iam-policy-validator 1.10.0__tar.gz → 1.10.1__tar.gz

{iam_policy_validator-1.10.0 → iam_policy_validator-1.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.10.0
+Version: 1.10.1
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://github.com/boogy/iam-policy-validator/tree/main/docs

{iam_policy_validator-1.10.0 → iam_policy_validator-1.10.1}/iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.10.0"
+__version__ = "1.10.1"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
 _version_base = __version__.split("-")[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

{iam_policy_validator-1.10.0 → iam_policy_validator-1.10.1}/iam_validator/core/aws_service/validators.py

@@ -280,9 +280,12 @@ class ServiceValidator:
                     "- `aws:RequestedRegion`\n"
                     "- `aws:SourceIp`\n"
                     "- `aws:SourceVpce`\n"
-                    "- `aws:UserAgent`\n"
+                    "- `aws:ResourceOrgID`\n"
+                    "- `aws:PrincipalOrgID`\n"
+                    "- `aws:SourceAccount`\n"
+                    "- `aws:PrincipalAccount`\n"
                     "- `aws:CurrentTime`\n"
-                    "- `aws:SecureTransport`\n"
+                    "- `aws:ResourceAccount`\n"
                     "- `aws:PrincipalArn`\n"
                     "- And many others"
                 )

{iam_policy_validator-1.10.0 → iam_policy_validator-1.10.1}/iam_validator/core/models.py

@@ -31,7 +31,7 @@ class ServiceInfo(BaseModel):
 class ActionDetail(BaseModel):
     """Details about an AWS IAM action."""
 
-    model_config = ConfigDict(populate_by_name=True)
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True)
 
     name: str = Field(alias="Name")
     action_condition_keys: list[str] | None = Field(
@@ -45,7 +45,7 @@ class ActionDetail(BaseModel):
 class ResourceType(BaseModel):
     """Details about an AWS resource type."""
 
-    model_config = ConfigDict(populate_by_name=True)
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True)
 
     name: str = Field(alias="Name")
     arn_formats: list[str] | None = Field(default=None, alias="ARNFormats")
@@ -68,7 +68,7 @@ class ResourceType(BaseModel):
 class ConditionKey(BaseModel):
     """Details about an AWS condition key."""
 
-    model_config = ConfigDict(populate_by_name=True)
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True)
 
     name: str = Field(alias="Name")
     description: str | None = Field(default=None, alias="Description")
@@ -78,7 +78,7 @@ class ConditionKey(BaseModel):
 class ServiceDetail(BaseModel):
     """Detailed information about an AWS service."""
 
-    model_config = ConfigDict(populate_by_name=True)
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True)
 
     name: str = Field(alias="Name")
     prefix: str | None = None  # Not always present in API response
@@ -106,7 +106,7 @@ class ServiceDetail(BaseModel):
 class Statement(BaseModel):
     """IAM policy statement."""
 
-    model_config = ConfigDict(populate_by_name=True, extra="allow")
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True, extra="allow")
 
     sid: str | None = Field(default=None, alias="Sid")
     effect: str | None = Field(default=None, alias="Effect")
@@ -136,7 +136,7 @@ class Statement(BaseModel):
 class IAMPolicy(BaseModel):
     """IAM policy document."""
 
-    model_config = ConfigDict(populate_by_name=True, extra="allow")
+    model_config = ConfigDict(validate_by_name=True, validate_by_alias=True, extra="allow")
 
     version: str | None = Field(default=None, alias="Version")
     statement: list[Statement] | None = Field(default=None, alias="Statement")

{iam_policy_validator-1.10.0 → iam_policy_validator-1.10.1}/iam_validator/sdk/policy_utils.py

@@ -63,9 +63,13 @@ def normalize_policy(policy: IAMPolicy) -> IAMPolicy:
     """
     # Pydantic model already handles this via Field(alias="Statement")
     # which expects a list, but we can ensure it's always a list
-    statements: list[Statement] = (
-        policy.statement if isinstance(policy.statement, list) else [policy.statement]
-    )
+    if policy.statement is None:
+        statements: list[Statement] = []
+    elif isinstance(policy.statement, list):
+        statements = policy.statement
+    else:
+        # Single statement - wrap in list
+        statements = [policy.statement]
 
     # Normalize actions and resources in each statement
     normalized_statements: list[Statement] = []
@@ -118,6 +122,9 @@ def extract_actions(policy: IAMPolicy) -> list[str]:
     """
     actions = set()
 
+    if policy.statement is None:
+        return []
+
     for stmt in policy.statement:
         # Handle Action field
         if stmt.action:
@@ -150,6 +157,9 @@ def extract_resources(policy: IAMPolicy) -> list[str]:
     """
     resources = set()
 
+    if policy.statement is None:
+        return []
+
     for stmt in policy.statement:
         # Handle Resource field
         if stmt.resource:
@@ -181,7 +191,10 @@ def extract_condition_keys(policy: IAMPolicy) -> list[str]:
         >>> keys = extract_condition_keys(policy)
         >>> print(f"Policy uses condition keys: {', '.join(keys)}")
     """
-    condition_keys = set()
+    condition_keys: set[str] = set()
+
+    if policy.statement is None:
+        return []
 
     for stmt in policy.statement:
         if stmt.condition:
@@ -216,6 +229,9 @@ def find_statements_with_action(policy: IAMPolicy, action: str) -> list[Statemen
 
     matching_statements = []
 
+    if policy.statement is None:
+        return []
+
     for stmt in policy.statement:
         stmt_actions = stmt.get_actions()
 
@@ -250,6 +266,9 @@ def find_statements_with_resource(policy: IAMPolicy, resource: str) -> list[Stat
 
     matching_statements = []
 
+    if policy.statement is None:
+        return []
+
     for stmt in policy.statement:
         stmt_resources = stmt.get_resources()
 
@@ -286,7 +305,8 @@ def merge_policies(*policies: IAMPolicy) -> IAMPolicy:
 
     all_statements: list[Statement] = []
     for policy in policies:
-        all_statements.extend(policy.statement)
+        if policy.statement is not None:
+            all_statements.extend(policy.statement)
 
     # Use capitalized field names (aliases) for Pydantic model construction
     return IAMPolicy(
@@ -318,8 +338,9 @@ def get_policy_summary(policy: IAMPolicy) -> dict[str, Any]:
     condition_keys = extract_condition_keys(policy)
 
     # Count allow vs deny statements
-    allow_count = sum(1 for s in policy.statement if s.effect.lower() == "allow")
-    deny_count = sum(1 for s in policy.statement if s.effect.lower() == "deny")
+    statements = policy.statement or []
+    allow_count = sum(1 for s in statements if s.effect and s.effect.lower() == "allow")
+    deny_count = sum(1 for s in statements if s.effect and s.effect.lower() == "deny")
 
     # Check for wildcards
     has_wildcard_actions = any("*" in action for action in actions)
@@ -327,7 +348,7 @@ def get_policy_summary(policy: IAMPolicy) -> dict[str, Any]:
 
     return {
         "version": policy.version,
-        "statement_count": len(policy.statement),
+        "statement_count": len(statements),
         "allow_statements": allow_count,
         "deny_statements": deny_count,
         "action_count": len(actions),
@@ -396,6 +417,8 @@ def is_resource_policy(policy: IAMPolicy) -> bool:
         >>> if is_resource_policy(policy):
         ...     print("This is an S3 bucket policy or similar")
     """
+    if policy.statement is None:
+        return False
     return any(stmt.principal is not None for stmt in policy.statement)
 
 
@@ -414,6 +437,9 @@ def has_public_access(policy: IAMPolicy) -> bool:
         >>> if has_public_access(policy):
         ...     print("WARNING: This policy allows public access!")
     """
+    if policy.statement is None:
+        return False
+
     for stmt in policy.statement:
         if stmt.principal == "*":
             return True

{iam_policy_validator-1.10.0 → iam_policy_validator-1.10.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "iam-policy-validator"
-version = "1.10.0"
+version = "1.10.1"
 description = "Validate AWS IAM policies for correctness and security using AWS Service Reference API"
 readme = "README.md"
 requires-python = ">=3.10"

{iam_policy_validator-1.10.0 → iam_policy_validator-1.10.1}/uv.lock

@@ -284,7 +284,7 @@ wheels = [
 
 [[package]]
 name = "iam-policy-validator"
-version = "1.9.0"
+version = "1.10.0"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },