Skip to content
Python library for AWS Access Policy Language creation
Branch: master
Clone or download
Latest commit 72bb7e2 Feb 23, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
awacs Release 0.8.3 Feb 23, 2019
examples pep8 fix for line length Jun 23, 2016
tests Emit proper ARN's for regionless services (#103) Jul 23, 2018
tools Add missing actions for Firehose (#113) Feb 23, 2019
.gitignore Add secrets manager (#108) Dec 5, 2018
.travis.yml Emit proper ARN's for regionless services (#103) Jul 23, 2018
CHANGELOG.md Release 0.8.3 Feb 23, 2019
CODE_OF_CONDUCT.md Create CODE_OF_CONDUCT.md (#69) Jun 13, 2017
LICENSE Initial commit Mar 27, 2013
MANIFEST.in
Makefile
README.rst
RELEASE.md
setup.py Release 0.8.3 Feb 23, 2019

README.rst

awacs

https://travis-ci.org/cloudtools/awacs.png?branch=master

About

awacs - Amazon Web Access Control Subsystem

The awacs library allows for easier creation of AWS Access Policy Language JSON by writing Python code to describe the AWS policies. To facilitate catching policy format or JSON errors early the library has property and type checking built into the classes.

NOTE: The old awacs.aws.Policy object is going to be deprecated in the future, in preference for the awacs.aws.PolicyDocument class. This is due to confusion that arises between the old object and troposphere.iam.Policy objects.

Installation

awacs can be installed using the pip distribution system for python by issuing:

$ pip install awacs

Alternatively, you can run use setup.py to install by cloning this repository and issuing:

$ python setup.py install

Examples

An example to use this comes from the AWS IAM documentation. This shows creating policy attached to an Amazon S3 bucket:

from awacs.aws import Action, Allow, PolicyDocument, Principal, Statement
from awacs.iam import ARN as IAM_ARN
from awacs.s3  import ARN as S3_ARN

account = "123456789012"
user = "user/Bob"

pd = PolicyDocument(
    Version="2012-10-17",
    Id="S3-Account-Permissions",
    Statement=[
        Statement(
            Sid="1",
            Effect=Allow,
            Principal=Principal("AWS", [IAM_ARN(user, '', account)]),
            Action=[Action("s3", "*")],
            Resource=[S3_ARN("my_corporate_bucket/*"),],
        ),
    ],
)
print(pd.to_json())

would produce this json policy:

{
    "Id": "S3-Account-Permissions",
    "Statement": [
        {
            "Action": [
                "s3:*"
            ],
            "Effect": "Allow",
            "Principal": [
                {
                    "AWS": [
                        "arn:aws:iam::123456789012:user/Bob"
                    ]
                }
            ],
            "Resource": [
                "arn:aws:s3:::my_corporate_bucket/*"
            ],
            "Sid": "1"
        }
    ],
    "Version": "2012-10-17"
}

Community

We have a google group, cloudtools-dev, where you can ask questions and engage with the cloudtools/awacs community. Issues & pull requests are always welcome!

Contributing new actions

To update actions there is a generator tool which will pull policies from an AWS resource and auto-generate new files. The following commands can be run to update the repo:

$ pip install -r tools/requirements.txt
$ rm -rf generated/
$ python tools/gen.py
$ diff -u awacs generated
$ mv generated/*.py awacs
$ git diff

Since not all of the actions appear in the AWS policy file it is sometimes required to add these extra actions to the tools/gen.py file.

You can’t perform that action at this time.