Vault EGP Sentinel for no wildcard AWS IAM permissions

shell.sh

# Setup AWS secrets
vault secrets enable aws
vault write aws/config/root \
    access_key=$AWS_ACCESS_KEY_ID \
    secret_key=$AWS_SECRET_ACCESS_KEY \
    region=us-east-1

# Write the Actions policy
# https://github.com/hashicorp/vault-guides/blob/master/governance/sentinel/inline-iam-actions.sentinel
POLICY=$(base64 inline_iam_actions.sentinel)
vault write sys/policies/egp/inline_iam_actions \
  policy="${POLICY}" \
  paths="aws/roles/*" \
  enforcement_level="hard-mandatory"

# Bad test
# https://github.com/hashicorp/vault-guides/tree/master/governance/sentinel/test/inline-iam-actions
vault write aws/roles/all_iam \
  credential_type=iam_user \
  policy_document=@test/inline_iam_actions/fail.json

# Good test
# https://github.com/hashicorp/vault-guides/tree/master/governance/sentinel/test/inline-iam-actions
vault write aws/roles/all_iam \
  credential_type=iam_user \
  policy_document=@test/inline_iam_actions/success.json