aws_iam_helpers.py

import json

import boto3


def clone_iam_role(original_role_name,
                   new_role_name):
    iam = boto3.client("iam")

    original_role = iam.get_role(RoleName=original_role_name)

    assume_role_policy_document = original_role["Role"]["AssumeRolePolicyDocument"]
    iam.create_role(
        RoleName=new_role_name,
        AssumeRolePolicyDocument=json.dumps(assume_role_policy_document)
    )

    inline_policies = iam.list_role_policies(RoleName=original_role_name)
    for policy_name in inline_policies["PolicyNames"]:
        role_policy = iam.get_role_policy(
            RoleName=original_role_name,
            PolicyName=policy_name
        )
        policy_document = role_policy["PolicyDocument"]
        iam.put_role_policy(
            RoleName=new_role_name,
            PolicyName=policy_name,
            PolicyDocument=json.dumps(policy_document)
        )

    attached_policies = iam.list_attached_role_policies(RoleName=original_role_name)
    for policy in attached_policies["AttachedPolicies"]:
        policy_arn = policy["PolicyArn"]
        iam.attach_role_policy(
            RoleName=new_role_name,
            PolicyArn=policy_arn
        )


def clone_instance_profile(original_instance_profile_name,
                           new_instance_profile_name):
    iam = boto3.client("iam")

    original_role_name = original_instance_profile_name
    new_role_name = new_instance_profile_name

    clone_iam_role(
        original_role_name=original_role_name,
        new_role_name=new_role_name
    )

    iam.create_instance_profile(InstanceProfileName=new_instance_profile_name)

    iam.add_role_to_instance_profile(
        InstanceProfileName=new_instance_profile_name,
        RoleName=new_role_name
    )


def clone_iam_user(original_user_name,
                   new_user_name):
    iam = boto3.client("iam")

    iam.create_user(UserName=new_user_name)

    groups = iam.list_groups_for_user(UserName=original_user_name)
    for group in groups["Groups"]:
        iam.add_user_to_group(
            GroupName=group["GroupName"],
            UserName=new_user_name
        )

    attached_policies = iam.list_attached_user_policies(UserName=original_user_name)
    for policy in attached_policies["AttachedPolicies"]:
        iam.attach_user_policy(
            PolicyArn=policy["PolicyArn"],
            UserName=new_user_name
        )

    inline_policies = iam.list_user_policies(UserName=original_user_name)
    for policy_name in inline_policies["PolicyNames"]:
        policy_document = iam.get_user_policy(
            UserName=original_user_name,
            PolicyName=policy_name
        )
        iam.put_user_policy(
            UserName=new_user_name,
            PolicyName=policy_name,
            PolicyDocument=policy_document["PolicyDocument"]
        )


def convert_managed_policies_to_inline_for_role(role_name):
    iam = boto3.client("iam")

    attached_policies = iam.list_attached_role_policies(RoleName=role_name)

    for policy in attached_policies["AttachedPolicies"]:
        policy_version = iam.get_policy(PolicyArn=policy["PolicyArn"])
        policy_document = iam.get_policy_version(
            PolicyArn=policy["PolicyArn"],
            VersionId=policy_version["Policy"]["DefaultVersionId"]
        )

        policy_name = policy["PolicyName"]
        policy_document = policy_document["PolicyVersion"]["Document"]
        policy_document_str = json.dumps(policy_document)

        iam.put_role_policy(
            RoleName=role_name,
            PolicyName=policy_name,
            PolicyDocument=policy_document_str
        )

        iam.detach_role_policy(RoleName=role_name, PolicyArn=policy["PolicyArn"])


def convert_managed_policies_to_inline_for_user(user_name):
    iam = boto3.client("iam")

    attached_policies = iam.list_attached_user_policies(UserName=user_name)

    for policy in attached_policies["AttachedPolicies"]:
        policy_version = iam.get_policy(PolicyArn=policy["PolicyArn"])
        policy_document = iam.get_policy_version(
            PolicyArn=policy["PolicyArn"],
            VersionId=policy_version["Policy"]["DefaultVersionId"]
        )

        policy_name = policy["PolicyName"]
        policy_document = policy_document["PolicyVersion"]["Document"]
        policy_document_str = json.dumps(policy_document)

        iam.put_user_policy(
            UserName=user_name,
            PolicyName=policy_name,
            PolicyDocument=policy_document_str
        )

        iam.detach_user_policy(UserName=user_name, PolicyArn=policy["PolicyArn"])


def list_user_policies(user_name):
    iam = boto3.client("iam")
    user_policies = []

    attached_policies = iam.list_attached_user_policies(UserName=user_name)
    for attached_policy in attached_policies["AttachedPolicies"]:
        policy_name = attached_policy["PolicyName"]
        policy_arn = attached_policy["PolicyArn"]
        policy_response = iam.get_policy(PolicyArn=policy_arn)
        policy_details = policy_response["Policy"]
        policy_version_id = policy_details["DefaultVersionId"]
        policy_version_response = iam.get_policy_version(
            PolicyArn=policy_arn,
            VersionId=policy_version_id
        )
        policy_version = policy_version_response["PolicyVersion"]
        policy_document = policy_version["Document"]

        user_policies.append({
            "policy_type": "managed",
            "policy_name": policy_name,
            "policy_arn": policy_arn,
            "policy_document": policy_document
        })

    inline_policies = iam.list_user_policies(UserName=user_name)
    for policy_name in inline_policies["PolicyNames"]:
        policy_response = iam.get_user_policy(
            UserName=user_name,
            PolicyName=policy_name
        )
        policy_document = policy_response["PolicyDocument"]
        user_policies.append({
            "policy_type": "inline",
            "policy_name": policy_name,
            "policy_arn": None,
            "policy_document": policy_document
        })

    return user_policies


def list_role_policies(role_name):
    iam = boto3.client("iam")

    role_policies = []

    attached_policies = iam.list_attached_role_policies(RoleName=role_name)
    for attached_policy in attached_policies["AttachedPolicies"]:
        policy_name = attached_policy["PolicyName"]
        policy_arn = attached_policy["PolicyArn"]
        policy_response = iam.get_policy(PolicyArn=policy_arn)
        policy_details = policy_response["Policy"]
        policy_version_id = policy_details["DefaultVersionId"]
        policy_version_response = iam.get_policy_version(
            PolicyArn=policy_arn,
            VersionId=policy_version_id
        )
        policy_version = policy_version_response["PolicyVersion"]
        policy_document = policy_version["Document"]

        role_policies.append({
            "policy_type": "managed",
            "policy_name": policy_name,
            "policy_arn": policy_arn,
            "policy_document": policy_document
        })

    inline_policies = iam.list_role_policies(RoleName=role_name)
    for policy_name in inline_policies["PolicyNames"]:
        policy_response = iam.get_role_policy(
            RoleName=role_name,
            PolicyName=policy_name
        )
        policy_document = policy_response["PolicyDocument"]
        role_policies.append({
            "policy_type": "inline",
            "policy_name": policy_name,
            "policy_arn": None,
            "policy_document": policy_document
        })

    return role_policies