Find IAM principals with any of the given actions

find_principals.rb

require 'json'

users = JSON.parse(`aws iam list-users`)['Users'].map { |u| u['Arn'] }
groups = JSON.parse(`aws iam list-groups`)['Groups'].map { |u| u['Arn'] }
roles = JSON.parse(`aws iam list-roles`)['Roles'].map { |u| u['Arn'] }

all = users + groups + roles

actions = ARGV

puts "Searching #{all.size} principals for #{actions} *"
all.each do |arn|
  out = JSON.parse(`aws iam simulate-principal-policy --policy-source-arn #{arn} --action-names #{actions.join(' ')}`)

  allowed = out['EvaluationResults'].select { |res| res["EvalDecision"] == "allowed" }
  unless allowed.empty?
    policies = allowed.map { |r| r['MatchedStatements'].map { |s| s['SourcePolicyId'] } }.flatten.uniq
    puts "* ALLOW: #{arn} by #{policies}"
  end
end