iam-policy-validator 1.11.0__tar.gz → 1.12.0__tar.gz

{iam_policy_validator-1.11.0 → iam_policy_validator-1.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.11.0
+Version: 1.12.0
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://github.com/boogy/iam-policy-validator/tree/main/docs

{iam_policy_validator-1.11.0 → iam_policy_validator-1.12.0}/examples/configs/full-reference-config.yaml

@@ -38,6 +38,11 @@
 # Every check supports ignore_patterns to filter specific findings while keeping
 # the check enabled. This is more flexible than disabling checks entirely.
 #
+# LEVELS OF IGNORE PATTERNS:
+#   1. Check-level: Applied to ALL requirements/findings in the check
+#   2. Requirement-level: Applied to SPECIFIC requirements only
+#      (Currently supported in: action_condition_enforcement)
+#
 # Pattern Matching Logic:
 #   - Multiple fields in ONE pattern = AND logic (all must match)
 #   - Multiple patterns = OR logic (any pattern matches → ignore)
@@ -861,6 +866,11 @@ action_condition_enforcement:
   #               "iam:PermissionsBoundary": "arn:aws:iam::123456789012:policy/XCompanyBoundaries"
   #             }
   #           }
+  #     # Per-requirement ignore_patterns: Skip this requirement for specific files
+  #     # This allows fine-grained control - other requirements still apply to these files
+  #     ignore_patterns:
+  #       # OpenID roles enforce permission boundary by default, so don't validate it
+  #       - filepath: ".*modules//?iam-openid.*"
   #
   #   # S3 write operations - Require organization ID
   #   - actions:

{iam_policy_validator-1.11.0 → iam_policy_validator-1.12.0}/iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.11.0"
+__version__ = "1.12.0"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
 _version_base = __version__.split("-", maxsplit=1)[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

{iam_policy_validator-1.11.0 → iam_policy_validator-1.12.0}/iam_validator/checks/action_condition_enforcement.py

@@ -125,6 +125,22 @@ Configuration in iam-validator.yaml:
                 - "iam:DeleteUser"
                 - "s3:DeleteBucket"
             description: "These dangerous actions should never be used"
+
+          # Per-requirement ignore_patterns: Skip specific requirements for certain files/actions
+          - actions:
+              - "iam:CreateRole"
+              - "iam:PutRolePolicy"
+              - "iam:AttachRolePolicy"
+            required_conditions:
+              - condition_key: "iam:PermissionsBoundary"
+                description: "Require permissions boundary for IAM operations"
+            ignore_patterns:
+              # Ignore this requirement for iam-openid modules (they enforce boundary by default)
+              - filepath_regex: ".*modules//?iam-openid.*"
+
+Note: ignore_patterns can be specified at TWO levels:
+  1. Check-level (applies to ALL requirements): Useful for broad exclusions
+  2. Requirement-level (applies to ONE requirement): Useful for fine-grained control
 """
 
 import re
@@ -132,6 +148,7 @@ from typing import TYPE_CHECKING, Any, ClassVar
 
 from iam_validator.core.aws_service import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
+from iam_validator.core.ignore_patterns import IgnorePatternMatcher
 from iam_validator.core.models import Statement, ValidationIssue
 from iam_validator.utils.regex import compile_and_cache
 
@@ -181,7 +198,7 @@ class ActionConditionEnforcementCheck(PolicyCheck):
         Returns:
             List of ValidationIssue objects found by this check
         """
-        del policy_file, kwargs  # Not used in current implementation
+        del kwargs  # Not used in current implementation
         issues = []
 
         # Get action condition requirements from config
@@ -211,16 +228,60 @@ class ActionConditionEnforcementCheck(PolicyCheck):
             if uses_logical_operators:
                 # Policy-wide detection (all_of/any_of/none_of)
                 policy_issues = await self._check_policy_wide(policy, requirement, fetcher, config)
+                # Filter by requirement-level ignore_patterns
+                policy_issues = self._filter_requirement_issues(
+                    policy_issues, requirement.get("ignore_patterns", []), policy_file
+                )
                 issues.extend(policy_issues)
             else:
                 # Per-statement check (simple list)
                 statement_issues = await self._check_per_statement(
                     policy, requirement, fetcher, config
                 )
+                # Filter by requirement-level ignore_patterns
+                statement_issues = self._filter_requirement_issues(
+                    statement_issues, requirement.get("ignore_patterns", []), policy_file
+                )
                 issues.extend(statement_issues)
 
         return issues
 
+    def _filter_requirement_issues(
+        self,
+        issues: list[ValidationIssue],
+        ignore_patterns: list[dict[str, Any]],
+        filepath: str,
+    ) -> list[ValidationIssue]:
+        """
+        Filter issues based on requirement-level ignore patterns.
+
+        This allows each requirement within action_condition_enforcement to have its own
+        ignore patterns, enabling fine-grained control over which findings to suppress.
+
+        Args:
+            issues: List of validation issues to filter
+            ignore_patterns: List of ignore pattern dictionaries for this requirement
+            filepath: Path to the policy file being checked
+
+        Returns:
+            Filtered list of issues (issues matching ignore patterns are removed)
+
+        Example:
+            A requirement can ignore specific files while other requirements check them:
+            - actions: ["iam:CreateRole"]
+              required_conditions: [...]
+              ignore_patterns:
+                - filepath_regex: ".*modules/iam-openid.*"
+        """
+        if not ignore_patterns:
+            return issues
+
+        return [
+            issue
+            for issue in issues
+            if not IgnorePatternMatcher.should_ignore_issue(issue, filepath, ignore_patterns)
+        ]
+
     async def _check_policy_wide(
         self,
         policy: "IAMPolicy",

{iam_policy_validator-1.11.0 → iam_policy_validator-1.12.0}/iam_validator/commands/completion.py

@@ -135,7 +135,7 @@ _iam_validator_completion() {{
     prev="${{COMP_WORDS[COMP_CWORD-1]}}"
 
     # Main commands
-    local commands="validate post-to-pr analyze cache download-services query completion"
+    local commands="validate post-to-pr analyze cache sync-services query completion"
 
     # Get the command (first non-option argument)
     local cmd=""
@@ -215,6 +215,7 @@ _iam_validator_completion() {{
             fi
 
             # Complete options for query subcommands
+            local opts=""
             case "$query_subcmd" in
                 action)
                     opts="--service --name --access-level --resource-type --condition --output"
@@ -226,7 +227,23 @@ _iam_validator_completion() {{
                     opts="--service --name --output"
                     ;;
             esac
-            COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
+
+            # Filter out already used options
+            local used_opts=""
+            for ((i=2; i<COMP_CWORD; i++)); do
+                if [[ ${{COMP_WORDS[i]}} == --* ]]; then
+                    used_opts="$used_opts ${{COMP_WORDS[i]}}"
+                fi
+            done
+
+            local available_opts=""
+            for opt in $opts; do
+                if [[ ! " $used_opts " =~ " $opt " ]]; then
+                    available_opts="$available_opts $opt"
+                fi
+            done
+
+            COMPREPLY=( $(compgen -W "$available_opts" -- "$cur") )
             return 0
             ;;
         validate)
@@ -234,18 +251,36 @@ _iam_validator_completion() {{
             COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
             return 0
             ;;
+        post-to-pr)
+            opts="--report -r --create-review --no-review --add-summary --no-summary --config -c"
+            COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
+            return 0
+            ;;
         analyze)
-            opts="--policy --format --output"
+            opts="--path -p --policy-type -t --region --profile --format -f --output -o --no-recursive --fail-on-warnings --github-comment --github-review --github-summary --run-all-checks --check-access-not-granted --check-access-resources --check-no-new-access --check-no-public-access --public-access-resource-type --verbose -v"
             COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
             return 0
             ;;
         cache)
-            opts="--clear --info"
-            COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
+            # Check if we need to complete the cache subcommand
+            local cache_subcmd=""
+            for ((i=2; i<COMP_CWORD; i++)); do
+                if [[ ${{COMP_WORDS[i]}} =~ ^(info|list|clear|refresh|prefetch|location)$ ]]; then
+                    cache_subcmd=${{COMP_WORDS[i]}}
+                    break
+                fi
+            done
+
+            if [[ -z "$cache_subcmd" ]]; then
+                # Complete cache subcommand
+                COMPREPLY=( $(compgen -W "info list clear refresh prefetch location" -- "$cur") )
+                return 0
+            fi
+            # Cache subcommands have no additional options
             return 0
             ;;
-        download-services)
-            opts="--output-dir --force"
+        sync-services)
+            opts="--output-dir --max-concurrent"
             COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
             return 0
             ;;
@@ -272,72 +307,34 @@ complete -F _iam_validator_completion iam-validator
 # Generated by: iam-validator completion zsh
 
 _iam_validator() {{
-    local -a commands
-    commands=(
-        'validate:Validate IAM policies'
-        'post-to-pr:Post validation results to GitHub PR'
-        'analyze:Analyze IAM policies'
-        'cache:Manage cache'
-        'download-services:Download AWS service definitions'
-        'query:Query AWS service definitions'
-        'completion:Generate shell completion scripts'
-    )
-
-    local -a query_subcommands
-    query_subcommands=(
-        'action:Query IAM actions'
-        'arn:Query ARN formats'
-        'condition:Query condition keys'
-    )
-
-    local -a access_levels
-    access_levels=(
-        'read:Read-only actions'
-        'write:Write actions'
-        'list:List actions'
-        'tagging:Tagging actions'
-        'permissions-management:Permission management actions'
-    )
-
-    local -a formats
-    formats=(
-        'json:JSON output'
-        'yaml:YAML output'
-        'text:Plain text output'
-    )
-
-    local -a shells
-    shells=(
-        'bash:Bash completion'
-        'zsh:Zsh completion'
-    )
+    local curcontext="$curcontext" state line
+    typeset -A opt_args
 
     # Cached AWS services
     local -a aws_services
     aws_services=({services_list})
 
     _arguments -C \\
-        '1: :->command' \\
-        '*:: :->args'
+        '1: :_iam_validator_commands' \\
+        '*::arg:->args'
 
     case $state in
-        command)
-            _describe 'command' commands
-            ;;
         args)
             case $words[1] in
                 query)
-                    case $CURRENT in
-                        2)
-                            _describe 'query subcommand' query_subcommands
-                            ;;
-                        *)
-                            case $words[2] in
+                    local query_state
+                    _arguments -C \\
+                        '1: :_iam_validator_query_subcommands' \\
+                        '*::arg:->query_args' && return 0
+
+                    case $state in
+                        query_args)
+                            case $words[1] in
                                 action)
                                     _arguments \\
                                         '--service[AWS service name]:service:($aws_services)' \\
                                         '--name[Action name]:action name:' \\
-                                        '--access-level[Filter by access level]:access level:($access_levels)' \\
+                                        '--access-level[Filter by access level]:access level:(read write list tagging permissions-management)' \\
                                         '--resource-type[Filter by resource type]:resource type:' \\
                                         '--condition[Filter by condition key]:condition key:' \\
                                         '--output[Output format]:format:(json yaml text)'
@@ -361,7 +358,8 @@ _iam_validator() {{
                     ;;
                 validate)
                     _arguments \\
-                        '(--path -p)'{{--path,-p}}'[Path to policy file or directory]:file:_files' \\
+                        '*--path[Path to policy file or directory]:file:_files' \\
+                        '*-p[Path to policy file or directory]:file:_files' \\
                         '--stdin[Read policy from stdin]' \\
                         '(--format -f)'{{--format,-f}}'[Output format]:format:(console enhanced json markdown html csv sarif)' \\
                         '(--output -o)'{{--output,-o}}'[Output file path]:file:_files' \\
@@ -380,30 +378,79 @@ _iam_validator() {{
                         '--summary[Show Executive Summary section]' \\
                         '--severity-breakdown[Show Issue Severity Breakdown section]'
                     ;;
+                post-to-pr)
+                    _arguments \\
+                        '(--report -r)'{{--report,-r}}'[Path to JSON report file]:file:_files' \\
+                        '--create-review[Create line-specific review comments]' \\
+                        '--no-review[Do not create line-specific review comments]' \\
+                        '--add-summary[Add summary comment]' \\
+                        '--no-summary[Do not add summary comment]' \\
+                        '(--config -c)'{{--config,-c}}'[Configuration file]:file:_files'
+                    ;;
                 analyze)
                     _arguments \\
-                        '--policy[Policy file]:file:_files' \\
-                        '--format[Output format]:format:($formats)' \\
-                        '--output[Output file]:file:_files'
+                        '*--path[Path to policy file or directory]:file:_files' \\
+                        '*-p[Path to policy file or directory]:file:_files' \\
+                        '(--policy-type -t)'{{--policy-type,-t}}'[Type of IAM policy]:policy type:(IDENTITY_POLICY RESOURCE_POLICY SERVICE_CONTROL_POLICY)' \\
+                        '--region[AWS region]:region:' \\
+                        '--profile[AWS profile]:profile:' \\
+                        '(--format -f)'{{--format,-f}}'[Output format]:format:(console json markdown)' \\
+                        '(--output -o)'{{--output,-o}}'[Output file path]:file:_files' \\
+                        '--no-recursive[Do not recursively search directories]' \\
+                        '--fail-on-warnings[Fail validation if warnings are found]' \\
+                        '--github-comment[Post validation results as GitHub PR comment]' \\
+                        '--github-review[Create line-specific review comments on PR]' \\
+                        '--github-summary[Write validation summary to GitHub Actions job summary]' \\
+                        '--run-all-checks[Run full validation checks if Access Analyzer passes]' \\
+                        '*--check-access-not-granted[Actions to check are NOT granted]:action:' \\
+                        '*--check-access-resources[Resources to check]:resource:' \\
+                        '--check-no-new-access[Path to existing policy]:file:_files' \\
+                        '--check-no-public-access[Check that resource policy does not allow public access]' \\
+                        '*--public-access-resource-type[Resource type for public access check]:resource type:' \\
+                        '(--verbose -v)'{{--verbose,-v}}'[Enable verbose logging]'
                     ;;
                 cache)
                     _arguments \\
-                        '--clear[Clear cache]' \\
-                        '--info[Show cache info]'
+                        '1: :(info list clear refresh prefetch location)'
                     ;;
-                download-services)
+                sync-services)
                     _arguments \\
                         '--output-dir[Output directory]:directory:_directories' \\
-                        '--force[Force re-download]'
+                        '--max-concurrent[Maximum concurrent downloads]:number:'
                     ;;
                 completion)
-                    _describe 'shell' shells
+                    _arguments \\
+                        '1: :(bash zsh)'
                     ;;
             esac
             ;;
     esac
 }}
 
+_iam_validator_commands() {{
+    local -a commands
+    commands=(
+        'validate:Validate IAM policies'
+        'post-to-pr:Post validation results to GitHub PR'
+        'analyze:Analyze IAM policies using AWS IAM Access Analyzer'
+        'cache:Manage AWS service definition cache'
+        'sync-services:Sync/download all AWS service definitions for offline use'
+        'query:Query AWS service definitions (actions, ARNs, condition keys)'
+        'completion:Generate shell completion scripts (bash or zsh)'
+    )
+    _describe 'command' commands
+}}
+
+_iam_validator_query_subcommands() {{
+    local -a subcommands
+    subcommands=(
+        'action:Query IAM actions'
+        'arn:Query ARN formats'
+        'condition:Query condition keys'
+    )
+    _describe 'query subcommand' subcommands
+}}
+
 _iam_validator "$@"
 """
 

{iam_policy_validator-1.11.0 → iam_policy_validator-1.12.0}/tests/core/test_action_condition_enforcement.py

@@ -438,3 +438,105 @@ class TestActionConditionEnforcement:
         assert len(issues) == 1
         assert issues[0].issue_type == "forbidden_condition_present"
         assert "0.0.0.0/0" in issues[0].message
+
+    @pytest.mark.asyncio
+    async def test_per_requirement_ignore_patterns(self, check, mock_fetcher):
+        """Test that per-requirement ignore_patterns work correctly."""
+        # Config with two requirements, one with ignore_patterns
+        config = CheckConfig(
+            check_id="action_condition_enforcement",
+            enabled=True,
+            severity="high",
+            config={
+                "requirements": [
+                    # Requirement 1: Permissions boundary (with ignore_patterns)
+                    {
+                        "actions": ["iam:CreateRole", "iam:PutRolePolicy"],
+                        "required_conditions": [
+                            {"condition_key": "iam:PermissionsBoundary"}
+                        ],
+                        "ignore_patterns": [
+                            {"filepath_regex": ".*iam-openid.*"}
+                        ],
+                    },
+                    # Requirement 2: PassRole (no ignore_patterns)
+                    {
+                        "actions": ["iam:PassRole"],
+                        "required_conditions": [
+                            {"condition_key": "iam:PassedToService"}
+                        ],
+                    },
+                ]
+            },
+        )
+
+        # Statement with both actions, no conditions
+        statement = Statement(
+            sid="TestStatement",
+            effect="Allow",
+            action=["iam:CreateRole", "iam:PassRole"],
+            resource="*",
+        )
+
+        policy = IAMPolicy(version="2012-10-17", statement=[statement])
+
+        # Test 1: Regular file - both requirements should trigger
+        issues = await check.execute_policy(policy, "policies/regular.json", mock_fetcher, config)
+        assert len(issues) == 2
+        assert any("iam:PermissionsBoundary" in i.message for i in issues)
+        assert any("iam:PassedToService" in i.message for i in issues)
+
+        # Test 2: iam-openid file - only PassRole requirement should trigger
+        issues = await check.execute_policy(
+            policy, "modules/iam-openid/main.tf", mock_fetcher, config
+        )
+        assert len(issues) == 1
+        assert "iam:PassedToService" in issues[0].message
+        assert "iam:PermissionsBoundary" not in issues[0].message
+
+    @pytest.mark.asyncio
+    async def test_per_requirement_ignore_patterns_policy_wide(self, check, mock_fetcher):
+        """Test that per-requirement ignore_patterns work with policy-wide (any_of) checks."""
+        config = CheckConfig(
+            check_id="action_condition_enforcement",
+            enabled=True,
+            severity="high",
+            config={
+                "requirements": [
+                    # Requirement with any_of and ignore_patterns
+                    {
+                        "actions": {
+                            "any_of": ["iam:CreateUser", "iam:AttachUserPolicy"]
+                        },
+                        "required_conditions": [
+                            {
+                                "condition_key": "aws:MultiFactorAuthPresent",
+                                "expected_value": True,
+                            }
+                        ],
+                        "ignore_patterns": [
+                            {"filepath_regex": ".*test.*"}
+                        ],
+                    },
+                ]
+            },
+        )
+
+        # Statement with iam:CreateUser, no MFA
+        statement = Statement(
+            sid="TestStatement",
+            effect="Allow",
+            action=["iam:CreateUser"],
+            resource="*",
+        )
+
+        policy = IAMPolicy(version="2012-10-17", statement=[statement])
+
+        # Test 1: Regular file - should trigger
+        issues = await check.execute_policy(policy, "policies/prod.json", mock_fetcher, config)
+        assert len(issues) == 1
+        assert "aws:MultiFactorAuthPresent" in issues[0].message
+
+        # Test 2: Test file - should be ignored
+        issues = await check.execute_policy(policy, "policies/test.json", mock_fetcher, config)
+        assert len(issues) == 0