{"id":13821760,"url":"https://github.com/tilfin/aws-iam-policy-tool","last_synced_at":"2025-05-07T12:47:06.770Z","repository":{"id":45326811,"uuid":"86094320","full_name":"tilfin/aws-iam-policy-tool","owner":"tilfin","description":"AWS IAM role/policy management command line tool","archived":false,"fork":false,"pushed_at":"2021-12-21T03:17:58.000Z","size":145,"stargazers_count":37,"open_issues_count":0,"forks_count":11,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-23T06:36:21.066Z","etag":null,"topics":["aws","aws-iam","iam","management","policy","role","tool"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tilfin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-03-24T17:32:23.000Z","updated_at":"2024-12-22T01:21:38.000Z","dependencies_parsed_at":"2022-09-17T08:00:11.387Z","dependency_job_id":null,"html_url":"https://github.com/tilfin/aws-iam-policy-tool","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tilfin%2Faws-iam-policy-tool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tilfin%2Faws-iam-policy-tool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tilfin%2Faws-iam-policy-tool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tilfin%2Faws-iam-policy-tool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tilfin","download_url":"https://codeload.github.com/tilfin/aws-iam-policy-tool/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252288912,"owners_count":21724323,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-iam","iam","management","policy","role","tool"],"created_at":"2024-08-04T08:01:27.582Z","updated_at":"2025-05-07T12:47:06.731Z","avatar_url":"https://github.com/tilfin.png","language":"TypeScript","funding_links":[],"categories":["TypeScript"],"sub_categories":[],"readme":"# AWS IAM Policy tool\n\n[![NPM Version][npm-image]][npm-url]\n[![Build Status](https://travis-ci.org/tilfin/aws-iam-policy-tool.svg?branch=master)](https://travis-ci.org/tilfin/aws-iam-policy-tool)\n[![Coverage Status](https://coveralls.io/repos/github/tilfin/aws-iam-policy-tool/badge.svg?branch=master)](https://coveralls.io/github/tilfin/aws-iam-policy-tool?branch=master)\n\nA cli tool to manage AWS IAM roles and the policies is useful to operate their definitions as JSON files.\n\n* Supports exporting roles/policies your AWS Account has already registered, importing new roles/policies, and validating whether them on AWS to equal the definitions at local.\n* Supports a **Role** with only **Managed Policies**, without **Inline policies** purposely\n* Supports the feature to substitute variables (ex `ACCOUNT_ID`, `ENV`) contained within definitions by given values\n* This module could also be used as a library.\n\n## Role/Policy definition file\n\nA definition is saved as JSON file that is like to be displayed by the editor on AWS Management Console.\nEach JSON filename must be based on the name of *Role* or *Policy*.\n\n### Role\n\n* `Role`\n    * `RoleName`\n    * `Path`\n    * `AssumeRolePolicyDocument` manifests the trust relationship.\n    * `Description` (optional)\n* `AttachedPolicies` contains attached managed policies.\n\n#### yourapp-ec2-api-ENV.json\n\n```json\n{\n    \"Role\": {\n        \"RoleName\": \"yourapp-ec2-api-ENV\",\n        \"Path\": \"/\",\n        \"AssumeRolePolicyDocument\": {\n            \"Version\": \"2012-10-17\",\n            \"Statement\": [\n                {\n                    \"Effect\": \"Allow\",\n                    \"Principal\": {\n                        \"Service\": \"ec2.amazonaws.com\"\n                    },\n                    \"Action\": \"sts:AssumeRole\"\n                }\n            ]\n        }\n    },\n    \"AttachedPolicies\": [\n        {\n            \"PolicyName\": \"yourapp-s3-storage-ENV\",\n            \"PolicyArn\": \"arn:aws:iam::ACCOUNT_ID:policy/yourapp-s3-storage-ENV\"\n        }\n    ]\n}\n```\n\n### Policy\n\nA filename minus the extension (.json) decides the policy name.\n\n#### yourapp-s3-storage-ENV.json\n\n```json\n{\n    \"Policy\": {\n        \"PolicyName\": \"yourapp-s3-storage-ENV\",\n        \"Path\": \"/\"\n    },\n    \"Document\": {\n        \"Version\": \"2012-10-17\",\n        \"Statement\": [\n            {\n                \"Effect\": \"Allow\",\n                \"Action\": [\n                    \"s3:PutObject\",\n                    \"s3:GetObject\",\n                    \"s3:DeleteObject\"\n                ],\n                \"Resource\": \"arn:aws:s3:::yourapp-storage-ENV/*\"\n            }\n        ]\n    }\n}\n```\n\nSee an [example](example) of *Role* and *Policy* definitions.\n\nIf you encounter `[WARN] policy-file.json : This policy definition is old version.` message, upgrade your policy definition files to new version. \nThere is [example/upgrade_policy.js](example/upgrade_policy.js) for the conversion script.\n\n## Install\n\n* Require Node.js 8.10 or later\n\n```\n$ npm install -g aws-iam-policy-tool\n```\n\n## Usage\n\n```\n$ awsiamtool --help\nUsage: awsiamtool [options] [command]\n\nAWS IAM export/import policy/role management tool\n\nOptions:\n  -V, --version                  output the version number\n  -h, --help                     output usage information\n\nCommands:\n  export-policy \u003cdir\u003e \u003cmatcher\u003e  export polies to target directory\n  export-role \u003cdir\u003e \u003cmatcher\u003e    export roles to target directory\n  import-policy \u003cdir\u003e            import policies from target directory\n  import-role \u003cdir\u003e              import roles from target directory\n  validate-policy \u003cdir\u003e          validate policies with target directory\n  validate-role \u003cdir\u003e            validate roles with target directory\n  delete-policy \u003cmatcher\u003e        delete policies specified regular expression matches\n  help [cmd]                     display help for [cmd]\n```\n\n### Common command options\n\n```\n  Options:\n\n    -j, --json                         output result as JSON text\n    -p, --plain                        output result as plain text\n    -h, --help                         output usage information\n```\n\n### Set substitution variables\n\n* `-i, --account-id [aws account id]`  set variable ACCOUNT_ID\n* `-e, --env [environment]`            set variable ENV\n\nThe above variables are substituted by given values in the name of *role* file, the name of *policy* file and all values of their JSON.\n\n### Export roles\n\n```\n$ awsiamtool export-role /tmp/current_roles\n```\n\n![export-role screen shot](https://raw.githubusercontent.com/wiki/tilfin/aws-iam-policy-tool/images/ss_export-role.png)\n\n### Export policies\n\n```\n$ awsiamtool export-policy /tmp/current_policies\n```\n\n![export-policy screen shot](https://raw.githubusercontent.com/wiki/tilfin/aws-iam-policy-tool/images/ss_export-policy.png)\n\n### Import roles\n\n\n```\n$ awsiamtool import-role -i \u003cAWS Account ID\u003e -e \u003cEnvironment\u003e exmaple/roles\n```\n\n![import-role screen shot](https://raw.githubusercontent.com/wiki/tilfin/aws-iam-policy-tool/images/ss_import-role.png)\n\n### Import policies\n\n* `-f, --overwrite` overwrite new content of policies. If it isn't specified, current policies are kept and new policy that does not exist is created.\n\n```\n$ awsiamtool import-policy -i \u003cAWS Account ID\u003e -e \u003cEnvironment\u003e [--overwrite] exmaple/policies\n```\n\n![import-policy screen shot](https://raw.githubusercontent.com/wiki/tilfin/aws-iam-policy-tool/images/ss_import-policy.png)\n\n### Validate roles\n\n```\n$ awsiamtool validate-role -i \u003cAWS Account ID\u003e -e \u003cEnvironment\u003e exmaple/roles\n```\n\n![validate-role screen shot](https://raw.githubusercontent.com/wiki/tilfin/aws-iam-policy-tool/images/ss_validate-role.png)\n\n### Validate policies\n\n```\n$ awsiamtool validate-policy -i \u003cAWS Account ID\u003e -e \u003cEnvironment\u003e exmaple/policies\n```\n\n![validate-policy screen shot](https://raw.githubusercontent.com/wiki/tilfin/aws-iam-policy-tool/images/ss_validate-policy.png)\n\n### Delete policies\n\n```\n$ awsiamtool delete-policy \"^myservice\\-\"\n```\n\n## Use as a library\n\nThe name of variable to substitute within the definitions must be to match the regular expression `/^[A-Z][A-Z0-9_]+$/`.\nIt can also be like Shell variables (ex. `$FOO`, `${BAR_NAME}`).\n\n```js\nconst awsIamPolicyLib = require('aws-iam-policy-tool');\n\nconst opts = {\n  json: true,\n  overwrite: true\n};\n\nconst varSets = {\n  ACCOUNT_ID: '000011112222',\n  ENV: 'stg',\n  COMMON_ACCOUNT_ID: '333344445555',\n  COMPANY_NAME: 'awesome'\n};\n\nawsIamPolicyLib.importPolicy('./policies', varSets, opts);\n.then(() =\u003e {\n  return awsIamPolicyLib.importRole('./roles', varSets, opts);  \n})\n.then(() =\u003e { console.info('Importing done') })\n.catch(err =\u003e { console.error(err) });\n```\n\n## License\n\n[MIT](LICENSE)\n\n[npm-image]: https://img.shields.io/npm/v/aws-iam-policy-tool.svg\n[npm-url]: https://npmjs.org/package/aws-iam-policy-tool\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftilfin%2Faws-iam-policy-tool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftilfin%2Faws-iam-policy-tool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftilfin%2Faws-iam-policy-tool/lists"}