AWS IAM policy generation from application code
:construction: EXPERIMENTAL :construction:
IAM policy generation from application code
npm i -g iamfast
You can also install iamfast as a Visual Studio Code extension.
Execute iamfast
with the first argument being the file or directory (currently slow, not yet recommended) to be scanned.
iamfast yourfile.js
iamfast supports the following programming languages:
--format <type>
: Sets the format of the output, currently supporting json
(default), yaml
, hcl
and sam
> cat tests/js/test1.js
// Load the AWS SDK for Node.js
var AWS = require('aws-sdk');
// Set the region
AWS.config.update({region: 'us-east-1'});
// Create the DynamoDB service object
var ddb = new AWS.DynamoDB({apiVersion: '2012-08-10'});
var params = {
TableName: 'CUSTOMER_LIST',
Item: {
'CUSTOMER_ID' : {N: '001'},
'CUSTOMER_NAME' : {S: 'Richard Roe'}
}
};
// Call DynamoDB to add the item to the table
ddb.putItem(params, function(err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
> iamfast tests/js/test1.js
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "dynamodb:PutItem",
"Resource": [
"arn:aws:dynamodb:us-east-1:123456789012:table/CUSTOMER_LIST"
]
}
]
}
To run tests:
npm test
src/AWSParser.js
- Generates token streams and calls walkers for individual languages, also maps resource instantiationssrc/EnvironmentVariable.js
- Dedicated class for environment variable typesrc/IAMFast.js
- Generates the actual policies / outputs by referencing the action map and calling AWSParser.js
functionssrc/main.js
- CLI setup and entrypoint for non-module usesrc/lib/<Language>ScopeListener.js
- Custom listener hooks to track variable and function declarations (1st pass)src/lib/<Language>AWSListener.js
- Custom listener hooks to track client calls etc. (2nd pass)src/lib/<Language>Parser.js
- Auto-generated (ANTLR) language parser logicgrammars/<Language>Parser.js
- Individual ANTLR language definitions, used to generate src/lib/<Language>Parser.js