From 6417b8bf578a5a048d70142afaa3e17e4c442a0d Mon Sep 17 00:00:00 2001 From: Will Bengtson Date: Tue, 24 Jul 2018 09:52:39 -0700 Subject: [PATCH 1/4] start of get_account_authorization_details for iam --- moto/iam/models.py | 3 + moto/iam/responses.py | 427 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 430 insertions(+) diff --git a/moto/iam/models.py b/moto/iam/models.py index 8b632e555092..650b9e487621 100644 --- a/moto/iam/models.py +++ b/moto/iam/models.py @@ -905,5 +905,8 @@ def create_account_alias(self, alias): def delete_account_alias(self, alias): self.account_aliases = [] + def get_account_authorization_details(self, filter): + return {} + iam_backend = IAMBackend() diff --git a/moto/iam/responses.py b/moto/iam/responses.py index 786afab08253..b2c7fc6dad3b 100644 --- a/moto/iam/responses.py +++ b/moto/iam/responses.py @@ -534,6 +534,14 @@ def delete_account_alias(self): template = self.response_template(DELETE_ACCOUNT_ALIAS_TEMPLATE) return template.render() + def get_account_authorization_details(self): + print('enter get_account') + filter_param = self._get_param('Filter') + iam_backend.get_account_authorization_details(filter_param) + template = self.response_template(GET_ACCOUNT_AUTHORIZATION_DETAILS_TEMPLATE) + print('render template') + return template.render() + ATTACH_ROLE_POLICY_TEMPLATE = """ @@ -1309,3 +1317,422 @@ def delete_account_alias(self): 7a62c49f-347e-4fc4-9331-6e8eEXAMPLE """ + + +LIST_GROUPS_FOR_USER_TEMPLATE = """ + + + {% for group in groups %} + + {{ group.path }} + {{ group.name }} + {{ group.id }} + {{ group.arn }} + + {% endfor %} + + false + + + 7a62c49f-347e-4fc4-9331-6e8eEXAMPLE + +""" + + +GET_ACCOUNT_AUTHORIZATION_DETAILS_TEMPLATE = """ + + true + + + + Admins + + + AIDACKCEVSQ6C2EXAMPLE + / + Alice + arn:aws:iam::123456789012:user/Alice + 2013-10-14T18:32:24Z + + + + Admins + + + + + DenyBillingAndIAMPolicy + + {"Version":"2012-10-17","Statement":{"Effect":"Deny","Action": + ["aws-portal:*","iam:*"],"Resource":"*"}} + + + + AIDACKCEVSQ6C3EXAMPLE + / + Bob + arn:aws:iam::123456789012:user/Bob + 2013-10-14T18:32:25Z + + + + Dev + + + AIDACKCEVSQ6C4EXAMPLE + / + Charlie + arn:aws:iam::123456789012:user/Charlie + 2013-10-14T18:33:56Z + + + + Dev + + + AIDACKCEVSQ6C5EXAMPLE + / + Danielle + arn:aws:iam::123456789012:user/Danielle + 2013-10-14T18:33:56Z + + + + Finance + + + AIDACKCEVSQ6C6EXAMPLE + / + Elaine + arn:aws:iam::123456789012:user/Elaine + 2013-10-14T18:57:48Z + + + + EXAMPLEkakv9BCuUNFDtxWSyfzetYwEx2ADc8dnzfvERF5S6YMvXKx41t6gCl/eeaCX3Jo94/ + bKqezEAg8TEVS99EKFLxm3jtbpl25FDWEXAMPLE + + + + AIDACKCEVSQ6C7EXAMPLE + + + AdministratorAccess + arn:aws:iam::aws:policy/AdministratorAccess + + + Admins + / + arn:aws:iam::123456789012:group/Admins + 2013-10-14T18:32:24Z + + + + AIDACKCEVSQ6C8EXAMPLE + + + PowerUserAccess + arn:aws:iam::aws:policy/PowerUserAccess + + + Dev + / + arn:aws:iam::123456789012:group/Dev + 2013-10-14T18:33:55Z + + + + AIDACKCEVSQ6C9EXAMPLE + + Finance + / + arn:aws:iam::123456789012:group/Finance + 2013-10-14T18:57:48Z + + + policygen-201310141157 + + {"Version":"2012-10-17","Statement":[{"Action":["aws-portal:*"], + "Sid":"Stmt1381777017000","Resource":["*"],"Effect":"Allow"}]} + + + + + + + + + + + AmazonS3FullAccess + arn:aws:iam::aws:policy/AmazonS3FullAccess + + + AmazonDynamoDBFullAccess + arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess + + + + + EC2role + + + / + arn:aws:iam::123456789012:role/EC2role + EC2role + + {"Version":"2012-10-17","Statement":[{"Sid":"", + "Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"}, + "Action":"sts:AssumeRole"}]} + + 2014-07-30T17:09:20Z + AROAFP4BKI7Y7TEXAMPLE + + + / + arn:aws:iam::123456789012:instance-profile/EC2role + AIPAFFYRBHWXW2EXAMPLE + 2014-07-30T17:09:20Z + + + / + arn:aws:iam::123456789012:role/EC2role + EC2role + + {"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow", + "Principal":{"Service":"ec2.amazonaws.com"}, + "Action":"sts:AssumeRole"}]} + + 2014-07-30T17:09:20Z + AROAFP4BKI7Y7TEXAMPLE + + + + + create-update-delete-set-managed-policies + v1 + ANPAJ2UCCR6DPCEXAMPLE + / + + + + {"Version":"2012-10-17","Statement":{"Effect":"Allow", + "Action":["iam:CreatePolicy","iam:CreatePolicyVersion", + "iam:DeletePolicy","iam:DeletePolicyVersion","iam:GetPolicy", + "iam:GetPolicyVersion","iam:ListPolicies", + "iam:ListPolicyVersions","iam:SetDefaultPolicyVersion"], + "Resource":"*"}} + + true + v1 + 2015-02-06T19:58:34Z + + + + arn:aws:iam::123456789012:policy/create-update-delete-set-managed-policies + + 1 + 2015-02-06T19:58:34Z + true + 2015-02-06T19:58:34Z + + + S3-read-only-specific-bucket + v1 + ANPAJ4AE5446DAEXAMPLE + / + + + + {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action": + ["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::example-bucket", + "arn:aws:s3:::example-bucket/*"]}]} + + true + v1 + 2015-01-21T21:39:41Z + + + arn:aws:iam::123456789012:policy/S3-read-only-specific-bucket + 1 + 2015-01-21T21:39:41Z + true + 2015-01-21T23:39:41Z + + + AWSOpsWorksRole + v1 + ANPAE376NQ77WV6KGJEBE + /service-role/ + + + + {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action": + ["cloudwatch:GetMetricStatistics","ec2:DescribeAccountAttributes", + "ec2:DescribeAvailabilityZones","ec2:DescribeInstances", + "ec2:DescribeKeyPairs","ec2:DescribeSecurityGroups","ec2:DescribeSubnets", + "ec2:DescribeVpcs","elasticloadbalancing:DescribeInstanceHealth", + "elasticloadbalancing:DescribeLoadBalancers","iam:GetRolePolicy", + "iam:ListInstanceProfiles","iam:ListRoles","iam:ListUsers", + "iam:PassRole","opsworks:*","rds:*"],"Resource":["*"]}]} + + true + v1 + 2014-12-10T22:57:47Z + + + arn:aws:iam::aws:policy/service-role/AWSOpsWorksRole + 1 + 2015-02-06T18:41:27Z + true + 2015-02-06T18:41:27Z + + + AmazonEC2FullAccess + v1 + ANPAE3QWE5YT46TQ34WLG + / + + + + {"Version":"2012-10-17","Statement":[{"Action":"ec2:*", + "Effect":"Allow","Resource":"*"},{"Effect":"Allow", + "Action":"elasticloadbalancing:*","Resource":"*"},{"Effect":"Allow", + "Action":"cloudwatch:*","Resource":"*"},{"Effect":"Allow", + "Action":"autoscaling:*","Resource":"*"}]} + + true + v1 + 2014-10-30T20:59:46Z + + + arn:aws:iam::aws:policy/AmazonEC2FullAccess + 1 + 2015-02-06T18:40:15Z + true + 2015-02-06T18:40:15Z + + + + + 92e79ae7-7399-11e4-8c85-4b53eEXAMPLE + +""" +# GET_ACCOUNT_AUTHORIZATION_DETAILS_TEMPLATE = """ +# +# true +# +# {% for user in users %} +# +# +# +# {{ user.id }} +# {{ user.path }} +# {{ user.name }} +# {{ user.arn }} +# 2012-05-09T15:45:35Z +# +# {% endfor %} +# +# +# EXAMPLEkakv9BCuUNFDtxWSyfzetYwEx2ADc8dnzfvERF5S6YMvXKx41t6gCl/eeaCX3Jo94/ +# bKqezEAg8TEVS99EKFLxm3jtbpl25FDWEXAMPLE +# +# +# {% for group in groups %} +# +# {{ group.id }} +# +# +# AdministratorAccess +# arn:aws:iam::aws:policy/AdministratorAccess +# +# +# {{ group.name }} +# {{ group.path }} +# {{ group.arn }} +# {{ group.created_iso_8601 }} +# +# +# {% endfor %} +# +# +# {% for role in roles %} +# +# +# +# {% for policy in policies %} +# +# {{ policy.name }} +# {{ policy.arn }} +# +# {% endfor %} +# +# +# {% for profile in instance_profiles %} +# +# {{ profile.id }} +# +# {% for role in profile.roles %} +# +# {{ role.path }} +# {{ role.arn }} +# {{ role.name }} +# {{ role.assume_policy_document }} +# 2012-05-09T15:45:35Z +# {{ role.id }} +# +# {% endfor %} +# +# {{ profile.name }} +# {{ profile.path }} +# {{ profile.arn }} +# 2012-05-09T16:27:11Z +# +# {% endfor %} +# +# {{ role.path }} +# {{ role.arn }} +# {{ role.name }} +# {{ role.assume_role_policy_document }} +# 2014-07-30T17:09:20Z +# {{ role.id }} +# +# {% endfor %} +# +# +# {% for policy in policies %} +# +# {{ policy.name }} +# {{ policy.default_version_id }} +# {{ policy.id }} +# {{ policy.path }} +# +# +# +# {"Version":"2012-10-17","Statement":{"Effect":"Allow", +# "Action":["iam:CreatePolicy","iam:CreatePolicyVersion", +# "iam:DeletePolicy","iam:DeletePolicyVersion","iam:GetPolicy", +# "iam:GetPolicyVersion","iam:ListPolicies", +# "iam:ListPolicyVersions","iam:SetDefaultPolicyVersion"], +# "Resource":"*"}} +# +# true +# v1 +# {{ policy.create_datetime.isoformat() }} +# +# +# {{ policy.arn }} +# 1 +# {{ policy.create_datetime.isoformat() }} +# true +# {{ policy.update_datetime.isoformat() }} +# +# {% endfor %} +# +# +# +# 92e79ae7-7399-11e4-8c85-4b53eEXAMPLE +# +# """ + From f2cae1325e6cec622e727590ce51bf8d3a7a526c Mon Sep 17 00:00:00 2001 From: Will Bengtson Date: Tue, 24 Jul 2018 15:01:15 -0700 Subject: [PATCH 2/4] add get_account_authorization_details dynamic template --- moto/iam/models.py | 16 +- moto/iam/responses.py | 692 +++++++++++++++++++++--------------------- 2 files changed, 364 insertions(+), 344 deletions(-) diff --git a/moto/iam/models.py b/moto/iam/models.py index 650b9e487621..243a4e3f37d9 100644 --- a/moto/iam/models.py +++ b/moto/iam/models.py @@ -906,7 +906,21 @@ def delete_account_alias(self, alias): self.account_aliases = [] def get_account_authorization_details(self, filter): - return {} + policies = self.managed_policies.values() + local_policies = set(policies) - set(aws_managed_policies) + returned_policies = [] + + if 'AWSManagedPolicy' in filter: + returned_policies = aws_managed_policies + if 'LocalManagedPolicy' in filter: + returned_policies = returned_policies + list(local_policies) + return { + 'instance_profiles': self.instance_profiles.values(), + 'roles': self.roles.values(), + 'groups': self.groups.values(), + 'users': self.users.values(), + 'managed_policies': returned_policies + } iam_backend = IAMBackend() diff --git a/moto/iam/responses.py b/moto/iam/responses.py index b2c7fc6dad3b..bd4ccf45d53a 100644 --- a/moto/iam/responses.py +++ b/moto/iam/responses.py @@ -535,12 +535,16 @@ def delete_account_alias(self): return template.render() def get_account_authorization_details(self): - print('enter get_account') - filter_param = self._get_param('Filter') - iam_backend.get_account_authorization_details(filter_param) + filter_param = self._get_multi_param('Filter.member') + account_details = iam_backend.get_account_authorization_details(filter_param) template = self.response_template(GET_ACCOUNT_AUTHORIZATION_DETAILS_TEMPLATE) - print('render template') - return template.render() + return template.render( + instance_profiles=account_details['instance_profiles'], + policies=account_details['managed_policies'], + users=account_details['users'], + groups=account_details['groups'], + roles=account_details['roles'] + ) ATTACH_ROLE_POLICY_TEMPLATE = """ @@ -1339,374 +1343,180 @@ def get_account_authorization_details(self): """ -GET_ACCOUNT_AUTHORIZATION_DETAILS_TEMPLATE = """ - - true - - - - Admins - - - AIDACKCEVSQ6C2EXAMPLE - / - Alice - arn:aws:iam::123456789012:user/Alice - 2013-10-14T18:32:24Z - - - - Admins - - - - - DenyBillingAndIAMPolicy - - {"Version":"2012-10-17","Statement":{"Effect":"Deny","Action": - ["aws-portal:*","iam:*"],"Resource":"*"}} - - - - AIDACKCEVSQ6C3EXAMPLE - / - Bob - arn:aws:iam::123456789012:user/Bob - 2013-10-14T18:32:25Z - - - - Dev - - - AIDACKCEVSQ6C4EXAMPLE - / - Charlie - arn:aws:iam::123456789012:user/Charlie - 2013-10-14T18:33:56Z - - - - Dev - - - AIDACKCEVSQ6C5EXAMPLE - / - Danielle - arn:aws:iam::123456789012:user/Danielle - 2013-10-14T18:33:56Z - - - - Finance - - - AIDACKCEVSQ6C6EXAMPLE - / - Elaine - arn:aws:iam::123456789012:user/Elaine - 2013-10-14T18:57:48Z - - - - EXAMPLEkakv9BCuUNFDtxWSyfzetYwEx2ADc8dnzfvERF5S6YMvXKx41t6gCl/eeaCX3Jo94/ - bKqezEAg8TEVS99EKFLxm3jtbpl25FDWEXAMPLE - - - - AIDACKCEVSQ6C7EXAMPLE - - - AdministratorAccess - arn:aws:iam::aws:policy/AdministratorAccess - - - Admins - / - arn:aws:iam::123456789012:group/Admins - 2013-10-14T18:32:24Z - - - - AIDACKCEVSQ6C8EXAMPLE - - - PowerUserAccess - arn:aws:iam::aws:policy/PowerUserAccess - - - Dev - / - arn:aws:iam::123456789012:group/Dev - 2013-10-14T18:33:55Z - - - - AIDACKCEVSQ6C9EXAMPLE - - Finance - / - arn:aws:iam::123456789012:group/Finance - 2013-10-14T18:57:48Z - - - policygen-201310141157 - - {"Version":"2012-10-17","Statement":[{"Action":["aws-portal:*"], - "Sid":"Stmt1381777017000","Resource":["*"],"Effect":"Allow"}]} - - - - - - - - - - - AmazonS3FullAccess - arn:aws:iam::aws:policy/AmazonS3FullAccess - - - AmazonDynamoDBFullAccess - arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess - - - - - EC2role - - - / - arn:aws:iam::123456789012:role/EC2role - EC2role - - {"Version":"2012-10-17","Statement":[{"Sid":"", - "Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"}, - "Action":"sts:AssumeRole"}]} - - 2014-07-30T17:09:20Z - AROAFP4BKI7Y7TEXAMPLE - - - / - arn:aws:iam::123456789012:instance-profile/EC2role - AIPAFFYRBHWXW2EXAMPLE - 2014-07-30T17:09:20Z - - - / - arn:aws:iam::123456789012:role/EC2role - EC2role - - {"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow", - "Principal":{"Service":"ec2.amazonaws.com"}, - "Action":"sts:AssumeRole"}]} - - 2014-07-30T17:09:20Z - AROAFP4BKI7Y7TEXAMPLE - - - - - create-update-delete-set-managed-policies - v1 - ANPAJ2UCCR6DPCEXAMPLE - / - - - - {"Version":"2012-10-17","Statement":{"Effect":"Allow", - "Action":["iam:CreatePolicy","iam:CreatePolicyVersion", - "iam:DeletePolicy","iam:DeletePolicyVersion","iam:GetPolicy", - "iam:GetPolicyVersion","iam:ListPolicies", - "iam:ListPolicyVersions","iam:SetDefaultPolicyVersion"], - "Resource":"*"}} - - true - v1 - 2015-02-06T19:58:34Z - - - - arn:aws:iam::123456789012:policy/create-update-delete-set-managed-policies - - 1 - 2015-02-06T19:58:34Z - true - 2015-02-06T19:58:34Z - - - S3-read-only-specific-bucket - v1 - ANPAJ4AE5446DAEXAMPLE - / - - - - {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action": - ["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::example-bucket", - "arn:aws:s3:::example-bucket/*"]}]} - - true - v1 - 2015-01-21T21:39:41Z - - - arn:aws:iam::123456789012:policy/S3-read-only-specific-bucket - 1 - 2015-01-21T21:39:41Z - true - 2015-01-21T23:39:41Z - - - AWSOpsWorksRole - v1 - ANPAE376NQ77WV6KGJEBE - /service-role/ - - - - {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action": - ["cloudwatch:GetMetricStatistics","ec2:DescribeAccountAttributes", - "ec2:DescribeAvailabilityZones","ec2:DescribeInstances", - "ec2:DescribeKeyPairs","ec2:DescribeSecurityGroups","ec2:DescribeSubnets", - "ec2:DescribeVpcs","elasticloadbalancing:DescribeInstanceHealth", - "elasticloadbalancing:DescribeLoadBalancers","iam:GetRolePolicy", - "iam:ListInstanceProfiles","iam:ListRoles","iam:ListUsers", - "iam:PassRole","opsworks:*","rds:*"],"Resource":["*"]}]} - - true - v1 - 2014-12-10T22:57:47Z - - - arn:aws:iam::aws:policy/service-role/AWSOpsWorksRole - 1 - 2015-02-06T18:41:27Z - true - 2015-02-06T18:41:27Z - - - AmazonEC2FullAccess - v1 - ANPAE3QWE5YT46TQ34WLG - / - - - - {"Version":"2012-10-17","Statement":[{"Action":"ec2:*", - "Effect":"Allow","Resource":"*"},{"Effect":"Allow", - "Action":"elasticloadbalancing:*","Resource":"*"},{"Effect":"Allow", - "Action":"cloudwatch:*","Resource":"*"},{"Effect":"Allow", - "Action":"autoscaling:*","Resource":"*"}]} - - true - v1 - 2014-10-30T20:59:46Z - - - arn:aws:iam::aws:policy/AmazonEC2FullAccess - 1 - 2015-02-06T18:40:15Z - true - 2015-02-06T18:40:15Z - - - - - 92e79ae7-7399-11e4-8c85-4b53eEXAMPLE - -""" # GET_ACCOUNT_AUTHORIZATION_DETAILS_TEMPLATE = """ # -# true +# false # -# {% for user in users %} # +# +# Admins # # -# {{ user.id }} -# {{ user.path }} -# {{ user.name }} -# {{ user.arn }} -# 2012-05-09T15:45:35Z +# AIDACKCEVSQ6C2EXAMPLE +# / +# Alice +# arn:aws:iam::123456789012:user/Alice +# 2013-10-14T18:32:24Z +# +# +# +# Admins +# +# +# +# +# DenyBillingAndIAMPolicy +# +# {"Version":"2012-10-17","Statement":{"Effect":"Deny","Action": +# ["aws-portal:*","iam:*"],"Resource":"*"}} +# +# +# +# AIDACKCEVSQ6C3EXAMPLE +# / +# Bob +# arn:aws:iam::123456789012:user/Bob +# 2013-10-14T18:32:25Z +# +# +# +# Dev +# +# +# AIDACKCEVSQ6C4EXAMPLE +# / +# Charlie +# arn:aws:iam::123456789012:user/Charlie +# 2013-10-14T18:33:56Z +# +# +# +# Dev +# +# +# AIDACKCEVSQ6C5EXAMPLE +# / +# Danielle +# arn:aws:iam::123456789012:user/Danielle +# 2013-10-14T18:33:56Z +# +# +# +# Finance +# +# +# AIDACKCEVSQ6C6EXAMPLE +# / +# Elaine +# arn:aws:iam::123456789012:user/Elaine +# 2013-10-14T18:57:48Z # -# {% endfor %} # # # EXAMPLEkakv9BCuUNFDtxWSyfzetYwEx2ADc8dnzfvERF5S6YMvXKx41t6gCl/eeaCX3Jo94/ # bKqezEAg8TEVS99EKFLxm3jtbpl25FDWEXAMPLE # # -# {% for group in groups %} # -# {{ group.id }} +# AIDACKCEVSQ6C7EXAMPLE # # # AdministratorAccess # arn:aws:iam::aws:policy/AdministratorAccess # # -# {{ group.name }} -# {{ group.path }} -# {{ group.arn }} -# {{ group.created_iso_8601 }} +# Admins +# / +# arn:aws:iam::123456789012:group/Admins +# 2013-10-14T18:32:24Z # # -# {% endfor %} +# +# AIDACKCEVSQ6C8EXAMPLE +# +# +# PowerUserAccess +# arn:aws:iam::aws:policy/PowerUserAccess +# +# +# Dev +# / +# arn:aws:iam::123456789012:group/Dev +# 2013-10-14T18:33:55Z +# +# +# +# AIDACKCEVSQ6C9EXAMPLE +# +# Finance +# / +# arn:aws:iam::123456789012:group/Finance +# 2013-10-14T18:57:48Z +# +# +# policygen-201310141157 +# +# {"Version":"2012-10-17","Statement":[{"Action":["aws-portal:*"], +# "Sid":"Stmt1381777017000","Resource":["*"],"Effect":"Allow"}]} +# +# +# +# # # -# {% for role in roles %} # # # -# {% for policy in policies %} -# -# {{ policy.name }} -# {{ policy.arn }} -# -# {% endfor %} +# +# AmazonS3FullAccess +# arn:aws:iam::aws:policy/AmazonS3FullAccess +# +# +# AmazonDynamoDBFullAccess +# arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess +# # # -# {% for profile in instance_profiles %} -# -# {{ profile.id }} -# -# {% for role in profile.roles %} -# -# {{ role.path }} -# {{ role.arn }} -# {{ role.name }} -# {{ role.assume_policy_document }} -# 2012-05-09T15:45:35Z -# {{ role.id }} -# -# {% endfor %} -# -# {{ profile.name }} -# {{ profile.path }} -# {{ profile.arn }} -# 2012-05-09T16:27:11Z -# -# {% endfor %} +# +# EC2role +# +# +# / +# arn:aws:iam::123456789012:role/EC2role +# EC2role +# +# {"Version":"2012-10-17","Statement":[{"Sid":"", +# "Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"}, +# "Action":"sts:AssumeRole"}]} +# +# 2014-07-30T17:09:20Z +# AROAFP4BKI7Y7TEXAMPLE +# +# +# / +# arn:aws:iam::123456789012:instance-profile/EC2role +# AIPAFFYRBHWXW2EXAMPLE +# 2014-07-30T17:09:20Z +# # -# {{ role.path }} -# {{ role.arn }} -# {{ role.name }} -# {{ role.assume_role_policy_document }} +# / +# arn:aws:iam::123456789012:role/EC2role +# EC2role +# +# {"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow", +# "Principal":{"Service":"ec2.amazonaws.com"}, +# "Action":"sts:AssumeRole"}]} +# # 2014-07-30T17:09:20Z -# {{ role.id }} +# AROAFP4BKI7Y7TEXAMPLE # -# {% endfor %} # # -# {% for policy in policies %} # -# {{ policy.name }} -# {{ policy.default_version_id }} -# {{ policy.id }} -# {{ policy.path }} +# create-update-delete-set-managed-policies +# v1 +# ANPAJ2UCCR6DPCEXAMPLE +# / # # # @@ -1719,20 +1529,216 @@ def get_account_authorization_details(self): # # true # v1 -# {{ policy.create_datetime.isoformat() }} +# 2015-02-06T19:58:34Z +# +# +# +# arn:aws:iam::123456789012:policy/create-update-delete-set-managed-policies +# +# 1 +# 2015-02-06T19:58:34Z +# true +# 2015-02-06T19:58:34Z +# +# +# S3-read-only-specific-bucket +# v1 +# ANPAJ4AE5446DAEXAMPLE +# / +# +# +# +# {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action": +# ["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::example-bucket", +# "arn:aws:s3:::example-bucket/*"]}]} +# +# true +# v1 +# 2015-01-21T21:39:41Z +# +# +# arn:aws:iam::123456789012:policy/S3-read-only-specific-bucket +# 1 +# 2015-01-21T21:39:41Z +# true +# 2015-01-21T23:39:41Z +# +# +# AWSOpsWorksRole +# v1 +# ANPAE376NQ77WV6KGJEBE +# /service-role/ +# +# +# +# {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action": +# ["cloudwatch:GetMetricStatistics","ec2:DescribeAccountAttributes", +# "ec2:DescribeAvailabilityZones","ec2:DescribeInstances", +# "ec2:DescribeKeyPairs","ec2:DescribeSecurityGroups","ec2:DescribeSubnets", +# "ec2:DescribeVpcs","elasticloadbalancing:DescribeInstanceHealth", +# "elasticloadbalancing:DescribeLoadBalancers","iam:GetRolePolicy", +# "iam:ListInstanceProfiles","iam:ListRoles","iam:ListUsers", +# "iam:PassRole","opsworks:*","rds:*"],"Resource":["*"]}]} +# +# true +# v1 +# 2014-12-10T22:57:47Z +# +# +# arn:aws:iam::aws:policy/service-role/AWSOpsWorksRole +# 1 +# 2015-02-06T18:41:27Z +# true +# 2015-02-06T18:41:27Z +# +# +# AmazonEC2FullAccess +# v1 +# ANPAE3QWE5YT46TQ34WLG +# / +# +# +# +# {"Version":"2012-10-17","Statement":[{"Action":"ec2:*", +# "Effect":"Allow","Resource":"*"},{"Effect":"Allow", +# "Action":"elasticloadbalancing:*","Resource":"*"},{"Effect":"Allow", +# "Action":"cloudwatch:*","Resource":"*"},{"Effect":"Allow", +# "Action":"autoscaling:*","Resource":"*"}]} +# +# true +# v1 +# 2014-10-30T20:59:46Z # # -# {{ policy.arn }} +# arn:aws:iam::aws:policy/AmazonEC2FullAccess # 1 -# {{ policy.create_datetime.isoformat() }} +# 2015-02-06T18:40:15Z # true -# {{ policy.update_datetime.isoformat() }} +# 2015-02-06T18:40:15Z # -# {% endfor %} # # # # 92e79ae7-7399-11e4-8c85-4b53eEXAMPLE # # """ +GET_ACCOUNT_AUTHORIZATION_DETAILS_TEMPLATE = """ + + false + + {% for user in users %} + + + + {{ user.id }} + {{ user.path }} + {{ user.name }} + {{ user.arn }} + 2012-05-09T15:45:35Z + + {% endfor %} + + + EXAMPLEkakv9BCuUNFDtxWSyfzetYwEx2ADc8dnzfvERF5S6YMvXKx41t6gCl/eeaCX3Jo94/ + bKqezEAg8TEVS99EKFLxm3jtbpl25FDWEXAMPLE + + + {% for group in groups %} + + {{ group.id }} + + {% for policy in group.managed_policies %} + + {{ policy.name }} + {{ policy.arn }} + + {% endfor %} + + {{ group.name }} + {{ group.path }} + {{ group.arn }} + 2012-05-09T16:27:11Z + + + {% endfor %} + + + {% for role in roles %} + + + + {% for policy in role.managed_policies %} + + {{ policy.name }} + {{ policy.arn }} + + {% endfor %} + + + {% for profile in instance_profiles %} + + {{ profile.id }} + + {% for role in profile.roles %} + + {{ role.path }} + {{ role.arn }} + {{ role.name }} + {{ role.assume_role_policy_document }} + 2012-05-09T15:45:35Z + {{ role.id }} + + {% endfor %} + + {{ profile.name }} + {{ profile.path }} + {{ profile.arn }} + 2012-05-09T16:27:11Z + + {% endfor %} + + {{ role.path }} + {{ role.arn }} + {{ role.name }} + {{ role.assume_role_policy_document }} + 2014-07-30T17:09:20Z + {{ role.id }} + + {% endfor %} + + + {% for policy in policies %} + + {{ policy.name }} + {{ policy.default_version_id }} + {{ policy.id }} + {{ policy.path }} + + + + {"Version":"2012-10-17","Statement":{"Effect":"Allow", + "Action":["iam:CreatePolicy","iam:CreatePolicyVersion", + "iam:DeletePolicy","iam:DeletePolicyVersion","iam:GetPolicy", + "iam:GetPolicyVersion","iam:ListPolicies", + "iam:ListPolicyVersions","iam:SetDefaultPolicyVersion"], + "Resource":"*"}} + + true + v1 + 2012-05-09T16:27:11Z + + + {{ policy.arn }} + 1 + 2012-05-09T16:27:11Z + true + 2012-05-09T16:27:11Z + + {% endfor %} + + + + 92e79ae7-7399-11e4-8c85-4b53eEXAMPLE + +""" From b1f7e7311fc191df4eb17bd9931d1d7c8a5b04f4 Mon Sep 17 00:00:00 2001 From: Will Bengtson Date: Tue, 24 Jul 2018 15:02:42 -0700 Subject: [PATCH 3/4] remove old commented out template --- moto/iam/responses.py | 279 ------------------------------------------ 1 file changed, 279 deletions(-) diff --git a/moto/iam/responses.py b/moto/iam/responses.py index bd4ccf45d53a..8718fd439c23 100644 --- a/moto/iam/responses.py +++ b/moto/iam/responses.py @@ -1343,285 +1343,6 @@ def get_account_authorization_details(self): """ -# GET_ACCOUNT_AUTHORIZATION_DETAILS_TEMPLATE = """ -# -# false -# -# -# -# Admins -# -# -# AIDACKCEVSQ6C2EXAMPLE -# / -# Alice -# arn:aws:iam::123456789012:user/Alice -# 2013-10-14T18:32:24Z -# -# -# -# Admins -# -# -# -# -# DenyBillingAndIAMPolicy -# -# {"Version":"2012-10-17","Statement":{"Effect":"Deny","Action": -# ["aws-portal:*","iam:*"],"Resource":"*"}} -# -# -# -# AIDACKCEVSQ6C3EXAMPLE -# / -# Bob -# arn:aws:iam::123456789012:user/Bob -# 2013-10-14T18:32:25Z -# -# -# -# Dev -# -# -# AIDACKCEVSQ6C4EXAMPLE -# / -# Charlie -# arn:aws:iam::123456789012:user/Charlie -# 2013-10-14T18:33:56Z -# -# -# -# Dev -# -# -# AIDACKCEVSQ6C5EXAMPLE -# / -# Danielle -# arn:aws:iam::123456789012:user/Danielle -# 2013-10-14T18:33:56Z -# -# -# -# Finance -# -# -# AIDACKCEVSQ6C6EXAMPLE -# / -# Elaine -# arn:aws:iam::123456789012:user/Elaine -# 2013-10-14T18:57:48Z -# -# -# -# EXAMPLEkakv9BCuUNFDtxWSyfzetYwEx2ADc8dnzfvERF5S6YMvXKx41t6gCl/eeaCX3Jo94/ -# bKqezEAg8TEVS99EKFLxm3jtbpl25FDWEXAMPLE -# -# -# -# AIDACKCEVSQ6C7EXAMPLE -# -# -# AdministratorAccess -# arn:aws:iam::aws:policy/AdministratorAccess -# -# -# Admins -# / -# arn:aws:iam::123456789012:group/Admins -# 2013-10-14T18:32:24Z -# -# -# -# AIDACKCEVSQ6C8EXAMPLE -# -# -# PowerUserAccess -# arn:aws:iam::aws:policy/PowerUserAccess -# -# -# Dev -# / -# arn:aws:iam::123456789012:group/Dev -# 2013-10-14T18:33:55Z -# -# -# -# AIDACKCEVSQ6C9EXAMPLE -# -# Finance -# / -# arn:aws:iam::123456789012:group/Finance -# 2013-10-14T18:57:48Z -# -# -# policygen-201310141157 -# -# {"Version":"2012-10-17","Statement":[{"Action":["aws-portal:*"], -# "Sid":"Stmt1381777017000","Resource":["*"],"Effect":"Allow"}]} -# -# -# -# -# -# -# -# -# -# -# AmazonS3FullAccess -# arn:aws:iam::aws:policy/AmazonS3FullAccess -# -# -# AmazonDynamoDBFullAccess -# arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess -# -# -# -# -# EC2role -# -# -# / -# arn:aws:iam::123456789012:role/EC2role -# EC2role -# -# {"Version":"2012-10-17","Statement":[{"Sid":"", -# "Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"}, -# "Action":"sts:AssumeRole"}]} -# -# 2014-07-30T17:09:20Z -# AROAFP4BKI7Y7TEXAMPLE -# -# -# / -# arn:aws:iam::123456789012:instance-profile/EC2role -# AIPAFFYRBHWXW2EXAMPLE -# 2014-07-30T17:09:20Z -# -# -# / -# arn:aws:iam::123456789012:role/EC2role -# EC2role -# -# {"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow", -# "Principal":{"Service":"ec2.amazonaws.com"}, -# "Action":"sts:AssumeRole"}]} -# -# 2014-07-30T17:09:20Z -# AROAFP4BKI7Y7TEXAMPLE -# -# -# -# -# create-update-delete-set-managed-policies -# v1 -# ANPAJ2UCCR6DPCEXAMPLE -# / -# -# -# -# {"Version":"2012-10-17","Statement":{"Effect":"Allow", -# "Action":["iam:CreatePolicy","iam:CreatePolicyVersion", -# "iam:DeletePolicy","iam:DeletePolicyVersion","iam:GetPolicy", -# "iam:GetPolicyVersion","iam:ListPolicies", -# "iam:ListPolicyVersions","iam:SetDefaultPolicyVersion"], -# "Resource":"*"}} -# -# true -# v1 -# 2015-02-06T19:58:34Z -# -# -# -# arn:aws:iam::123456789012:policy/create-update-delete-set-managed-policies -# -# 1 -# 2015-02-06T19:58:34Z -# true -# 2015-02-06T19:58:34Z -# -# -# S3-read-only-specific-bucket -# v1 -# ANPAJ4AE5446DAEXAMPLE -# / -# -# -# -# {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action": -# ["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::example-bucket", -# "arn:aws:s3:::example-bucket/*"]}]} -# -# true -# v1 -# 2015-01-21T21:39:41Z -# -# -# arn:aws:iam::123456789012:policy/S3-read-only-specific-bucket -# 1 -# 2015-01-21T21:39:41Z -# true -# 2015-01-21T23:39:41Z -# -# -# AWSOpsWorksRole -# v1 -# ANPAE376NQ77WV6KGJEBE -# /service-role/ -# -# -# -# {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action": -# ["cloudwatch:GetMetricStatistics","ec2:DescribeAccountAttributes", -# "ec2:DescribeAvailabilityZones","ec2:DescribeInstances", -# "ec2:DescribeKeyPairs","ec2:DescribeSecurityGroups","ec2:DescribeSubnets", -# "ec2:DescribeVpcs","elasticloadbalancing:DescribeInstanceHealth", -# "elasticloadbalancing:DescribeLoadBalancers","iam:GetRolePolicy", -# "iam:ListInstanceProfiles","iam:ListRoles","iam:ListUsers", -# "iam:PassRole","opsworks:*","rds:*"],"Resource":["*"]}]} -# -# true -# v1 -# 2014-12-10T22:57:47Z -# -# -# arn:aws:iam::aws:policy/service-role/AWSOpsWorksRole -# 1 -# 2015-02-06T18:41:27Z -# true -# 2015-02-06T18:41:27Z -# -# -# AmazonEC2FullAccess -# v1 -# ANPAE3QWE5YT46TQ34WLG -# / -# -# -# -# {"Version":"2012-10-17","Statement":[{"Action":"ec2:*", -# "Effect":"Allow","Resource":"*"},{"Effect":"Allow", -# "Action":"elasticloadbalancing:*","Resource":"*"},{"Effect":"Allow", -# "Action":"cloudwatch:*","Resource":"*"},{"Effect":"Allow", -# "Action":"autoscaling:*","Resource":"*"}]} -# -# true -# v1 -# 2014-10-30T20:59:46Z -# -# -# arn:aws:iam::aws:policy/AmazonEC2FullAccess -# 1 -# 2015-02-06T18:40:15Z -# true -# 2015-02-06T18:40:15Z -# -# -# -# -# 92e79ae7-7399-11e4-8c85-4b53eEXAMPLE -# -# """ GET_ACCOUNT_AUTHORIZATION_DETAILS_TEMPLATE = """ false From e6dd9cbd0da16aecf6b44f96599ff178dfc8a09e Mon Sep 17 00:00:00 2001 From: Will Bengtson Date: Tue, 24 Jul 2018 15:30:04 -0700 Subject: [PATCH 4/4] Fix flake8 problems and add unit test --- moto/iam/models.py | 16 ++++++++-- moto/iam/responses.py | 1 - tests/test_iam/test_iam.py | 65 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 78 insertions(+), 4 deletions(-) diff --git a/moto/iam/models.py b/moto/iam/models.py index 243a4e3f37d9..697be798884e 100644 --- a/moto/iam/models.py +++ b/moto/iam/models.py @@ -910,6 +910,15 @@ def get_account_authorization_details(self, filter): local_policies = set(policies) - set(aws_managed_policies) returned_policies = [] + if len(filter) == 0: + return { + 'instance_profiles': self.instance_profiles.values(), + 'roles': self.roles.values(), + 'groups': self.groups.values(), + 'users': self.users.values(), + 'managed_policies': self.managed_policies.values() + } + if 'AWSManagedPolicy' in filter: returned_policies = aws_managed_policies if 'LocalManagedPolicy' in filter: @@ -917,10 +926,11 @@ def get_account_authorization_details(self, filter): return { 'instance_profiles': self.instance_profiles.values(), - 'roles': self.roles.values(), - 'groups': self.groups.values(), - 'users': self.users.values(), + 'roles': self.roles.values() if 'Role' in filter else [], + 'groups': self.groups.values() if 'Group' in filter else [], + 'users': self.users.values() if 'User' in filter else [], 'managed_policies': returned_policies } + iam_backend = IAMBackend() diff --git a/moto/iam/responses.py b/moto/iam/responses.py index 8718fd439c23..9c1241c365cd 100644 --- a/moto/iam/responses.py +++ b/moto/iam/responses.py @@ -1462,4 +1462,3 @@ def get_account_authorization_details(self): 92e79ae7-7399-11e4-8c85-4b53eEXAMPLE """ - diff --git a/tests/test_iam/test_iam.py b/tests/test_iam/test_iam.py index 182a606613a6..2225f0644604 100644 --- a/tests/test_iam/test_iam.py +++ b/tests/test_iam/test_iam.py @@ -678,3 +678,68 @@ def test_update_access_key(): Status='Inactive') resp = client.list_access_keys(UserName=username) resp['AccessKeyMetadata'][0]['Status'].should.equal('Inactive') + + +@mock_iam +def test_get_account_authorization_details(): + import json + conn = boto3.client('iam', region_name='us-east-1') + conn.create_role(RoleName="my-role", AssumeRolePolicyDocument="some policy", Path="/my-path/") + conn.create_user(Path='/', UserName='testCloudAuxUser') + conn.create_group(Path='/', GroupName='testCloudAuxGroup') + conn.create_policy( + PolicyName='testCloudAuxPolicy', + Path='/', + PolicyDocument=json.dumps({ + "Version": "2012-10-17", + "Statement": [ + { + "Action": "s3:ListBucket", + "Resource": "*", + "Effect": "Allow", + } + ] + }), + Description='Test CloudAux Policy' + ) + + result = conn.get_account_authorization_details(Filter=['Role']) + len(result['RoleDetailList']) == 1 + len(result['UserDetailList']) == 0 + len(result['GroupDetailList']) == 0 + len(result['Policies']) == 0 + + result = conn.get_account_authorization_details(Filter=['User']) + len(result['RoleDetailList']) == 0 + len(result['UserDetailList']) == 1 + len(result['GroupDetailList']) == 0 + len(result['Policies']) == 0 + + result = conn.get_account_authorization_details(Filter=['Group']) + len(result['RoleDetailList']) == 0 + len(result['UserDetailList']) == 0 + len(result['GroupDetailList']) == 1 + len(result['Policies']) == 0 + + result = conn.get_account_authorization_details(Filter=['LocalManagedPolicy']) + len(result['RoleDetailList']) == 0 + len(result['UserDetailList']) == 0 + len(result['GroupDetailList']) == 0 + len(result['Policies']) == 1 + + # Check for greater than 1 since this should always be greater than one but might change. + # See iam/aws_managed_policies.py + result = conn.get_account_authorization_details(Filter=['AWSManagedPolicy']) + len(result['RoleDetailList']) == 0 + len(result['UserDetailList']) == 0 + len(result['GroupDetailList']) == 0 + len(result['Policies']) > 1 + + result = conn.get_account_authorization_details() + len(result['RoleDetailList']) == 1 + len(result['UserDetailList']) == 1 + len(result['GroupDetailList']) == 1 + len(result['Policies']) > 1 + + +