AWS EmulatorでIAMの権限がAWSどおりに判定されない例

aws-emulator -t off

export AWS_ENDPOINT_URL=https://127.0.0.1:9297
export AWS_SHARED_CREDENTIALS_FILE=~/.aws/emulator/9297/emulator_credentials
export AWS_CONFIG_FILE=~/.aws/emulator/9297/config
export AWS_CA_BUNDLE=~/.aws/emulator/9297/ca.pem
export AWS_EC2_METADATA_DISABLED=true
export AWS_DISABLE_HOST_PREFIX_INJECTION=true
export AWS_REGION=us-east-1
export AWS_DEFAULT_REGION=us-east-1
unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN AWS_PROFILE
export AWS_PAGER=""

$ aws sts get-caller-identity --query Arn --output text
arn:aws:iam::<12桁の0>:user/emulator
$ aws iam list-attached-user-policies --user-name emulator
{
    "AttachedPolicies": []
}
$ aws iam list-user-policies --user-name emulator
{
    "PolicyNames": []
}
$ aws iam list-groups-for-user --user-name emulator
{
    "Groups": []
}

$ aws s3api create-bucket --bucket demo-emulator-bucket
{
    "Location": "/demo-emulator-bucket",
    "BucketArn": "arn:aws:s3:::demo-emulator-bucket"
}
$ aws dynamodb create-table --table-name DemoTable \
    --attribute-definitions AttributeName=id,AttributeType=S \
    --key-schema AttributeName=id,KeyType=HASH \
    --billing-mode PAY_PER_REQUEST --query TableDescription.TableStatus
"CREATING"
$ aws iam create-user --user-name no-policy-user --query User.Arn
"arn:aws:iam::<12桁の0>:user/no-policy-user"

read -r AK SK < <(aws iam create-access-key --user-name no-policy-user --query 'AccessKey.[AccessKeyId,SecretAccessKey]' --output text)
unset AWS_SHARED_CREDENTIALS_FILE
export AWS_ACCESS_KEY_ID=$AK AWS_SECRET_ACCESS_KEY=$SK

$ aws sts get-caller-identity --query Arn --output text
arn:aws:iam::<12桁の0>:user/no-policy-user

$ aws sqs create-queue --queue-name demo-queue
{
    "QueueUrl": "https://sqs.us-east-1.amazonaws.com/<12桁の0>/demo-queue"
}
$ aws sns create-topic --name demo-topic
{
    "TopicArn": "arn:aws:sns:us-east-1:<12桁の0>:demo-topic"
}
$ aws ssm put-parameter --name /demo/param --value hello --type String
{
    "Version": 1,
    "Tier": "Standard"
}

$ aws dynamodb put-item --table-name DemoTable --item '{"id":{"S":"cat-1"}}'

aws: [ERROR]: An error occurred (AccessDeniedException) when calling the PutItem operation: User: arn:aws:iam::<12桁の0>:user/no-policy-user is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:us-east-1:<12桁の0>:table/DemoTable because no identity-based policy allows the dynamodb:PutItem action

$ aws s3api list-buckets --query 'Buckets[].Name'
[
    "demo-emulator-bucket"
]
$ aws s3api create-bucket --bucket demo-no-policy-bucket

aws: [ERROR]: An error occurred (AccessDenied) when calling the CreateBucket operation: User: arn:aws:iam::<12桁の0>:user/no-policy-user is not authorized to perform: s3:CreateBucket on resource: "arn:aws:s3:::demo-no-policy-bucket" because no identity-based policy allows the s3:CreateBucket action

$ cat deny-all.json
{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*"}]}
$ aws iam attach-user-policy --user-name no-policy-user --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
$ aws iam put-user-policy --user-name no-policy-user --policy-name DenyAll --policy-document file://deny-all.json

$ aws sqs create-queue --queue-name demo-queue-2
{
    "QueueUrl": "https://sqs.us-east-1.amazonaws.com/<12桁の0>/demo-queue-2"
}
$ aws ssm get-parameter --name /demo/param --query Parameter.Value --output text
hello

$ aws sqs delete-queue --queue-url https://sqs.us-east-1.amazonaws.com/<12桁の0>/demo-queue

aws: [ERROR]: An error occurred (AccessDenied) when calling the DeleteQueue operation: User: arn:aws:iam::<12桁の0>:user/no-policy-user is not authorized to perform: sqs:deletequeue on resource: arn:aws:sqs:us-east-1:<12桁の0>:demo-queue with an explicit deny in an identity-based policy

$ aws iam put-user-policy --user-name emulator --policy-name DenyAll --policy-document file://deny-all.json
$ aws sqs create-queue --queue-name demo-queue-3
{
    "QueueUrl": "https://sqs.us-east-1.amazonaws.com/<12桁の0>/demo-queue-3"
}
$ aws iam create-user --user-name made-by-emulator-after-deny --query User.Arn
"arn:aws:iam::<12桁の0>:user/made-by-emulator-after-deny"
$ aws s3api create-bucket --bucket demo-emulator-deny-bucket

aws: [ERROR]: An error occurred (AccessDenied) when calling the CreateBucket operation: User: arn:aws:iam::<12桁の0>:user/emulator is not authorized to perform: s3:CreateBucket on resource: "arn:aws:s3:::demo-emulator-deny-bucket" with an explicit deny in an identity-based policy

$ aws iam delete-user-policy --user-name emulator --policy-name DenyAll
$ aws s3api put-object --bucket demo-emulator-bucket --key before.txt --body hello.txt --query ETag
"\"b1946ac92492d2347c6235b4d2611184\""
$ aws s3api put-bucket-policy --bucket demo-emulator-bucket --policy file://bucket-deny.json
$ aws s3api put-object --bucket demo-emulator-bucket --key after.txt --body hello.txt

aws: [ERROR]: An error occurred (AccessDenied) when calling the PutObject operation: User: arn:aws:iam::<12桁の0>:user/emulator is not authorized to perform: s3:PutObject on resource: "arn:aws:s3:::demo-emulator-bucket/after.txt" with an explicit deny in a resource-based policy