mercredi 7 janvier 2015

How to check if an IAM access key has specific permissions?

Is it possible to check if a particular AWS IAM key has permissions for a set of specific commands?


Essentially, is there an API for AWS's privacy simulator?


So far I've been using hacks, such as executing a command with incorrect parameters that utilizes the permission in question, and watching what response I get back.


Example:



# needed resource: 'elasticloadbalancer:SetLoadBalancerListenerSSLCertificate'

# Check:
try:
elb.set_listener_SSL_certificate(443, 'fake')
except BotoServerError as e:
if e.error_code == 'AccessDenied':
print ("You don't have access to "
"elasticloadbalancer:SetLoadBalancerListenerSSLCertificate")


This is obviously hacky. Ideally I'd have some function call like iam.check_against(resource) or something. Any suggestions?





Aucun commentaire:

Enregistrer un commentaire