# CDK IAM Generator
[AWS CDK](https://aws.amazon.com/cdk/) construct helps create IAM Managed Policies and IAM Roles using JSON Configuration
This package is written in TypeScript and made available via [JSII](https://github.com/aws/jsii) to all other supported languages. Package are available on:
* [npm](https://www.npmjs.com/package/cdk-iam-generator)
* [PyPI](https://pypi.org/project/cdk-iamgenerator/)
## Quickstart
Install or update from npm
TypeScript/Javascript
```console
npm i cdk-iam-generator
```
Python
```console
pip install cdk-iamgenerator
```
## Usage
** TypeScript **
```python
# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
from cdk_iam_generator import IamPolicyGenerator, IamRoleGenerator
IamPolicyGenerator(self, "IamPolicyGenerator",
config_path="config/iam_generator_config.json",
policy_path="config/policy"
)
IamRoleGenerator(self, "IamRoleGenerator",
config_path="config/iam_generator_config.json"
)
```
## Prerequsites
Example folder structure for Json Configuration of Roles and Policies:
```
config
├── policy
│ ├── CodeCommitArchive.json
│ └── KMSPolicy.json
│ └── CreateServiceLinkedRoleECS.json
│ └── DeployService1.json
│ └── DeployService2.json
├── iam_generator_config.json
```
Place all the Policy Json files inside config/policy in your project root and policy file would look something like this:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"codecommit:CancelUploadArchive",
"codecommit:UploadArchive"
],
"Resource": "*"
}
]
}
```
Configure the policies and roles to be created in config/iam_generator_config.json file and would look something like this:
```json
{
"policies": [
{
"policy_name": "CodeCommitArchive",
"description": "CodeCommitArchive policy",
"policy_file": "CodeCommitArchive.json"
},
{
"policy_name": "KMSPolicy",
"description": "KMSPolicy policy",
"policy_file": "KMSPolicy.json"
},
{
"policy_name": "CreateServiceLinkedRoleECS",
"description": "CreateServiceLinkedRoleECS policy",
"policy_file": "CreateServiceLinkedRoleECS.json"
},
{
"policy_name": "DeployService1",
"description": "DeployService1 policy",
"policy_file": "DeployService1.json"
},
{
"policy_name": "DeployService2",
"description": "DeployService2 policy",
"policy_file": "DeployService2.json"
}
],
"roles": [
{
"role_name": "TestRole1",
"trust_service_principal": ["apigateway.amazonaws.com","lambda.amazonaws.com"],
"customer_managed_policies": ["DeployService1","DeployService2","KMSPolicy"],
"aws_managed_policies": ["service-role/AmazonAPIGatewayPushToCloudWatchLogs"]
},
{
"role_name": "TestRole2",
"trust_service_principal": ["sns.amazonaws.com"],
"trust_account_principal": ["748669239283"],
"customer_managed_policies": ["CreateServiceLinkedRoleECS","CodeCommitArchive","KMSPolicy"],
"aws_managed_policies": ["service-role/AmazonAPIGatewayPushToCloudWatchLogs"]
},
{
"role_name": "TestRole3",
"trust_service_principal": ["ec2.amazonaws.com","sns.amazonaws.com"],
"trust_account_principal": ["748669239283"],
"customer_managed_policies": ["DeployService2","CodeCommitArchive","KMSPolicy"],
"aws_managed_policies": ["AWSLambdaFullAccess"]
}
]
}
```
## License
cdk-iam-generator is distributed under the [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0).
See [LICENSE](./LICENSE) for more information.