how can i quickly troubleshoot IAM permission for a service

Question

hi.. i'm currently developing a beanstalk service that calls an automation  document that creates cloudformation stacks. 
the role for such a service requires many MANY iterations, of modify Role, upload, restart, try again. 
as a developer we only have SSO roles, is there a way i can develop under the context of the service role without modifying the original role to allow my sso user to assume it? 
i'd like to be able to perform operations as though i am the service to figure out faster what kind of permissions i require (for example execute cloudformation stack as though i am that role

Answer

One way of generating policies is to use AWS's policy generator based off activity: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_generate-policy.html. With this, IAM Access Analyzer reviews AWS CloudTrail for API calls and generates a policy template that contains the permissions that the entity used over a specified data range.

There are other 3rd party tools that do something like this as well.

I also recommend using AWS Policy Sim: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html

There are other 3rd party tools that do something like this as well.

I also recommend using AWS Policy Sim: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html

Answer

You can search for the service role in IAM Roles and see which policies are applied to it. Then create another role that you can assume or create an IAM user with the same policies that are applied to the server role. After you are done you can remove the role/user that you created.

how can i quickly troubleshoot IAM permission for a service

関連するコンテンツ