Array Correlation Between 3 Different Loops using Bash
0
I have 3 loops that I use to determine the permission level of AWS user accounts.
This array lists the AWS policy Effect:
for ((policy_index=0;policy_index<${#aws_managed_policies[@]};++policy_index)); do
aws_policy_arn="${aws_managed_policies[policy_index]}"
aws_policy_version_id=$(aws iam get-policy --policy-arn "$aws_policy_arn" --profile="$aws_key" | jq -r '.Policy.DefaultVersionId')
readarray -t aws_policy_effects < <( if aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Effect' 2> /dev/null
then
true
else
aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Effect' 2> /dev/null
fi )
done
I get the effect of the policy with this loop (Allow/Deny):
for ((effect_index=0;effect_index<${#aws_policy_effects[@]};++effect_index)); do
policy_effect="${aws_policy_effects[effect_index]}"
if [[ "$policy_effect" = "Allow" ]]; then
aws_policy_effects[effect_index]='ALLOW'
unset aws_policy_effects
elif [[ "$policy_effect" = "Deny" ]]; then
aws_policy_effects[effect_index]='DENY'
fi
done
And I get the list of services that the user has permission to with this loop:
readarray -t aws_policy_actions < <(aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Action' 2> /dev/null | grep '*')
if [[ "$aws_policy_effect" = "Allow" ]]; then
for ((action_index=0;action_index<${#aws_policy_actions[@]};++action_index)); do
policy_action="${aws_policy_actions[action_index]}"
if [[ "$policy_action" = "^*$" ]]; then
admin_access="YES"
elif [[ -n "$policy_action" ]]; then
policy_action=$(echo "$policy_action" | cut -d: -f1)
admin_access="YES"
aws_admin_services+=("$policy_action")
else
admin_access="NO"
fi
done # action loop
fi
I want the 3 loops to correspond.
I need the ARN, Effect and Policies loops to agree: ARN1 with Effect 1 and Policy 1, ARN 2 with effect 2 and Policy 2, and so on.
How can I best achieve this? Do I need to embed the 3 loops within one another in order to achieve this?
bash
asked Nov 15 '18 at 18:44
bluethundrbluethundr
56441742
|
show 1 more comment
0
I have 3 loops that I use to determine the permission level of AWS user accounts.
This array lists the AWS policy Effect:
for ((policy_index=0;policy_index<${#aws_managed_policies[@]};++policy_index)); do
aws_policy_arn="${aws_managed_policies[policy_index]}"
aws_policy_version_id=$(aws iam get-policy --policy-arn "$aws_policy_arn" --profile="$aws_key" | jq -r '.Policy.DefaultVersionId')
readarray -t aws_policy_effects < <( if aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Effect' 2> /dev/null
then
true
else
aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Effect' 2> /dev/null
fi )
done
I get the effect of the policy with this loop (Allow/Deny):
for ((effect_index=0;effect_index<${#aws_policy_effects[@]};++effect_index)); do
policy_effect="${aws_policy_effects[effect_index]}"
if [[ "$policy_effect" = "Allow" ]]; then
aws_policy_effects[effect_index]='ALLOW'
unset aws_policy_effects
elif [[ "$policy_effect" = "Deny" ]]; then
aws_policy_effects[effect_index]='DENY'
fi
done
And I get the list of services that the user has permission to with this loop:
readarray -t aws_policy_actions < <(aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Action' 2> /dev/null | grep '*')
if [[ "$aws_policy_effect" = "Allow" ]]; then
for ((action_index=0;action_index<${#aws_policy_actions[@]};++action_index)); do
policy_action="${aws_policy_actions[action_index]}"
if [[ "$policy_action" = "^*$" ]]; then
admin_access="YES"
elif [[ -n "$policy_action" ]]; then
policy_action=$(echo "$policy_action" | cut -d: -f1)
admin_access="YES"
aws_admin_services+=("$policy_action")
else
admin_access="NO"
fi
done # action loop
fi
I want the 3 loops to correspond.
I need the ARN, Effect and Policies loops to agree: ARN1 with Effect 1 and Policy 1, ARN 2 with effect 2 and Policy 2, and so on.
How can I best achieve this? Do I need to embed the 3 loops within one another in order to achieve this?
bash
asked Nov 15 '18 at 18:44
bluethundrbluethundr
56441742
Can't you use the index? Instead ofaws_policy_effects+=("ALLOW"), you'd useaws_policy_effects[effect_index]='ALLOW'.
– Benjamin W.
Nov 15 '18 at 19:22
Also, you useaws_policy_effect="Deny", which defaults to setting the first element instead of appending one.
– Benjamin W.
Nov 15 '18 at 19:23
Yes, good point. Thank you!
– bluethundr
Nov 15 '18 at 19:35
Corrected that in the OP.
– bluethundr
Nov 15 '18 at 19:37
1
That's a lot of complexity per line. While it might work like a champ, I'd suggest breaking it into smaller bites, even if that means adding otherwise superfluous variables to store the intermediate results. In ten months when someone else has taken over maintaining this and something upstream changes that breaks it, they are going to have to do something similar anyway to read through it. Readability is a resource - manage it. ...also, I prefertestCmd || nextCmdtoif testCmd; then true; else nextCmd; fi. YMMV.
– Paul Hodges
Nov 15 '18 at 19:54
|
show 1 more comment
0
0
0
I have 3 loops that I use to determine the permission level of AWS user accounts.
This array lists the AWS policy Effect:
for ((policy_index=0;policy_index<${#aws_managed_policies[@]};++policy_index)); do
aws_policy_arn="${aws_managed_policies[policy_index]}"
aws_policy_version_id=$(aws iam get-policy --policy-arn "$aws_policy_arn" --profile="$aws_key" | jq -r '.Policy.DefaultVersionId')
readarray -t aws_policy_effects < <( if aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Effect' 2> /dev/null
then
true
else
aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Effect' 2> /dev/null
fi )
done
I get the effect of the policy with this loop (Allow/Deny):
for ((effect_index=0;effect_index<${#aws_policy_effects[@]};++effect_index)); do
policy_effect="${aws_policy_effects[effect_index]}"
if [[ "$policy_effect" = "Allow" ]]; then
aws_policy_effects[effect_index]='ALLOW'
unset aws_policy_effects
elif [[ "$policy_effect" = "Deny" ]]; then
aws_policy_effects[effect_index]='DENY'
fi
done
And I get the list of services that the user has permission to with this loop:
readarray -t aws_policy_actions < <(aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Action' 2> /dev/null | grep '*')
if [[ "$aws_policy_effect" = "Allow" ]]; then
for ((action_index=0;action_index<${#aws_policy_actions[@]};++action_index)); do
policy_action="${aws_policy_actions[action_index]}"
if [[ "$policy_action" = "^*$" ]]; then
admin_access="YES"
elif [[ -n "$policy_action" ]]; then
policy_action=$(echo "$policy_action" | cut -d: -f1)
admin_access="YES"
aws_admin_services+=("$policy_action")
else
admin_access="NO"
fi
done # action loop
fi
I want the 3 loops to correspond.
I need the ARN, Effect and Policies loops to agree: ARN1 with Effect 1 and Policy 1, ARN 2 with effect 2 and Policy 2, and so on.
How can I best achieve this? Do I need to embed the 3 loops within one another in order to achieve this?
bash
asked Nov 15 '18 at 18:44
bluethundrbluethundr
56441742
I have 3 loops that I use to determine the permission level of AWS user accounts.
This array lists the AWS policy Effect:
for ((policy_index=0;policy_index<${#aws_managed_policies[@]};++policy_index)); do
aws_policy_arn="${aws_managed_policies[policy_index]}"
aws_policy_version_id=$(aws iam get-policy --policy-arn "$aws_policy_arn" --profile="$aws_key" | jq -r '.Policy.DefaultVersionId')
readarray -t aws_policy_effects < <( if aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Effect' 2> /dev/null
then
true
else
aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Effect' 2> /dev/null
fi )
done
I get the effect of the policy with this loop (Allow/Deny):
for ((effect_index=0;effect_index<${#aws_policy_effects[@]};++effect_index)); do
policy_effect="${aws_policy_effects[effect_index]}"
if [[ "$policy_effect" = "Allow" ]]; then
aws_policy_effects[effect_index]='ALLOW'
unset aws_policy_effects
elif [[ "$policy_effect" = "Deny" ]]; then
aws_policy_effects[effect_index]='DENY'
fi
done
And I get the list of services that the user has permission to with this loop:
readarray -t aws_policy_actions < <(aws iam get-policy-version --policy-arn "$aws_policy_arn" --version-id "$aws_policy_version_id" --profile="$aws_key" 2> /dev/null | jq -r '.PolicyVersion.Document.Statement.Action' 2> /dev/null | grep '*')
if [[ "$aws_policy_effect" = "Allow" ]]; then
for ((action_index=0;action_index<${#aws_policy_actions[@]};++action_index)); do
policy_action="${aws_policy_actions[action_index]}"
if [[ "$policy_action" = "^*$" ]]; then
admin_access="YES"
elif [[ -n "$policy_action" ]]; then
policy_action=$(echo "$policy_action" | cut -d: -f1)
admin_access="YES"
aws_admin_services+=("$policy_action")
else
admin_access="NO"
fi
done # action loop
fi
I want the 3 loops to correspond.
I need the ARN, Effect and Policies loops to agree: ARN1 with Effect 1 and Policy 1, ARN 2 with effect 2 and Policy 2, and so on.
How can I best achieve this? Do I need to embed the 3 loops within one another in order to achieve this?
bash
bash
asked Nov 15 '18 at 18:44
bluethundrbluethundr
56441742
asked Nov 15 '18 at 18:44
bluethundrbluethundr
56441742
edited Nov 16 '18 at 21:21
bluethundr
asked Nov 15 '18 at 18:44
bluethundrbluethundr
56441742
asked Nov 15 '18 at 18:44
bluethundrbluethundr
56441742
asked Nov 15 '18 at 18:44
bluethundrbluethundr
56441742
56441742
Can't you use the index? Instead ofaws_policy_effects+=("ALLOW"), you'd useaws_policy_effects[effect_index]='ALLOW'.
– Benjamin W.
Nov 15 '18 at 19:22
Also, you useaws_policy_effect="Deny", which defaults to setting the first element instead of appending one.
– Benjamin W.
Nov 15 '18 at 19:23
Yes, good point. Thank you!
– bluethundr
Nov 15 '18 at 19:35
Corrected that in the OP.
– bluethundr
Nov 15 '18 at 19:37
1
That's a lot of complexity per line. While it might work like a champ, I'd suggest breaking it into smaller bites, even if that means adding otherwise superfluous variables to store the intermediate results. In ten months when someone else has taken over maintaining this and something upstream changes that breaks it, they are going to have to do something similar anyway to read through it. Readability is a resource - manage it. ...also, I prefertestCmd || nextCmdtoif testCmd; then true; else nextCmd; fi. YMMV.
– Paul Hodges
Nov 15 '18 at 19:54
|
show 1 more comment
Can't you use the index? Instead ofaws_policy_effects+=("ALLOW"), you'd useaws_policy_effects[effect_index]='ALLOW'.
– Benjamin W.
Nov 15 '18 at 19:22
Also, you useaws_policy_effect="Deny", which defaults to setting the first element instead of appending one.
– Benjamin W.
Nov 15 '18 at 19:23
Yes, good point. Thank you!
– bluethundr
Nov 15 '18 at 19:35
Corrected that in the OP.
– bluethundr
Nov 15 '18 at 19:37
1
That's a lot of complexity per line. While it might work like a champ, I'd suggest breaking it into smaller bites, even if that means adding otherwise superfluous variables to store the intermediate results. In ten months when someone else has taken over maintaining this and something upstream changes that breaks it, they are going to have to do something similar anyway to read through it. Readability is a resource - manage it. ...also, I prefertestCmd || nextCmdtoif testCmd; then true; else nextCmd; fi. YMMV.
– Paul Hodges
Nov 15 '18 at 19:54
Can't you use the index? Instead of
aws_policy_effects+=("ALLOW"), you'd use aws_policy_effects[effect_index]='ALLOW'.– Benjamin W.
Nov 15 '18 at 19:22
Can't you use the index? Instead of
aws_policy_effects+=("ALLOW"), you'd use aws_policy_effects[effect_index]='ALLOW'.– Benjamin W.
Nov 15 '18 at 19:22
Also, you use
aws_policy_effect="Deny", which defaults to setting the first element instead of appending one.– Benjamin W.
Nov 15 '18 at 19:23
Also, you use
aws_policy_effect="Deny", which defaults to setting the first element instead of appending one.– Benjamin W.
Nov 15 '18 at 19:23
Yes, good point. Thank you!
– bluethundr
Nov 15 '18 at 19:35
Yes, good point. Thank you!
– bluethundr
Nov 15 '18 at 19:35
Corrected that in the OP.
– bluethundr
Nov 15 '18 at 19:37
Corrected that in the OP.
– bluethundr
Nov 15 '18 at 19:37
1
1
That's a lot of complexity per line. While it might work like a champ, I'd suggest breaking it into smaller bites, even if that means adding otherwise superfluous variables to store the intermediate results. In ten months when someone else has taken over maintaining this and something upstream changes that breaks it, they are going to have to do something similar anyway to read through it. Readability is a resource - manage it. ...also, I prefer
testCmd || nextCmd to if testCmd; then true; else nextCmd; fi. YMMV.– Paul Hodges
Nov 15 '18 at 19:54
That's a lot of complexity per line. While it might work like a champ, I'd suggest breaking it into smaller bites, even if that means adding otherwise superfluous variables to store the intermediate results. In ten months when someone else has taken over maintaining this and something upstream changes that breaks it, they are going to have to do something similar anyway to read through it. Readability is a resource - manage it. ...also, I prefer
testCmd || nextCmd to if testCmd; then true; else nextCmd; fi. YMMV.– Paul Hodges
Nov 15 '18 at 19:54
|
show 1 more comment
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53326024%2farray-correlation-between-3-different-loops-using-bash%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53326024%2farray-correlation-between-3-different-loops-using-bash%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Can't you use the index? Instead of
aws_policy_effects+=("ALLOW"), you'd useaws_policy_effects[effect_index]='ALLOW'.– Benjamin W.
Nov 15 '18 at 19:22
Also, you use
aws_policy_effect="Deny", which defaults to setting the first element instead of appending one.– Benjamin W.
Nov 15 '18 at 19:23
Yes, good point. Thank you!
– bluethundr
Nov 15 '18 at 19:35
Corrected that in the OP.
– bluethundr
Nov 15 '18 at 19:37
1
That's a lot of complexity per line. While it might work like a champ, I'd suggest breaking it into smaller bites, even if that means adding otherwise superfluous variables to store the intermediate results. In ten months when someone else has taken over maintaining this and something upstream changes that breaks it, they are going to have to do something similar anyway to read through it. Readability is a resource - manage it. ...also, I prefer
testCmd || nextCmdtoif testCmd; then true; else nextCmd; fi. YMMV.– Paul Hodges
Nov 15 '18 at 19:54