IAM boto example showing read-only access to SimpleDB domain

iam_sdb_example.py

"""
IAM boto examples:
In this example, we create a group that allows read-only access
to a single SimpleDB domain.
"""
import boto

#
# First create a connection to the IAM service
#
iam = boto.connect_iam()

#
# Now create a group for EC2/S3 users.
# This group will allow members to use all EC2 and S3 functionality
#
sdb_ro_policy = """
{
   "Statement":[{
         "Effect":"Allow",
         "Action":["sdb:GetAttributes","sdb:Select"],
         "Resource":"arn:aws:sdb:*:963068290131:domain\\/test_iam"
      }
   ]
}"""
response = iam.create_group('SDB-ReadOnly')
response = iam.put_group_policy('SDB-ReadOnly', 'sdb_readonly', sdb_ro_policy)

#
# Now create a user and place him in the EC2 group.
#
response = iam.create_user('Mary')
user = response.user
response = iam.add_user_to_group('SDB-ReadOnly', 'Mary')

#
# Create AccessKey/SecretKey pair for Mary
#
response = iam.create_access_key('Mary')
access_key = response.access_key_id
secret_key = response.secret_access_key

#
# create connection to SimpleDB as Mary
#
sdb = boto.connect_sdb(access_key, secret_key)

#
# Now try to access the domain as the new user
#
domain = sdb.lookup('test_iam')