Show a diff of changes to existing policies/roles

[simpsora]

Sometimes it can be hard to see what's changed, when the only output is the set of AWS commands used to apply the changes.

Consider the following output:

ommands to push changes to AWS:
      aws iam update-assume-role-policy --role-name administrator-role --policy-document '{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::518040037068:user/andrew.humphrey",
          "arn:aws:iam::518040037068:user/geoff.evason",
          "arn:aws:iam::518040037068:user/owen.butler",
          "arn:aws:iam::518040037068:user/peter.vandoros",
          "arn:aws:iam::518040037068:user/ross.simpson"
        ]
      },
      "Sid": "AssumeRoleWithPrincipal"
    }
  ],
  "Version": "2012-10-17"
}'
Run 1 aws commands (0 destructive)? (y/N)

This is an easy one as the role is short, but you can't tell what's changed. The change here is specifically the addition of another user to the trust policy (Humpy). It would be great to see a diff here that just showed the addition of Humpy's user, so it's clearer to the applier what's happening. With a longer policy or role it can be impossible to see the changes. You can of course look at the diff in git, but sometimes iamy changes more than what's in the code, so having a diff would be real handy.

[simpsora]

Another good example: https://github.com/envato/growth-iam-configuration/pull/1193

Commands to push changes to AWS:
      aws iam delete-role-policy --role-name config-role --policy-name oneClick_config-role_1436162628375
      aws iam put-role-policy --role-name config-role --policy-name oneClick_config-role_1436162628375 --policy-document '{
  "Statement": [
    {
      "Action": [
        "acm:ListCertificates",
        "appstream:Get*",
        "autoscaling:Describe*",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResource",
        "cloudformation:DescribeStackResources",
        "cloudformation:DescribeStacks",
        "cloudformation:GetTemplate",
        "cloudformation:List*",
        "cloudfront:Get*",
        "cloudfront:List*",
        "cloudtrail:DescribeTrails",
        "cloudtrail:GetTrailStatus",
        "cloudwatch:Describe*",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "directconnect:Describe*",
        "dynamodb:BatchGetItem",
        "dynamodb:DescribeTable",
        "dynamodb:GetItem",
        "dynamodb:ListTables",
        "dynamodb:Query",
        "dynamodb:Scan",
        "ec2:Describe*",
        "elasticache:Describe*",
        "elasticbeanstalk:Check*",
        "elasticbeanstalk:Describe*",
        "elasticbeanstalk:List*",
        "elasticbeanstalk:RequestEnvironmentInfo",
        "elasticbeanstalk:RetrieveEnvironmentInfo",
        "elasticfilesystem:DescribeAccessPoints",
        "elasticloadbalancing:Describe*",
        "elastictranscoder:List*",
        "elastictranscoder:Read*",
        "iam:Get*",
        "iam:List*",
        "kinesis:Describe*",
        "kinesis:Get*",
        "kinesis:List*",
        "opsworks:Describe*",
        "opsworks:Get*",
        "rds:Describe*",
        "rds:ListTagsForResource",
        "redshift:Describe*",
        "redshift:ViewQueriesInConsole",
        "route53:Get*",
        "route53:List*",
        "s3:Get*",
        "s3:List*",
        "sdb:GetAttributes",
        "sdb:List*",
        "sdb:Select*",
        "ses:Get*",
        "ses:List*",
        "sns:Get*",
        "sns:List*",
        "sqs:GetQueueAttributes",
        "sqs:ListQueues",
        "sqs:ReceiveMessage",
        "storagegateway:Describe*",
        "storagegateway:List*",
        "trustedadvisor:Describe*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": "es:ListDomainNames",
      "Effect": "Allow",
      "Resource": "arn:aws:es:us-west-2:581634149805:domain/*"
    },
    {
      "Action": "s3:PutObject*",
      "Condition": {
        "StringLike": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      },
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::config-bucket-581634149805/AWSLogs/581634149805/*"
    },
    {
      "Action": "s3:GetBucketAcl",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::config-bucket-581634149805"
    },
    {
      "Action": "sns:Publish",
      "Effect": "Allow",
      "Resource": "arn:aws:sns:us-west-2:581634149805:config-topic"
    }
  ],
  "Version": "2012-10-17"
}'

Run 2 aws commands (1 destructive)? (y/N)