botool

Hopefully useful botocore scripts for managing aws resources

TODO

IAM

• add backup flag to write out settings to file(s)
• add capacity to remove users, groups, and roles
• tests
• allow "users" to have individual policies

Example Config

service: IAM

groups:
  - group_name: "group1"
    policy_name: "allow-rw-to-s3"
    policy_document: "example-allow-rw-to-s3.json"
  - group_name: "group2"
    policy_name: "allow-rw-to-s3"
    policy_document: "example-allow-rw-to-s3.json"
  - group_name: "group3"
    policy_name: "allow-rw-to-s3"
    policy_document: "example-allow-rw-to-s3.json"

users:
  - user_name: "user1"
    groups: [group2, group1]
  - user_name: "user2"
    groups: [group1]
  - user_name: "user3"
    groups: [group3, group2, group1]
  - user_name: "user4"
    groups: [group2, group3]

roles:
  - role_name: "role1-service"
    policy_name: "allow-rw-to-s3"
    assume_role_policy_document: "allow-assume-role-by-ec2-service.json"
    policy_document: "example-allow-rw-to-s3.json"
  - role_name: "role2-service"
    policy_name: "allow-rw-to-s3"
    assume_role_policy_document: "allow-assume-role-by-ec2-service.json"
    policy_document: "example-allow-rw-to-s3.json"
  - role_name: "role3-service"
    policy_name: "allow-rw-to-s3"
    assume_role_policy_document: "allow-assume-role-by-ec2-service.json"
    policy_document: "example-allow-rw-to-s3.json"

Example Policies

allow-assume-role-by-ec2-service.json

{
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
                ],
            "Principal":
            {
                "Service" :
                [
                    "ec2.amazonaws.com"
                ]
            }
        }
    ]
}

example-allow-rw-to-s3.json

{
    "Version":"2012-10-17",
    "Statement":
        [
            {
                "Effect":"Allow",
                "Action":
                [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:ListMultipartUploadParts",
                "s3:PutObject",
                "s3:PutObjectAcl"
                ],
                "Resource":
                    [
                    "arn:aws:s3:::hqmigrat-stage/*"
                    ]
            },
            {
                "Sid":"Stmt1391189122000",
                "Effect":"Allow",
                "Action":
                [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:ListMultipartUploadParts",
                "s3:PutObject",
                "s3:PutObjectAcl"
                ],
                "Resource":
                [
                "arn:aws:s3:::hqmigrat-prod/*"
                ]
            }
        ]
}