boto3 获取每个服务的可用操作

Question

I want to programatically get all the actions a user is allowed to do across aws services. I've tried to fiddle with simulate_principal_policy but it seems this method expects a list of all actions, and I don't want to maintain a hard-coded list.

I also tried to call it with iam:* for example and got a generic 'implicitDeny' response so I know the user is not permitted all the actions but I require a higher granularity of actions.

Any ideas as to how do I get the action list dynamically? Thanks!

Answer 1

To start with, there is no programmatic way to retrieve all possible actions (regardless of whether they are permitted to use an action).

You would need to construct a list of possible actions before checking the security. As an example, the boto3 SDK for Python contains an internal list of commands that it uses to validate commands before sending them to AWS.

Once you have a particular action, you could use Access the Policy Simulator API to validate whether a given user would be allowed to make a particular API call. This is much easier than attempting to parse the various Allow and Deny permissions associated with a given user.

However, a call might be denied based upon the specific parameters of the call . For example, a user might have permissions to terminate any Amazon EC2 instance that has a particular tag, but cannot terminate all instances. To correctly test this, an InstanceId would need to be provided to the simulation.

Also, permissions might be restricted by IP Address and even Time of Day. Thus, while a user would have permission to call an Action, where and when they do it will have an impact on whether the Action is permitted.

Bottom line: It ain't easy! AWS will validate permissions at the time of the call. Use the Policy Simulator to obtain similar validation results.

Answer 2

I am surprised no one has answered this question correctly. Here is code that uses boto3 that addresses the OP's question directly:

import boto3

session = boto3.Session('us-east-1')

for service in session.get_available_services ():
   service_client = session.client (service)
   print (service)
   print (service_client.meta.service_model.operation_names)

IAM, however, is a special case as it won't be listed in the get_available_services() call above:

IAM = session.client ('iam')
print ('iam')
print (IAM.meta.service_model.operation_names)