How to parse the policy document response by boto3

Question

I am working on a python script that is scanning all S3 buckets and files. I want the script to log every file that is exposed to public in the policy document, I mean it has : "Effect": "Allow" and "Principal" : "*" . So I have this line in my code:

bucket_policy = storageClient.get_bucket_policy(Bucket='mybucket-documents-2017')
print(bucket_policy)

It returns a string :

{
'Policy':
 u'{
 "Version":"2012-10-17",
 "Statement":[
 {
 "Sid":"",
 "Effect":"Allow",
 "Principal":
 {"AWS":"arn:aws:iam::000000000000:user/myuser"},
 "Action":"s3:GetObject",
 "Resource":"arn:aws:s3:::mybucket-documents-2017/*"
 },
 {
 "Sid":"",
 "Effect":"Allow",
 "Principal":{"AWS":"arn:aws:iam::0000000000000:user/myuser"},
 "Action":"s3:PutObject",
 "Resource":"arn:aws:s3:::mybucket-documents-2017/*"
 }]
 }', 
 'ResponseMetadata': {
 'HTTPStatusCode': 200, 'RetryAttempts': 0, 'HostId': '0EkHM/G1rnRjZH3lhTim1uaDG+5dCJmbJAhSVTnniGsNZIAl6SOMlYgbJOR0XAJOtzmXuu/CSd0=', 'RequestId': '037CADEB6342E9C
2', 'HTTPHeaders': {'x-amz-id-2': '0EkHM/G1rnRjZH3lhTim1uaDG+5dCJmbJAhSVTnniGsNZIAl6SOMlYgbJOR0XAJOtzmXuu/CSd0=', 'server': 'AmazonS3', 'transfer-encoding': 'chunked', 'x-amz-request-id': '037CADEB634
2E9C2', 'date': 'Fri, 11 Aug 2017 10:03:21 GMT', 'content-type': 'application/json'}
}

}

When I do something like:

 for policy in bucket_policy:
        print(policy[0])

or

for policy in bucket_policy['Policy']:
        print(policy[0])

I don't get anything .

How do I do to get the value of Effect and Principal by parsing the policy document ?

Answer 1

You would want to start by loading that string into native data types:

import json
policy = json.loads(bucket_policy['Policy'])

This would then allow you to loop through the Statement array.

for statement in policy['statement']:
    print(statement['Effect'])