AWS IAM WITH SWAMP
Swamp manages AWS Identity and Access Management (IAM) through behaviors. Each behavior describes one IAM resource, such as a role, a user or a policy. When you run a method on it, Swamp makes the matching change in AWS or reads the resource back, and records the result as resource state in the repository's data layer.
Get started
curl -fsSL https://swamp-club.com/install.sh | sh swamp repo init swamp extension pull @swamp/aws/iam swamp extension pull @sntxrr/aws-access-key swamp extension pull @webframp/aws/iamMost of this work is done by the @swamp/aws/iam extension. It has one behavior
type for each kind of IAM resource: @swamp/aws/iam/role, @swamp/aws/iam/user
and @swamp/aws/iam/group, the policy types @swamp/aws/iam/managed-policy,
@swamp/aws/iam/role-policy, @swamp/aws/iam/user-policy and
@swamp/aws/iam/group-policy, and types for instance profiles, OIDC and SAML
identity providers, server certificates, service-linked roles and virtual MFA
devices. Every type has create, get, update, delete and sync methods,
and most also have list. Credentials come from the standard AWS environment
variables or profile, or from a Swamp vault through vault.get() expressions.
Because IAM is global, the default region of us-east-1 works for most accounts.
Community extensions cover work that @swamp/aws/iam does not do.
@sntxrr/aws-access-key creates, lists, deactivates and deletes IAM user access
keys, and writes each new key straight into a named vault item.
@webframp/aws/iam and @jentz/aws-iam-role-audit are read-only. They sweep
several AWS accounts and record roles, users, policies, trust relationships and
compliance findings as data, without changing anything in AWS.
To provision a first role, follow Getting started with AWS IAM in Swamp. For specific tasks, the how-to guides show how to attach a customer managed policy to a role, rotate a user's access key into a vault and inventory roles and trust across accounts. Understanding AWS IAM automation in Swamp covers how IAM resources map onto behaviors and the choices teams make about policy ownership, credentials and auditing. The extensions reference lists every type, global argument and method.
AWS IAM documentation
Getting started with AWS IAM in Swamp
Pull the @swamp/aws/iam extension, define an IAM role behavior with a trust policy, validate it offline and run create to provision the role in an AWS account.
Tutorials →Attach a customer managed policy to an IAM role
Create an IAM role and a customer managed policy as Swamp behaviors, attach the policy through its Roles argument, then validate and run create for both.
How-to Guides →Rotate an IAM user access key into a Swamp vault
Use @sntxrr/aws-access-key to list a user's keys, mint a new key into a Swamp vault item, then deactivate the old key and delete it once nothing uses it.
How-to Guides →Inventory IAM roles and trust across AWS accounts
Run @webframp/aws/iam discovery across several AWS CLI profiles to record roles, users, policies and a cross-account trust map, then query the results as data.
How-to Guides →AWS IAM extensions
Every Swamp extension for AWS IAM: behavior types, global arguments, methods, vault configuration and the data each one writes, read from the registry.
Reference →Understanding AWS IAM automation in Swamp
How AWS IAM resources map onto Swamp behavior types, resource state and vaults, and the choices teams make about policy ownership, credentials and auditing.
Explanation →