Skip to main content

This CDK Construct helps create IAM Managed Policies and IAM Roles using JSON Configuration

Project description

CDK IAM Generator

AWS CDK construct helps create IAM Managed Policies and IAM Roles using JSON Configuration

This package is written in TypeScript and made available via JSII to all other supported languages. Package are available on:

Quickstart

Install or update from npm

TypeScript/Javascript

npm i cdk-iam-generator

Python

pip install cdk-iamgenerator

Usage

** TypeScript **

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
from cdk_iam_generator import IamPolicyGenerator, IamRoleGenerator

IamPolicyGenerator(self, "IamPolicyGenerator",
    config_path="config/iam_generator_config.json",
    policy_path="config/policy"
)

IamRoleGenerator(self, "IamRoleGenerator",
    config_path="config/iam_generator_config.json"
)

Prerequsites

Example folder structure for Json Configuration of Roles and Policies:

config
├── policy
│   ├── CodeCommitArchive.json
│   └── KMSPolicy.json
│   └── CreateServiceLinkedRoleECS.json
│   └── DeployService1.json
│   └── DeployService2.json
├── iam_generator_config.json

Place all the Policy Json files inside config/policy in your project root and policy file would look something like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "codecommit:CancelUploadArchive",
        "codecommit:UploadArchive"
      ],
      "Resource": "*"
    }
  ]
}

Configure the policies and roles to be created in config/iam_generator_config.json file and would look something like this:

{
    "policies": [
        {
            "policy_name": "CodeCommitArchive",
            "description": "CodeCommitArchive policy",
            "policy_file": "CodeCommitArchive.json"
        },
        {
            "policy_name": "KMSPolicy",
            "description": "KMSPolicy policy",
            "policy_file": "KMSPolicy.json"
        },
        {
            "policy_name": "CreateServiceLinkedRoleECS",
            "description": "CreateServiceLinkedRoleECS policy",
            "policy_file": "CreateServiceLinkedRoleECS.json"
        },
        {
            "policy_name": "DeployService1",
            "description": "DeployService1 policy",
            "policy_file": "DeployService1.json"
        },
        {
            "policy_name": "DeployService2",
            "description": "DeployService2 policy",
            "policy_file": "DeployService2.json"
        }
    ],
    "roles": [
        {
            "role_name": "TestRole1",
            "trust_service_principal": ["apigateway.amazonaws.com","lambda.amazonaws.com"],
            "customer_managed_policies": ["DeployService1","DeployService2","KMSPolicy"],
            "aws_managed_policies": ["service-role/AmazonAPIGatewayPushToCloudWatchLogs"]
        },
        {
            "role_name": "TestRole2",
            "trust_service_principal": ["sns.amazonaws.com"],
            "trust_account_principal": ["748669239283"],
            "customer_managed_policies": ["CreateServiceLinkedRoleECS","CodeCommitArchive","KMSPolicy"],
            "aws_managed_policies": ["service-role/AmazonAPIGatewayPushToCloudWatchLogs"]
        },
        {
            "role_name": "TestRole3",
            "trust_service_principal": ["ec2.amazonaws.com","sns.amazonaws.com"],
            "trust_account_principal": ["748669239283"],
            "customer_managed_policies": ["DeployService2","CodeCommitArchive","KMSPolicy"],
            "aws_managed_policies": ["AWSLambdaFullAccess"]
        }

    ]
}

License

cdk-iam-generator is distributed under the Apache License, Version 2.0.

See LICENSE for more information.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for cdk-iamgenerator, version 1.0.4
Filename, size File type Python version Upload date Hashes
Filename, size cdk-iamgenerator-1.0.4.tar.gz (22.2 kB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page