Vinc3nt's Life

AWS CLI - 修改特定 Policy & Hands on

2024-06-09
develop
aws
cli
aws-iam
最後更新:2025-01-26
3分鐘
533字

紀錄一下如何只使用 AWS CLI 修改指定的 IAM 策略

步驟說明

  1. 獲取現有策略文件的內容: 首先,你需要獲取並保存現有策略文件的內容,這樣你可以在現有文件的基礎上進行修改。

    Terminal window
    1
    aws iam get-policy --policy-arn <policy-arn>

    這個指令會返回策略的基本信息,包括策略的最新版本 ID。然後使用這個版本 ID 獲取具體的策略文件內容:

    Terminal window
    1
    aws iam get-policy-version --policy-arn <policy-arn> --version-id <version-id>

    將返回的策略文件內容保存到一個 JSON 文件中,例如 policy.json

  2. 編輯策略文件: 使用你熟悉的編輯器打開並編輯 policy.json 文件,進行你需要的修改。

  3. 更新策略文件: 修改完成後,使用以下指令來更新策略文件。注意,每個策略最多可以有五個版本,如果已達到此上限,你需要先刪除一個舊的版本。

    Terminal window
    1
    aws iam create-policy-version --policy-arn <policy-arn> --policy-document file://policy.json --set-as-default

    這個指令會創建新的策略版本並將其設置為默認版本。

Hands on

這裡使用之前文章 AWS STS & Hands on 創建的 Policy s3-readonly 示範:

Policy 資料

Terminal window
1
$ aws iam get-policy --policy-arn arn:aws:iam::344227375522:policy/s3-readonly
2
{
3
"Policy": {
4
"PolicyName": "s3-readonly",
5
"PolicyId": "ANPAYZKJQNIYJCA3V22KR",
6
"Arn": "arn:aws:iam::344227375522:policy/s3-readonly",
7
"Path": "/",
8
"DefaultVersionId": "v1",
9
"AttachmentCount": 1,
10
"PermissionsBoundaryUsageCount": 0,
11
"IsAttachable": true,
12
"CreateDate": "2024-06-08T11:30:00+00:00",
13
"UpdateDate": "2024-06-08T11:30:00+00:00",
14
"Tags": []
15
}
1 collapsed line
16
}

Policy Version 資料

Terminal window
1
$ aws iam get-policy-version --policy-arn arn:aws:iam::344227375522:policy/s3-readonly --version-id v1
2
{
3
"PolicyVersion": {
4
"Document": {
5
"Version": "2012-10-17",
6
"Statement": [
7
{
8
"Effect": "Allow",
9
"Action": [
10
"s3:Get*",
11
"s3:List*"
12
],
13
"Resource": "*"
14
}
15
]
6 collapsed lines
16
},
17
"VersionId": "v1",
18
"IsDefaultVersion": true,
19
"CreateDate": "2024-06-08T11:30:00+00:00"
20
}
21
}
  1. 獲取現有策略內容,擷取 Document 的部分,儲存為 json 檔:

    Terminal window
    1
    aws iam get-policy-version --policy-arn arn:aws:iam::344227375522:policy/s3-readonly --version-id v1 --query 'PolicyVersion.Document' --output json > s3-readonly.json
  2. 編輯 s3-readonly.json 文件,限制 Policy 作用的資源。

    1
    {
    2
    "Version": "2012-10-17",
    3
    "Statement": [
    4
    {
    5
    "Effect": "Allow",
    6
    "Action": [
    7
    "s3:Get*",
    8
    "s3:List*"
    9
    ],
    10
    "Resource": [
    11
    "arn:aws:s3:::vince987-sts-demo",
    12
    "arn:aws:s3:::vince987-sts-demo/*"
    13
    ]
    14
    }
    15
    ]
    1 collapsed line
    16
    }
  3. 更新策略文件:

    Terminal window
    1
    $ aws iam create-policy-version --policy-arn arn:aws:iam::344227375522:policy/s3-readonly --policy-document file://s3-readonly.json --set-as-default
    2
    {
    3
    "PolicyVersion": {
    4
    "VersionId": "v2",
    5
    "IsDefaultVersion": true,
    6
    "CreateDate": "2024-06-09T09:59:25+00:00"
    7
    }
    8
    }
  4. 檢查策略

    Terminal window
    1
    $ aws iam get-policy --policy-arn arn:aws:iam::344227375522:policy/s3-readonly
    2
    {
    3
    "Policy": {
    4
    "PolicyName": "s3-readonly",
    5
    "PolicyId": "ANPAYZKJQNIYJCA3V22KR",
    6
    "Arn": "arn:aws:iam::344227375522:policy/s3-readonly",
    7
    "Path": "/",
    8
    "DefaultVersionId": "v2",
    9
    "AttachmentCount": 1,
    10
    "PermissionsBoundaryUsageCount": 0,
    11
    "IsAttachable": true,
    12
    "CreateDate": "2024-06-08T11:30:00+00:00",
    13
    "UpdateDate": "2024-06-09T09:59:25+00:00",
    14
    "Tags": []
    15
    }
    1 collapsed line
    16
    }
    Terminal window
    1
    $ aws iam get-policy-version --policy-arn arn:aws:iam::344227375522:policy/s3-readonly --version-id v2
    2
    {
    3
    "PolicyVersion": {
    4
    "Document": {
    5
    "Version": "2012-10-17",
    6
    "Statement": [
    7
    {
    8
    "Effect": "Allow",
    9
    "Action": [
    10
    "s3:Get*",
    11
    "s3:List*"
    12
    ],
    13
    "Resource": [
    14
    "arn:aws:s3:::vince987-sts-demo",
    15
    "arn:aws:s3:::vince987-sts-demo/*"
    9 collapsed lines
    16
    ]
    17
    }
    18
    ]
    19
    },
    20
    "VersionId": "v2",
    21
    "IsDefaultVersion": true,
    22
    "CreateDate": "2024-06-09T09:59:25+00:00"
    23
    }
    24
    }
本文標題:AWS CLI - 修改特定 Policy & Hands on
文章作者:Vincent Lin
發布時間:2024-06-09