複数の AWS アカウントに対して IAM ロールが特定のアクションを許可しているかどうか確認するシェルスクリプトを作成してみた

#!/bin/bash

# 調査対象のAWSアカウント一覧
ACCOUNT_ID_LIST=(111122223333 444455556666)

# 調査対象のAWSアカウントで事前に作成しているIAMロール名
ROLE_NAME="test-tool-access-role"

# AWS CloudTrailに記録されるセッション名
ROLE_SESSION_NAME=" test-tool"

# IAMロールで許可されているかどうか確認するアクション
ACTION_NAME="iam:CreateRole iam:AttachRolePolicy iam:PutRolePolicy"

for account_id in "${ACCOUNT_ID_LIST[@]}"; do
    echo "### Account ID: ${account_id}"

    # AssumeRoleにより一時的なクレデンシャルを取得
    assume_role_output=$(aws sts assume-role --role-arn arn:aws:iam::$account_id:role/$ROLE_NAME --role-session-name $ROLE_SESSION_NAME)

    access_key_id=$(echo "${assume_role_output}" | jq -r '.Credentials.AccessKeyId')
    secret_access_key=$(echo "${assume_role_output}" | jq -r '.Credentials.SecretAccessKey')
    session_token=$(echo "${assume_role_output}" | jq -r '.Credentials.SessionToken')

    # IAMロール一覧を取得してIAM Policy SimulatorでACTION_NAMEの許可があるか確認
    AWS_ACCESS_KEY_ID=$access_key_id AWS_SECRET_ACCESS_KEY=$secret_access_key AWS_SESSION_TOKEN=$session_token \
    aws iam list-roles --query='Roles[?!(starts_with(RoleName,`AWSServiceRoleFor`))].[Arn]' --output text \
    | while read role_arn; do
        echo "${role_arn}"
        AWS_ACCESS_KEY_ID=$access_key_id AWS_SECRET_ACCESS_KEY=$secret_access_key AWS_SESSION_TOKEN=$session_token \
        aws iam simulate-principal-policy \
            --policy-source-arn ${role_arn} \
            --action-names ${ACTION_NAME} \
            --query EvaluationResults[].[EvalActionName,EvalDecision] \
            --output text
    done
done

$ sh test-tool.sh
### Account ID: 444455556666
(略)
arn:aws:iam::444455556666:role/test-access-role
iam:CreateRole  implicitDeny
iam:AttachRolePolicy    implicitDeny
iam:PutRolePolicy       implicitDeny
arn:aws:iam::444455556666:role/test-admin-role-for-idc
iam:CreateRole  allowed
iam:AttachRolePolicy    allowed
iam:PutRolePolicy       allowed
(略)
### Account ID: 111122223333
(略)
arn:aws:iam::111122223333:role/test-access-role
iam:CreateRole  implicitDeny
iam:AttachRolePolicy    implicitDeny
iam:PutRolePolicy       implicitDeny
arn:aws:iam::111122223333:role/test-org-aggregator-role
iam:CreateRole  implicitDeny
iam:AttachRolePolicy    implicitDeny
iam:PutRolePolicy       implicitDeny
(略)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:GetContextKeysForCustomPolicy",
                "iam:GetRole",
                "iam:GetPolicyVersion",
                "iam:SimulatePrincipalPolicy",
                "iam:SimulateCustomPolicy",
                "iam:GetPolicy",
                "iam:ListAttachedRolePolicies",
                "iam:ListRoles",
                "iam:ListRolePolicies",
                "iam:GetRolePolicy",
                "iam:GetContextKeysForPrincipalPolicy"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:root"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

AWSTemplateFormatVersion: 2010-09-09
Description: Create IAM Role

Parameters:
  IAMRoleName:
    Type: String
    Description: IAM Role Name
    Default: test-tool-access-role
  IAMPolicyName:
    Type: String
    Description: IAM Policy Name
    Default: test-tool-access-policy
  TrustedAccountID:
    Type: String
    Description: Trusted Account ID
    Default: 111122223333

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: AWS IAM Role
        Parameters:
          - IAMRoleName
          - IAMPolicyName
          - TrustedAccountID

Resources:
  IAMRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Ref IAMRoleName
      Path: "/"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: "Allow"
          Principal:
            AWS:
            - !Sub "arn:aws:iam::${TrustedAccountID}:root"
          Action: "sts:AssumeRole"
      ManagedPolicyArns:
        - !Ref IAMPolicy
  IAMPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      ManagedPolicyName: !Ref IAMPolicyName
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'iam:GetContextKeysForCustomPolicy'
              - 'iam:GetRole'
              - 'iam:GetPolicyVersion'
              - 'iam:SimulatePrincipalPolicy'
              - 'iam:SimulateCustomPolicy'
              - 'iam:GetPolicy'
              - 'iam:ListAttachedRolePolicies'
              - 'iam:ListRoles'
              - 'iam:ListRolePolicies'
              - 'iam:GetRolePolicy'
              - 'iam:GetContextKeysForPrincipalPolicy'
            Resource: '*'

{
    "eventVersion": "1.10",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AROAYS2EXAMPLEEXAMPLE:test-tool",
        "arn": "arn:aws:sts::444455556666:assumed-role/test-tool-access-role/test-tool",
        "accountId": "444455556666",
        "accessKeyId": "ASIAYS2NR3GH7D7EFJVR",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "AROAYS2EXAMPLEEXAMPLE",
                "arn": "arn:aws:iam::444455556666:role/test-tool-access-role",
                "accountId": "444455556666",
                "userName": "test-tool-access-role"
            },
            "attributes": {
                "creationDate": "2024-09-28T14:35:37Z",
                "mfaAuthenticated": "false"
            }
        }
    },
    "eventTime": "2024-09-28T14:36:52Z",
    "eventSource": "iam.amazonaws.com",
    "eventName": "SimulatePrincipalPolicy",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "18.176.236.26",
    "userAgent": "aws-cli/2.17.57 md/awscrt#0.21.2 ua/2.0 os/linux#6.1.109-118.189.amzn2023.x86_64 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython exec-env/CloudShell cfg/retry-mode#standard md/installer#exe md/distrib#amzn.2023 md/prompt#off md/command#iam.simulate-principal-policy",
    "requestParameters": {
        "policySourceArn": "arn:aws:iam::444455556666:role/test-tool-access-role",
        "actionNames": [
            "iam:CreateRole",
            "iam:AttachRolePolicy",
            "iam:PutRolePolicy"
        ]
    },
    "responseElements": null,
    "requestID": "44430e83-9474-471a-a9a3-9d67e89f85ca",
    "eventID": "9829d500-6d6e-4b96-8d12-967247c56d0c",
    "readOnly": true,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "444455556666",
    "eventCategory": "Management",
    "tlsDetails": {
        "tlsVersion": "TLSv1.3",
        "cipherSuite": "TLS_AES_128_GCM_SHA256",
        "clientProvidedHostHeader": "iam.amazonaws.com"
    }
}