16

I am looking for a way to list all of the actions that can be used in a AWS IAM policy.

This is an example policy that uses IAM actions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1457442845000",
            "Effect": "Allow",
            "Action": [
                "iam:CreatePolicy",
                "iam:CreatePolicyVersion",
                "iam:GetGroupPolicy",
                "iam:CreateGroup",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRolePolicy",
                "iam:ListAttachedGroupPolicies"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

I would like to search through actions from a file, and for that I would like to have all the available actions. I could not find a way yet to get that list. Any direction is appreciated.

6 Answers 6

9

I liked Trentium answer, but it will need maintenance.

I think I will use the AWS Policy Generator call for the policies.js file

2
  • With respect to requiring maintenance, any point in time query of the AWS service actions or IAM policy actions will require constant maintenance. AWS is constantly enhancing their services, and thus new actions are being added all the time. I have seen this on multiple occasions, eg with Athena and QuickSight, in which over the course of a few weeks, new service actions have become available. Keeping an eye on these changes is particularly necessary if the IAM or Orgs policies are configured to ALLOW by default and DENY by exception.
    – Trentium
    Dec 13, 2020 at 20:04
  • Let's hope that AWS maintains the policies.js file for us! Aug 12, 2022 at 15:15
7

Amazon provides a policy generator which it self, knows all of the possible APIs and Actions at the current point in time.

One can generate a list of Actions from the AWS Policy Generator policies.js:

curl --header 'Connection: keep-alive' \
     --header 'Pragma: no-cache' \
     --header 'Cache-Control: no-cache' \
     --header 'Accept: */*' \
     --header 'Referer: https://awspolicygen.s3.amazonaws.com/policygen.html' \
     --header 'Accept-Language: en-US,en;q=0.9' \
     --silent \
     --compressed \
     'https://awspolicygen.s3.amazonaws.com/js/policies.js' |
    cut -d= -f2 |
    jq -r '.serviceMap[] | .StringPrefix as $prefix | .Actions[] | "\($prefix):\(.)"' |
    sort |
    uniq
1
  • I get --silent, but why have the other curl options? It works for me without them. Aug 12, 2022 at 15:19
5

The available actions for each service are in the documentation for those services, for example the list of IAM actions is in the IAM documentation, and the list of EC2 actions is in the EC2 documentation.

4
  • one may also get them from going into the IAM console and creating a policy. That's a nice way to know if it's "ListBucket" or "ListBuckets". (answer: yes. both.)
    – tedder42
    Apr 7, 2016 at 0:28
  • Not all policies exist in the IAM namespace. Things that define policies on the resource itself like S3 or ECR are really hard to find more than a general allow everything policy example.
    – btilford
    May 20, 2020 at 16:54
  • @btilford it is hard to find good examples of resource level policies, but the acceptable fields are all documented under that specific service's documentation. The IAM link I gave is to the IAM specific actions. I didn't say all policies are a available there, I said this is where all the IAM service actions are documented, and you can look at the other services to see the list of their actions.
    – Mark B
    May 20, 2020 at 17:06
  • There's an easier spot to find a reference to all actions available in the IAM reference page: docs.aws.amazon.com/IAM/latest/UserGuide/… Sep 3, 2020 at 15:22
2

Ran into the same issue, except was looking for Actions associated with more than just AWS Service IAM. Solved by:

  • Pulling the AWS SDK for Javascript ( see https://sdk.amazonaws.com/builder/js/ ) for all services.
  • Loading the resulting minified javascript file ( aws-sdk-2.680.0.min.js ) as part of a small custom HTML document.
  • Writing a javascript function that takes the desired service, and loops through the object AWS.apiLoader.services[ 'iam' ][ Version ].operations, pulling the list of Actions. ( Note that 'Version' is in the format of yyyy-mm-dd and in the minified javascript file, there was only one entry for each AWS service. )
  • Exporting the results.

Hope someone finds this helpful, as this was the only way I was able to programmatically get a comprehensive list of the Actions associated with an AWS Service...

5
  • I accept this until I find a better way. Thanks!
    – Istvan
    Nov 29, 2020 at 16:50
  • @Istvan, I appreciate the upvote, but since the time that I wrote my response, I believe Adam's recent response regarding the policies.js file is more accurate and simpler. In fact, back in Aug 2020 during an engagement with AWS engineering, they provided me the policies.js link referred by Adam, as a simpler alternative which contains all the service action policies available. (As a minor aside, the policies.js file is ever so slightly different than the service actions APIs, as there are a sprinkling of IAM policies, e.g. codecommit:GitPull, which are IAM policies, but not APIs...)
    – Trentium
    Dec 1, 2020 at 22:45
  • Yes, I think his code is great too. Thanks @Trentium.
    – Istvan
    Dec 3, 2020 at 7:24
  • Interesting discussion, with the help of a fellow dev and AWS enthusiast, created 2 Lambda functions to pull this off. github.com/cloudframeworks/aws-api 1. getServiceNames will return all valid service names, sorted. 2. getServiceActions will return all valid service actions for a provided service name, sorted. We took it a step further and created an API Gateway HTTP API, linked the routes to the two functions and can now just make a quick API call to get the service actions. Does anyone know if AWS regularly updates that policies.js file hosted on their S3 bucket?
    – NJITman
    Jan 9, 2022 at 3:39
  • @NJITman, we still use the API builder to enumerate the AWS service-actions, but predominantly rely on the policies.js file to vet our custom IAM role policies. Per my comment just above, it was AWS engineering that pointed us to the policies.js file as an alternative. We continually find new service-actions and new IAM permission-only-actions in the policies.js file as AWS expands their services. (Note that the API builder will not include the IAM permission-only-actions, such as 'iam:PassRole' or 'codecommit:GitPull', and hence the policies.js file is more comprehensive.)
    – Trentium
    Jan 9, 2022 at 14:48
1

Lists of all actions available for each service are available in the IAM Reference Documentation here:

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.html

Actions, Resources and applicable Conditions are defined.

1
  • This is the only official source as far as I can tell. I was about to write a scraper for these pages until I saw the solution using policies.js. Aug 12, 2022 at 15:17
1

If you have node installed on your machine, simply type npx get-aws-actions in your terminal. No need to install anything. This npx command fetches the actions from the AWS policy generator file https://awspolicygen.s3.amazonaws.com/js/policies.js and support text search to pinpoint the actions for specific AWS services (e.g., search for s3: to list all the S3 actions).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.