Helper to find (most) AWS permissions for Terraform

permission_finder.rb

#!/usr/bin/ruby
# frozen_string_literal: true

# Instructions:
# Set TF_LOG=debug and run `terraform apply > apply_log.txt`, followed by `terraform destroy > destroy_log.txt`
# Run this script (permission_finder.rb) with those log files => `permission_finder.rb apply_log.txt destroy_log.txt`

# This script will parse through the requests that Terraform made to AWS. Note that it is NOT perfect.
# There are some 'gotchas' I've seen that are noted below in the TODO section.

require "set"

services = %w[
  acm
  apigateway
  application-autoscaling
  appstream
  athena
  autoscaling
  aws-marketplace
  aws-marketplace-management
  aws-portal
  batch
  budgets
  clouddirectory
  cloudformation
  cloudfront
  cloudhsm
  cloudsearch
  cloudtrail
  cloudwatch
  codebuild
  codecommit
  codedeploy
  codepipeline
  codestar
  cognito-identity
  cognito-idp
  cognito-sync
  config
  cur
  datapipeline
  dax
  devicefarm
  directconnect
  discovery
  dms
  ds
  dynamodb
  ec2
  ecr
  ecs
  elasticache
  elasticbeanstalk
  elasticfilesystem
  elasticloadbalancing
  elasticmapreduce
  elastictranscoder
  es
  events
  execute-api
  firehose
  gamelift
  glacier
  health
  iam
  importexport
  inspector
  iot
  kinesis
  kinesisanalytics
  kms
  lambda
  lex
  lightsail
  logs
  machinelearning
  mechanicalturk
  mobileanalytics
  mobilehub
  mobiletargeting
  opsworks
  opsworks-cm
  organizations
  polly
  rds
  redshift
  rekognition
  route53
  route53domains
  s3
  sdb
  servicecatalog
  ses
  shield
  snowball
  sns
  sqs
  ssm
  states
  storagegateway
  sts
  swf
  tag
  trustedadvisor
  waf
  waf-regional
  wam
  workdocs
  workmail
  workspaces
  xray
]

services_regex = services.join("|")
pattern = %r{Request (#{services_regex})\/(\w+)}

results = SortedSet.new

ARGV.each do |log_file|
  File.foreach(log_file) do |line|
    line.scan(pattern) { |service, request| results.add("#{service}:#{request}") }
  end
end

# TODO: Cloudfront commands with tagged suffixes should have those suffixes removed, and a permission for 'cloudfront:TagResource' should be added
# TODO: Terraform won't tell you on destroy if you can't "ListAllMyBuckets"
# TODO: If you are deleting objects in S3 buckets, you probably also want s3:DeleteObjectVersion
# TODO: Watch out for Docker builds => since layer uploads don't happen every time, you may miss the necessary permissions:
# ecr:BatchCheckLayerAvailability
# ecr:CompleteLayerUpload
# ecr:InitiateLayerUpload
# ecr:UploadLayerPart
# ecr:PutImage

# TODO: The following Terraform commands are wrong, and need to be changed to:
# GetBucketAccelerateConfiguration => GetAccelerateConfiguration
# GetBucketLifecycleConfiguration => GetLifecycleConfiguration
# GetBucketReplication => GetReplicationConfiguration
# s3:ListObjects => s3:ListBucket
# s3:ListObjectVersions => s3:ListBucketVersions
# s3:DeleteObjects => s3:DeleteObject

puts "Result:"
results.each { |result| puts "\"#{result}\"," }