DOCSEARCHbyAlgolia
Submit Docs

IAM Dataset

repository·main·Indexed 43 days ago

https://github.com/iann0036/iam-dataset

A dataset mapping AWS SDK calls to their required IAM actions. It provides a structured map.json file detailing the relationship between programmatic service calls and permissions, including resource ARN templates, service mappings for CloudTrail, and a specific template syntax for variable substitution and logic.

Tokens
1.2K
Snippets
2
Records
3
Agent score
7%

What's inside IAM Dataset

  1. Understand the structure of the AWS map.json file

    main

    The map.json file contains mappings between AWS SDK calls and IAM actions. It is used to understand which IAM permissions are required to execute specific SDK methods. The file includes service mappings for CloudTrail, SDK friendly names, and detailed permission requirements including resource ARN templates.

    Key top-level keys include:

    • sdk_permissionless_actions: A list of SDK calls that do not require IAM permissions.
    • sdk_method_iam_mappings: The core mapping of SDK methods to their required IAM actions.
    • sdk_service_mappings: Maps friendly service names to IAM namespaces.
    • service_sdk_mappings: Maps IAM namespaces back to friendly service names.
    • cloudtrail_service_mappings: Maps CloudTrail event sources to IAM namespaces.
    • service_cloudtrail_mappings: Maps IAM namespaces to CloudTrail event sources.
    {
    "info": "string",
    "schema_version": "1.0.2",
    "sdk_permissionless_actions": [
       "DynamoDB.DescribeEndpoints"
    ],
    "sdk_method_iam_mappings": {
        "Budgets.CreateBudget": [
            {
                "action": "budgets:CreateBudget",
                "resource_mappings": {
                    "BudgetName": {
                        "template": "${Budget.BudgetName}"
                    }
                }
            }
        ]
    }
}

  2. Use template syntax for variable substitution and logic

    main

    The map.json file uses a specific template syntax within template, resource_mappings, and resourcearn_mappings properties. Any text not matching these patterns is treated as a literal string.

    SyntaxDescription
    ${PropertyName}Variable substitution for the specified property.
    .Access a property within an object/map (e.g., ${Object.Property}).
    []Iterate over each value within an array.
    %%urlencode%${PropertyName}%%Performs URL-encoding on the property.
    %%many%${P1}%${P2}%${P3}%%Iterates over multiple properties of any length.
    %%iftemplatematch%${ArnProperty}%%Valid only if the template matches the resource type's template. If invalid, use a wildcard (*) for the ARN.
    %%iftruthy%${P}%TrueVal%FalseVal%%Performs a truthy test.
    %%regex%${P}%/(.+)/g%%Returns the first capture group of the provided Regex.

  3. Reference the IAM mapping variants in sdk_method_iam_mappings

    main

    Within sdk_method_iam_mappings, each SDK method maps to an array of IAM permission objects. There are four primary variants used to describe how an IAM action relates to the SDK call:

    1. Variable Resource Mappings: Used when the IAM permission has a resource type with variables. Uses resource_mappings to link ARN variables to SDK properties via a template.
    2. Static Resource Mappings: Used when the IAM permission has a resource type but no variables. resource_mappings is an empty object {}.
    3. Full ARN Template Mappings: Used when the IAM ARN itself is constructed from a template. Uses resourcearn_mappings to map a resource type to a template that fulfills the entire ARN.
    4. ARN Overrides: Used to explicitly override the provided ARN template with a specific template using the arn_override key.

    Note on Conditions: The conditions property is currently in draft and is not fully supported. Do not use it at this time.

    // Variant 1: Variable resource mappings
{
    "action": "budgets:CreateBudget",
    "resource_mappings": {
        "BudgetName": { "template": "${Budget.BudgetName}" }
    }
}

// Variant 2: Static resource (no variables)
{
    "action": "sts:GetSessionToken",
    "resource_mappings": {}
}

// Variant 3: Full ARN template
{
    "action": "acm:UpdateCertificateOptions",
    "resource_mappings": {},
    "resourcearn_mappings": {
        "certificate": "${CertificateArn}"
    }
}

// Variant 4: ARN override
{
    "action": "iam:PassRole",
    "arn_override": {
        "template": "%%iftemplatematch%${IamRoleArn}%%"
    }
}