Extract AWS IAM action list tables to JSON.

README.md

Extract AWS IAM action list tables to JSON

A quick-and-dirty browser script for extracting action list tables from AWS Identity and Access Management pages to JSON documents.

Once in JSON, these IAM action lists can be easily queried using tools such as jq to answer questions such as:

• List all Write IAM actions for service X.
• List all Read IAM actions for service X resource type Y.

Usage example

Open an Identity and Access Management page for a service via a browser, say AWS Backup.

With the page loaded, open the web developer tools console (e.g. macOS ⌥ ⌘ I) and execute JavaScript extract.js:

Copy resulting JSON, and save to file:

JSON shape will be the following format:

$ cat backup-actions.json | jq
[
  {
    "action": "AssociateBackupVaultMpaApprovalTeam",
    "description": "Grants permission to associate an MPA approval team with a backup vault",
    "accessLevel": "Write",
    "resourceType": "backupVault"
  },
  {
    "action": "CancelLegalHold",
    "description": "Grants permission to cancel a legal hold",
    "accessLevel": "Write",
    "resourceType": "legalHold"
  },
  {
    "action": "CopyFromBackupVault [permission only]",
    "description": "Grants permission to copy from a backup vault",
    "accessLevel": "Write",
    "resourceType": "recoveryPoint"
  },
  {
    "action": "CopyIntoBackupVault [permission only]",
    "description": "Grants permission to copy into a backup vault",
    "accessLevel": "Write",
    "resourceType": "backupVault"
  },
  {
    "action": "CreateBackupPlan",
    "description": "Grants permission to create a new backup plan",
    "accessLevel": "Write",
    "resourceType": "backupPlan"
  },
	...
]

Answering questions

List all access levels:

$ cat backup-actions.json | jq --raw-output 'map(.accessLevel) | unique[]'

List
Permissions management
Read
Tagging
Write

List all resource types:

$ cat backup-actions.json | jq --raw-output 'map(select(.resourceType != "") | .resourceType) | unique[]'

backupPlan
backupVault
framework
legalHold
recoveryPoint
reportPlan
restoreTestingPlan

Generate IAM action strings for given access levels and resource types:

$ cat backup-actions.json |
  jq --raw-output '.[] | select(.accessLevel | IN("Permissions management","Write")) | select(.resourceType | IN("","backupPlan","backupVault")) | "backup:\(.action)"'

backup:AssociateBackupVaultMpaApprovalTeam
backup:CopyIntoBackupVault [permission only]
backup:CreateBackupPlan
backup:CreateBackupSelection
backup:CreateBackupVault
backup:CreateLogicallyAirGappedBackupVault
backup:CreateRestoreAccessBackupVault
backup:DeleteBackupPlan
backup:DeleteBackupSelection
backup:DeleteBackupVault
backup:DeleteBackupVaultAccessPolicy
backup:DeleteBackupVaultLockConfiguration
backup:DeleteBackupVaultNotifications
backup:DeleteBackupVaultSharingPolicy [permission only]
backup:DisassociateBackupVaultMpaApprovalTeam
backup:ListIndexedRecoveryPointsForSearch [permission only]
backup:PutBackupVaultAccessPolicy
backup:PutBackupVaultLockConfiguration
backup:PutBackupVaultNotifications
backup:PutBackupVaultSharingPolicy [permission only]
backup:PutRestoreValidationResult
backup:RevokeRestoreAccessBackupVault
backup:StartBackupJob
backup:StopBackupJob
backup:UpdateBackupPlan
backup:UpdateGlobalSettings
backup:UpdateRegionSettings

Related

• https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html
• https://docs.aws.amazon.com/service-authorization/latest/reference/service-reference.html

extract.js

// note: to be executed from browser Web developer tools
'use strict';

(() => {
	function getRowCellText(itemRow,cellNum) {
		return itemRow.cells[cellNum].innerText.trim();
	}

	const exportData = [];
	let lastActionRow;
	let firstRow = true;
	for (const itemRow of $$('table')[0].rows) {
		if (firstRow) {
			// skip header
			firstRow = false;
			continue;
		}

		if (itemRow.cells.length == 3) {
			const cell = getRowCellText(itemRow,0);
			if (cell == '') {
				// skip condition key row
				continue;
			}

			// resource type row, associated to previous action row
			lastActionRow.resourceType = cell.replace(/\*+$/,'');
		} else {
			// action row
			lastActionRow = {
				action: getRowCellText(itemRow,0),
				description: getRowCellText(itemRow,1),
				accessLevel: getRowCellText(itemRow,2),
				resourceType: getRowCellText(itemRow,3).replace(/\*+$/,''),
			};
		}

		exportData.push({ ...lastActionRow });
	}

	console.log(JSON.stringify(exportData));
})();

Alternatively.

https://docs.aws.amazon.com/service-authorization/latest/reference/service-reference.html
https://servicereference.us-east-1.amazonaws.com/
https://servicereference.us-east-1.amazonaws.com/v1/backup/backup.json

$ cat backup.json | jq --raw-output '.Actions | map(.Resources[]?.Name) | unique[]'

backupPlan
backupVault
framework
legalHold
recoveryPoint
reportPlan
restoreTestingPlan

$ cat backup.json |
  jq --raw-output '.Actions[] | select(.Annotations.Properties.IsWrite == true) | select((.Resources == null) or (.Resources[]?.Name | IN("backupPlan","backupVault"))) | "backup:\(.Name)"'

backup:AssociateBackupVaultMpaApprovalTeam
backup:CopyIntoBackupVault
backup:CreateBackupPlan
backup:CreateBackupSelection
backup:CreateBackupVault
backup:CreateLogicallyAirGappedBackupVault
backup:CreateRestoreAccessBackupVault
backup:DeleteBackupPlan
backup:DeleteBackupSelection
backup:DeleteBackupVault
backup:DeleteBackupVaultAccessPolicy
backup:DeleteBackupVaultLockConfiguration
backup:DeleteBackupVaultNotifications
backup:DeleteBackupVaultSharingPolicy
backup:DisassociateBackupVaultMpaApprovalTeam
backup:ListIndexedRecoveryPointsForSearch
backup:PutBackupVaultAccessPolicy
backup:PutBackupVaultLockConfiguration
backup:PutBackupVaultNotifications
backup:PutBackupVaultSharingPolicy
backup:PutRestoreValidationResult
backup:RevokeRestoreAccessBackupVault
backup:StartBackupJob
backup:StopBackupJob
backup:TagResource
backup:TagResource
backup:UntagResource
backup:UntagResource
backup:UpdateBackupPlan
backup:UpdateGlobalSettings
backup:UpdateRegionSettings