4 ms·
Neat project. How does it differ from `aws-iam-generator` released by AWS themselves? https://github.com/awslabs/aws-iam-generator https://github.com/awslabs/
by bloblaw 7y ago
Neat project.
How does it differ from `aws-iam-generator` released by AWS themselves?
https://github.com/awslabs/aws-iam-generator https://github.com/awslabs/aws-iam-generator
- kmcquade 7y agoThanks! aws-iam-generator still requires you to write the actual policy templates from scratch, and then they allow you to re-use those policy templates. Consider the JSON under this area of their README: https://github.com/awslabs/aws-iam-generator#managed-policies-derived-from-a-jinja2-template https://github.com/awslabs/aws-iam-generator#managed-policie... It's essentially a method for managing their policies as code - but it doesn't make those policies restricted to certain resources, unless you configure it that way. Using `policy_sentry --write-policy --crud`, you have to supply a file with resource ARNs, and it will write the policy for you, rather than supplying a policy file, and hoping the ARNs fit that use case. Does that make sense?