Skip to content

Instantly share code, notes, and snippets.

@superdaigo
Last active February 21, 2022 10:23
Show Gist options
  • Save superdaigo/a309197b1bceea6ac0394396f8b087dd to your computer and use it in GitHub Desktop.
Save superdaigo/a309197b1bceea6ac0394396f8b087dd to your computer and use it in GitHub Desktop.
Download all IAM user policies
#!/usr/bin/env bash
#
# Usage: iam-user-policies.sh USERNAME PROFILE_NAME
#
# Requirements:
# - jq
# - Able to use the profile passes as the 2nd parameter
set -euo pipefail
username="$1"
profile="$2"
workdir="iam-user_${username}_$(date -u +%Y-%m-%d_%H%M%S)"
mkdir "${workdir}"
# user
aws --profile "$profile" \
iam get-user \
--user-name "$username" \
--output json \
> "$workdir/get-user.json"
# inline policy
aws --profile "$profile" \
iam list-user-policies \
--user-name "$username" \
--output json \
> "$workdir/list-user-policies.json"
num_policies=$(jq '.PolicyNames|length' < $workdir/list-user-policies.json)
echo "Inline policy: ${num_policies}"
if [ "$num_policies" == "0" ]; then
echo "# No Inline Policies"
else
echo "# $num_policies Inline Policies"
for inline_policy in $(jq -r '.PolicyNames[]' < $workdir/list-user-policies.json)
do
echo "# policy_name=${inline_policy}"
aws --profile "$profile" \
iam get-user-policy \
--user-name "$username" \
--policy-name "$inline_policy" \
--output json \
> "${workdir}/get-user-policy_${inline_policy}.json"
done
fi
# attached/managed policy
aws --profile "$profile" \
iam list-attached-user-policies \
--user-name "$username" \
--output json \
> "$workdir/list-attached-user-policies.json"
num_attached_policies=$(jq '.AttachedPolicies|length' < "$workdir/list-attached-user-policies.json")
if [ "$num_attached_policies" == "0" ]; then
echo "# No Attached Policies"
else
echo "# $num_attached_policies Attached Policies"
for i in $(jq -r '.AttachedPolicies[]|"\(.PolicyName),\(.PolicyArn)"' < ${workdir}/list-attached-user-policies.json)
do
name=$(echo "$i" | cut -d',' -f1)
arn=$(echo "$i" | cut -d',' -f2)
echo "# policy_name=$name, arn=$arn"
aws --profile "$profile" \
iam get-policy \
--policy-arn "$arn" \
--output json \
> "$workdir/get-policy_attached-user-policy_${name}.json"
done
fi
# groups
aws --profile "$profile" \
iam list-groups-for-user \
--user-name "$username" \
--output json \
> "$workdir/list-groups-for-user.json"
# group inline policy
num_groups=$(jq '.Groups|length' < "$workdir/list-groups-for-user.json")
if [ "$num_groups" == "0" ]; then
echo "# No Group"
else
echo "# $num_groups Groups"
for group_name_arn in $(jq -r '.Groups[]|"\(.GroupName),\(.Arn)"' < "${workdir}/list-groups-for-user.json")
do
groupname=$(echo "$group_name_arn"|cut -d',' -f1)
group_arn=$(echo "$group_name_arn"|cut -d',' -f2)
echo "## group_name=${groupname}, arn=${group_arn}"
# inline policies
aws --profile "$profile" \
iam list-group-policies \
--group-name "$groupname" \
--output json \
> "${workdir}/list-groups-policies_${groupname}.json"
num_group_policies=$(jq -r '.PolicyNames|length' < "${workdir}/list-groups-policies_${groupname}.json")
if [ "$num_group_policies" == "0" ]; then
echo "## No inline policy for the group ${groupname}"
else
echo "## $num_group_policies inline policies for the group ${groupname}"
for g_policy in $(jq -r '.PolicyNames[]' < "${workdir}/list-groups-policies_${groupname}.json")
do
echo "## ${groupname} - policy_name=${g_policy}"
aws --profile "${profile}" \
iam get-group-policy \
--group-name "${groupname}" \
--policy-name "${g_policy}" \
--output json \
> "${workdir}/get-group-policy_${groupname}_${g_policy}.json"
done
fi
# attached/managed policies
aws --profile "$profile" \
iam list-attached-group-policies \
--group-name "$groupname" \
--output json \
> "$workdir/list-attached-group-policies_${groupname}.json"
num_attached_group_policies=$(jq '.AttachedPolicies|length' < "$workdir/list-attached-group-policies_${groupname}.json")
if [ "$num_attached_group_policies" == "0" ]; then
echo "## No atached policy for the group ${groupname}"
else
echo "## ${num_attached_group_policies} atached policies for the group ${groupname}"
for g_policy_name_arn in $(jq -r '.AttachedPolicies[]|"\(.PolicyName),\(.PolicyArn)"' < "$workdir/list-attached-group-policies_${groupname}.json")
do
g_policy_name=$(echo "$g_policy_name_arn" | cut -d',' -f1)
g_policy_arn=$(echo "$g_policy_name_arn" | cut -d',' -f2)
echo "## ${groupname} - policy_name=$g_policy_name_arn, arn=$g_policy_name_arn"
aws --profile "$profile" \
iam get-policy \
--policy-arn "$g_policy_arn" \
--output json \
> "$workdir/get-policy_attached-group-policy_${groupname}_${g_policy_name}.json"
done
fi
done
fi
echo "Results: ${workdir}"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment