IAM 模拟
一个AWS IAM模拟与政策测试器被建为节点/标本库.
模拟器目前支持 AWS IAM 的这些特性
IAM 特性支持
- 身份政策
- 资源政策
- 服务控制政策
- 资源控制政策
- 权限边界
- 全体 AWS 条件操作员
- 同一账户和交叉账户请求
- IAM 信托政策和 KMS 关键政策自定义信任行为
请求验证
iam- 模拟将自动验证输入, 包括
目前所有 全局条件键 允许所有不完全真实的请求。 今后将增加更多的验证.
解释
亚姆模拟将详细说明哪些声明在最后决定允许或拒绝请求时具有决定性意义.
它还会回复每一份被评价的语句的"解释",详细说明该语句为何适用于请求与否.
即将到来的特点
- 会议政策
- 验证每项行动的全球条件关键
- 从请求中自动插入上下文密钥, 如
aws:PrincipalServiceName
匿名请求
使用 anonymousPrincipal 以模拟未签名的请求,例如通过桶策略给予的公共 S3 对象访问。 匿名请求没有身份政策、会话政策、许可界限或SCP;这些主要侧面政策投入被 runSimulation。 。 。 .
import { anonymousPrincipal, runSimulation, type Simulation } from '@cloud-copilot/iam-simulate'
const simulation: Simulation = {
request: {
principal: anonymousPrincipal,
action: 's3:GetObject',
resource: {
resource: 'arn:aws:s3:::public-bucket/file.txt',
accountId: '123456789012'
},
contextVariables: {}
},
identityPolicies: [],
serviceControlPolicies: [],
resourceControlPolicies: [],
resourcePolicy: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Principal: '*',
Action: 's3:GetObject',
Resource: 'arn:aws:s3:::public-bucket/*'
}
]
}
}
const response = await runSimulation(simulation, {})
S3 块公共访问
对于S3请求,打电话者可以提供有效的 RestrictPublicBuckets 设置 additionalSettings.s3.blockPublicAccess。iam-模拟不获取或确定此设置;提供 true 仅当S3区块公共访问申请模拟的桶/账户时.
const simulation: Simulation = {
// request and policies...
additionalSettings: {
s3: {
blockPublicAccess: true
}
}
}
当启用时,公共 S3 桶政策可以阻止匿名和交叉账户访问 blockedBy: ['s3-bpa']。 。 。 .
安装
npm install @cloud-copilot/iam-simulate
使用量
import { runSimulation, type Simulation } from '@cloud-copilot/iam-simulate'
const simulation: Simulation = {
identityPolicies: [
{
name: 'userpolicy',
policy: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Action: ['s3:GetObject'],
Resource: ['arn:aws:s3:::mybucket/*']
}
]
}
}
],
serviceControlPolicies: [
{
orgIdentifier: 'ou-12345',
policies: [
{
name: 'AllowAll',
policy: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Action: '*',
Resource: '*'
}
]
}
}
]
}
],
/*
The default RCP `RCPFullAWSAccess` is always applied implicitly and you do not need to include it here. https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps_examples.html#example-rcp-full-aws-access
*/
resourceControlPolicies: [
{
orgIdentifier: 'o-123456789012',
policies: [
{
name: 'EnforceSecureTransport',
policy: {
Version: '2012-10-17',
Statement: [
{
Sid: 'EnforceSecureTransport',
Effect: 'Deny',
Principal: '*',
Action: ['sts:*', 's3:*', 'sqs:*', 'secretsmanager:*', 'kms:*'],
Resource: '*',
Condition: {
BoolIfExists: {
'aws:SecureTransport': 'false'
}
}
}
]
}
}
]
}
],
resourcePolicy: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Action: ['s3:GetObject'],
Resource: ['arn:aws:s3:::mybucket/*'],
Principal: 'aws:arn:iam::123456789012:root',
Condition: {
StringEquals: {
'aws:PrincipalOrgID': 'o-123456789012'
}
}
}
]
},
request: {
action: 's3:GetObject',
principal: 'arn:aws:iam::123456789012:user/username',
resource: {
accountId: '123456789012',
resource: 'arn:aws:s3:::mybucket/file.txt'
},
contextVariables: {
'aws:PrincipalOrgID': 'o-123456789012'
}
}
}
`runSimulation` returns a discriminated union with `resultType`:
- `resultType: 'error'` includes `errors` and no simulation results.
- `resultType: 'single'` includes `overallResult` and a single `result`.
- `resultType: 'wildcard'` includes `overallResult` and `results` for each matching pattern.
const response = await runSimulation(simulation, {})
//Check for validation errors (errors are returned at the response level):
if (response.resultType === 'error') {
console.log(response.errors.message)
console.log(JSON.stringify(response.errors, null, 2))
}
//The simulation ran successfully
if (response.resultType === 'single') {
const result = response.result
console.log(response.overallResult) // 'Allowed', 'ExplicitlyDenied', or 'ImplicitlyDenied'
console.log(result.analysis?.result)
//Output the identity statements that allowed the request
const identityAllowExplains =
result?.analysis?.identityAnalysis?.allowStatements.map((s) => s.explain) || []
//Show which statements applied and exactly how.
for (const explain of identityAllowExplains) {
console.log(explain)
}
}
if (response.resultType === 'wildcard') {
console.log(response.overallResult)
for (const result of response.results) {
console.log(result.resourcePattern, result.analysis?.result)
}
}
这将给出一个说明,说明如何评价身份说明:
{
effect: 'Allow',
identifier: '1',
matches: true,
actionMatch: true,
principalMatch: 'Match',
resourceMatch: true,
conditionMatch: true,
resources: [
{
resource: 'arn:aws:s3:::mybucket/*',
matches: true,
}
],
actions: [ { action: 's3:GetObject', matches: true } ],
}