Skip to content

Instantly share code, notes, and snippets.

@andresriancho
Last active January 18, 2019 21:03
Show Gist options
  • Save andresriancho/8245478 to your computer and use it in GitHub Desktop.
Save andresriancho/8245478 to your computer and use it in GitHub Desktop.
How to decode STS message from AWS using boto, helpful to debug permissions issues with IAM policies
>>> import json
>>> import pprint
>>> from boto.sts import STSConnection
>>> s = STSConnection()
>>> d = s.decode_authorization_message('48hdmxfrx3...41DFkQ') # replace with your own string
>>> pprint.pprint(json.loads(d.decoded_message), indent=4)
{ u'allowed': False,
u'context': { u'action': u'iam:PassRole',
u'conditions': { u'items': []},
u'principal': { u'arn': u'arn:aws:iam::334918212912:user/staging-bouncer',
u'id': u'AIDAIA6EK27IQ5JAHLLRM',
u'name': u'staging-bouncer'},
u'resource': u'arn:aws:iam::334918212912:role/StagingScanworkerpolicy'},
u'explicitDeny': False,
u'failures': { u'items': []},
u'matchedStatements': { u'items': []}}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment