Package: policy-sentry
Policy SentryIAM Least Privilege Policy Generator.TutorialInstallationPackage managersShell completionStep 1: Create the TemplateStep 2: Copy/paste ARNsStep 3: Write-policy commandCheat sheetsPolicy Writing cheat sheetIAM Database Query Cheat SheetLocal Initialization (Optional)Other UsageCommandsPython Library usageDockerTerraformReferencesDocumentationFor walkthroughs and full documentation, please visit theproject on ReadTheDocs.See theSalesforce Engineering Blog poston Policy Sentry.OverviewWriting security-conscious IAM Policies by hand can be very tedious and inefficient. Many Infrastructure as Code developers have experienced something like this:Determined to make your best effort to give users and roles the least amount of privilege you need to perform your duties, you spend way too much time combing through the AWS IAM Documentation onActions, Resources, and Condition Keys for AWS Services.Your team lead encourages you to build security into your IAM Policies for product quality, but eventually you get frustrated due to project deadlines.You don't have an embedded security person on your team who can write those IAM Policies for you, and there's no automated tool that will automagically sense the AWS API calls that you perform and then write them for you with Resource ARN constraints.After fantasizing about that level of automation, you realize that writing least privilege IAM Policies, seemingly out of charity, will jeopardize your ability to finish your code in time to meet project deadlines.You use Managed Policies (because hey, why not) or you eyeball the names of the API calls and use wildcards instead so you can move on with your life.Such a process is not ideal for security or for Infrastructure as Code developers. We need to make it easier to write IAM Policies securely and abstract the complexity of writing least-privilege IAM policies. That's why I made this tool.Policy Sentry allows users to create least-privilege IAM policies in a matter of seconds, rather than tediously writing IAM policies by hand. These policies are scoped down according to access levels and resources. In the case of a breach, this helps to limit the blast radius of compromised credentials by only giving IAM principals access to what they need.Before this tool, it could take hours to craft an IAM Policy with resource ARN constraints — but now it can take a matter of seconds. This way, developers only have to determine the resources that they need to access, andPolicy Sentry abstracts the complexity of IAM policiesaway from their development processes.Writing Secure Policies based on Resource Constraints and Access LevelsPolicy Sentry's flagship feature is that it can create IAM policies based on resource ARNs and access levels. Our CRUD functionality takes the opinionated approach that IAC developers shouldn't have to understand the complexities of AWS IAM - we should abstract the complexity for them. In fact, developers should just be able to say..."I need Read/Write/List access toarn:aws:s3:::example-org-sbx-vmimport""I need Permissions Management access toarn:aws:secretsmanager:us-east-1:123456789012:secret:mysecret""I need Tagging access toarn:aws:ssm:us-east-1:123456789012:parameter/test"...and our automation should create policies that correspond to those access levels.How do we accomplish this? Well, Policy Sentry leverages the AWS documentation onActions, Resources, and Condition Keysdocumentation to look up the actions, access levels, and resource types, and generates policies according to the ARNs and access levels. Consider the table snippet below:ActionsAccess LevelResource Typesssm:GetParameterReadparameterssm:DescribeParametersListparameterssm:PutParameterWriteparametersecretsmanager:PutResourcePolicyPermissions managementsecretsecretsmanager:TagResourceTaggingsecretPolicy Sentry aggregates all of that documentation into a single database and uses that database to generate policies according to actions, resources, and access levels.TutorialInstallationPackage managersHomebrewbrewtapsalesforce/policy_sentryhttps://github.com/salesforce/policy_sentry
brewinstallpolicy_sentryPippip3install--userpolicy_sentryShell completionTo enable Bash completion, put this in your.bashrc:eval"$(_POLICY_SENTRY_COMPLETE=sourcepolicy_sentry)"To enable ZSH completion, put this in your.zshrc:eval "$(_POLICY_SENTRY_COMPLETE=source_zsh policy_sentry)"Step 1: Create the TemplateTo generate a policy according to resources and access levels, start by
creating a template with this command so you can just fill out the ARNs:policy_sentrycreate-template--output-filecrud.yml--template-typecrudIt will generate a file like this:mode:crudname:''# Specify resource ARNsread:-''write:-''list:-''tagging:-''permissions-management:-''# Actions that do not support resource constraintswildcard-only:single-actions:# standalone actions-''# Service-wide - like 's3' or 'ec2'service-read:-''service-write:-''service-list:-''service-tagging:-''service-permissions-management:-''# Skip resource constraint requirements by listing actions here.skip-resource-constraints:-''# Exclude actions from the output by specifying them here. Accepts wildcards, like kms:Delete*exclude-actions:-''# If this policy needs to include an AssumeRole actionsts:assume-role:-''assume-role-with-saml:-''assume-role-with-web-identity:-''Step 2: Copy/paste ARNsCopy/paste the ARNs you want to include in your policy. You can delete lines that you don't use, or just leave them there.mode:crudread:-'arn:aws:ssm:us-east-1:123456789012:parameter/myparameter'write:-'arn:aws:ssm:us-east-1:123456789012:parameter/myparameter'list:-'arn:aws:ssm:us-east-1:123456789012:parameter/myparameter'tagging:-'arn:aws:secretsmanager:us-east-1:123456789012:secret:mysecret'permissions-management:-'arn:aws:secretsmanager:us-east-1:123456789012:secret:mysecret'Step 3: Write-policy commandThen run this command:policy_sentrywrite-policy--input-filecrud.ymlIt will generate these results:{"Version":"2012-10-17","Statement":[{"Sid":"SsmReadParameter","Effect":"Allow","Action":["ssm:GetParameter","ssm:GetParameterHistory","ssm:GetParameters","ssm:GetParametersByPath","ssm:ListTagsForResource"],"Resource":["arn:aws:ssm:us-east-1:123456789012:parameter/myparameter"]},{"Sid":"SsmWriteParameter","Effect":"Allow","Action":["ssm:DeleteParameter","ssm:DeleteParameters","ssm:LabelParameterVersion","ssm:PutParameter"],"Resource":["arn:aws:ssm:us-east-1:123456789012:parameter/myparameter"]},{"Sid":"SecretsmanagerPermissionsmanagementSecret","Effect":"Allow","Action":["secretsmanager:DeleteResourcePolicy","secretsmanager:PutResourcePolicy"],"Resource":["arn:aws:secretsmanager:us-east-1:123456789012:secret:mysecret"]},{"Sid":"SecretsmanagerTaggingSecret","Effect":"Allow","Action":["secretsmanager:TagResource","secretsmanager:UntagResource"],"Resource":["arn:aws:secretsmanager:us-east-1:123456789012:secret:mysecret"]}]}Notice how the policy above recognizes the ARNs that the user supplies, along with the requested access level. For instance, the SIDSecretsmanagerTaggingSecretcontains Tagging actions that are assigned to the secret resource type only.This rapidly speeds up the time to develop IAM policies, and ensures that all policies created limit access to exactly what your role needs access to. This way, developers only have to determine the resources that they need to access, and we abstract the complexity of IAM policies away from their development processes.Cheat sheetsPolicy Writing cheat sheet# Create templates first!!! This way you can just paste the values you need rather than remembering the YAML format# CRUD modepolicy_sentrycreate-template--output-filetmp.yml--template-typecrud# Actions modepolicy_sentrycreate-template--output-filetmp.yml--template-typeactions# Write policy based on resource-specific access levelspolicy_sentrywrite-policy--input-fileexamples/yml/crud.yml# Write policy based on a list of actionspolicy_sentrywrite-policy--input-fileexamples/yml/actions.ymlIAM Database Query Cheat Sheet################ Actions Table################ NOTE: Use --fmt yaml or --fmt json to change the output format. Defaults to json for querying# Get a list of actions that do not support resource constraintspolicy_sentryqueryaction-table--services3--resource-type"*"--fmtyaml# Get a list of actions at the "Write" level in S3 that do not support resource constraintspolicy_sentryqueryaction-table--services3--access-levelwrite--resource-type"*"--fmtyaml# Get a list of all IAM actions across ALL services that have "Permissions management" accesspolicy_sentryqueryaction-table--serviceall--access-levelpermissions-management# Get a list of all IAM Actions available to the RAM servicepolicy_sentryqueryaction-table--serviceram# Get details about the `ram:TagResource` IAM Actionpolicy_sentryqueryaction-table--serviceram--nametagresource# Get a list of all IAM actions under the RAM service that have the Permissions management access level.policy_sentryqueryaction-table--serviceram--access-levelpermissions-management# Get a list of all IAM actions under the SES service that support the `ses:FeedbackAddress` condition key.policy_sentryqueryaction-table--serviceses--conditionses:FeedbackAddress############ ARN Table############ Get a list of all RAW ARN formats available through the SSM service.policy_sentryqueryarn-table--servicessm# Get the raw ARN format for the `cloud9` ARN with the short name `environment`policy_sentryqueryarn-table--servicecloud9--nameenvironment# Get key/value pairs of all RAW ARN formats plus their short namespolicy_sentryqueryarn-table--servicecloud9--list-arn-types####################### Condition Keys Table####################### Get a list of all condition keys available to the Cloud9 servicepolicy_sentryquerycondition-table--servicecloud9# Get details on the condition key titled `cloud9:Permissions`policy_sentryquerycondition-table--servicecloud9--namecloud9:PermissionsLocal Initialization (Optional)# Initialize the policy_sentry config folder and create the IAM database tables.policy_sentryinitialize# Fetch the most recent version of the AWS documentation so you can experiment with new services.policy_sentryinitialize--fetch# Override the Access Levels by specifying your own Access Levels (example:, correcting Permissions management levels)policy_sentryinitialize--access-level-overrides-file~/.policy_sentry/overrides-resource-policies.yml

policy_sentryinitialize--access-level-overrides-file~/.policy_sentry/access-level-overrides.ymlOther UsageCommandscreate-template: Creates the YML file templates for use in thewrite-policycommand types.write-policy: Leverage a YAML file to write policies for youOption 1: Specify CRUD levels (Read, Write, List, Tagging, or Permissions management) and the ARN of the resource. It will write this for you. See thedocumentationOption 2: Specify a list of actions. It will write the IAM Policy for you, but you will have to fill in the ARNs. See thedocumentation.query: Query the IAM database tables. This can help when filling out the Policy Sentry templates, or just querying the database for quick knowledge.Option 1: Query the Actions Table (action-table)Option 2: Query the ARNs Table (arn-table)Option 3: Query the Conditions Table (condition-table)initialize: (Optional). Create a SQLite database that contains all of the services available through theActions, Resources, and Condition Keys documentation. See thedocumentation.Python Library usageIf you are developing your own Python code and you want to import Policy Sentry as a third party package, you can skip the initialization and leverage the local database file that is bundled with the Python package itself.This is especially useful for developers who wish to leverage Policy Sentry’s capabilities that require the use of the IAM database (such as querying the IAM database table). This way, you don’t have to initialize the database and can just query it immediately.The code example is locatedhere. It is also shown below.frompolicy_sentry.querying.actionsimportget_actions_for_servicedefexample():actions=get_actions_for_service('cloud9')# Then you can leverage any method that requires access to the database.foractioninactions:print(action)if__name__=='__main__':example()The results will look like:cloud9:CreateEnvironmentEC2
cloud9:CreateEnvironmentMembership
cloud9:DeleteEnvironment
cloud9:DeleteEnvironmentMembership
cloud9:DescribeEnvironmentMemberships
cloud9:DescribeEnvironmentStatus
cloud9:DescribeEnvironments
cloud9:GetUserSettings
cloud9:ListEnvironments
cloud9:ListTagsForResource
cloud9:TagResource
cloud9:UntagResource
cloud9:UpdateEnvironment
cloud9:UpdateEnvironmentMembership
cloud9:UpdateUserSettingsDockerIf you prefer using Docker instead of installing the script with Python, we support that as well. From the root of the repository, use this to build the docker image:dockerbuild-tkmcquade/policy_sentry.Use this to run some basic commands:# Basic commands with no argumentsdockerrun-i--rmkmcquade/policy_sentry:latest"--help"dockerrun-i--rmkmcquade/policy_sentry:latest"query"# Query the databasedockerrun-i--rmkmcquade/policy_sentry:latest"query action-table --service all --access-level permissions-management"Thewrite-policycommand also supports passing in the YML config via STDIN. If you are using the docker method, try it out here:# Write policies by passing in the config via STDINcatexamples/yml/crud.yml|dockerrun-i--rmkmcquade/policy_sentry:latest"write-policy"catexamples/yml/actions.yml|dockerrun-i--rmkmcquade/policy_sentry:latest"write-policy"TerraformThe Terraform module is published and maintainedhere.ReferencesThe document scraping process was inspired and borrowed from a similaransible hacking script.Identity-Based vs Resource-based policiesActions, Resources, and Condition Keys for AWS Services