Support for AWS managed policies

[akefirad]

This is more of a discussion than a specific feature.
There are cases that we need to work with AWS managed policies, (e.g. attach them to a role). This might seem to be out of scope of this library, but I think it adds enough value to justify including it into this library.
Specifically two use cases come to my mind:

1. Having AWS managed policies available to be able to use instead of cdk.iam.ManagedPolicy.fromAwsManagedPolicyName("SomeAwsManagedPolicy"). Even having their name as a constant would be nice.
2. Being able to create policies based on AWS managed policies. For example, we have a case in which we create our own managed policies based on AWS managed policies but on slightly different resources (or with different conditions). Currently I downloaded the policy document of all AWS managed policies as JSON and import them into my code.

[udondan]

I like that!

The first one would be pretty straightforward.

The 2nd seems to be quite tricky though. It would be easy to make them available as collection or something similar. But how would you, on the fly, inject conditions/resources or make other changes to the statements? Most of those policies contain multiple statements and conditions/resources will only make sense on one/some statement(s) of a policy. How would you apply it to the correct statement? There also is quite some movement on those policies and neither the order nor the SID is guaranteed to be static. Applying a change would require to select a specific version of a policy. So we would need to store every version of all AWS policies.... ooof. But even with this in place, I fear the API wouldn't feel very convenient. It would feel much like jq manipulation, where you won't understand your query 15 minutes after you've written it. 😹

Another thing I could imagine, would be some cli/online helper tool, where a user can paste any JSON policy in and it generates Floyd code, where then of course you can make adjustments to your needs. In fact, I would have loved to have this tool in the past months when migrating old CFN templates to CDK+Floyd code. 😸

[akefirad]

Fair enough. I can think of a way to manage versions, but first the value should justify the cost. I'm not sure about the exact API that might be useful either. You're right, customizing managed policy is not straightforward (it was easy in my case though, since those I was interested were all single statement). I also support your idea about a helper to convert JOSN documents to iam-floyd objects. Let me know if I can help with anything.

[udondan]

I started a prototype of an online converter tool in the policy-converter branch. It is integrated in the online documentation and can be previewed here: https://iam-floyd.readthedocs.io/en/policy-converter/policy-converter.html. Paste JSON in the upper field, push the JavaScript or Python button and some code should show up in the lower field.

In case you want to check it out or contribute, here is how to work with the docs locally:

• HTML is in /docs/source/policy-converter.rst
• CSS is in /docs/source/_static/css/custom.css
• JS is in /docs/source/_static/js/policy-converter.js

After any of the files have been modified, you need to call make docs. (probably won't work on Windows). This will generate the static HTML page. The HTML file then can just be opened in the browser: /docs/build/html/policy-converter.html

Todos:

• Support for actions with wildcards
• Support for notAction/notResource/notPrincipal
• Principal logic, this is more tricky than all the other elements
• Python method names need to be snake case instead of camel case
• Styling of the form
• Implement statements into policy object/document
  • Needs form options to select if the user wants CDK or Standalone code
• Code generation for Java / .Net
• Find solution to include the page only in the HTML version of the documentation and skip from PDF and EPUB
• Import managed policies from AWS (requires to fetch all policies and store the JSON content in the docs/_static folder (needs to be updated daily via GitHub action generate))
• Probably a lot of other stuff I haven't thought of

[udondan]

You can now import any AWS managed policy.

This functionality will not work when served via file:// protocol locally. So if you want to run it locally, you need to serve the dir /docs/build/html though a http server.

[udondan]

Except .Net/Java, everything should be covered. I hadn't have time yet to test if the generated code for all languages actually runs. But it looks good. 😸

[akefirad]

Thanks man. I'll try to test it later.

[udondan]

The online policy converter is now live: https://iam-floyd.readthedocs.io/en/latest/policy-converter.html