Last active
August 29, 2015 14:17
-
-
Save maimai-swap/571428ea92bb1d87ae69 to your computer and use it in GitHub Desktop.
AWS cli をつかってよくありそうなiamのgroupつくる
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/sh | |
| # オリジナルのポリシー名 | |
| POLICY_NAME=$1 | |
| # オリジナルのポリシーのjsonの場所 file:// とか http://とか | |
| POLICY_DOCUMENT=$2 | |
| # cli の configure 済の profile名いれる | |
| AWS_PROFILE_NAME=$3 | |
| # オリジナルのポリシーつくる | |
| aws iam create-policy \ | |
| --policy-name $POLICY_NAME \ | |
| --policy-document $POLICY_DOCUMENT \ | |
| --description "EC2 Resource Stop Start and more like RDS stop start..." \ | |
| --profile $AWS_PROFILE_NAME | |
| # ポリシーのARNゲット | |
| POLICY_ARN=$(aws iam list-policies --query Policies[][] --profile $AWS_PROFILE_NAME --scope Local --output text | grep $POLICY_NAME | awk '{print $1}') | |
| # adminグループ作る | |
| GROUP_NAME=admin | |
| aws iam create-group --group-name $GROUP_NAME --profile $AWS_PROFILE_NAME | |
| aws iam attach-group-policy --group-name $GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --profile $AWS_PROFILE_NAME | |
| # developerグループ作る ポリシーはReadOnlyとオリジナルのやつだけ | |
| GROUP_NAME=developer | |
| aws iam create-group --group-name $GROUP_NAME --profile $AWS_PROFILE_NAME | |
| aws iam attach-group-policy --group-name $GROUP_NAME --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess --profile $AWS_PROFILE_NAME | |
| aws iam attach-group-policy --group-name $GROUP_NAME --policy-arn $POLICY_ARN --profile $AWS_PROFILE_NAME | |
| # deployerグループ作る ポリシーはPowerUserAccessとIAMReadOnlyAccessだけ | |
| GROUP_NAME=deployer | |
| aws iam create-group --group-name $GROUP_NAME --profile $AWS_PROFILE_NAME | |
| aws iam attach-group-policy --group-name $GROUP_NAME --policy-arn arn:aws:iam::aws:policy/PowerUserAccess --profile $AWS_PROFILE_NAME | |
| aws iam attach-group-policy --group-name $GROUP_NAME --policy-arn arn:aws:iam::aws:policy/IAMReadOnlyAccess --profile $AWS_PROFILE_NAME | |
| # operatorグループ作る ポリシーはReadOnlyAccessだけ | |
| GROUP_NAME=operator | |
| aws iam create-group --group-name $GROUP_NAME --profile $AWS_PROFILE_NAME | |
| aws iam attach-group-policy --group-name $GROUP_NAME --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess --profile $AWS_PROFILE_NAME | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment