问以编程方式将所有AWS内联策略转换为当前IAM角色的托管策略

EN

import json

import boto3

user_name = 'xxxxxxx'

client = boto3.client("iam")

response = client.list_user_policies(UserName=user_name)


for policy_name in response["PolicyNames"]:

    response = client.get_user_policy(UserName=user_name, PolicyName=policy_name)
    policy_document = json.dumps(response["PolicyDocument"])

    response = client.create_policy(
        PolicyName=policy_name, PolicyDocument=policy_document_json
    )

    # response = client.delete_user_policy(
    #     UserName=user_name,
    #     PolicyName=policy_name
    # )

response=client.list_roles()

for i in response['Roles']:
    role_name = i['RoleName']
    # print(role_name)

import json
import boto3
from botocore.exceptions import ClientError

role_name = 'xxxxxxxx'
account_id = '123456789'

client = boto3.client("iam")
resource = boto3.resource('iam')

response = client.list_role_policies(RoleName=role_name)

for policy_name in response["PolicyNames"]:
    response = client.get_role_policy(RoleName=role_name, PolicyName=policy_name)
    policy_document = json.dumps(response["PolicyDocument"])
    print(policy_document)
    try:
        response = client.create_policy(
            PolicyName=policy_name, PolicyDocument=policy_document
        )
        print(policy_name + 'Policy Created')
    except ClientError as error:
        if error.response['Error']['Code'] == 'EntityAlreadyExists':
            print(policy_name + ' policy already exists')
        else:
            print("Unexpected error: %s" % error)

    policy_arn = f'arn:aws:iam::{account_id}:policy/{policy_name}'
    role = resource.Role(role_name)
    role.attach_policy(PolicyArn=policy_arn)

    response = client.delete_role_policy(
        RoleName=role_name,
        PolicyName=policy_name
    )