cloudtools / cloudtools/awacs

Specific support actions are not allowed in IAM Policies

Open
#124 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Python
Stars
393
Forks
98
PR merge metrics
No merged PRs in 30d

Description

From [AWS Support's documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awssupport.html#awssupport-actions-as-permissions):

AWS Support does not let you allow or deny access to individual actions;
therefore your policy must use the "Action": "support:*" to use the
AWS Support Center or to use the AWS Support API.

Therefore the actions in [support.py](https://github.com/cloudtools/awacs/blob/f905a0ac46a9f9fec157d730f8798f15c19df442/awacs/support.py#L26-L42) seem useless if not misleading. And there's no predefined action in awacs that covers `support:*`.

Can the actions be used for anything else than IAM Policies? Am I missing something?

Contributor guide

No contributing guide indexed for this repository

Research direction

Review awacs/support.py lines 26-42 alongside the linked AWS Support IAM documentation to confirm which actions are valid policy permissions. Resolve whether the existing actions should be removed or whether support:* needs representation, and consider the repository's existing tests before defining the expected behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
authorization, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.