awsquery 0.2.0__tar.gz → 0.3.0__tar.gz

{awsquery-0.2.0 → awsquery-0.3.0}/.devcontainer/devcontainer.json

@@ -1,7 +1,6 @@
 {
   "name": "AWSQuery Development",
   "image": "mcr.microsoft.com/devcontainers/python:3.11-bullseye",
-  
   "features": {
     "ghcr.io/anthropics/devcontainer-features/claude-code:1.0.5": {},
     "ghcr.io/devcontainers/features/aws-cli:1": {
@@ -10,10 +9,8 @@
     "ghcr.io/devcontainers/features/git:1": {
       "ppa": true,
       "version": "latest"
-    },
-    "ghcr.io/devcontainers-contrib/features/pre-commit:2": {}
+    }
   },
-
   "customizations": {
     "vscode": {
       "extensions": [
@@ -34,30 +31,37 @@
         "python.linting.enabled": true,
         "python.linting.pylintEnabled": true,
         "python.formatting.provider": "black",
-        "python.formatting.blackArgs": ["--line-length=100"],
+        "python.formatting.blackArgs": [
+          "--line-length=100"
+        ],
         "python.linting.mypyEnabled": true,
         "python.testing.pytestEnabled": true,
         "python.testing.unittestEnabled": false,
-        "python.testing.pytestArgs": ["tests"],
+        "python.testing.pytestArgs": [
+          "tests"
+        ],
         "editor.formatOnSave": true,
-        "editor.rulers": [100],
+        "editor.rulers": [
+          100
+        ],
         "[python]": {
           "editor.defaultFormatter": "ms-python.black-formatter",
           "editor.codeActionsOnSave": {
             "source.organizeImports": "explicit"
           }
         },
-        "isort.args": ["--profile", "black", "--line-length", "100"]
+        "isort.args": [
+          "--profile",
+          "black",
+          "--line-length",
+          "100"
+        ]
       }
     }
   },
-
   "postCreateCommand": "pip install -e '.[dev]' && pre-commit install",
-  
   "postStartCommand": "echo 'Welcome to AWSQuery development environment!'",
-
   "remoteUser": "vscode",
-
   "mounts": [
     {
       "source": "${localEnv:HOME}/.aws",
@@ -66,15 +70,12 @@
       "consistency": "cached"
     }
   ],
-
   "containerEnv": {
     "AWS_REGION": "${localEnv:AWS_REGION}",
     "AWS_PROFILE": "${localEnv:AWS_PROFILE}",
     "AWS_DEFAULT_REGION": "${localEnv:AWS_DEFAULT_REGION}"
   },
-
   "forwardPorts": [],
-
   "remoteEnv": {
     "PYTHONPATH": "/workspaces/awsquery/src:${PYTHONPATH}"
   }

{awsquery-0.2.0 → awsquery-0.3.0}/.github/workflows/test.yml

@@ -38,12 +38,46 @@ jobs:
           python -m pip install --upgrade pip
           pip install -e ".[dev]"
 
-      - name: Run tests
+      - name: Run tests (fast, no coverage)
         run: |
-          make test
+          # Run tests without coverage for speed on older Python versions
+          python -m pytest tests/ -n auto -q
+
+      - name: Archive test results
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-${{ matrix.python-version }}
+          path: |
+            .pytest_cache/
+
+  coverage:
+    runs-on: ubuntu-latest
+    needs: test  # Run after tests pass
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python 3.12 (latest)
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Cache pip packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('pyproject.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
 
       - name: Generate coverage report
         run: |
+          # Run with coverage on latest Python where it's fast
           make coverage
 
       - name: Upload coverage to Codecov
@@ -54,11 +88,10 @@ jobs:
           name: codecov-umbrella
           fail_ci_if_error: false
 
-      - name: Archive test results
-        if: always()
+      - name: Archive coverage results
         uses: actions/upload-artifact@v4
         with:
-          name: test-results-${{ matrix.python-version }}
+          name: coverage-report
           path: |
             htmlcov/
             .coverage

{awsquery-0.2.0 → awsquery-0.3.0}/Makefile

@@ -11,10 +11,10 @@ NC := \033[0m
 # Default target
 .DEFAULT_GOAL := help
 
-.PHONY: help clean install-dev test test-unit test-integration test-critical test-slow coverage \
-        coverage-report lint format format-check type-check security-check ci build publish-test \
-        publish watch-tests version release update-policy validate-policy all ec2-instances s3-buckets iam-users \
-        iam-roles lambda-functions cloudformation-stacks dynamodb-tables ec2-volumes \
+.PHONY: help clean install-dev test test-unit test-integration test-critical test-slow test-fast test-unit-fast \
+        test-integration-fast coverage coverage-report lint format format-check type-check security-check ci build \
+        publish-test publish watch-tests version release update-policy validate-policy all ec2-instances s3-buckets \
+        iam-users iam-roles lambda-functions cloudformation-stacks dynamodb-tables ec2-volumes \
         ec2-security-groups s3-bucket-versioning cloudwatch-alarms route53-zones shell \
         docker-build docker-clean test-in-docker test-awsquery
 
@@ -48,6 +48,15 @@ test-integration: ## Run integration tests only
 test-slow: ## Run slow tests
 	python3 -m pytest tests/ -v -m "slow"
 
+test-fast: ## Run all tests with parallel execution (optimized for Python 3.8-3.10)
+	python3 -m pytest tests/ -n auto -q
+
+test-unit-fast: ## Run unit tests with parallel execution (2-5 seconds)
+	python3 -m pytest tests/unit/ -n auto -q
+
+test-integration-fast: ## Run integration tests with parallel execution
+	python3 -m pytest tests/integration/ -n auto -q
+
 test-critical: ## Run critical path tests
 	python3 -m pytest tests/ -v -m "critical"
 

{awsquery-0.2.0 → awsquery-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: awsquery
-Version: 0.2.0
+Version: 0.3.0
 Summary: Advanced CLI tool for querying AWS APIs with flexible filtering and automatic parameter resolution
 Author-email: Florian Motlik <flo@flomotlik.me>
 License: MIT

{awsquery-0.2.0 → awsquery-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "awsquery"
-version = "0.2.0"
+version = "0.3.0"
 description = "Advanced CLI tool for querying AWS APIs with flexible filtering and automatic parameter resolution"
 readme = "README.md"
 authors = [{ name = "Florian Motlik", email = "flo@flomotlik.me" }]

awsquery-0.3.0/pytest.ini

@@ -0,0 +1,10 @@
+[pytest]
+minversion = 7.0
+testpaths = tests
+python_files = test_*.py
+python_classes = Test*
+python_functions = test_*
+# Coverage disabled by default for Python 3.8-3.10 performance
+# Use: pytest --cov=src/awsquery --cov-report=term-missing
+# Or: make coverage
+addopts = -ra --durations=0 --tb=short

{awsquery-0.2.0 → awsquery-0.3.0}/src/awsquery/cli.py

@@ -24,9 +24,18 @@ from .formatters import (
     format_table_output,
     show_keys,
 )
-from .security import action_to_policy_format, load_security_policy, validate_security
+from .security import (
+    action_to_policy_format,
+    get_service_valid_operations,
+    is_readonly_operation,
+    validate_readonly,
+)
 from .utils import create_session, debug_print, get_aws_services, sanitize_input
 
+# CLI flag constants
+SIMPLE_FLAGS = ["-d", "--debug", "-j", "--json", "-k", "--keys", "--allow-unsafe"]
+VALUE_FLAGS = ["--region", "--profile"]
+
 
 def _extract_flags_from_args(remaining_args):
     """Extract CLI flags from remaining arguments."""
@@ -35,9 +44,9 @@ def _extract_flags_from_args(remaining_args):
     i = 0
     while i < len(remaining_args):
         arg = remaining_args[i]
-        if arg in ["-d", "--debug", "-j", "--json", "-k", "--keys"]:
+        if arg in SIMPLE_FLAGS:
             flags.append(arg)
-        elif arg in ["--region", "--profile"]:
+        elif arg in VALUE_FLAGS:
             flags.append(arg)
             # Check for value after the flag
             if i + 1 < len(remaining_args):
@@ -60,6 +69,8 @@ def _preserve_parsed_flags(args):
         flags.append("-j")
     if getattr(args, "keys", False):
         flags.append("-k")
+    if getattr(args, "allow_unsafe", False):
+        flags.append("--allow-unsafe")
     if getattr(args, "region", None):
         flags.extend(["--region", args.region])
     if getattr(args, "profile", None):
@@ -96,7 +107,7 @@ def _extract_flag_and_value(args, i):
     """Extract a flag and optionally its value from args list."""
     flags = []
     flags.append(args[i])
-    if args[i] in ["--region", "--profile"]:
+    if args[i] in VALUE_FLAGS:
         if i + 1 < len(args) and not args[i + 1].startswith("-") and args[i + 1] != "--":
             flags.append(args[i + 1])
             return flags, 2  # consumed 2 args
@@ -110,10 +121,10 @@ def _process_remaining_args_after_separator(remaining):
     i = 0
     while i < len(remaining):
         arg = remaining[i]
-        if arg in ["-d", "--debug", "-j", "--json", "-k", "--keys"]:
+        if arg in SIMPLE_FLAGS:
             flags.append(arg)
             i += 1
-        elif arg in ["--region", "--profile"]:
+        elif arg in VALUE_FLAGS:
             extracted, consumed = _extract_flag_and_value(remaining, i)
             flags.extend(extracted)
             i += consumed
@@ -130,10 +141,10 @@ def _process_remaining_args(remaining):
     i = 0
     while i < len(remaining):
         arg = remaining[i]
-        if arg in ["-d", "--debug", "-j", "--json", "-k", "--keys"]:
+        if arg in SIMPLE_FLAGS:
             flags.append(arg)
             i += 1
-        elif arg in ["--region", "--profile"]:
+        elif arg in VALUE_FLAGS:
             extracted, consumed = _extract_flag_and_value(remaining, i)
             flags.extend(extracted)
             i += consumed
@@ -154,10 +165,10 @@ def _build_filter_argv(args, remaining):
     i = 0
     while i < len(remaining):
         arg = remaining[i]
-        if arg in ["-d", "--debug", "-j", "--json", "-k", "--keys"]:
+        if arg in SIMPLE_FLAGS:
             i += 1
             continue
-        if arg in ["--region", "--profile"]:
+        if arg in VALUE_FLAGS:
             i += 1
             if i < len(remaining) and not remaining[i].startswith("-"):
                 i += 1
@@ -195,6 +206,8 @@ def action_completer(prefix, parsed_args, **kwargs):
     if not parsed_args.service:
         return []
 
+    service = parsed_args.service
+
     try:
         # Create a client with minimal configuration to get operation names
         # This doesn't require valid AWS credentials, just the service model
@@ -206,36 +219,29 @@ def action_completer(prefix, parsed_args, **kwargs):
             session = botocore.session.Session()
 
             # Check if service exists in botocore's data
-            if parsed_args.service not in session.get_available_services():
+            if service not in session.get_available_services():
                 return []
 
             # Load the service model to get operations
-            service_model = session.get_service_model(parsed_args.service)
+            service_model = session.get_service_model(service)
             operations = list(service_model.operation_names)
         finally:
             # Restore AWS_PROFILE if it existed
             if old_profile is not None:
                 os.environ["AWS_PROFILE"] = old_profile
 
-        try:
-            allowed_actions = load_security_policy()
-        except:
-            # If policy loading fails, allow common read operations
-            allowed_actions = set()
-            for op in operations:
-                if any(op.startswith(prefix) for prefix in ["Describe", "List", "Get"]):
-                    allowed_actions.add(f"{parsed_args.service}:{op}")
+        # Filter operations to only show read-only ones in autocomplete
+        valid_operations = get_service_valid_operations(service, operations)
 
+        # Convert to CLI format
         cli_operations = []
         for op in operations:
-            if not validate_security(parsed_args.service, op, allowed_actions):
-                continue
-
-            kebab_case = re.sub("([a-z0-9])([A-Z])", r"\1-\2", op).lower()
-            cli_operations.append(kebab_case)
+            if op in valid_operations:
+                kebab_case = re.sub("([a-z0-9])([A-Z])", r"\1-\2", op).lower()
+                cli_operations.append(kebab_case)
 
         matched_ops = [op for op in cli_operations if op.startswith(prefix)]
-        return sorted(list(set(matched_ops)))
+        return sorted(matched_ops)
     except Exception:
         # If we can't get operations, return empty
         return []
@@ -277,6 +283,11 @@ Examples:
     )  # pragma: no mutate
     parser.add_argument("--region", help="AWS region to use for requests")  # pragma: no mutate
     parser.add_argument("--profile", help="AWS profile to use for requests")  # pragma: no mutate
+    parser.add_argument(
+        "--allow-unsafe",
+        action="store_true",
+        help="Allow potentially unsafe (non-readonly) operations without prompting",
+    )  # pragma: no mutate
 
     service_arg = parser.add_argument(
         "service", nargs="?", help="AWS service name"
@@ -315,6 +326,8 @@ Examples:
             flags.append("-j")
         if getattr(args, "keys", False):
             flags.append("-k")
+        if getattr(args, "allow_unsafe", False):
+            flags.append("--allow-unsafe")
         if getattr(args, "region", None):
             flags.extend(["--region", args.region])
         if getattr(args, "profile", None):
@@ -373,23 +386,17 @@ Examples:
     value_filters = [sanitize_input(f) for f in value_filters] if value_filters else []
     column_filters = [sanitize_input(f) for f in column_filters] if column_filters else []
 
-    allowed_actions = load_security_policy()
-
-    policy_action = action_to_policy_format(action)
-
-    debug_print(
-        f"DEBUG: Checking security for service='{service}', "
-        f"action='{action}', policy_action='{policy_action}'"
-    )  # pragma: no mutate
-    debug_print(f"DEBUG: Policy has {len(allowed_actions)} allowed actions")  # pragma: no mutate
-
-    if not validate_security(service, policy_action, allowed_actions):
-        print(f"ERROR: Action {service}:{action} not permitted by security policy", file=sys.stderr)
+    # Validate operation safety (only if we have a non-empty action)
+    if (
+        action is not None
+        and action
+        and str(action).strip() != "None"
+        and not validate_readonly(service, action, allow_unsafe=args.allow_unsafe)
+    ):
+        print(f"ERROR: Operation {service}:{action} was not allowed", file=sys.stderr)
         sys.exit(1)
-    else:
-        debug_print(
-            f"DEBUG: Action {service}:{policy_action} IS ALLOWED by security policy"
-        )  # pragma: no mutate
+
+    debug_print(f"DEBUG: Operation {service}:{action} validated successfully")  # pragma: no mutate
 
     # Create session with region/profile if specified
     session = create_session(region=args.region, profile=args.profile)

{awsquery-0.2.0 → awsquery-0.3.0}/src/awsquery/filters.py

@@ -1,6 +1,9 @@
 """Filtering logic for AWS Query Tool."""
 
+from __future__ import annotations
+
 import sys
+from typing import Dict, List
 
 from .formatters import convert_parameter_name, flatten_dict_keys, transform_tags_structure
 from .utils import debug_print, simplify_key
@@ -85,7 +88,7 @@ def filter_resources(resources, value_filters):
         transformed = transform_tags_structure(resource)
         transformed_resources.append(transformed)
 
-    filtered: list[dict] = []
+    filtered: List[Dict] = []
     for resource in transformed_resources:
         flattened = flatten_dict_keys(resource)
 
@@ -156,7 +159,7 @@ def parse_multi_level_filters_for_mode(argv, mode="single"):
 
     first_segment = segments[0] if segments else []
 
-    third_segment: list[str]
+    third_segment: List[str]
     if len(segments) == 1:
         second_segment = []
         third_segment = []
@@ -185,7 +188,7 @@ def parse_multi_level_filters_for_mode(argv, mode="single"):
             extra_args.append(arg)
 
     if mode == "single":
-        resource_filters: list[str] = []
+        resource_filters: List[str] = []
 
         if len(segments) == 1:
             value_filters = extra_args

{awsquery-0.2.0 → awsquery-0.3.0}/src/awsquery/formatters.py

@@ -1,6 +1,10 @@
 """Output formatting for AWS Query Tool."""
 
+from __future__ import annotations
+
 import json
+from collections import OrderedDict
+from typing import Dict, List
 
 from tabulate import tabulate
 
@@ -289,7 +293,7 @@ def format_table_output(resources, column_filters=None):
     if not selected_keys:
         return "No matching columns found."
 
-    simplified_to_full_keys: dict[str, list[str]] = {}
+    simplified_to_full_keys: Dict[str, List[str]] = {}
     unique_headers_ordered = []
 
     for key in selected_keys:
@@ -327,15 +331,13 @@ def format_table_output(resources, column_filters=None):
 
 def _process_json_resource_with_filters(resource, column_filters):
     """Process a single resource with column filters for JSON output."""
-    from collections import OrderedDict
-
     flat = flatten_dict_keys(resource)
 
     # Use filter_columns to apply pattern matching with ! operators
     filtered_flat = filter_columns(flat, column_filters)
 
     # Preserve order by using ordered dictionary
-    simplified_ordered: OrderedDict[str, list[str]] = OrderedDict()
+    simplified_ordered: Dict[str, List[str]] = OrderedDict()
 
     # Process keys in the order they appear in filtered_flat
     for key, value in filtered_flat.items():
@@ -346,7 +348,7 @@ def _process_json_resource_with_filters(resource, column_filters):
             simplified_ordered[simplified].append(str(value))
 
     # Build final filtered dict preserving order
-    filtered: OrderedDict[str, str] = OrderedDict()
+    filtered: Dict[str, str] = OrderedDict()
     for simplified_key, values in simplified_ordered.items():
         if not values:
             continue

awsquery-0.3.0/src/awsquery/security.py

@@ -0,0 +1,120 @@
+"""Security validation for AWS Query Tool using simple prefix matching."""
+
+import sys
+from typing import Optional
+
+from .utils import debug_print
+
+# Common read-only operation prefixes based on AWS ReadOnly policy analysis
+# These prefixes appear 20+ times across AWS services
+SAFE_READONLY_PREFIXES = [
+    "List",
+    "Get",
+    "Describe",
+    "Batch",
+    "Search",
+    "Query",
+    "View",
+    "Lookup",
+    "Read",
+    "Scan",
+    "Select",
+    "Check",
+    "Validate",
+    "Test",
+    "Preview",
+    "Verify",
+    "Estimate",
+    "Discover",
+    "Retrieve",
+    "Is",
+    "Has",
+    "Can",
+]
+
+
+def is_readonly_operation(action: str) -> bool:
+    """Check if an operation is read-only based on common prefixes."""
+    # Convert kebab-case to PascalCase for checking
+    if "-" in action:
+        parts = action.split("-")
+        action = "".join(part.capitalize() for part in parts)
+
+    # Check if action starts with any safe prefix
+    for prefix in SAFE_READONLY_PREFIXES:
+        if action.startswith(prefix):
+            debug_print(f"DEBUG: Operation {action} matches safe prefix {prefix}")
+            return True
+
+    debug_print(f"DEBUG: Operation {action} does not match any safe prefix")
+    return False
+
+
+def prompt_unsafe_operation(service: str, action: str) -> bool:
+    """Prompt user to confirm unsafe operation."""
+    print(f"\nWARNING: Operation '{service}:{action}' may not be read-only.", file=sys.stderr)
+    print("This operation could potentially modify AWS resources.", file=sys.stderr)
+
+    while True:
+        response = input("Do you want to proceed? (yes/no): ").lower().strip()
+        if response in ["yes", "y"]:
+            return True
+        elif response in ["no", "n"]:
+            return False
+        else:
+            print("Please answer 'yes' or 'no'.", file=sys.stderr)
+
+
+def validate_readonly(service: str, action: str, allow_unsafe: bool = False) -> bool:
+    """Validate if an operation is safe to execute.
+
+    Args:
+        service: AWS service name
+        action: Action/operation name
+        allow_unsafe: If True, allow all operations without prompting
+
+    Returns:
+        True if operation should proceed, False otherwise
+    """
+    # If allow_unsafe flag is set, allow everything
+    if allow_unsafe:
+        debug_print(f"DEBUG: --allow-unsafe flag set, allowing {service}:{action}")
+        return True
+
+    # Check if operation matches read-only prefixes
+    if is_readonly_operation(action):
+        return True
+
+    # For non-readonly operations, prompt the user
+    return prompt_unsafe_operation(service, action)
+
+
+# Legacy functions for backward compatibility (will be removed later)
+def load_security_policy():
+    """Legacy function - returns empty set to avoid breaking existing code."""
+    return set()
+
+
+def validate_security(service: str, action: str, allowed_actions) -> bool:
+    """Legacy function - always returns True to avoid breaking existing code."""
+    return True
+
+
+def action_to_policy_format(action: str) -> str:
+    """Convert kebab-case or snake_case action to PascalCase."""
+    if "-" in action:
+        parts = action.split("-")
+        return "".join(part.capitalize() for part in parts)
+    elif "_" in action:
+        parts = action.split("_")
+        return "".join(part.capitalize() for part in parts)
+    return action
+
+
+def get_service_valid_operations(service: str, all_operations: list) -> set:
+    """Get operations that match read-only prefixes."""
+    valid_ops = set()
+    for op in all_operations:
+        if is_readonly_operation(op):
+            valid_ops.add(op)
+    return valid_ops

{awsquery-0.2.0 → awsquery-0.3.0}/src/awsquery.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: awsquery
-Version: 0.2.0
+Version: 0.3.0
 Summary: Advanced CLI tool for querying AWS APIs with flexible filtering and automatic parameter resolution
 Author-email: Florian Motlik <flo@flomotlik.me>
 License: MIT

{awsquery-0.2.0 → awsquery-0.3.0}/src/awsquery.egg-info/SOURCES.txt

@@ -60,7 +60,7 @@ tests/unit/test_cli_flags.py
 tests/unit/test_cli_parser.py
 tests/unit/test_cli_session_args.py
 tests/unit/test_column_ordering.py
-tests/unit/test_config_loading.py
+tests/unit/test_config_loading_simple.py
 tests/unit/test_core.py
 tests/unit/test_core_inference.py
 tests/unit/test_core_string_handling.py

{awsquery-0.2.0 → awsquery-0.3.0}/tests/conftest.py

@@ -508,13 +508,13 @@ def workflow_validator():
 
         return base_cmd, res_filters, val_filters, col_filters
 
-    def _validate_security_workflow(service, action, policy):
+    def _validate_readonly_workflow(service, action, policy):
         """Validate security workflow."""
-        from awsquery.security import validate_security
+        from awsquery.security import validate_readonly
         from awsquery.utils import normalize_action_name
 
         normalized = normalize_action_name(action)
-        assert validate_security(service, action.replace("-", "").title().replace(" ", ""), policy)
+        assert validate_readonly(service, action.replace("-", "").title().replace(" ", ""), policy)
         return normalized
 
     def _validate_formatting_workflow(response, filters, expected_content):
@@ -535,7 +535,7 @@ def workflow_validator():
         (),
         {
             "validate_parsing": _validate_parsing_workflow,
-            "validate_security": _validate_security_workflow,
+            "validate_readonly": _validate_readonly_workflow,
             "validate_formatting": _validate_formatting_workflow,
         },
     )()