設定値の確認
各変数に正しい設定値が格納されていることを確認します。
変数の確認:
cat << END
# 1. DIR_AWS_POLICY_DOCUMENT:"${HOME}/conf-handson-awspolicy-1st/ResourceBasedPolicy"
DIR_AWS_POLICY_DOCUMENT="${DIR_AWS_POLICY_DOCUMENT}"
# 2. FILENAME_AWS_POLICY_DOCUMENT:"IdentityBasedPolicy"
FILENAME_AWS_POLICY_DOCUMENT="${FILENAME_AWS_POLICY_DOCUMENT}"
# 3. DIR_AWS_POLICY_STATEMENT_DOC:"${HOME}/conf-handson-awspolicy-1st/ResourceBasedPolicy/statement-AllowMessageSendAndReceiveAccount111122223333"
DIR_AWS_POLICY_STATEMENT_DOC="${DIR_AWS_POLICY_STATEMENT_DOC}"
# 4. AWS_POLICY_DOCUMENT_ID:"a3276934-8e1b-d0d3-46b1-a9a17276005d"
AWS_POLICY_DOCUMENT_ID="${AWS_POLICY_DOCUMENT_ID}"
END
各変数について、上の行と下の行の値の内容もしくは形式が同じであることを確認します。
もし異なる場合は、それぞれの手順番号に戻って変数の設定を行います。
処理の実行
ポリシードキュメントを作成します。
変数の設定:
FILE_AWS_POLICY_DOCUMENT_YAML="${DIR_AWS_POLICY_DOCUMENT}/${FILENAME_AWS_POLICY_DOCUMENT}.yaml" \
&& echo ${FILE_AWS_POLICY_DOCUMENT_YAML}
結果(例):
/home/cloudshell-user/conf-handson-awspolicy-1st/ResourceBasedPolicy/IdentityBasedPolicy.yaml
変数の確認:
cat << END
# AWS_POLICY_DOCUMENT_ID:"a3276934-8e1b-d0d3-46b1-a9a17276005d"
AWS_POLICY_DOCUMENT_ID="${AWS_POLICY_DOCUMENT_ID}"
# FILE_AWS_POLICY_DOCUMENT_YAML:"${HOME}/conf-handson-awspolicy-1st/ResourceBasedPolicy/IdentityBasedPolicy.yaml"
FILE_AWS_POLICY_DOCUMENT_YAML="${FILE_AWS_POLICY_DOCUMENT_YAML}"
# DIR_AWS_POLICY_STATEMENT_DOC:"${HOME}/conf-handson-awspolicy-1st/ResourceBasedPolicy/statement-AllowMessageSendAndReceiveAccount111122223333"
DIR_AWS_POLICY_STATEMENT_DOC="${DIR_AWS_POLICY_STATEMENT_DOC}"
END
コマンド:
cat << EOF > ${FILE_AWS_POLICY_DOCUMENT_YAML}
---
Version: '2012-10-17'
Id: '${AWS_POLICY_DOCUMENT_ID}'
Statement:
EOF
for i in $( ls ${DIR_AWS_POLICY_STATEMENT_DOC}/*.txt ); do \
cat ${i} | sed '/^$/d' >> ${FILE_AWS_POLICY_DOCUMENT_YAML}; \
done
cat ${FILE_AWS_POLICY_DOCUMENT_YAML}
結果(例):
---
Version: '2012-10-17'
Id: 'a3276934-8e1b-d0d3-46b1-a9a17276005d'
Statement:
- Sid: 'AllowMessageSendAndReceiveAccount111122223333'
Effect: 'Allow'
Action:
- sqs:SendMessage
- sqs:ReceiveMessage
Principal:
AWS:
- '111122223333'
Resource: arn:aws:sqs:us-east-2:444455556666:queue2
ポリシードキュメントをYAML形式からJSON形式に変換します。
変数の設定:
FILE_AWS_POLICY_DOCUMENT_JSON="${DIR_AWS_POLICY_DOCUMENT}/${FILENAME_AWS_POLICY_DOCUMENT}.json" \
&& echo ${FILE_AWS_POLICY_DOCUMENT_JSON}
結果(例):
/home/cloudshell-user/conf-handson-awspolicy-1st/ResourceBasedPolicy/IdentityBasedPolicy.json
変数の確認:
cat << END
# FILE_AWS_POLICY_DOCUMENT_YAML:"${HOME}/conf-handson-awspolicy-1st/ResourceBasedPolicy/IdentityBasedPolicy.yaml"
FILE_AWS_POLICY_DOCUMENT_YAML="${FILE_AWS_POLICY_DOCUMENT_YAML}"
# FILE_AWS_POLICY_DOCUMENT_JSON:"${HOME}/conf-handson-awspolicy-1st/ResourceBasedPolicy/IdentityBasedPolicy.json"
FILE_AWS_POLICY_DOCUMENT_JSON="${FILE_AWS_POLICY_DOCUMENT_JSON}"
END
コマンド:
cat ${FILE_AWS_POLICY_DOCUMENT_YAML} \
| python -c "import yaml; import json; import sys; \
print(json.dumps(yaml.safe_load(sys.stdin)))" \
| jq \
> ${FILE_AWS_POLICY_DOCUMENT_JSON}
cat ${FILE_AWS_POLICY_DOCUMENT_JSON}
結果(例):
{
"Version": "2012-10-17",
"Id": "a3276934-8e1b-d0d3-46b1-a9a17276005d",
"Statement": [
{
"Sid": "AllowMessageSendAndReceiveAccount111122223333",
"Effect": "Allow",
"Action": [
"sqs:SendMessage",
"sqs:ReceiveMessage"
],
"Principal": {
"AWS": [
"111122223333"
]
},
"Resource": "arn:aws:sqs:us-east-2:444455556666:queue2"
}
]
}
コマンド:
cat ${FILE_AWS_POLICY_DOCUMENT_JSON} \
| python3 -m json.tool \
> /dev/null
結果(例):