IAM ポリシーシミュレータ API を使用して、特定のアクションを許可しているかつ許可していないIAMロール、ユーザーを抽出してみた

import boto3
import time ## 追加
from botocore.exceptions import ClientError
import sys

def simulate_policy(arn, actions):
    iam = boto3.client('iam')
    try:
        response = iam.simulate_principal_policy(
            PolicySourceArn=arn,
            ActionNames=actions
        )
        return {action: any(result['EvalDecision'] == 'allowed' for result in response['EvaluationResults'] if result['EvalActionName'] == action)
                for action in actions}
    except ClientError as e:
        print(f"Error simulating policy for entity {arn}: {e}")
        return {action: False for action in actions}

def get_entities_with_specific_access():
    iam = boto3.client('iam')
    entities_with_specific_access = []
    all_entities_info = []
    processed_entities = 0

    # ロールの処理
    role_paginator = iam.get_paginator('list_roles')
    for page in role_paginator.paginate():
        for role in page['Roles']:
            time.sleep(0.1) ## 追加
            processed_entities += 1
            role_name = role['RoleName']
            role_arn = role['Arn']

            sys.stdout.write(f"\rProcessed entities: {processed_entities}, Current: Role - {role_name}")
            sys.stdout.flush()

            simulation_results = simulate_policy(role_arn, ['lambda:GetFunction', 'lambda:ListTags'])

            entity_info = {
                'type': 'Role',
                'name': role_name,
                'arn': role_arn,
                'get_function': simulation_results.get('lambda:GetFunction', False),
                'list_tags': simulation_results.get('lambda:ListTags', False)
            }
            all_entities_info.append(entity_info)

            if entity_info['get_function'] and not entity_info['list_tags']:
                entities_with_specific_access.append((role_name, 'Role'))

    # ユーザーの処理
    user_paginator = iam.get_paginator('list_users')
    for page in user_paginator.paginate():
        for user in page['Users']:
            time.sleep(0.1)   ## 追加
            processed_entities += 1
            user_name = user['UserName']
            user_arn = user['Arn']

            sys.stdout.write(f"\rProcessed entities: {processed_entities}, Current: User - {user_name}")
            sys.stdout.flush()

            simulation_results = simulate_policy(user_arn, ['lambda:GetFunction', 'lambda:ListTags'])

            entity_info = {
                'type': 'User',
                'name': user_name,
                'arn': user_arn,
                'get_function': simulation_results.get('lambda:GetFunction', False),
                'list_tags': simulation_results.get('lambda:ListTags', False)
            }
            all_entities_info.append(entity_info)

            if entity_info['get_function'] and not entity_info['list_tags']:
                entities_with_specific_access.append((user_name, 'User'))

    print()  # 進捗表示の後に改行
    return entities_with_specific_access, processed_entities, all_entities_info

# メイン処理
try:
    print("Analyzing IAM roles and users...")
    entities, total_processed, all_entities_info = get_entities_with_specific_access()

    print(f"\nTotal entities processed: {total_processed}")
    print("Entities with access to GetFunction but not to ListTags:")
    for entity, entity_type in entities:
        print(f"{entity_type}: {entity}")
    print(f"\nTotal entities meeting criteria: {len(entities)}")

    # 詳細情報の表示
    print("\nDetailed information:")
    for entity_info in all_entities_info:
        print(f"{entity_info['type']}: {entity_info['name']}")
        print(f"  ARN: {entity_info['arn']}")
        print(f"  GetFunction: {'Allowed' if entity_info['get_function'] else 'Denied'}")
        print(f"  ListTags: {'Allowed' if entity_info['list_tags'] else 'Denied'}")
        print()

except Exception as e:
    print(f"An unexpected error occurred: {e}")

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "lambda:GetFunction",
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "lambda:ListTags",
                "lambda:GetFunction"
            ],
            "Resource": "*"
        }
    ]
}