iam-policy-validator 1.11.1__tar.gz → 1.12.0__tar.gz

{iam_policy_validator-1.11.1 → iam_policy_validator-1.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.11.1
+Version: 1.12.0
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://github.com/boogy/iam-policy-validator/tree/main/docs

{iam_policy_validator-1.11.1 → iam_policy_validator-1.12.0}/examples/configs/full-reference-config.yaml

@@ -38,6 +38,11 @@
 # Every check supports ignore_patterns to filter specific findings while keeping
 # the check enabled. This is more flexible than disabling checks entirely.
 #
+# LEVELS OF IGNORE PATTERNS:
+#   1. Check-level: Applied to ALL requirements/findings in the check
+#   2. Requirement-level: Applied to SPECIFIC requirements only
+#      (Currently supported in: action_condition_enforcement)
+#
 # Pattern Matching Logic:
 #   - Multiple fields in ONE pattern = AND logic (all must match)
 #   - Multiple patterns = OR logic (any pattern matches → ignore)
@@ -861,6 +866,11 @@ action_condition_enforcement:
   #               "iam:PermissionsBoundary": "arn:aws:iam::123456789012:policy/XCompanyBoundaries"
   #             }
   #           }
+  #     # Per-requirement ignore_patterns: Skip this requirement for specific files
+  #     # This allows fine-grained control - other requirements still apply to these files
+  #     ignore_patterns:
+  #       # OpenID roles enforce permission boundary by default, so don't validate it
+  #       - filepath: ".*modules//?iam-openid.*"
   #
   #   # S3 write operations - Require organization ID
   #   - actions:

{iam_policy_validator-1.11.1 → iam_policy_validator-1.12.0}/iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.11.1"
+__version__ = "1.12.0"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
 _version_base = __version__.split("-", maxsplit=1)[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

{iam_policy_validator-1.11.1 → iam_policy_validator-1.12.0}/iam_validator/checks/action_condition_enforcement.py

@@ -125,6 +125,22 @@ Configuration in iam-validator.yaml:
                 - "iam:DeleteUser"
                 - "s3:DeleteBucket"
             description: "These dangerous actions should never be used"
+
+          # Per-requirement ignore_patterns: Skip specific requirements for certain files/actions
+          - actions:
+              - "iam:CreateRole"
+              - "iam:PutRolePolicy"
+              - "iam:AttachRolePolicy"
+            required_conditions:
+              - condition_key: "iam:PermissionsBoundary"
+                description: "Require permissions boundary for IAM operations"
+            ignore_patterns:
+              # Ignore this requirement for iam-openid modules (they enforce boundary by default)
+              - filepath_regex: ".*modules//?iam-openid.*"
+
+Note: ignore_patterns can be specified at TWO levels:
+  1. Check-level (applies to ALL requirements): Useful for broad exclusions
+  2. Requirement-level (applies to ONE requirement): Useful for fine-grained control
 """
 
 import re
@@ -132,6 +148,7 @@ from typing import TYPE_CHECKING, Any, ClassVar
 
 from iam_validator.core.aws_service import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
+from iam_validator.core.ignore_patterns import IgnorePatternMatcher
 from iam_validator.core.models import Statement, ValidationIssue
 from iam_validator.utils.regex import compile_and_cache
 
@@ -181,7 +198,7 @@ class ActionConditionEnforcementCheck(PolicyCheck):
         Returns:
             List of ValidationIssue objects found by this check
         """
-        del policy_file, kwargs  # Not used in current implementation
+        del kwargs  # Not used in current implementation
         issues = []
 
         # Get action condition requirements from config
@@ -211,16 +228,60 @@ class ActionConditionEnforcementCheck(PolicyCheck):
             if uses_logical_operators:
                 # Policy-wide detection (all_of/any_of/none_of)
                 policy_issues = await self._check_policy_wide(policy, requirement, fetcher, config)
+                # Filter by requirement-level ignore_patterns
+                policy_issues = self._filter_requirement_issues(
+                    policy_issues, requirement.get("ignore_patterns", []), policy_file
+                )
                 issues.extend(policy_issues)
             else:
                 # Per-statement check (simple list)
                 statement_issues = await self._check_per_statement(
                     policy, requirement, fetcher, config
                 )
+                # Filter by requirement-level ignore_patterns
+                statement_issues = self._filter_requirement_issues(
+                    statement_issues, requirement.get("ignore_patterns", []), policy_file
+                )
                 issues.extend(statement_issues)
 
         return issues
 
+    def _filter_requirement_issues(
+        self,
+        issues: list[ValidationIssue],
+        ignore_patterns: list[dict[str, Any]],
+        filepath: str,
+    ) -> list[ValidationIssue]:
+        """
+        Filter issues based on requirement-level ignore patterns.
+
+        This allows each requirement within action_condition_enforcement to have its own
+        ignore patterns, enabling fine-grained control over which findings to suppress.
+
+        Args:
+            issues: List of validation issues to filter
+            ignore_patterns: List of ignore pattern dictionaries for this requirement
+            filepath: Path to the policy file being checked
+
+        Returns:
+            Filtered list of issues (issues matching ignore patterns are removed)
+
+        Example:
+            A requirement can ignore specific files while other requirements check them:
+            - actions: ["iam:CreateRole"]
+              required_conditions: [...]
+              ignore_patterns:
+                - filepath_regex: ".*modules/iam-openid.*"
+        """
+        if not ignore_patterns:
+            return issues
+
+        return [
+            issue
+            for issue in issues
+            if not IgnorePatternMatcher.should_ignore_issue(issue, filepath, ignore_patterns)
+        ]
+
     async def _check_policy_wide(
         self,
         policy: "IAMPolicy",

{iam_policy_validator-1.11.1 → iam_policy_validator-1.12.0}/tests/core/test_action_condition_enforcement.py

@@ -438,3 +438,105 @@ class TestActionConditionEnforcement:
         assert len(issues) == 1
         assert issues[0].issue_type == "forbidden_condition_present"
         assert "0.0.0.0/0" in issues[0].message
+
+    @pytest.mark.asyncio
+    async def test_per_requirement_ignore_patterns(self, check, mock_fetcher):
+        """Test that per-requirement ignore_patterns work correctly."""
+        # Config with two requirements, one with ignore_patterns
+        config = CheckConfig(
+            check_id="action_condition_enforcement",
+            enabled=True,
+            severity="high",
+            config={
+                "requirements": [
+                    # Requirement 1: Permissions boundary (with ignore_patterns)
+                    {
+                        "actions": ["iam:CreateRole", "iam:PutRolePolicy"],
+                        "required_conditions": [
+                            {"condition_key": "iam:PermissionsBoundary"}
+                        ],
+                        "ignore_patterns": [
+                            {"filepath_regex": ".*iam-openid.*"}
+                        ],
+                    },
+                    # Requirement 2: PassRole (no ignore_patterns)
+                    {
+                        "actions": ["iam:PassRole"],
+                        "required_conditions": [
+                            {"condition_key": "iam:PassedToService"}
+                        ],
+                    },
+                ]
+            },
+        )
+
+        # Statement with both actions, no conditions
+        statement = Statement(
+            sid="TestStatement",
+            effect="Allow",
+            action=["iam:CreateRole", "iam:PassRole"],
+            resource="*",
+        )
+
+        policy = IAMPolicy(version="2012-10-17", statement=[statement])
+
+        # Test 1: Regular file - both requirements should trigger
+        issues = await check.execute_policy(policy, "policies/regular.json", mock_fetcher, config)
+        assert len(issues) == 2
+        assert any("iam:PermissionsBoundary" in i.message for i in issues)
+        assert any("iam:PassedToService" in i.message for i in issues)
+
+        # Test 2: iam-openid file - only PassRole requirement should trigger
+        issues = await check.execute_policy(
+            policy, "modules/iam-openid/main.tf", mock_fetcher, config
+        )
+        assert len(issues) == 1
+        assert "iam:PassedToService" in issues[0].message
+        assert "iam:PermissionsBoundary" not in issues[0].message
+
+    @pytest.mark.asyncio
+    async def test_per_requirement_ignore_patterns_policy_wide(self, check, mock_fetcher):
+        """Test that per-requirement ignore_patterns work with policy-wide (any_of) checks."""
+        config = CheckConfig(
+            check_id="action_condition_enforcement",
+            enabled=True,
+            severity="high",
+            config={
+                "requirements": [
+                    # Requirement with any_of and ignore_patterns
+                    {
+                        "actions": {
+                            "any_of": ["iam:CreateUser", "iam:AttachUserPolicy"]
+                        },
+                        "required_conditions": [
+                            {
+                                "condition_key": "aws:MultiFactorAuthPresent",
+                                "expected_value": True,
+                            }
+                        ],
+                        "ignore_patterns": [
+                            {"filepath_regex": ".*test.*"}
+                        ],
+                    },
+                ]
+            },
+        )
+
+        # Statement with iam:CreateUser, no MFA
+        statement = Statement(
+            sid="TestStatement",
+            effect="Allow",
+            action=["iam:CreateUser"],
+            resource="*",
+        )
+
+        policy = IAMPolicy(version="2012-10-17", statement=[statement])
+
+        # Test 1: Regular file - should trigger
+        issues = await check.execute_policy(policy, "policies/prod.json", mock_fetcher, config)
+        assert len(issues) == 1
+        assert "aws:MultiFactorAuthPresent" in issues[0].message
+
+        # Test 2: Test file - should be ignored
+        issues = await check.execute_policy(policy, "policies/test.json", mock_fetcher, config)
+        assert len(issues) == 0