Shows how to manage users, keys, and policies. This demonstration creates two users: one user who can put and get objects in an Amazon S3 bucket, and another user who can only get objects from the bucket. The demo then shows how the users can perform only the actions they are permit
()
| 146 | |
| 147 | # snippet-start:[python.example_code.iam.Scenario_UserPolicies] |
| 148 | def usage_demo(): |
| 149 | """ |
| 150 | Shows how to manage users, keys, and policies. |
| 151 | This demonstration creates two users: one user who can put and get objects in an |
| 152 | Amazon S3 bucket, and another user who can only get objects from the bucket. |
| 153 | The demo then shows how the users can perform only the actions they are permitted |
| 154 | to perform. |
| 155 | """ |
| 156 | logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s") |
| 157 | print("-" * 88) |
| 158 | print("Welcome to the AWS Identity and Account Management user demo.") |
| 159 | print("-" * 88) |
| 160 | print( |
| 161 | "Users can have policies and roles attached to grant them specific " |
| 162 | "permissions." |
| 163 | ) |
| 164 | s3 = boto3.resource("s3") |
| 165 | bucket = s3.create_bucket( |
| 166 | Bucket=f"demo-iam-bucket-{time.time_ns()}", |
| 167 | CreateBucketConfiguration={ |
| 168 | "LocationConstraint": s3.meta.client.meta.region_name |
| 169 | }, |
| 170 | ) |
| 171 | print(f"Created an Amazon S3 bucket named {bucket.name}.") |
| 172 | user_read_writer = create_user("demo-iam-read-writer") |
| 173 | user_reader = create_user("demo-iam-reader") |
| 174 | print(f"Created two IAM users: {user_read_writer.name} and {user_reader.name}") |
| 175 | update_user(user_read_writer.name, "demo-iam-creator") |
| 176 | update_user(user_reader.name, "demo-iam-getter") |
| 177 | users = list_users() |
| 178 | user_read_writer = next( |
| 179 | user for user in users if user.user_id == user_read_writer.user_id |
| 180 | ) |
| 181 | user_reader = next(user for user in users if user.user_id == user_reader.user_id) |
| 182 | print( |
| 183 | f"Changed the names of the users to {user_read_writer.name} " |
| 184 | f"and {user_reader.name}." |
| 185 | ) |
| 186 | |
| 187 | read_write_policy = policy_wrapper.create_policy( |
| 188 | "demo-iam-read-write-policy", |
| 189 | "Grants rights to create and get an object in the demo bucket.", |
| 190 | ["s3:PutObject", "s3:GetObject"], |
| 191 | f"arn:aws:s3:::{bucket.name}/*", |
| 192 | ) |
| 193 | print( |
| 194 | f"Created policy {read_write_policy.policy_name} with ARN: {read_write_policy.arn}" |
| 195 | ) |
| 196 | print(read_write_policy.description) |
| 197 | read_policy = policy_wrapper.create_policy( |
| 198 | "demo-iam-read-policy", |
| 199 | "Grants rights to get an object from the demo bucket.", |
| 200 | "s3:GetObject", |
| 201 | f"arn:aws:s3:::{bucket.name}/*", |
| 202 | ) |
| 203 | print(f"Created policy {read_policy.policy_name} with ARN: {read_policy.arn}") |
| 204 | print(read_policy.description) |
| 205 | attach_policy(user_read_writer.name, read_write_policy.arn) |
no test coverage detected