Programmatic access to AWS IAM users policy and access

0
votes

I have an app that uses the AWS SDK iOS 2.9.10 to login an AWS IAM user to his/hers AWS S3 account. I would like to be able to assess whether the user has read/write access to various S3 buckets under the account. Basically, I would like to programmatically do this:

aws iam list-user-policies --user-name IAM_User_Name

aws iam get-user-policy --user-name IAM_User_Name --policy-name IAM_Policy_Name

Using these outputs to know which S3 bucket to which IAM user has access, I could then check the Action field in the IAM policy if it allows permission like "s3:GetObject" or "s3:" and resource field contains the value as "arn:aws:s3:::examplebucket/" or "*". If both applicable then IAM user has permission to the S3 "examplebucket".

However, I am unable to figure out if this kind of IAM access is possible programmatically using AWS SDK iOS (Swift or Objective-C) so any help would be very useful.

1
objective-cswiftamazon-web-servicesamazon-s3aws-amplify

1 Answers

1
votes

I think this feature is not provided by the AWS SDK iOS since there is an open issue on GitHub which was closed unanswered. [1]

Instead, you can query the service directly using the service's so called IAM Query API [2].
AWS states that:

AWS provides SDKs that consist of libraries and sample code for various programming languages and platforms (Java, Ruby, .NET, iOS, Android, etc.). The SDKs provide a convenient way to create programmatic access to IAM and AWS. For example, the SDKs take care of tasks such as cryptographically signing requests (see below), managing errors, and retrying requests automatically. For information about the AWS SDKs, including how to download and install them, see the Tools for Amazon Web Services page.

Unfortunately the iOS SDK is not officially supported by the IAM service. That is why the IAM service endpoints are not included in the iOS SDK. You could try to open another feature request on GitHub though...

If you decide to implement the HTTP client and proper request signing manually, you can use the IAM commands which you mentioned above (in AWS terms called "Actions"), e.g. the ListUserPolicies action [3].

Suggestion for Improvement

I could then check the Action field in the IAM policy if it allows permission like "s3:GetObject" or "s3:" and resource field contains the value as "arn:aws:s3:::examplebucket/" or "*". If both applicable then IAM user has permission to the S3 "examplebucket".

If you want an approach which is more robust, I would suggest to use the IAM Policy Simulator API. [4]

References

[1] https://github.com/aws-amplify/aws-sdk-ios/issues/496
[2] https://docs.aws.amazon.com/IAM/latest/APIReference/Welcome.html
[3] https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListUserPolicies.html
[4] https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html#policies-simulator-using-api