iam-policy-validator 1.13.0__tar.gz → 1.14.0__tar.gz

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/.github/workflows/codeql.yml

@@ -29,15 +29,15 @@ jobs:
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v5
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4
+        uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v4
         with:
           languages: ${{ matrix.language }}
           queries: security-extended,security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4
+        uses: github/codeql-action/autobuild@fe4161a26a8629af62121b670040955b330f9af2 # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4
+        uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v4
         with:
           category: "/language:${{matrix.language}}"

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/.github/workflows/pre-release.yml

@@ -178,7 +178,7 @@ jobs:
         run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
       - name: Create GitHub Pre-Release
-        uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
         with:
           name: "${{ steps.version.outputs.tag }}"
           tag_name: ${{ steps.version.outputs.tag }}

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/.github/workflows/release.yml

@@ -70,7 +70,7 @@ jobs:
           echo "Generated changelog with $COMMIT_COUNT commits"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
         with:
           name: ${{ steps.get_version.outputs.tag }}
           body_path: CHANGELOG.txt

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/.github/workflows/scorecard.yml

@@ -57,6 +57,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           sarif_file: results.sarif

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.13.0
+Version: 1.14.0
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://github.com/boogy/iam-policy-validator/tree/main/docs

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/action.yaml

@@ -31,11 +31,21 @@ inputs:
     required: false
     default: "true"
 
+  allow-owner-ignore:
+    description: "Allow CODEOWNERS to ignore findings by replying 'ignore' to review comments"
+    required: false
+    default: "true"
+
   github-summary:
     description: "Write summary to GitHub Actions job summary (visible in Actions tab)"
     required: false
     default: "false"
 
+  show-console-output:
+    description: "Show enhanced validation results in job logs (CI mode). Set to 'false' to suppress console output"
+    required: false
+    default: "true"
+
   format:
     description: "Output format (console, enhanced, json, markdown, sarif, csv, html)"
     required: false
@@ -442,17 +452,26 @@ runs:
           ARGS="$ARGS --aws-services-dir ${{ github.workspace }}/${{ inputs.aws-services-dir }}"
         fi
 
-        echo "Running: uv run iam-validator $ARGS"
+        # Add owner-ignore flag (default is enabled, so only add flag when disabled)
+        if [ "${{ inputs.allow-owner-ignore }}" = "false" ]; then
+          ARGS="$ARGS --no-owner-ignore"
+        fi
 
         # Create temp file for JSON metrics extraction
         METRICS_FILE=$(mktemp)
 
-        # Save original format and override to JSON for metrics parsing
-        ORIGINAL_FORMAT="${{ inputs.format }}"
-        METRICS_ARGS="${ARGS//--format $ORIGINAL_FORMAT/--format json --output $METRICS_FILE}"
+        # Build the final command based on show-console-output setting
+        if [ "${{ inputs.show-console-output }}" = "true" ]; then
+          # CI mode: show enhanced output in console, write JSON to temp file for metrics
+          # Remove --format from ARGS and add --ci flags
+          FINAL_ARGS="${ARGS//--format ${{ inputs.format }}/--ci --ci-output $METRICS_FILE}"
+        else
+          # Quiet mode: only JSON output for metrics, no console output
+          FINAL_ARGS="${ARGS//--format ${{ inputs.format }}/--format json --output $METRICS_FILE}"
+        fi
 
-        # Run validation and capture exit code
-        uv run iam-validator $METRICS_ARGS 2>&1 || EXIT_CODE=$?
+        echo "Running: uv run iam-validator $FINAL_ARGS"
+        uv run iam-validator $FINAL_ARGS 2>&1 || EXIT_CODE=$?
 
         # Extract metrics from JSON output
         if [ -f "$METRICS_FILE" ] && [ -s "$METRICS_FILE" ]; then
@@ -466,12 +485,14 @@ runs:
           echo "invalid-policies=$INVALID_POLICIES" >> $GITHUB_OUTPUT
           echo "total-issues=$TOTAL_ISSUES" >> $GITHUB_OUTPUT
 
-          # Output summary to console as well
-          echo "📊 Validation Metrics:"
-          echo "  Total policies: $TOTAL_POLICIES"
-          echo "  Valid: $VALID_POLICIES"
-          echo "  Invalid: $INVALID_POLICIES"
-          echo "  Total issues: $TOTAL_ISSUES"
+          # Only show metrics summary if console output is disabled (to avoid duplication)
+          if [ "${{ inputs.show-console-output }}" != "true" ]; then
+            echo "📊 Validation Metrics:"
+            echo "  Total policies: $TOTAL_POLICIES"
+            echo "  Valid: $VALID_POLICIES"
+            echo "  Invalid: $INVALID_POLICIES"
+            echo "  Total issues: $TOTAL_ISSUES"
+          fi
 
           rm -f "$METRICS_FILE"
         else

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.13.0"
+__version__ = "1.14.0"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
 _version_base = __version__.split("-", maxsplit=1)[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/action_condition_enforcement.py

@@ -645,6 +645,7 @@ class ActionConditionEnforcementCheck(PolicyCheck):
                     action=", ".join(actions),
                     suggestion=f"Remove these forbidden actions. Found in: {', '.join(statement_refs)}. {description}",
                     line_number=stmt.line_number,
+                    field_name="action",
                 )
             )
 
@@ -683,6 +684,7 @@ class ActionConditionEnforcementCheck(PolicyCheck):
                     action=", ".join(sorted(set(found_actions))),
                     suggestion=f"Review these statements: {', '.join(statement_refs)}. {description}",
                     line_number=first_stmt.line_number,
+                    field_name="action",
                 )
             )
             return issues
@@ -772,6 +774,7 @@ class ActionConditionEnforcementCheck(PolicyCheck):
                     action=", ".join(sorted(all_actions)),
                     suggestion=f"Review these statements: {', '.join(statement_refs)}. {description}",
                     line_number=first_stmt.line_number,
+                    field_name="action",
                 )
             )
             return issues
@@ -1129,6 +1132,7 @@ class ActionConditionEnforcementCheck(PolicyCheck):
                             suggestion=suggestion,
                             example=example if example else None,
                             line_number=statement.line_number,
+                            field_name="condition",
                         )
                     )
 
@@ -1267,12 +1271,13 @@ class ActionConditionEnforcementCheck(PolicyCheck):
             statement_sid=statement.sid,
             statement_index=statement_idx,
             issue_type="missing_required_condition",
-            message=f"{message_prefix} Action(s) `{matching_actions_str}` require condition `{condition_key}`",
+            message=f"{message_prefix} Action(s) {matching_actions_str} require condition `{condition_key}`",
             action=", ".join(matching_actions),
             condition_key=condition_key,
             suggestion=suggestion_text,
             example=example_code,
             line_number=statement.line_number,
+            field_name="condition",
         )
 
     def _build_suggestion(
@@ -1433,4 +1438,5 @@ class ActionConditionEnforcementCheck(PolicyCheck):
             condition_key=condition_key,
             suggestion=suggestion,
             line_number=statement.line_number,
+            field_name="condition",
         )

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/action_resource_matching.py

@@ -24,6 +24,7 @@ Example:
 import re
 from typing import ClassVar
 
+from iam_validator.checks.utils.action_parser import get_action_case_insensitive, parse_action
 from iam_validator.core.aws_service import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
 from iam_validator.core.models import Statement, ValidationIssue
@@ -91,27 +92,25 @@ class ActionResourceMatchingCheck(PolicyCheck):
 
         # Check each action
         for action in actions:
-            # Skip wildcard actions
-            if action == "*" or ":" not in action:
-                continue
-
-            # Parse service and action name
-            try:
-                service, action_name = action.split(":", 1)
-            except ValueError:
-                continue  # Invalid action format, handled by action_validation
+            # Parse and validate action
+            parsed = parse_action(action)
+            if not parsed:
+                continue  # Invalid action format (or "*"), handled by action_validation
 
             # Skip wildcard actions
-            if "*" in service or "*" in action_name:
+            if parsed.has_wildcard:
                 continue
 
+            service = parsed.service
+            action_name = parsed.action_name
+
             # Get service definition
             service_detail = await fetcher.fetch_service_by_name(service)
             if not service_detail:
                 continue  # Unknown service, handled by action_validation
 
-            # Get action definition
-            action_detail = service_detail.actions.get(action_name)
+            # Get action definition (case-insensitive since AWS actions are case-insensitive)
+            action_detail = get_action_case_insensitive(service_detail.actions, action_name)
             if not action_detail:
                 continue  # Unknown action, handled by action_validation
 
@@ -262,6 +261,7 @@ class ActionResourceMatchingCheck(PolicyCheck):
             ),
             suggestion=suggestion,
             line_number=line_number,
+            field_name="resource",
         )
 
     def _get_suggestion(

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/action_validation.py

@@ -60,6 +60,7 @@ class ActionValidationCheck(PolicyCheck):
                         message=error_msg or f"Invalid action: `{action}`",
                         action=action,
                         line_number=line_number,
+                        field_name="action",
                     )
                 )
 

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/condition_key_validation.py

@@ -61,6 +61,7 @@ class ConditionKeyValidationCheck(PolicyCheck):
                                 condition_key=condition_key,
                                 line_number=line_number,
                                 suggestion=result.suggestion,
+                                field_name="condition",
                             )
                         )
                         # Only report once per condition key (not per action)
@@ -78,6 +79,7 @@ class ConditionKeyValidationCheck(PolicyCheck):
                                 action=action,
                                 condition_key=condition_key,
                                 line_number=line_number,
+                                field_name="condition",
                             )
                         )
                         # Only report once per condition key (not per action)

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/condition_type_mismatch.py

@@ -108,6 +108,7 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                             statement_index=statement_idx,
                             issue_type="type_mismatch_usable",
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
                 # Check if operator type matches key type
@@ -124,6 +125,7 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                             issue_type="type_mismatch",
                             condition_key=condition_key,
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
 
@@ -141,6 +143,7 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                             issue_type="invalid_value_format",
                             condition_key=condition_key,
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
 

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/full_wildcard.py

@@ -55,6 +55,7 @@ class FullWildcardCheck(PolicyCheck):
                     suggestion=suggestion,
                     example=example if example else None,
                     line_number=statement.line_number,
+                    field_name="action",  # Action is primary concern in full wildcard
                 )
             )
 

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/mfa_condition_check.py

@@ -71,6 +71,7 @@ class MFAConditionCheck(PolicyCheck):
                             statement_index=statement_idx,
                             issue_type="mfa_antipattern_bool_false",
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
 
@@ -97,6 +98,7 @@ class MFAConditionCheck(PolicyCheck):
                             statement_index=statement_idx,
                             issue_type="mfa_antipattern_null_false",
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
 

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/policy_structure.py

@@ -352,6 +352,7 @@ def validate_statement_structure(
                 message="`Statement` is missing the required `Effect` field",
                 suggestion="Add an `Effect` field with value `Allow` or `Deny`",
                 example='"Effect": "Allow"',
+                field_name="effect",
             )
         )
     elif statement_dict["Effect"] not in VALID_EFFECTS:
@@ -364,6 +365,7 @@ def validate_statement_structure(
                 message=f"Invalid `Effect` value: `{statement_dict['Effect']}`. Must be `Allow` or `Deny`",
                 suggestion="Change `Effect` to either `Allow` or `Deny`",
                 example='"Effect": "Allow"',
+                field_name="effect",
             )
         )
 
@@ -379,6 +381,7 @@ def validate_statement_structure(
                     message=f"`Sid` must be a `string`, not `{type(sid).__name__}`",
                     suggestion='Wrap the `Sid` value in quotes to make it a string: `"Sid": "AllowS3Access"`',
                     example='"Sid": "AllowS3Access"',
+                    field_name="sid",
                 )
             )
         elif not SID_PATTERN.match(sid):
@@ -393,6 +396,7 @@ def validate_statement_structure(
                     issue_type="invalid_sid_format",
                     message=f"`Sid` `{sid}` contains non-alphanumeric characters: `{invalid_chars}`",
                     suggestion="According to AWS IAM policy grammar, `Sid` should contain only alphanumeric characters `(A-Z, a-z, 0-9)`.",
+                    field_name="sid",
                 )
             )
 
@@ -406,6 +410,7 @@ def validate_statement_structure(
                 issue_type="principal_conflict",
                 message="`Statement` contains both `Principal` and `NotPrincipal` fields",
                 suggestion="Use either `Principal` or `NotPrincipal`, not both",
+                field_name="principal",
             )
         )
 
@@ -422,6 +427,7 @@ def validate_statement_structure(
                 issue_type="action_conflict",
                 message="`Statement` contains both `Action` and `NotAction` fields",
                 suggestion="Use either `Action` or `NotAction`, not both",
+                field_name="action",
             )
         )
     elif not has_action and not has_not_action:
@@ -434,6 +440,7 @@ def validate_statement_structure(
                 message="`Statement` is missing both `Action` and `NotAction` fields",
                 suggestion="Add either an `Action` or `NotAction` field to specify which AWS actions this statement applies to",
                 example=('"Action": [\n  "s3:GetObject",\n  "s3:PutObject"\n]'),
+                field_name="action",
             )
         )
 
@@ -450,6 +457,7 @@ def validate_statement_structure(
                 issue_type="resource_conflict",
                 message="`Statement` contains both `Resource` and `NotResource` fields",
                 suggestion="Use either `Resource` or `NotResource`, not both",
+                field_name="resource",
             )
         )
     elif not has_resource and not has_not_resource:
@@ -469,6 +477,7 @@ def validate_statement_structure(
                     message="`Statement` is missing both `Resource` and `NotResource` fields",
                     suggestion="Most policies require a `Resource` field. Add a `Resource` or `NotResource` field to specify which AWS resources this statement applies to.",
                     example=('"Resource": "*" OR "Resource": "arn:aws:s3:::my-bucket/*"'),
+                    field_name="resource",
                 )
             )
 

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/policy_type_validation.py

@@ -98,6 +98,7 @@ async def execute_policy(
                         '  "Resource": "arn:aws:s3:::bucket/*"\n'
                         "}\n"
                         "```",
+                        field_name="principal",
                     )
                 )
 
@@ -127,6 +128,7 @@ async def execute_policy(
                         '  "Resource": "arn:aws:s3:::bucket/*"\n'
                         "}\n"
                         "```",
+                        field_name="principal",
                     )
                 )
 
@@ -160,6 +162,7 @@ async def execute_policy(
                         "  }\n"
                         "}\n"
                         "```",
+                        field_name="principal",
                     )
                 )
 
@@ -182,6 +185,7 @@ async def execute_policy(
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
                         suggestion="Change the `Effect` to `Deny` for this RCP statement.",
+                        field_name="effect",
                     )
                 )
 
@@ -201,6 +205,7 @@ async def execute_policy(
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
                         suggestion='Remove `NotPrincipal` and use `Principal: "*"` with `Condition` elements to restrict access.',
+                        field_name="principal",
                     )
                 )
             elif not has_principal:
@@ -215,6 +220,7 @@ async def execute_policy(
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
                         suggestion='Add `Principal: "*"` to this RCP statement.',
+                        field_name="principal",
                     )
                 )
             elif statement.principal != "*":
@@ -232,6 +238,7 @@ async def execute_policy(
                             statement_sid=statement.sid,
                             line_number=statement.line_number,
                             suggestion='Change `Principal` to `"*"` and use `Condition` elements to restrict access.',
+                            field_name="principal",
                         )
                     )
 
@@ -258,6 +265,7 @@ async def execute_policy(
                                     line_number=statement.line_number,
                                     suggestion="Replace `*` with service-specific actions from supported "
                                     f"services: {', '.join(f'`{a}`' for a in sorted(rcp_supported_services))}",
+                                    field_name="action",
                                 )
                             )
                         else:
@@ -282,6 +290,7 @@ async def execute_policy(
                             line_number=statement.line_number,
                             suggestion=f"Use only actions from supported RCP services: "
                             f"{', '.join(f'`{a}`' for a in sorted(rcp_supported_services))}",
+                            field_name="action",
                         )
                     )
 
@@ -297,6 +306,7 @@ async def execute_policy(
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
                         suggestion="Replace `NotAction` with `Action` element listing the specific actions to deny.",
+                        field_name="action",
                     )
                 )
 
@@ -314,6 +324,7 @@ async def execute_policy(
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
                         suggestion='Add `Resource: "*"` or specify specific resource ARNs.',
+                        field_name="resource",
                     )
                 )
 

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/principal_validation.py

@@ -103,6 +103,7 @@ class PrincipalValidationCheck(PolicyCheck):
                         line_number=statement.line_number,
                         suggestion=f"Remove the `Principal` `{principal}` or add appropriate `Condition`s to restrict access. "
                         "Consider using more specific `Principal`s instead of `*` (wildcard).",
+                        field_name="principal",
                     )
                 )
                 continue
@@ -122,6 +123,7 @@ class PrincipalValidationCheck(PolicyCheck):
                         line_number=statement.line_number,
                         suggestion=f"Add `{principal}` to the `allowed_principals` list in your config, "
                         "or use a `Principal` that matches an allowed pattern.",
+                        field_name="principal",
                     )
                 )
                 continue
@@ -407,6 +409,7 @@ class PrincipalValidationCheck(PolicyCheck):
                             ),
                             suggestion=self._build_any_of_suggestion(any_of),
                             line_number=statement.line_number,
+                            field_name="principal",
                         )
                     )
 
@@ -568,6 +571,7 @@ class PrincipalValidationCheck(PolicyCheck):
             suggestion=suggestion_text,
             example=example_code,
             line_number=statement.line_number,
+            field_name="principal",
         )
 
     def _build_condition_suggestion(
@@ -700,4 +704,5 @@ class PrincipalValidationCheck(PolicyCheck):
             message=message,
             suggestion=suggestion,
             line_number=statement.line_number,
+            field_name="principal",
         )

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/resource_validation.py

@@ -70,6 +70,7 @@ class ResourceValidationCheck(PolicyCheck):
                         resource=resource[:100] + "...",
                         suggestion="`ARN` is too long and may be invalid",
                         line_number=line_number,
+                        field_name="resource",
                     )
                 )
                 continue
@@ -98,6 +99,7 @@ class ResourceValidationCheck(PolicyCheck):
                                 resource=resource,
                                 suggestion="`ARN` should follow format: `arn:partition:service:region:account-id:resource` (template variables like `${aws_account_id}` are supported)",
                                 line_number=line_number,
+                                field_name="resource",
                             )
                         )
                     else:
@@ -111,6 +113,7 @@ class ResourceValidationCheck(PolicyCheck):
                                 resource=resource,
                                 suggestion="`ARN` should follow format: `arn:partition:service:region:account-id:resource`",
                                 line_number=line_number,
+                                field_name="resource",
                             )
                         )
             except Exception:  # pylint: disable=broad-exception-caught
@@ -125,6 +128,7 @@ class ResourceValidationCheck(PolicyCheck):
                         resource=resource,
                         suggestion="`ARN` validation failed - may contain unexpected characters",
                         line_number=line_number,
+                        field_name="resource",
                     )
                 )
 

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/sensitive_action.py

@@ -266,6 +266,7 @@ class SensitiveActionCheck(PolicyCheck):
                     suggestion=suggestion_text,
                     example=example if example else None,
                     line_number=statement.line_number,
+                    field_name="action",
                 )
             )
 

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/service_wildcard.py

@@ -2,6 +2,7 @@
 
 from typing import ClassVar
 
+from iam_validator.checks.utils.action_parser import parse_action
 from iam_validator.core.aws_service import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
 from iam_validator.core.models import Statement, ValidationIssue
@@ -36,9 +37,10 @@ class ServiceWildcardCheck(PolicyCheck):
             if action == "*":
                 continue
 
-            # Check if it's a service-level wildcard (e.g., "iam:*", "s3:*")
-            if ":" in action and action.endswith(":*"):
-                service = action.split(":")[0]
+            # Parse action and check if it's a service-level wildcard (e.g., "iam:*", "s3:*")
+            parsed = parse_action(action)
+            if parsed and parsed.action_name == "*":
+                service = parsed.service
 
                 # Check if this service is in the allowed list
                 if service not in allowed_services:
@@ -72,6 +74,7 @@ class ServiceWildcardCheck(PolicyCheck):
                             suggestion=suggestion,
                             example=example if example else None,
                             line_number=statement.line_number,
+                            field_name="action",
                         )
                     )
 

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/set_operator_validation.py

@@ -103,6 +103,7 @@ class SetOperatorValidationCheck(PolicyCheck):
                             issue_type="set_operator_on_single_valued_key",
                             condition_key=condition_key,
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
 
@@ -123,6 +124,7 @@ class SetOperatorValidationCheck(PolicyCheck):
                                 issue_type="forallvalues_allow_without_null_check",
                                 condition_key=condition_key,
                                 line_number=line_number,
+                                field_name="condition",
                             )
                         )
 
@@ -142,6 +144,7 @@ class SetOperatorValidationCheck(PolicyCheck):
                                 statement_sid=statement_sid,
                                 statement_index=statement_idx,
                                 issue_type="foranyvalue_deny_without_null_check",
+                                field_name="condition",
                                 condition_key=condition_key,
                                 line_number=line_number,
                             )

{iam_policy_validator-1.13.0 → iam_policy_validator-1.14.0}/iam_validator/checks/sid_uniqueness.py

@@ -70,6 +70,7 @@ def _check_sid_uniqueness_impl(policy: IAMPolicy, severity: str) -> list[Validat
                         message=issue_msg,
                         suggestion=suggestion,
                         line_number=statement.line_number,
+                        field_name="sid",
                     )
                 )
 
@@ -99,6 +100,7 @@ def _check_sid_uniqueness_impl(policy: IAMPolicy, severity: str) -> list[Validat
                     message=f"Statement ID `{duplicate_sid}` is used **{count} times** in this policy (found in statements `{statement_numbers}`)",
                     suggestion="Change this SID to a unique value. Statement IDs help identify and reference specific statements, so duplicates can cause confusion.",
                     line_number=statement.line_number,
+                    field_name="sid",
                 )
             )