iam-policy-validator 1.10.0__py3-none-any.whl → 1.10.1__py3-none-any.whl

{iam_policy_validator-1.10.0.dist-info → iam_policy_validator-1.10.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.10.0
+Version: 1.10.1
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://github.com/boogy/iam-policy-validator/tree/main/docs

{iam_policy_validator-1.10.0.dist-info → iam_policy_validator-1.10.1.dist-info}/RECORD

@@ -1,6 +1,6 @@
 iam_validator/__init__.py,sha256=xHdUASOxFHwEXfT_GSr_KrkLlnxZ-pAAr1wW1PwAGko,693
 iam_validator/__main__.py,sha256=to_nz3n_IerJpVVZZ6WSFlFR5s_06J0csfPOTfQZG8g,197
-iam_validator/__version__.py,sha256=FvUNUrZJC1gRVPHFBok-yxk6rVZGHH_JjnMPCje10kg,362
+iam_validator/__version__.py,sha256=SRRdMee5oIovcL25-xNSjSxoHM9bzGQhwmx_U4YhnXQ,362
 iam_validator/checks/__init__.py,sha256=OTkPnmlelu4YjMO8krjhu2wXiTV72RzopA5u1SfPQA0,1990
 iam_validator/checks/action_condition_enforcement.py,sha256=0dCH_xX-Xc0uLxtNeRjrpNjWYbdWQRzO1XNcLTSn6sI,51698
 iam_validator/checks/action_resource_matching.py,sha256=WiGJmCIJfx5yituMjZxpKmk-99N6nK20ueN02ddy9oM,19296
@@ -42,7 +42,7 @@ iam_validator/core/condition_validators.py,sha256=7zBjlcf2xGFKGbcFrXSLvWT5tFhWxo
 iam_validator/core/constants.py,sha256=cVBPgbXr4ALltH_NTSKsgBi6wmndLnOyUWhyBx0ZwrM,6113
 iam_validator/core/ignore_patterns.py,sha256=pZqDJBtkbck-85QK5eFPM5ZOPEKs3McRh3avqiCT5z0,10398
 iam_validator/core/label_manager.py,sha256=48CRASWg98wyjfVF_1pUzj6dm9itzmG7SeIWf0TSUfc,7502
-iam_validator/core/models.py,sha256=f5d9ovtO1xMSwhyBrKIgc2psEq0eugnd3S3ioqurqEE,13242
+iam_validator/core/models.py,sha256=yQ5iBTffdAzx88h8RyVCCmBg6kkD2zg5_lb-qLdjy3w,13386
 iam_validator/core/policy_checks.py,sha256=FNVuS2GTffwCjjrlupVIazC172gSxKYAAT_ObV6Apbo,8803
 iam_validator/core/policy_loader.py,sha256=2KJnXzGg3g9pDXWZHk3DO0xpZnZZ-wXWFEOdQ_naJ8s,17862
 iam_validator/core/pr_commenter.py,sha256=NTKoSmjvspYX2rbl3Xn8d611XkTNSfYlGUY0zBHBP4g,16801
@@ -54,7 +54,7 @@ iam_validator/core/aws_service/fetcher.py,sha256=X4iI6fiLj4l9f3W6_J0E58lSP26UsBh
 iam_validator/core/aws_service/parsers.py,sha256=gJzR7HCD8ItCWCCbguTQIZpPEdj2rdMwC7LPhu7ve14,5174
 iam_validator/core/aws_service/patterns.py,sha256=gGc55Tn-EJ3cmcWtmYAZROUajKYz7DaMchYWGEhHpC0,1726
 iam_validator/core/aws_service/storage.py,sha256=PrfKdvF60IL7E_8xYs_XwFoAJPRcVYw57FVLHCoqwVk,10429
-iam_validator/core/aws_service/validators.py,sha256=rgCScqEjXNH8xNg2R91eJbb4eIV3jZN7a6VW0n0hgA4,16347
+iam_validator/core/aws_service/validators.py,sha256=AY0BjydskXoesEzUShH4gZKp6gtSX7s1rCLP_iOZQMc,16493
 iam_validator/core/config/__init__.py,sha256=CWSyIA7kEyzrskEenjYbs9Iih10BXRpiY9H2dHg61rU,2671
 iam_validator/core/config/aws_api.py,sha256=HLIzOItQ0A37wxHcgWck6ZFO0wmNY8JNTiWMMK6JKYU,1248
 iam_validator/core/config/aws_global_conditions.py,sha256=gdmMxXGBy95B3uYUG-J7rnM6Ixgc6L7Y9Pcd2XAMb60,7170
@@ -83,14 +83,14 @@ iam_validator/sdk/arn_matching.py,sha256=HSDpLltOYISq-SoPebAlM89mKOaUaghq_04urch
 iam_validator/sdk/context.py,sha256=FvAEyUa_s7tHWoSdgjSkzHf1CLlYpAEmLZANxs2IJ4A,6826
 iam_validator/sdk/exceptions.py,sha256=tm91TxIwU157U_UHN7w5qICf_OhU11agj6pV5W_YP-4,1023
 iam_validator/sdk/helpers.py,sha256=sjfK0na_Fo7O8GhEVhl44rVHqOdw6nAKkBL4FVL-QdU,5697
-iam_validator/sdk/policy_utils.py,sha256=CZS1OGSdiWsd2lsCwg0BDcUNWa61tUwgvn-P5rKqeN8,12987
+iam_validator/sdk/policy_utils.py,sha256=Fh-QElhmPypzSJuF9rcrY7y46Gz3hQu3-yN5b1_mSHY,13579
 iam_validator/sdk/shortcuts.py,sha256=EVNSYV7rv4TFH03ulsZ3mS1UVmTSp2jKpc2AXs4j1q4,8531
 iam_validator/utils/__init__.py,sha256=NveA2F3G1E6-ANZzFr7J6Q6u5mogvMp862iFokmYuCs,1021
 iam_validator/utils/cache.py,sha256=wOQKOBeoG6QqC5f0oXcHz63Cjtu_-SsSS-0pTSwyAiM,3254
 iam_validator/utils/regex.py,sha256=xHoMECttb7qaMhts-c9b0GIxdhHNZTt-UBr7wNhWfzg,6219
 iam_validator/utils/terminal.py,sha256=FsRaRMH_JAyDgXWBCOgOEhbS89cs17HCmKYoughq5io,724
-iam_policy_validator-1.10.0.dist-info/METADATA,sha256=ksZBI5NOZxypD5leqm2BSUOnak43V9EeLBOw1XoLXd0,19070
-iam_policy_validator-1.10.0.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-iam_policy_validator-1.10.0.dist-info/entry_points.txt,sha256=8HtWd8O7mvPiPdZR5YbzY8or_qcqLM4-pKaFdhtFT8M,62
-iam_policy_validator-1.10.0.dist-info/licenses/LICENSE,sha256=AMnbFTBDcK4_MITe2wiQBkj0vg-jjBBhsc43ydC7tt4,1098
-iam_policy_validator-1.10.0.dist-info/RECORD,,
+iam_policy_validator-1.10.1.dist-info/METADATA,sha256=lIMmE1Y6TX34sh3stfe9J2_q5ATb9fYZqVqOupYNcL8,19070
+iam_policy_validator-1.10.1.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+iam_policy_validator-1.10.1.dist-info/entry_points.txt,sha256=8HtWd8O7mvPiPdZR5YbzY8or_qcqLM4-pKaFdhtFT8M,62
+iam_policy_validator-1.10.1.dist-info/licenses/LICENSE,sha256=AMnbFTBDcK4_MITe2wiQBkj0vg-jjBBhsc43ydC7tt4,1098
+iam_policy_validator-1.10.1.dist-info/RECORD,,

iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.10.0"
+__version__ = "1.10.1"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
 _version_base = __version__.split("-")[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

iam_validator/core/aws_service/validators.py

@@ -280,9 +280,12 @@ class ServiceValidator:
                     "- `aws:RequestedRegion`\n"
                     "- `aws:SourceIp`\n"
                     "- `aws:SourceVpce`\n"
-                    "- `aws:UserAgent`\n"
+                    "- `aws:ResourceOrgID`\n"
+                    "- `aws:PrincipalOrgID`\n"
+                    "- `aws:SourceAccount`\n"
+                    "- `aws:PrincipalAccount`\n"
                     "- `aws:CurrentTime`\n"
-                    "- `aws:SecureTransport`\n"
+                    "- `aws:ResourceAccount`\n"
                     "- `aws:PrincipalArn`\n"
                     "- And many others"
                 )

iam_validator/core/models.py

@@ -31,7 +31,7 @@ class ServiceInfo(BaseModel):
 class ActionDetail(BaseModel):
     """Details about an AWS IAM action."""
 
-    model_config = ConfigDict(populate_by_name=True)
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True)
 
     name: str = Field(alias="Name")
     action_condition_keys: list[str] | None = Field(
@@ -45,7 +45,7 @@ class ActionDetail(BaseModel):
 class ResourceType(BaseModel):
     """Details about an AWS resource type."""
 
-    model_config = ConfigDict(populate_by_name=True)
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True)
 
     name: str = Field(alias="Name")
     arn_formats: list[str] | None = Field(default=None, alias="ARNFormats")
@@ -68,7 +68,7 @@ class ResourceType(BaseModel):
 class ConditionKey(BaseModel):
     """Details about an AWS condition key."""
 
-    model_config = ConfigDict(populate_by_name=True)
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True)
 
     name: str = Field(alias="Name")
     description: str | None = Field(default=None, alias="Description")
@@ -78,7 +78,7 @@ class ConditionKey(BaseModel):
 class ServiceDetail(BaseModel):
     """Detailed information about an AWS service."""
 
-    model_config = ConfigDict(populate_by_name=True)
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True)
 
     name: str = Field(alias="Name")
     prefix: str | None = None  # Not always present in API response
@@ -106,7 +106,7 @@ class ServiceDetail(BaseModel):
 class Statement(BaseModel):
     """IAM policy statement."""
 
-    model_config = ConfigDict(populate_by_name=True, extra="allow")
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True, extra="allow")
 
     sid: str | None = Field(default=None, alias="Sid")
     effect: str | None = Field(default=None, alias="Effect")
@@ -136,7 +136,7 @@ class Statement(BaseModel):
 class IAMPolicy(BaseModel):
     """IAM policy document."""
 
-    model_config = ConfigDict(populate_by_name=True, extra="allow")
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True, extra="allow")
 
     version: str | None = Field(default=None, alias="Version")
     statement: list[Statement] | None = Field(default=None, alias="Statement")

iam_validator/sdk/policy_utils.py

@@ -63,9 +63,13 @@ def normalize_policy(policy: IAMPolicy) -> IAMPolicy:
     """
     # Pydantic model already handles this via Field(alias="Statement")
     # which expects a list, but we can ensure it's always a list
-    statements: list[Statement] = (
-        policy.statement if isinstance(policy.statement, list) else [policy.statement]
-    )
+    if policy.statement is None:
+        statements: list[Statement] = []
+    elif isinstance(policy.statement, list):
+        statements = policy.statement
+    else:
+        # Single statement - wrap in list
+        statements = [policy.statement]
 
     # Normalize actions and resources in each statement
     normalized_statements: list[Statement] = []
@@ -118,6 +122,9 @@ def extract_actions(policy: IAMPolicy) -> list[str]:
     """
     actions = set()
 
+    if policy.statement is None:
+        return []
+
     for stmt in policy.statement:
         # Handle Action field
         if stmt.action:
@@ -150,6 +157,9 @@ def extract_resources(policy: IAMPolicy) -> list[str]:
     """
     resources = set()
 
+    if policy.statement is None:
+        return []
+
     for stmt in policy.statement:
         # Handle Resource field
         if stmt.resource:
@@ -181,7 +191,10 @@ def extract_condition_keys(policy: IAMPolicy) -> list[str]:
         >>> keys = extract_condition_keys(policy)
         >>> print(f"Policy uses condition keys: {', '.join(keys)}")
     """
-    condition_keys = set()
+    condition_keys: set[str] = set()
+
+    if policy.statement is None:
+        return []
 
     for stmt in policy.statement:
         if stmt.condition:
@@ -216,6 +229,9 @@ def find_statements_with_action(policy: IAMPolicy, action: str) -> list[Statemen
 
     matching_statements = []
 
+    if policy.statement is None:
+        return []
+
     for stmt in policy.statement:
         stmt_actions = stmt.get_actions()
 
@@ -250,6 +266,9 @@ def find_statements_with_resource(policy: IAMPolicy, resource: str) -> list[Stat
 
     matching_statements = []
 
+    if policy.statement is None:
+        return []
+
     for stmt in policy.statement:
         stmt_resources = stmt.get_resources()
 
@@ -286,7 +305,8 @@ def merge_policies(*policies: IAMPolicy) -> IAMPolicy:
 
     all_statements: list[Statement] = []
     for policy in policies:
-        all_statements.extend(policy.statement)
+        if policy.statement is not None:
+            all_statements.extend(policy.statement)
 
     # Use capitalized field names (aliases) for Pydantic model construction
     return IAMPolicy(
@@ -318,8 +338,9 @@ def get_policy_summary(policy: IAMPolicy) -> dict[str, Any]:
     condition_keys = extract_condition_keys(policy)
 
     # Count allow vs deny statements
-    allow_count = sum(1 for s in policy.statement if s.effect.lower() == "allow")
-    deny_count = sum(1 for s in policy.statement if s.effect.lower() == "deny")
+    statements = policy.statement or []
+    allow_count = sum(1 for s in statements if s.effect and s.effect.lower() == "allow")
+    deny_count = sum(1 for s in statements if s.effect and s.effect.lower() == "deny")
 
     # Check for wildcards
     has_wildcard_actions = any("*" in action for action in actions)
@@ -327,7 +348,7 @@ def get_policy_summary(policy: IAMPolicy) -> dict[str, Any]:
 
     return {
         "version": policy.version,
-        "statement_count": len(policy.statement),
+        "statement_count": len(statements),
         "allow_statements": allow_count,
         "deny_statements": deny_count,
         "action_count": len(actions),
@@ -396,6 +417,8 @@ def is_resource_policy(policy: IAMPolicy) -> bool:
         >>> if is_resource_policy(policy):
         ...     print("This is an S3 bucket policy or similar")
     """
+    if policy.statement is None:
+        return False
     return any(stmt.principal is not None for stmt in policy.statement)
 
 
@@ -414,6 +437,9 @@ def has_public_access(policy: IAMPolicy) -> bool:
         >>> if has_public_access(policy):
         ...     print("WARNING: This policy allows public access!")
     """
+    if policy.statement is None:
+        return False
+
     for stmt in policy.statement:
         if stmt.principal == "*":
             return True