4

How can I add "arn:aws:iam::xxxxxxx:role/3" line below "arn:aws:iam::xxxxxxx:role/2" adding a comma after "arn:aws:iam::xxxxxxx:role/2",.

Before:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::xxxxxxx:role/1",
          "arn:aws:iam::xxxxxxx:role/2"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

After

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::xxxxxxx:role/1",
          "arn:aws:iam::xxxxxxx:role/2",
          "arn:aws:iam::xxxxxxx:role/3"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

1 Answer 1

9

Do not try to parse JSON text with standard text processing tools like awk, sed or without JSON modules in perl, as they are non JSON syntax aware. jq is a lightweight JSON processor that allows you manipulate content on the fly.

For e.g. your requirement could be simply written as

jq --arg new "arn:aws:iam::xxxxxxx:role/3" '.Statement[].Principal.AWS? += [$new]' json

If there is more than one element to be appended, create the arg as a JSON blob

jq --argjson new '["arn:aws:iam::xxxxxxx:role/3", "arn:aws:iam::xxxxxxx:role/4"]' '.Statement[].Principal.AWS? += $new'

Instructions for downloading and using the tool are at Download jq and usage tutorial at jq Manual

If the contents are in a file and you want to modify this file permanently, use a in-place edit tool like sponge available from GNU moreutils package which you can do

jq --arg new "arn:aws:iam::xxxxxxx:role/3" '.Statement[].Principal.AWS? += [$new]' json | sponge json

or use a POSIX tool like mktemp

temp="$(mktemp)"
jq --arg new "arn:aws:iam::xxxxxxx:role/3" '.Statement[].Principal.AWS? += [$new]' json > "$temp" && mv "$temp" json
7
  • Genius, let me test this. I use jq a lot to read but never to add.
    – tr53
    Apr 3, 2020 at 10:41
  • 1
    I used this and it worked aws iam get-role --role-name <rolename> | jq --arg new "arn:aws:iam::xxxxxxx:role/3" '.Role.AssumeRolePolicyDocument.Statement[].Principal.AWS? += [$new]' > role.json
    – tr53
    Apr 3, 2020 at 10:50
  • Thanks, I always found jq difficult to use but I'm getting better at it.
    – tr53
    Apr 3, 2020 at 10:56
  • Do you know how can I add multiple entires one under another? Example: "arn:aws:iam::xxxxxxx:role/3" "arn:aws:iam::xxxxxxx:role/4"
    – tr53
    Apr 3, 2020 at 11:09
  • @tr53: See update
    – Inian
    Apr 3, 2020 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.