s3-credentials list-user-policies command

[simonw]

Since the implementation of #3 is going to start adding inline policies to users, having a command to see those policies will be useful.

It can look similar to list-users from #4.

[simonw]

This will have to make N+1 calls - list_user_policies only returns the policy names: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iam.html#IAM.Client.list_user_policies

Then call get_user_policy for each one to retrieve the policy details: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iam.html#IAM.Client.get_user_policy

[simonw]

Made a start on this:

@cli.command()
@click.argument("username")
@click.option("--array", help="Output a valid JSON array", is_flag=True)
@click.option("--nl", help="Output newline-delimited JSON", is_flag=True)
def list_user_policies(username, array, nl):
    "List inline policies for specified user"
    iam = boto3.client("iam")
    paginator = iam.get_paginator("list_user_policies")
    gathered = []
    for response in paginator.paginate(UserName=username):
        print(response)

But I can't try it out yet because I haven't written any inline policies to anyone - so back to work on #3 instead.

[simonw]

I'm going to have this accept 0 or more usernames - if you pass none it will loop through all users.

[simonw]

Better version:

@cli.command()
@click.argument("usernames", nargs=-1)
def list_user_policies(usernames):
    "List inline policies for specified user"
    iam = boto3.client("iam")
    if not usernames:
        usernames = []
        paginator = iam.get_paginator("list_users")
        for response in paginator.paginate():
            for user in response["Users"]:
                usernames.append(user["UserName"])

    paginator = iam.get_paginator("list_user_policies")
    for username in usernames:
        click.echo("User: {}".format(username))
        for response in paginator.paginate(UserName=username):
            for policy_name in response["PolicyNames"]:
                click.echo("PolicyName: {}".format(policy_name))
                policy_response = iam.get_user_policy(
                    UserName=username, PolicyName=policy_name
                )
                click.echo(
                    json.dumps(policy_response["PolicyDocument"], indent=4, default=str)
                )