CSM mode doesn't capture all while proxy mode works

[jizusun]

Proxy Mode

iamlive --mode proxy --set-ini --output-file policy.json --force-wildcard-resource

❯ export HTTP_PROXY=http://127.0.0.1:10080
export HTTPS_PROXY=http://127.0.0.1:10080
export AWS_CA_BUNDLE=$HOME/.iamlive/ca.pem
❯ aws sts get-caller-identity

❯ aws s3 ls

CSM Mode

iamlive --set-ini --output-file policy.json --refresh-rate 1 --sort-alphabetical --host 127.0.0.1

❯ export AWS_CSM_ENABLED=true
❯ aws sts get-caller-identity

❯ aws s3 ls

As you can see below, sts:GetCallerIdentity is missing, only s3 one.

[iann0036]

Hi @jizusun,

This might be that sts:GetCallerIdentity is a special call that doesn't in itself require any actual permissions, despite it being documented as such. Arguably, the proxy mode output is incorrect in this instance (ignoring unrelated other proxy mode errors, covering in #102).

I'll take a look to see if I can make things more consistent.