Skip to content

Commit ba7a77f

Browse files
kmcquadekmcquade
authored
Merge pull request #394 from kmcquade/fix/GH-393-overlap-scenarios-missing-services
Fixes issue with IAM definition having missing actions for several popular services
2 parents 4cc3309 + 6c05e31 commit ba7a77f

32 files changed

+54512
-66375
lines changed

‎policy_sentry/shared/awsdocs.py

Lines changed: 27 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,7 @@ def create_database(destination_directory, access_level_overrides_file):
161161
parents=True, exist_ok=True
162162
)
163163

164+
# This holds the entire IAM definition
164165
schema = {}
165166

166167
# for filename in ['list_amazonathena.partial.html']:
@@ -191,27 +192,30 @@ def create_database(destination_directory, access_level_overrides_file):
191192
title = title.replace("</h1>", "")
192193
service_name = chomp(title)
193194

194-
prefix = ""
195+
service_prefix = ""
195196
for c in main_content.find("h1", class_="topictitle").parent.children:
196197
if "prefix" in str(c):
197-
prefix = str(c)
198-
prefix = prefix.split('<code class="code">')[1]
199-
prefix = chomp(prefix.split("</code>")[0])
198+
service_prefix = str(c)
199+
service_prefix = service_prefix.split('<code class="code">')[1]
200+
service_prefix = chomp(service_prefix.split("</code>")[0])
200201
break
201-
# The URL to that service's Actions, Resources, and Condition Keys page
202-
service_authorization_url_prefix = "https://docs.aws.amazon.com/service-authorization/latest/reference"
203-
service_authorization_url = f"{service_authorization_url_prefix}/{filename}"
204-
service_schema = {
205-
"service_name": service_name,
206-
"prefix": prefix,
207-
"service_authorization_url": service_authorization_url,
208-
"privileges": {},
209-
"resources": {},
210-
"conditions": {},
211-
}
202+
203+
if service_prefix not in schema.keys():
204+
schema[service_prefix] = {}
205+
# The URL to that service's Actions, Resources, and Condition Keys page
206+
service_authorization_url_prefix = "https://docs.aws.amazon.com/service-authorization/latest/reference"
207+
service_authorization_url = f"{service_authorization_url_prefix}/{filename}"
208+
schema[service_prefix] = {
209+
"service_name": service_name,
210+
"prefix": service_prefix,
211+
"service_authorization_url": service_authorization_url,
212+
"privileges": {},
213+
"resources": {},
214+
"conditions": {},
215+
}
212216

213217
access_level_overrides_cfg = get_action_access_level_overrides_from_yml(
214-
prefix, access_level_overrides_file
218+
service_prefix, access_level_overrides_file
215219
)
216220

217221
tables = main_content.find_all("div", class_="table-contents")
@@ -256,7 +260,6 @@ def create_database(destination_directory, access_level_overrides_file):
256260
priv = chomp(link.text)
257261
if priv == "":
258262
priv = chomp(cells[0].text)
259-
service_prefix = prefix
260263
action_name = priv
261264
description = chomp(cells[1].text)
262265
access_level = chomp(cells[2].text)
@@ -338,7 +341,7 @@ def create_database(destination_directory, access_level_overrides_file):
338341
"api_documentation_link": api_documentation_link
339342
}
340343

341-
service_schema["privileges"][priv] = privilege_schema
344+
schema[service_prefix]["privileges"][priv] = privilege_schema
342345
row_number += 1
343346

344347
# Get resource table
@@ -368,7 +371,7 @@ def create_database(destination_directory, access_level_overrides_file):
368371
for condition in cells[2].find_all("p"):
369372
conditions.append(chomp(condition.text))
370373

371-
service_schema["resources"][resource] = {
374+
schema[service_prefix]["resources"][resource] = {
372375
"resource": resource,
373376
"arn": arn,
374377
"condition_keys": conditions
@@ -398,15 +401,15 @@ def create_database(destination_directory, access_level_overrides_file):
398401
description = chomp(cells[1].text)
399402
value_type = chomp(cells[2].text)
400403

401-
service_schema["conditions"][condition] = {
404+
schema[service_prefix]["conditions"][condition] = {
402405
"condition": condition,
403406
"description": description,
404407
"type": value_type,
405408
}
406-
this_service_schema = {
407-
service_prefix: service_schema
408-
}
409-
schema.update(this_service_schema)
409+
# this_service_schema = {
410+
# service_prefix: service_schema
411+
# }
412+
# schema.update(this_service_schema)
410413

411414
iam_definition_file = os.path.join(destination_directory, "iam-definition.json")
412415
with open(iam_definition_file, "w") as file:

‎policy_sentry/shared/data/docs/list_amazoncomprehend.html

Lines changed: 183 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -678,6 +678,45 @@ <h2 id="amazoncomprehend-actions-as-permissions">
678678
<td>
679679
</td>
680680
</tr>
681+
<tr>
682+
<td rowspan="2">
683+
<a id="amazoncomprehend-DeleteResourcePolicy">
684+
</a>
685+
<a href="https://docs.aws.amazon.com/comprehend/latest/dg/API_DeleteResourcePolicy.html">
686+
DeleteResourcePolicy
687+
</a>
688+
</td>
689+
<td rowspan="2">
690+
Grants permission to remove policy on resource
691+
</td>
692+
<td rowspan="2">
693+
Write
694+
</td>
695+
<td>
696+
<p>
697+
<a href="#amazoncomprehend-document-classifier">
698+
document-classifier*
699+
</a>
700+
</p>
701+
</td>
702+
<td>
703+
</td>
704+
<td>
705+
</td>
706+
</tr>
707+
<tr>
708+
<td>
709+
<p>
710+
<a href="#amazoncomprehend-entity-recognizer">
711+
entity-recognizer*
712+
</a>
713+
</p>
714+
</td>
715+
<td>
716+
</td>
717+
<td>
718+
</td>
719+
</tr>
681720
<tr>
682721
<td>
683722
<a id="amazoncomprehend-DescribeDocumentClassificationJob">
@@ -925,6 +964,45 @@ <h2 id="amazoncomprehend-actions-as-permissions">
925964
<td>
926965
</td>
927966
</tr>
967+
<tr>
968+
<td rowspan="2">
969+
<a id="amazoncomprehend-DescribeResourcePolicy">
970+
</a>
971+
<a href="https://docs.aws.amazon.com/comprehend/latest/dg/API_DescribeResourcePolicy.html">
972+
DescribeResourcePolicy
973+
</a>
974+
</td>
975+
<td rowspan="2">
976+
Grants permission to read attached policy on resource
977+
</td>
978+
<td rowspan="2">
979+
Read
980+
</td>
981+
<td>
982+
<p>
983+
<a href="#amazoncomprehend-document-classifier">
984+
document-classifier*
985+
</a>
986+
</p>
987+
</td>
988+
<td>
989+
</td>
990+
<td>
991+
</td>
992+
</tr>
993+
<tr>
994+
<td>
995+
<p>
996+
<a href="#amazoncomprehend-entity-recognizer">
997+
entity-recognizer*
998+
</a>
999+
</p>
1000+
</td>
1001+
<td>
1002+
</td>
1003+
<td>
1004+
</td>
1005+
</tr>
9281006
<tr>
9291007
<td>
9301008
<a id="amazoncomprehend-DescribeSentimentDetectionJob">
@@ -1108,6 +1186,68 @@ <h2 id="amazoncomprehend-actions-as-permissions">
11081186
<td>
11091187
</td>
11101188
</tr>
1189+
<tr>
1190+
<td rowspan="3">
1191+
<a id="amazoncomprehend-ImportModel">
1192+
</a>
1193+
<a href="https://docs.aws.amazon.com/comprehend/latest/dg/API_ImportModel.html">
1194+
ImportModel
1195+
</a>
1196+
</td>
1197+
<td rowspan="3">
1198+
Grants permission to import a trained Comprehend model
1199+
</td>
1200+
<td rowspan="3">
1201+
Write
1202+
</td>
1203+
<td>
1204+
<p>
1205+
<a href="#amazoncomprehend-document-classifier">
1206+
document-classifier*
1207+
</a>
1208+
</p>
1209+
</td>
1210+
<td>
1211+
</td>
1212+
<td>
1213+
</td>
1214+
</tr>
1215+
<tr>
1216+
<td>
1217+
<p>
1218+
<a href="#amazoncomprehend-entity-recognizer">
1219+
entity-recognizer*
1220+
</a>
1221+
</p>
1222+
</td>
1223+
<td>
1224+
</td>
1225+
<td>
1226+
</td>
1227+
</tr>
1228+
<tr>
1229+
<td>
1230+
</td>
1231+
<td>
1232+
<p>
1233+
<a href="#amazoncomprehend-aws_RequestTag___TagKey_">
1234+
aws:RequestTag/${TagKey}
1235+
</a>
1236+
</p>
1237+
<p>
1238+
<a href="#amazoncomprehend-aws_TagKeys">
1239+
aws:TagKeys
1240+
</a>
1241+
</p>
1242+
<p>
1243+
<a href="#amazoncomprehend-comprehend_ModelKmsKey">
1244+
comprehend:ModelKmsKey
1245+
</a>
1246+
</p>
1247+
</td>
1248+
<td>
1249+
</td>
1250+
</tr>
11111251
<tr>
11121252
<td>
11131253
<a id="amazoncomprehend-ListDocumentClassificationJobs">
@@ -1550,6 +1690,45 @@ <h2 id="amazoncomprehend-actions-as-permissions">
15501690
<td>
15511691
</td>
15521692
</tr>
1693+
<tr>
1694+
<td rowspan="2">
1695+
<a id="amazoncomprehend-PutResourcePolicy">
1696+
</a>
1697+
<a href="https://docs.aws.amazon.com/comprehend/latest/dg/API_PutResourcePolicy.html">
1698+
PutResourcePolicy
1699+
</a>
1700+
</td>
1701+
<td rowspan="2">
1702+
Grants permission to attach policy to resource
1703+
</td>
1704+
<td rowspan="2">
1705+
Write
1706+
</td>
1707+
<td>
1708+
<p>
1709+
<a href="#amazoncomprehend-document-classifier">
1710+
document-classifier*
1711+
</a>
1712+
</p>
1713+
</td>
1714+
<td>
1715+
</td>
1716+
<td>
1717+
</td>
1718+
</tr>
1719+
<tr>
1720+
<td>
1721+
<p>
1722+
<a href="#amazoncomprehend-entity-recognizer">
1723+
entity-recognizer*
1724+
</a>
1725+
</p>
1726+
</td>
1727+
<td>
1728+
</td>
1729+
<td>
1730+
</td>
1731+
</tr>
15531732
<tr>
15541733
<td rowspan="3">
15551734
<a id="amazoncomprehend-StartDocumentClassificationJob">
@@ -3180,7 +3359,7 @@ <h2 id="amazoncomprehend-policy-keys">
31803359
</a>
31813360
</td>
31823361
<td>
3183-
Filters access to create requests based on the allowed set of values for each of the mandatory tags
3362+
Filters access by requiring tag values present in a resource creation request
31843363
</td>
31853364
<td>
31863365
String
@@ -3195,7 +3374,7 @@ <h2 id="amazoncomprehend-policy-keys">
31953374
</a>
31963375
</td>
31973376
<td>
3198-
Filters access to actions based on the tag value associated with the resource
3377+
Filters access by requiring tag value associated with the resource
31993378
</td>
32003379
<td>
32013380
String
@@ -3210,7 +3389,7 @@ <h2 id="amazoncomprehend-policy-keys">
32103389
</a>
32113390
</td>
32123391
<td>
3213-
Filters access to create requests based on the presence of mandatory tags in the request
3392+
Filters access by requiring the presence of mandatory tags in the request
32143393
</td>
32153394
<td>
32163395
String
@@ -3388,4 +3567,4 @@ <h2 id="amazoncomprehend-policy-keys">
33883567
</awsdocs-cookie-banner>
33893568
</div>
33903569
</body>
3391-
</html>
3570+
</html>

0 commit comments

Comments
 (0)