>>>('sns',set([u'List',u'Read',u'Write',u'Permissions']))Possible categories arePermissions,Write,Read,Tagging, andList.  This data can be used to summarize statements and policies and to look for sensitive permissions.Expanding and Minificationfrompolicyuniverse.expander_minimizerimportexpand_policyfrompolicyuniverse.expander_minimizerimportminimize_policypolicy={"Statement":[{"Action":["swf:res*"],"Resource":"*","Effect":"Allow"}]}expanded_policy=expand_policy(policy=policy)>>>Startsize:131.Endsize:286print(expanded_policy=={"Statement":[{"Action":["swf:respondactivitytaskcanceled","swf:respondactivitytaskcompleted","swf:respondactivitytaskfailed","swf:responddecisiontaskcompleted"],"Resource":"*","Effect":"Allow"}]})>>>Trueminimized_policy=minimize_policy(policy=expanded_policy,minchars=3)>>>Skippingprefixrbecauselengthof1>>>Skippingprefixrebecauselengthof2>>>Skippingprefixrbecauselengthof1>>>Skippingprefixrebecauselengthof2>>>Skippingprefixrbecauselengthof1>>>Skippingprefixrebecauselengthof2>>>Skippingprefixrbecauselengthof1>>>Skippingprefixrebecauselengthof2>>>Startsize:286.Endsize:131print(minimized_policy==policy)>>>True