AWSSDK.IdentityManagement ( AWS IAM )

#cloud #csharp #aws #dotnet

The AWS SDK for .NET supports AWS Identity and Access Management (IAM), which is a web service that enables AWS customers to manage users and user permissions in AWS.

First of all, let's have a brief about IAM Service in AWS...

➽What is IAM Service in AWS?

☞AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources.
☞You grant permissions to a user by creating a IAM policy. The policy contains a policy document that lists the actions that a user can perform and the resources those actions can affect.
☞ Read more about IAM Service
☞ Read more about Policies and Permissions

➽Installing AWSSDK.IdentityManagement :

☞AWSSDK.IdentityManagement is installed mainly from Nuget
☞There is 3 ways to install AWSSDK.IdentityManagement, they are the same as installing AWSSDK.S3 from Part 1 of this series
☞let's use the easiest one, from Package Manager Console by using the Install-Package command.

PM> Install-Package AWSSDK.IdentityManagement

🌟 Second step is to connect to our AWS account using __ Access keys (Access Key ID and Secret Access Key)__, this was explained before briefly in the first article under (Get AWS Access keys)

➽Let's now check what we can do with this SDK :

☞1- Create IAM user:
➤The following snippet creates an IAM user, adds the given managed security policy, and then creates and stores credentials for him.

    // Create the user Method
    private static async Task<CreateUserResponse> CreateUser(
      IAmazonIdentityManagementService iamClient, string userName,
      string policyArn, string csvFilename)
    {
      // Create the user
      // Could also create a login profile for the user by using CreateLoginProfileAsync
      CreateUserResponse responseCreate =
        await iamClient.CreateUserAsync(new CreateUserRequest(userName));

      // Attach an existing managed policy
      await iamClient.AttachUserPolicyAsync(new AttachUserPolicyRequest{
        UserName = responseCreate.User.UserName,
        PolicyArn = policyArn});

      // Create credentials and write them to a CSV file.
      CreateAccessKeyResponse responseCreds =
        await iamClient.CreateAccessKeyAsync(new CreateAccessKeyRequest{
          UserName = responseCreate.User.UserName});
      using (FileStream s = new FileStream(csvFilename, FileMode.Create))
      using (StreamWriter writer = new StreamWriter(s))
      {
        writer.WriteLine("User name,Access key ID,Secret access key");
        writer.WriteLine("{0},{1},{2}", responseCreds.AccessKey.UserName,
          responseCreds.AccessKey.AccessKeyId,
          responseCreds.AccessKey.SecretAccessKey);
      }

      return responseCreate;
    }

☞2- Display list of IAM users:
➤ To display a list of existing users, as well as information about each user such as access key IDs and attached policies.

    // Method to print out a list of the existing users and information about them
    private static async Task ListUsers(IAmazonIdentityManagementService iamClient)
    {
      // Get the list of users
      ListUsersResponse responseUsers = await iamClient.ListUsersAsync();
      Console.WriteLine("\nFull list of users...");
      foreach (var user in responseUsers.Users)
      {
        Console.WriteLine($"User {user.UserName}:");
        Console.WriteLine($"\tCreated: {user.CreateDate.ToShortDateString()}");

        // Show the list of groups this user is part of
        var responseGroups = await iamClient.ListGroupsForUserAsync(
            new ListGroupsForUserRequest(user.UserName));
        foreach (var group in responseGroups.Groups)
          Console.WriteLine($"\tGroup: {group.GroupName}");

        // Show the list of access keys for this user
        ListAccessKeysResponse responseAccessKeys =
          await iamClient.ListAccessKeysAsync(
            new ListAccessKeysRequest{UserName = user.UserName});
        foreach(AccessKeyMetadata accessKey in responseAccessKeys.AccessKeyMetadata)
          Console.WriteLine($"\tAccess key ID: {accessKey.AccessKeyId}");

        // Show the list of managed policies attached to this user
        var requestManagedPolicies = new ListAttachedUserPoliciesRequest{
          UserName = user.UserName};
        var responseManagedPolicies = await iamClient.ListAttachedUserPoliciesAsync(
            new ListAttachedUserPoliciesRequest{UserName = user.UserName});
        foreach(var policy in responseManagedPolicies.AttachedPolicies)
          Console.WriteLine($"\tManaged policy name: {policy.PolicyName}");

        // Show the list of inline policies attached to this user
        var responseInlinePolicies = await iamClient.ListUserPoliciesAsync(
            new ListUserPoliciesRequest(user.UserName));
        foreach(var policy in responseInlinePolicies.PolicyNames)
          Console.WriteLine($"\tInline policy name: {policy}");
      }
    }

☞3- Delete IAM users:
⛔ Before deleting a user, we should first de-attach all his policies and remove all his access keys using the following methods

    // Method to detach managed policies from a user
    private static async Task DetachPolicies(
      IAmazonIdentityManagementService iamClient, string userName)
    {
      ListAttachedUserPoliciesResponse responseManagedPolicies =
        await iamClient.ListAttachedUserPoliciesAsync(
          new ListAttachedUserPoliciesRequest{UserName = userName});
      foreach(AttachedPolicyType policy in responseManagedPolicies.AttachedPolicies)
      {
        Console.WriteLine($"\tDetaching policy {policy.PolicyName}");
        await iamClient.DetachUserPolicyAsync(new DetachUserPolicyRequest{
          PolicyArn = policy.PolicyArn,
          UserName = userName});
      }
    }

    // Method to delete access keys from a user
    private static async Task DeleteAccessKeys(
      IAmazonIdentityManagementService iamClient, string userName)
    {
      ListAccessKeysResponse responseAccessKeys =
        await iamClient.ListAccessKeysAsync(
          new ListAccessKeysRequest{UserName = userName});
      foreach(AccessKeyMetadata accessKey in responseAccessKeys.AccessKeyMetadata)
      {
        Console.WriteLine($"\tDeleting Access key {accessKey.AccessKeyId}");
        await iamClient.DeleteAccessKeyAsync(new DeleteAccessKeyRequest{
          UserName = userName,
          AccessKeyId = accessKey.AccessKeyId});
      }
    }

➤ Now we can delete the user:

    // Method to delete a user
    private static async Task DeleteUser(
      IAmazonIdentityManagementService iamClient, string userName)
    {
      // Remove items from the user
      // Detach any managed policies
      await DetachPolicies(iamClient, userName);

      // Delete any access keys
      await DeleteAccessKeys(iamClient, userName);

      // DeleteLoginProfileAsycn(), DeleteUserPolicyAsync(), etc.
      // See the description of DeleteUserAsync for a full list.

      // Delete the user
      await iamClient.DeleteUserAsync(new DeleteUserRequest(userName));
      Console.WriteLine("Done");
    }

☞4- Creating IAM managed policies from JSON:
✅ Let's assume that we have a policy file like this

{
  "Version" : "2012-10-17",
  "Id"  : "DotnetTutorialPolicy",
  "Statement" : [
    {
      "Sid" : "DotnetTutorialPolicyS3",
      "Effect" : "Allow",
      "Action" : [
        "s3:Get*",
        "s3:List*"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "DotnetTutorialPolicyPolly",
      "Effect": "Allow",
      "Action": [
        "polly:DescribeVoices",
        "polly:SynthesizeSpeech"
      ],
      "Resource": "*"
    }
  ]
}

➤To read more about IAM managed policies

➤ To create an IAM managed policy from a given policy document in JSON by creating an IAM client object, reads the policy document from a file, and then creates the policy.

    // create an IAM policy from a JSON file
    private static async Task<CreatePolicyResponse> CreateManagedPolicy(
      IAmazonIdentityManagementService iamClient, string policyName, string jsonFilename)
    {
      return await iamClient.CreatePolicyAsync(new CreatePolicyRequest{
        PolicyName = policyName,
        PolicyDocument = File.ReadAllText(jsonFilename)});
    }

☞5- Display the policy document of an IAM managed policy:
➤ First, we need to find the default version of the given IAM Policy

    // Method to determine the default version of an IAM policy
    // Returns a string with the version
    private static async Task<string> GetDefaultVersion(
      IAmazonIdentityManagementService iamClient, string policyArn)
    {
      // Retrieve all the versions of this policy
      string defaultVersion = string.Empty;
      ListPolicyVersionsResponse reponseVersions =
        await iamClient.ListPolicyVersionsAsync(new ListPolicyVersionsRequest{
          PolicyArn = policyArn});

      // Find the default version
      foreach(PolicyVersion version in reponseVersions.Versions)
      {
        if(version.IsDefaultVersion)
        {
          defaultVersion = version.VersionId;
          break;
        }
      }
      return defaultVersion;
    }

➤Then, display the policy document

    // Method to retrieve and display the policy document of an IAM policy
    private static async Task ShowPolicyDocument(
      IAmazonIdentityManagementService iamClient, string policyArn, string defaultVersion)
    {
      // Retrieve the policy document of the default version
      GetPolicyVersionResponse responsePolicy =
        await iamClient.GetPolicyVersionAsync(new GetPolicyVersionRequest{
          PolicyArn = policyArn,
          VersionId = defaultVersion});

      // Display the policy document (in JSON)
      Console.WriteLine($"Version {defaultVersion} of the policy (in JSON format):");
      Console.WriteLine(
        $"{HttpUtility.UrlDecode(responsePolicy.PolicyVersion.Document)}");
    }