IAM

# AWS IAM 정책 예제 - S3 읽기 전용
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}

# AWS CLI로 역할 생성 및 정책 연결
aws iam create-role \
  --role-name MyAppRole \
  --assume-role-policy-document file://trust-policy.json

aws iam attach-role-policy \
  --role-name MyAppRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

# EC2 인스턴스 프로파일 생성 (Access Key 대신 사용)
aws iam create-instance-profile \
  --instance-profile-name MyAppProfile

aws iam add-role-to-instance-profile \
  --instance-profile-name MyAppProfile \
  --role-name MyAppRole

# IAM Access Analyzer로 미사용 권한 분석
aws accessanalyzer list-findings \
  --analyzer-arn arn:aws:access-analyzer:region:account:analyzer/name

# GCP IAM - 서비스 계정 생성 및 역할 부여
# 서비스 계정 생성
gcloud iam service-accounts create my-app-sa \
  --display-name="My Application Service Account"

# 역할 바인딩 (프로젝트 수준)
gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:my-app-sa@my-project.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"

# 조건부 역할 바인딩 (리소스 기반 조건)
gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:my-app-sa@my-project.iam.gserviceaccount.com" \
  --role="roles/storage.objectAdmin" \
  --condition='expression=resource.name.startsWith("projects/_/buckets/my-bucket"),title=my-bucket-only'

# Workload Identity (GKE용 - Access Key 불필요)
gcloud iam service-accounts add-iam-policy-binding \
  my-app-sa@my-project.iam.gserviceaccount.com \
  --member="serviceAccount:my-project.svc.id.goog[my-namespace/my-ksa]" \
  --role="roles/iam.workloadIdentityUser"

# IAM 정책 조회
gcloud projects get-iam-policy my-project --format=json

# Terraform으로 AWS IAM 역할 및 정책 생성
# Lambda 실행 역할
resource "aws_iam_role" "lambda_role" {
  name = "lambda-execution-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "lambda.amazonaws.com"
      }
    }]
  })
}

# 커스텀 정책
resource "aws_iam_policy" "custom_policy" {
  name        = "custom-s3-policy"
  description = "Custom S3 access policy"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:PutObject"
        ]
        Resource = "arn:aws:s3:::my-bucket/*"
        Condition = {
          StringEquals = {
            "s3:x-amz-acl" = "private"
          }
        }
      },
      {
        Effect = "Allow"
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Resource = "arn:aws:logs:*:*:*"
      }
    ]
  })
}

# 역할에 정책 연결
resource "aws_iam_role_policy_attachment" "attach" {
  role       = aws_iam_role.lambda_role.name
  policy_arn = aws_iam_policy.custom_policy.arn
}