salesforce / policy_sentry

IAM Least Privilege Policy Generator
https://policy-sentry.readthedocs.io/
MIT License
2.02k stars 143 forks source link

How does one list all the services? #475

Closed nitrocode closed 4 months ago

nitrocode commented 7 months ago

Problem

I was having issues finding the service name for amazon health events (health) and privateca (acm-pca) and it would be nice to do query a service-table that could match on the service name, description, etc

Proposal

✗ policy_sentry query service-table | grep -i health
health | AWS Health APIs and Notifications

Workaround

My workaround which works if I can guess a portion of the name like health.

✗ policy_sentry initialize --fetch
✗ jq 'keys' ~/.policy_sentry/iam-definition.json | grep health
  "health",
  "healthlake",

This is harder with privateca where my guesses would be difficult unless I searched for ca unless there was some kind of description associated with each service.

✗ jq 'keys' ~/.policy_sentry/iam-definition.json | grep ca
  "acm-pca",
  "application-autoscaling",
  "application-cost-profiler",
  "application-transformation",
  "applicationinsights",
  "autoscaling",
  "autoscaling-plans",
  "cases",
  "cassandra",
  "codecatalyst",
  "codestar-notifications",
  "comprehendmedical",
  "connect-campaigns",
  "controlcatalog",
  "customer-verification",
  "elasticache",
  "elemental-support-cases",
  "forecast",
  "inspector-scan",
  "mechanicalturk",
  "medical-imaging",
  "notifications",
  "notifications-contacts",
  "pca-connector-ad",
  "servicecatalog",

Some extra parsing and we can do it using the .service_name

✗ jq 'del(.policy_sentry_schema_version) | to_entries | .[].value | {name: .service_name, prefix: .prefix}' ~/.policy_sentry/iam-definition.json | grep -i private -B1 -A1
{
  "name": "AWS Certificate Manager Private Certificate Authority",
  "prefix": "acm-pca"
--
{
  "name": "AWS Private CA Connector for Active Directory",
  "prefix": "pca-connector-ad"
--
{
  "name": "AWS re:Post Private",
  "prefix": "repostspace"
--
{
  "name": "AWS service providing managed private networks",
  "prefix": "private-networks"
}

Thank you