IAM Floyd
Attention
IAM Floyd has not reached 1.0.0 yet, and the API can still change between releases. Pin the exact version of the package.
AWS IAM policy statement generator with a fluent interface, for TypeScript, JavaScript, Python, Java, C# and Go.
IAM Floyd has a class for every AWS service, with a method for every action, resource type and condition key. Your IDE completes them and shows their documentation, so you neither look up action names and ARN formats, nor deploy policies with typos.
It comes in two variants: iam-floyd creates statements as JSON, for the AWS SDKs or anything else that takes an IAM policy, and cdk-iam-floyd creates statements of the AWS CDK. See Packages to choose and install one, and Getting Started for the first steps.
const policy = {
Version: '2012-10-17',
Statement: [
new Statement.Ec2()
.allow()
.toStartInstances()
.ifAwsRequestTag('Owner', '${aws:username}'),
new Statement.Ec2()
.allow()
.toStopInstances()
.ifResourceTag('Owner', '${aws:username}'),
new Statement.Ec2() //
.allow()
.allListActions()
.allReadActions(),
],
};
policy = iam.PolicyDocument(
statements=[
Statement.Ec2()
.allow()
.to_start_instances()
.if_aws_request_tag('Owner', '${aws:username}'),
Statement.Ec2()
.allow()
.to_stop_instances()
.if_resource_tag('Owner', '${aws:username}'),
Statement.Ec2()
.allow()
.all_list_actions()
.all_read_actions(),
],
)
PolicyDocument policy = PolicyDocument.Builder.create()
.statements(List.of(
new Ec2()
.allow()
.toStartInstances()
.ifAwsRequestTag("Owner", "${aws:username}"),
new Ec2()
.allow()
.toStopInstances()
.ifResourceTag("Owner", "${aws:username}"),
new Ec2()
.allow()
.allListActions()
.allReadActions()))
.build();
var policy = new PolicyDocument(new PolicyDocumentProps
{
Statements = new PolicyStatement[]
{
new Statement.Ec2()
.Allow()
.ToStartInstances()
.IfAwsRequestTag("Owner", "${aws:username}"),
new Statement.Ec2()
.Allow()
.ToStopInstances()
.IfResourceTag("Owner", "${aws:username}"),
new Statement.Ec2()
.Allow()
.AllListActions()
.AllReadActions(),
},
});
policy := awsiam.NewPolicyDocument(&awsiam.PolicyDocumentProps{
Statements: &[]awsiam.PolicyStatement{
statement.NewEc2(nil).
Allow().
ToStartInstances().
IfAwsRequestTag(jsii.String("Owner"), jsii.String("${aws:username}"), nil),
statement.NewEc2(nil).
Allow().
ToStopInstances().
IfResourceTag(jsii.String("Owner"), jsii.String("${aws:username}"), nil),
statement.NewEc2(nil).
Allow().
AllListActions().
AllReadActions(),
},
})
{
"Version": "2012-10-17",
"Statement": [
{
"Condition": {
"StringLike": {
"aws:RequestTag/Owner": "${aws:username}"
}
},
"Action": "ec2:StartInstances",
"Resource": "*",
"Effect": "Allow"
},
{
"Condition": {
"StringLike": {
"ec2:ResourceTag/Owner": "${aws:username}"
}
},
"Action": "ec2:StopInstances",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ec2:DescribeAccountAttributes",
"ec2:DescribeAccountVpcEncryptionControl",
"ec2:DescribeAddressTransfers",
"ec2:DescribeAddresses",
"ec2:DescribeAddressesAttribute",
"ec2:DescribeAggregateIdFormat",
"ec2:DescribeApplicationStatus",
"ec2:DescribeApplicationStatusCheckAssociations",
"ec2:DescribeApplicationStatusChecks",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeAwsNetworkPerformanceMetricSubscriptions",
"ec2:DescribeBundleTasks",
"ec2:DescribeByoipCidrs",
"ec2:DescribeCapacityBlockExtensionHistory",
"ec2:DescribeCapacityBlockExtensionOfferings",
"ec2:DescribeCapacityBlockOfferings",
"ec2:DescribeCapacityBlockStatus",
"ec2:DescribeCapacityBlocks",
"ec2:DescribeCapacityManagerDataExports",
"ec2:DescribeCapacityReservationBillingRequests",
"ec2:DescribeCapacityReservationCancellationQuotes",
"ec2:DescribeCapacityReservationFleets",
"ec2:DescribeCapacityReservationTopology",
"ec2:DescribeCapacityReservations",
"ec2:DescribeCarrierGateways",
"ec2:DescribeClassicLinkInstances",
"ec2:DescribeClientVpnAuthorizationRules",
"ec2:DescribeClientVpnConnections",
"ec2:DescribeClientVpnEndpoints",
"ec2:DescribeClientVpnRoutes",
"ec2:DescribeClientVpnTargetNetworks",
"ec2:DescribeCoipPools",
"ec2:DescribeConversionTasks",
"ec2:DescribeCustomerGateways",
"ec2:DescribeDeclarativePoliciesReports",
"ec2:DescribeDhcpOptions",
"ec2:DescribeEgressOnlyInternetGateways",
"ec2:DescribeElasticGpus",
"ec2:DescribeExportImageTasks",
"ec2:DescribeExportTasks",
"ec2:DescribeFastLaunchImages",
"ec2:DescribeFastSnapshotRestores",
"ec2:DescribeFleetHistory",
"ec2:DescribeFleetInstances",
"ec2:DescribeFleets",
"ec2:DescribeFlowLogs",
"ec2:DescribeFpgaImageAttribute",
"ec2:DescribeFpgaImages",
"ec2:DescribeHostReservationOfferings",
"ec2:DescribeHostReservations",
"ec2:DescribeHosts",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeIdFormat",
"ec2:DescribeIdentityIdFormat",
"ec2:DescribeImageAttribute",
"ec2:DescribeImageReferences",
"ec2:DescribeImageUsageReportEntries",
"ec2:DescribeImageUsageReports",
"ec2:DescribeImages",
"ec2:DescribeImportImageTasks",
"ec2:DescribeImportSnapshotTasks",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceConnectEndpoints",
"ec2:DescribeInstanceCreditSpecifications",
"ec2:DescribeInstanceEventNotificationAttributes",
"ec2:DescribeInstanceEventWindows",
"ec2:DescribeInstanceImageMetadata",
"ec2:DescribeInstanceSqlHaHistoryStates",
"ec2:DescribeInstanceSqlHaStates",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTopology",
"ec2:DescribeInstanceTypeOfferings",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeIpamByoasn",
"ec2:DescribeIpamExternalResourceVerificationTokens",
"ec2:DescribeIpamInternetRegistryAssociations",
"ec2:DescribeIpamPolicies",
"ec2:DescribeIpamPoolAllocations",
"ec2:DescribeIpamPools",
"ec2:DescribeIpamPrefixListResolverTargets",
"ec2:DescribeIpamPrefixListResolvers",
"ec2:DescribeIpamResourceDiscoveries",
"ec2:DescribeIpamResourceDiscoveryAssociations",
"ec2:DescribeIpamScopes",
"ec2:DescribeIpams",
"ec2:DescribeIpv6Pools",
"ec2:DescribeKeyPairs",
"ec2:DescribeLaunchTemplateVersions",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeLocalGatewayRouteTablePermissions",
"ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
"ec2:DescribeLocalGatewayRouteTableVpcAssociations",
"ec2:DescribeLocalGatewayRouteTables",
"ec2:DescribeLocalGatewayVirtualInterfaceGroups",
"ec2:DescribeLocalGatewayVirtualInterfaces",
"ec2:DescribeLocalGateways",
"ec2:DescribeLockedSnapshots",
"ec2:DescribeMacHosts",
"ec2:DescribeMacModificationTasks",
"ec2:DescribeManagedPrefixLists",
"ec2:DescribeMovingAddresses",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkAcls",
"ec2:DescribeNetworkInsightsAccessScopeAnalyses",
"ec2:DescribeNetworkInsightsAccessScopes",
"ec2:DescribeNetworkInsightsAnalyses",
"ec2:DescribeNetworkInsightsPaths",
"ec2:DescribeNetworkInterfaceAttribute",
"ec2:DescribeNetworkInterfacePermissions",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeOutpostLags",
"ec2:DescribePlacementGroups",
"ec2:DescribePrefixLists",
"ec2:DescribePrincipalIdFormat",
"ec2:DescribePublicIpv4Pools",
"ec2:DescribeRegions",
"ec2:DescribeReplaceRootVolumeTasks",
"ec2:DescribeReservedInstances",
"ec2:DescribeReservedInstancesListings",
"ec2:DescribeReservedInstancesModifications",
"ec2:DescribeReservedInstancesOfferings",
"ec2:DescribeRouteServerEndpoints",
"ec2:DescribeRouteServerPeers",
"ec2:DescribeRouteServers",
"ec2:DescribeRouteTables",
"ec2:DescribeScheduledInstanceAvailability",
"ec2:DescribeScheduledInstances",
"ec2:DescribeSecondaryInterfaces",
"ec2:DescribeSecondaryNetworks",
"ec2:DescribeSecondarySubnets",
"ec2:DescribeSecurityGroupReferences",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroupVpcAssociations",
"ec2:DescribeSecurityGroups",
"ec2:DescribeServiceLinkVirtualInterfaces",
"ec2:DescribeSnapshotAttribute",
"ec2:DescribeSnapshotTierStatus",
"ec2:DescribeSnapshots",
"ec2:DescribeSpotDatafeedSubscription",
"ec2:DescribeSpotFleetInstances",
"ec2:DescribeSpotFleetRequestHistory",
"ec2:DescribeSpotFleetRequests",
"ec2:DescribeSpotInstanceRequests",
"ec2:DescribeSpotPriceHistory",
"ec2:DescribeStaleSecurityGroups",
"ec2:DescribeStoreImageTasks",
"ec2:DescribeSubnets",
"ec2:DescribeTags",
"ec2:DescribeTrafficMirrorFilterRules",
"ec2:DescribeTrafficMirrorFilters",
"ec2:DescribeTrafficMirrorSessions",
"ec2:DescribeTrafficMirrorTargets",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeTransitGatewayConnectPeers",
"ec2:DescribeTransitGatewayConnects",
"ec2:DescribeTransitGatewayMeteringPolicies",
"ec2:DescribeTransitGatewayMulticastDomains",
"ec2:DescribeTransitGatewayPeeringAttachments",
"ec2:DescribeTransitGatewayPolicyTables",
"ec2:DescribeTransitGatewayRouteTableAnnouncements",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeTransitGateways",
"ec2:DescribeTrunkInterfaceAssociations",
"ec2:DescribeVerifiedAccessEndpoints",
"ec2:DescribeVerifiedAccessGroups",
"ec2:DescribeVerifiedAccessInstanceLoggingConfigurations",
"ec2:DescribeVerifiedAccessInstanceWebAclAssociations",
"ec2:DescribeVerifiedAccessInstances",
"ec2:DescribeVerifiedAccessTrustProviders",
"ec2:DescribeVolumeAttribute",
"ec2:DescribeVolumeStatus",
"ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcBlockPublicAccessExclusions",
"ec2:DescribeVpcBlockPublicAccessOptions",
"ec2:DescribeVpcClassicLink",
"ec2:DescribeVpcClassicLinkDnsSupport",
"ec2:DescribeVpcEncryptionControls",
"ec2:DescribeVpcEndpointAssociations",
"ec2:DescribeVpcEndpointConnectionNotifications",
"ec2:DescribeVpcEndpointConnections",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcEndpointServicePermissions",
"ec2:DescribeVpcEndpointServices",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConcentrators",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ec2:ExportClientVpnClientCertificateRevocationList",
"ec2:ExportClientVpnClientConfiguration",
"ec2:ExportVerifiedAccessInstanceClientConfiguration",
"ec2:GetActiveVpnTunnelStatus",
"ec2:GetAllowedImagesSettings",
"ec2:GetAssociatedEnclaveCertificateIamRoles",
"ec2:GetAssociatedIpv6PoolCidrs",
"ec2:GetAwsNetworkPerformanceData",
"ec2:GetCapacityManagerAttributes",
"ec2:GetCapacityManagerMetricData",
"ec2:GetCapacityManagerMetricDimensions",
"ec2:GetCapacityManagerMonitoredTagKeys",
"ec2:GetCapacityReservationUsage",
"ec2:GetCoipPoolUsage",
"ec2:GetConsoleOutput",
"ec2:GetConsoleScreenshot",
"ec2:GetDeclarativePoliciesReportSummary",
"ec2:GetDefaultCreditSpecification",
"ec2:GetEbsDefaultKmsKeyId",
"ec2:GetEbsEncryptionByDefault",
"ec2:GetEnabledIpamPolicy",
"ec2:GetFlowLogsIntegrationTemplate",
"ec2:GetGroupsForCapacityReservation",
"ec2:GetHostReservationPurchasePreview",
"ec2:GetImageAncestry",
"ec2:GetImageBlockPublicAccessState",
"ec2:GetInstanceMetadataDefaults",
"ec2:GetInstanceTpmEkPub",
"ec2:GetInstanceTypesFromInstanceRequirements",
"ec2:GetInstanceUefiData",
"ec2:GetIpamAddressHistory",
"ec2:GetIpamDiscoveredAccounts",
"ec2:GetIpamDiscoveredPublicAddresses",
"ec2:GetIpamDiscoveredResourceCidrs",
"ec2:GetIpamDiscoveredRoutes",
"ec2:GetIpamInternetRegistryAssociationAsns",
"ec2:GetIpamInternetRegistryAssociationCidrs",
"ec2:GetIpamPolicyAllocationRules",
"ec2:GetIpamPolicyOrganizationTargets",
"ec2:GetIpamPoolAllocations",
"ec2:GetIpamPoolCidrs",
"ec2:GetIpamPrefixListResolverRules",
"ec2:GetIpamPrefixListResolverVersionEntries",
"ec2:GetIpamPrefixListResolverVersions",
"ec2:GetIpamResourceCidrs",
"ec2:GetIpamRouteOriginAuthorizations",
"ec2:GetIpamRouteProtectionFindings",
"ec2:GetIpamRoutingPolicyRegistrationDeltas",
"ec2:GetIpamRoutingPolicyRegistrations",
"ec2:GetLaunchTemplateData",
"ec2:GetManagedPrefixListAssociations",
"ec2:GetManagedPrefixListEntries",
"ec2:GetManagedResourceVisibility",
"ec2:GetNetworkInsightsAccessScopeAnalysisFindings",
"ec2:GetNetworkInsightsAccessScopeContent",
"ec2:GetPasswordData",
"ec2:GetReservedInstancesExchangeQuote",
"ec2:GetResourcePolicy",
"ec2:GetRouteServerAssociations",
"ec2:GetRouteServerPropagations",
"ec2:GetRouteServerRoutingDatabase",
"ec2:GetSecurityGroupsForVpc",
"ec2:GetSerialConsoleAccessStatus",
"ec2:GetSnapshotBlockPublicAccessState",
"ec2:GetSpotPlacementScores",
"ec2:GetSubnetCidrReservations",
"ec2:GetTransitGatewayAttachmentPropagations",
"ec2:GetTransitGatewayMeteringPolicyEntries",
"ec2:GetTransitGatewayMulticastDomainAssociations",
"ec2:GetTransitGatewayPolicyTableAssociations",
"ec2:GetTransitGatewayPolicyTableEntries",
"ec2:GetTransitGatewayPrefixListReferences",
"ec2:GetTransitGatewayRouteTableAssociations",
"ec2:GetTransitGatewayRouteTablePropagations",
"ec2:GetVerifiedAccessEndpointPolicy",
"ec2:GetVerifiedAccessEndpointTargets",
"ec2:GetVerifiedAccessGroupPolicy",
"ec2:GetVerifiedAccessInstanceWebAcl",
"ec2:GetVpcResourcesBlockingEncryptionEnforcement",
"ec2:GetVpnConnectionDeviceSampleConfiguration",
"ec2:GetVpnConnectionDeviceTypes",
"ec2:GetVpnTunnelReplacementStatus",
"ec2:ListImagesInRecycleBin",
"ec2:ListSnapshotsInRecycleBin",
"ec2:ListVolumesInRecycleBin",
"ec2:SearchLocalGatewayRoutes",
"ec2:SearchTransitGatewayMulticastGroups",
"ec2:SearchTransitGatewayRoutes",
"ec2:StartDeclarativePoliciesReport",
"ec2:ValidateSecurityGroupQuotasForInterface"
],
"Resource": "*",
"Effect": "Allow"
}
]
}
Support for:
455 Services
22036 Actions
2329 Resource Types
2497 Condition keys