A simple script for managing attached policies to AWS IAM entitites, written in Python
- boto3
- python 3.6 or higher
All dependencies can be installed from the requirements.txt by any package manager like pip, anaconda, virtualenv, etc. Enviroment configuration should be made according your package manager or preference.
Before making use of this script, make sure you have your AWS credentials defined on your system, either by IAM console or having the AWS CLI installed and going to aws configure, more info on this can be found here
[default]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEY
From the terminal, do python policy_upgrade.py or python3 policy_upgrade.py
The script will start by asking you to provide a policy arn, not the friendly name of it but the amazon resource name.
Ex: arn:aws:iam::aws:policy/AmazonEC2FullAccess
Enter a number to choose:
1.List entities using a policy
2.Only delete a policy
3.Replace a policy
- Option 1 will only list and display all existing roles, groups and users from the AWS linked account, if the policy has no entities, it will return a message of no resources found .
Resources with "arn:aws:iam::aws:policy/examplePolicy" attached:
- Users:
['user']
- Roles:
['role']
- Groups:
['group']
- Option 2 will only detach the policy defined above from ALL the entities listed right away, this can't be undone once you select option 2.
- Option 3 will remove the policy you defined and will ask you for a new arn to attach to the same entities.
To check all entities listed before have been detached from their policy or attached the new one, run the script again on Option 1 (introducing the attached/detached policy accordingly)