Download all IAM user policies

iam-user-policies.sh

#!/usr/bin/env bash
#
# Usage: iam-user-policies.sh USERNAME PROFILE_NAME
#
# Requirements:
# - jq
# - Able to use the profile passes as the 2nd parameter

set -euo pipefail

username="$1"
profile="$2"

workdir="iam-user_${username}_$(date -u +%Y-%m-%d_%H%M%S)"
mkdir "${workdir}"

# user
aws --profile "$profile" \
  iam get-user \
  --user-name "$username" \
  --output json \
  > "$workdir/get-user.json"

# inline policy
aws --profile "$profile" \
  iam list-user-policies \
  --user-name "$username" \
  --output json \
  > "$workdir/list-user-policies.json"
num_policies=$(jq '.PolicyNames|length' < $workdir/list-user-policies.json)
echo "Inline policy: ${num_policies}"
if [ "$num_policies" == "0" ]; then
  echo "# No Inline Policies"
else
  echo "# $num_policies Inline Policies"
  for inline_policy in $(jq -r '.PolicyNames[]' < $workdir/list-user-policies.json)
  do
	echo "# policy_name=${inline_policy}"
    aws --profile "$profile" \
      iam get-user-policy \
      --user-name "$username" \
      --policy-name "$inline_policy" \
      --output json \
      > "${workdir}/get-user-policy_${inline_policy}.json"
  done
fi
# attached/managed policy
aws --profile "$profile" \
  iam list-attached-user-policies \
  --user-name "$username" \
  --output json \
  > "$workdir/list-attached-user-policies.json"
num_attached_policies=$(jq '.AttachedPolicies|length' < "$workdir/list-attached-user-policies.json")
if [ "$num_attached_policies" == "0" ]; then
  echo "# No Attached Policies"
else
  echo "# $num_attached_policies Attached Policies"
  for i in $(jq -r '.AttachedPolicies[]|"\(.PolicyName),\(.PolicyArn)"' < ${workdir}/list-attached-user-policies.json)
  do
    name=$(echo "$i" | cut -d',' -f1)
    arn=$(echo "$i" | cut -d',' -f2)
    echo "# policy_name=$name, arn=$arn"
    aws --profile "$profile" \
      iam get-policy \
      --policy-arn "$arn" \
      --output json \
      > "$workdir/get-policy_attached-user-policy_${name}.json"
  done
fi

# groups
aws --profile "$profile" \
  iam list-groups-for-user \
  --user-name "$username" \
  --output json \
  > "$workdir/list-groups-for-user.json"

# group inline policy
num_groups=$(jq '.Groups|length' <  "$workdir/list-groups-for-user.json")
if [ "$num_groups" == "0" ]; then
  echo "# No Group"
else
  echo "# $num_groups Groups"
  for group_name_arn in $(jq -r '.Groups[]|"\(.GroupName),\(.Arn)"' <  "${workdir}/list-groups-for-user.json")
  do
    groupname=$(echo "$group_name_arn"|cut -d',' -f1)
    group_arn=$(echo "$group_name_arn"|cut -d',' -f2)
	echo "## group_name=${groupname}, arn=${group_arn}"
    # inline policies
    aws --profile "$profile" \
      iam list-group-policies \
      --group-name "$groupname" \
      --output json \
      > "${workdir}/list-groups-policies_${groupname}.json"
    num_group_policies=$(jq -r '.PolicyNames|length' < "${workdir}/list-groups-policies_${groupname}.json")
    if [ "$num_group_policies" == "0" ]; then
      echo "## No inline policy for the group ${groupname}"
    else
      echo "## $num_group_policies inline policies for the group ${groupname}"
      for g_policy in $(jq -r '.PolicyNames[]' < "${workdir}/list-groups-policies_${groupname}.json")
      do
		echo "## ${groupname} - policy_name=${g_policy}"
        aws --profile "${profile}" \
          iam get-group-policy \
          --group-name "${groupname}" \
          --policy-name "${g_policy}" \
          --output json \
          > "${workdir}/get-group-policy_${groupname}_${g_policy}.json"
      done
    fi
    
    # attached/managed policies
    aws --profile "$profile" \
      iam list-attached-group-policies \
      --group-name "$groupname" \
      --output json \
      > "$workdir/list-attached-group-policies_${groupname}.json"
    num_attached_group_policies=$(jq '.AttachedPolicies|length' < "$workdir/list-attached-group-policies_${groupname}.json")
    if [ "$num_attached_group_policies" == "0" ]; then
      echo "## No atached policy for the group ${groupname}"
    else
      echo "## ${num_attached_group_policies} atached policies for the group ${groupname}"    
      for g_policy_name_arn in $(jq -r '.AttachedPolicies[]|"\(.PolicyName),\(.PolicyArn)"' < "$workdir/list-attached-group-policies_${groupname}.json")
      do
        g_policy_name=$(echo "$g_policy_name_arn" | cut -d',' -f1)
        g_policy_arn=$(echo "$g_policy_name_arn" | cut -d',' -f2)
        echo "## ${groupname} - policy_name=$g_policy_name_arn, arn=$g_policy_name_arn"
        aws --profile "$profile" \
          iam get-policy \
          --policy-arn "$g_policy_arn" \
          --output json \
          > "$workdir/get-policy_attached-group-policy_${groupname}_${g_policy_name}.json"
      done
    fi
  done
fi

echo "Results: ${workdir}"