Can I search existing IAM policies for a specific action? - amazon-web-services

Question

In AWS IAM is there a way, either by scripting or in the web console, to find which existing policies contain a given action?
For example, I want to allow role myRole to have access to the DescribeTags action on all of my EC2 instances. I know I can create my own policy with an appropriate rule, but would like to use an existing Amazon policy if such a thing exists.

Answer 1

This is an old post, but it may help someone... Despite what others have said, you can do this. It just requires a bit of scripting.
You can do the following with the AWS CLI.
Get the ARNs of the policies and store in the policies_arn array.
mapfile -t policies_arn < <(aws iam list-policies --query 'Policies[*].[Arn]' --output text)
Get the VersionIds for each policy and store in the policies_ver array.
mapfile -t policies_ver < <(aws iam list-policies --query 'Policies[*].[DefaultVersionId]' --output text)
Use a for loop to loop through each policy and store the policy document in policies.txt
for (( i=0; i<${#policies_arn[#]}; i++ )); do echo ${policies_arn[i]} >> policies.txt && aws iam get-policy-version --policy-arn ${policies_arn[i]} --version-id ${policies_ver[i]} --output json >> policies.txt; done
Open up policies.txt in a text editor and search for your action.
Note: Depending on your CLI configuration, you may or may not need the --output text parameter. However, the output must be text (not JSON) in order for this to work.
From there, you can turn that into a .sh shell script easily enough.
Sample Output:
arn:aws:iam::123456789012:policy/DenyAllAccess
{
"PolicyVersion": {
"CreateDate": "2016-12-06T18:40:51Z",
"VersionId": "v1",
"Document": {
"Statement": [
{
"Action": "*",
"Effect": "Deny",
"Resource": "*"
}
],
"Version": "2012-10-17"
},
"IsDefaultVersion": true
}
}
Cheers!

Answer 2

To elaborate on my understanding of https://stackoverflow.com/a/43128660/447862 the important thing is to get the JSON from the default version of each policy. Since my machine does not have mapfile I opted to use Python.
import boto3, json, sys
iam = boto3.client('iam')
policy_arn = sys.argv[1]
policy_name = policy_arn.split('/')[-1]
version = iam.get_policy(PolicyArn=policy_arn)['Policy']['DefaultVersionId']
policy_version = iam.get_policy_version(PolicyArn=policy_arn, VersionId=version)
policy_document = policy_version['PolicyVersion']['Document']
with open(f"{policy_name}.json", 'w') as outfile:
outfile.write(json.dumps(policy_document, indent=2))
outfile.write('\n')
Saving this as aws-iam-policy-dump.py, now I can write each policy document to its own file and search as much as I want.
aws iam list-policies --query 'Policies[*].Arn' --output text > policy-arns.txt
for arn in $(cat policy-arns.txt); do
python aws-iam-policy-dump.py $arn
done
This could probably go faster by doing everything in Python, but this hybrid approach is good enough for me.

Answer 3

aws iam list-policies --query 'Policies[*].[Arn, DefaultVersionId]' | jq -rc '.[] | join(" ")' | xargs -l bash -c 'aws iam get-policy-version --policy-arn=$0 --version-id=$1 --query="{\"$0\": PolicyVersion.Document.Statement[*].[Action, NotAction][][]}"' | jq -c | grep YOUR_POLICY_ACTION_HERE
This basically captures all the Arns and Versions in the single call
Then joins the output into a single space-separated string
This string is then sent to another bash process via xargs where the ARN and VersionId are passed in as separate parameters to get-policy-version
The result of this is combined with the ARN into a single line
Lines are grepped for your pleasure with the search action you're looking for.
I came across this question looking for a way to find existing policies that may contain specific actions. The command will run in O(n) time based on the number of policies since a separate call is made for every policy you have.
I couldn't figure out how to get .contains() working properly in the last --query to allow aws to filter rather than grep.