iam-policy-validator 1.13.1__py3-none-any.whl → 1.14.1__py3-none-any.whl

{iam_policy_validator-1.13.1.dist-info → iam_policy_validator-1.14.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.13.1
+Version: 1.14.1
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://github.com/boogy/iam-policy-validator/tree/main/docs

{iam_policy_validator-1.13.1.dist-info → iam_policy_validator-1.14.1.dist-info}/RECORD

@@ -1,59 +1,64 @@
 iam_validator/__init__.py,sha256=xHdUASOxFHwEXfT_GSr_KrkLlnxZ-pAAr1wW1PwAGko,693
 iam_validator/__main__.py,sha256=to_nz3n_IerJpVVZZ6WSFlFR5s_06J0csfPOTfQZG8g,197
-iam_validator/__version__.py,sha256=KDeKn_AQFlsUFr46JSJX-ubu1SG9kRW25oS9YifUqLU,374
+iam_validator/__version__.py,sha256=AoaYA0Mf5TpngovvZd8XG-okIqOb8ySOhHKPoa8aUwo,374
 iam_validator/checks/__init__.py,sha256=OTkPnmlelu4YjMO8krjhu2wXiTV72RzopA5u1SfPQA0,1990
-iam_validator/checks/action_condition_enforcement.py,sha256=TwVaUq0Q30Ap6j5qWpvs0RmAwwyJXFGpcvpv8hQ3_WY,60378
-iam_validator/checks/action_resource_matching.py,sha256=WiGJmCIJfx5yituMjZxpKmk-99N6nK20ueN02ddy9oM,19296
-iam_validator/checks/action_validation.py,sha256=QXfNamcstQIO41zNed1-bCmXYkXdV77owu8G2cZ09-A,2517
-iam_validator/checks/condition_key_validation.py,sha256=QJjG82wxvjdG2m-YuEzAjKRRiWaaPkf_LChdUTvm9g4,3919
-iam_validator/checks/condition_type_mismatch.py,sha256=y7M9rlSGaBmnckvZ_LXyfgMXz_Rl9ctCwOJ4mf0OF2E,10496
-iam_validator/checks/full_wildcard.py,sha256=s-CEsHRa-VTL1e-cdEJkvj1Q6QaL6QihzcFz7BFlK5Y,2238
-iam_validator/checks/mfa_condition_check.py,sha256=7qTgqxZl9GHqu0VsDTnogLgS4uAI4mlKZyR8DMAown4,4710
+iam_validator/checks/action_condition_enforcement.py,sha256=2-XUMbof9tQ7SHZNmAHMkR1DgbOIzY2eFWlp9S9dwLk,60625
+iam_validator/checks/action_resource_matching.py,sha256=qND0hfDgNoxFEdLWwrxOPVDfdj3k50nzedT2qF7nK7o,19428
+iam_validator/checks/action_validation.py,sha256=glA2F3iQBU-d8rruiyB9IdzVOESC2Kb-91SnwRCdQF0,2562
+iam_validator/checks/condition_key_validation.py,sha256=u9eCxI_OjkWqK_KcgPPxu4ZO16E9pqjK8CDiW7QbvZ4,4031
+iam_validator/checks/condition_type_mismatch.py,sha256=KJp7zQHDd8VeTcfjcD-ur3S4070cXEDTWkFtxfp7CuE,10652
+iam_validator/checks/full_wildcard.py,sha256=0TkkHtV0MZ6nZtJRtGdn3wwOMM96TRyGO7l7mmdHNUo,2325
+iam_validator/checks/mfa_condition_check.py,sha256=y1LbqcvQ_fL2BPTNaKRQoBYM5hM7JET9cDPUOWKFEVs,4814
 iam_validator/checks/policy_size.py,sha256=eJd36Nj4gqWLIkQ5imhHR1hGtQ6T-iJsC22Wd1VSUf0,4681
-iam_validator/checks/policy_structure.py,sha256=9eR8EEcERKcc5n7D3_LmFIQyDNzVV5MexOVFfvqrlAI,21743
-iam_validator/checks/policy_type_validation.py,sha256=z4RiAvmPhtrf6Gj3z1Ln4dDFWnFclsokVL7x-YhkMiM,15986
-iam_validator/checks/principal_validation.py,sha256=jusBVEA-sHHft3Kfq_YdvPUgX3cBnxKqC1zhth74kCU,27691
-iam_validator/checks/resource_validation.py,sha256=G_Pfh3WZ6-C3KTk3XPpUKhOESwIO5ISgbsUXc-aK1SE,5988
-iam_validator/checks/sensitive_action.py,sha256=vLGgFMDpW_CmKnKiQcR5pyAZRaDQtqeAAgS3D4CSPDU,18911
-iam_validator/checks/service_wildcard.py,sha256=ycggiozWm1Z4lkWsDlooMEvRJflzLxZkihQDPZ9G_zw,3949
-iam_validator/checks/set_operator_validation.py,sha256=FyxZ7qWlp9-ABzZaRRkxRP_Hws7Re7qZgeQCCM9sJAM,7258
-iam_validator/checks/sid_uniqueness.py,sha256=vfpk88b9G9OApxtrotABI2mPXvGd_C_X4gJKeqIURlk,5968
-iam_validator/checks/trust_policy_validation.py,sha256=a8Sm2xu3gFOHLd7rXDl-ibqiLEmg5c-dyWv1lK2i6HA,17816
-iam_validator/checks/wildcard_action.py,sha256=CyURgURDt2fQT2468LK813RupQ3WWvpmvLVLjUZf9QQ,1960
-iam_validator/checks/wildcard_resource.py,sha256=lRNZN7f3ZQrvnbGdVDCefUQF8lESIMoXVfhIgpln3mM,6679
-iam_validator/checks/utils/__init__.py,sha256=j0X4ibUB6RGx2a-kNoJnlVZwHfoEvzZsIeTmJIAoFzA,45
+iam_validator/checks/policy_structure.py,sha256=LExdm93JeqsyhikWrh9lfJ9sBiZ4818Ts0-N3MwUrtk,22089
+iam_validator/checks/policy_type_validation.py,sha256=-Q2Yn_sa7Cba_Fb9ESxSL5qNbRpncuC7NQy7R_fdJtY,16521
+iam_validator/checks/principal_validation.py,sha256=TthgDW5YXFfv5li1u4nn56k0Feqt5HeOEtQgo5pBKqo,27911
+iam_validator/checks/resource_validation.py,sha256=RIBMiCMwX45wwnDwSzpvF1mIught5QSbSbmTQSVa1wI,6192
+iam_validator/checks/sensitive_action.py,sha256=LHicl6dd5E1JV19cLKvFAMGzLzYr5h_Y7QvS8s57kvA,18952
+iam_validator/checks/service_wildcard.py,sha256=1epcET5oDclAmzxhtmQfKBg3Q5Rl4VXBMoZouxCJLpM,4114
+iam_validator/checks/set_operator_validation.py,sha256=GMZ1OWqySptYWV7565-K4R5ODs1eYgWXDozwtU-3sgY,7422
+iam_validator/checks/sid_uniqueness.py,sha256=MPQwALBjcvbY4Q55mpxDrGMqmVCMb13YSg621YbQYF8,6048
+iam_validator/checks/trust_policy_validation.py,sha256=r3fM2hU7W0yCFS6hbd4ZSlD8y2tm0zk99mUVlIt0LsI,17956
+iam_validator/checks/wildcard_action.py,sha256=VhWezb1JXmFnwV9WKgVu-48ythScGfZasg8fFd6tAG4,2001
+iam_validator/checks/wildcard_resource.py,sha256=5nswLCYvjgiZvv64y3OOywVwmTZMlpYBRSC94FS3X8M,16801
+iam_validator/checks/utils/__init__.py,sha256=iI9jHIDlDuuPK2vxjJA-qc927PaWC9zVJb9z3vBRUsQ,356
+iam_validator/checks/utils/action_parser.py,sha256=zA_NGknc5gJvsmIlf4aC14eHFIkBLyL9if5ad80gHwY,4421
 iam_validator/checks/utils/policy_level_checks.py,sha256=pr-uLo-otB612YLZ-rd8W5Kl9ENaTHuzTNOUhQaULKc,7593
 iam_validator/checks/utils/sensitive_action_matcher.py,sha256=qDXcJa_2sCJu9pBbjDlI7x5lPtLRc6jQCpKPMheCOJQ,11215
 iam_validator/checks/utils/wildcard_expansion.py,sha256=3W13hlyWcP2wJ6w-BwM887VOnRzglK6Bk3eHMjUtOco,3131
 iam_validator/commands/__init__.py,sha256=RBEz-Kgt3aRVn_9B1HRy_XgQMIKzlSSQs4Gtg2jQEv8,729
-iam_validator/commands/analyze.py,sha256=rvLBJ5_A3HB530xtixhaIsC19QON68olEQnn8TievgI,20784
+iam_validator/commands/analyze.py,sha256=rtXZmevC7GCXrADoGrxihRkrLbma59wMAMP2yBhqWPU,21752
 iam_validator/commands/base.py,sha256=5baCCMwxz7pdQ6XMpWfXFNz7i1l5dB8Qv9dKKR04Gzs,1074
 iam_validator/commands/cache.py,sha256=llfyQzPE5Azd5YcW0ohYcYjF_OCyiQ1GoJQ982t71lQ,14294
-iam_validator/commands/completion.py,sha256=1TfkVjeltsf2jAZy5RqaxKVIxpbL_bnZc6k8uvrk6Xg,18915
+iam_validator/commands/completion.py,sha256=cnQf3qcV5WSNpwJlPyl_hMNB1z3TkeeXCxj8K2FmEBw,19320
 iam_validator/commands/download_services.py,sha256=KKz3ybMLT8DQUf9aFZ0tilJ-o1b6PE8Pf1pC4K6cT8I,9175
 iam_validator/commands/post_to_pr.py,sha256=CvUXs2xvO-UhluxdfNM6F0TCWD8hDBEOiYw60fm1Dms,2363
 iam_validator/commands/query.py,sha256=ft8ptWfsNUK4Wprq_A11txdV_chBgqkoAo7SQfzEwK0,17079
-iam_validator/commands/validate.py,sha256=lsiHXjeY1JVKelP5CpIpwMHx1cldmEMLPqCzD-XHvL4,24214
+iam_validator/commands/validate.py,sha256=4wk-eSwhgqnQvyUre426S831JadVUctb0FDeCZD4RTk,34176
 iam_validator/core/__init__.py,sha256=hYXkSbxplKzhM6dqrVzV4M3k7GKLsZbgExypxKq74gs,376
 iam_validator/core/access_analyzer.py,sha256=mtMaY-FnKjKEVITky_9ywZe1FaCAm61ElRv5Z_ZeC7E,24562
 iam_validator/core/access_analyzer_report.py,sha256=UMm2RNGj2rAKav1zsCw_htQZZRwRC0jjayd2zvKma1A,24896
 iam_validator/core/aws_fetcher.py,sha256=op93QvtGmeLF9dHobl2IuoPDeunn33pBLb8h7XjtmoQ,920
 iam_validator/core/check_registry.py,sha256=oRCdWoCGQ8VZERVYd821u9r5NdKQ9FMC54e6dRWJfqw,25475
 iam_validator/core/cli.py,sha256=PkXiZjlgrQ21QustBbspefYsdbxst4gxoClyG2_HQR8,3843
+iam_validator/core/codeowners.py,sha256=dfRjYTpcTVmc-h95i4EoPXCXlcblD8yryeJBaTKQfjM,7530
 iam_validator/core/condition_validators.py,sha256=7zBjlcf2xGFKGbcFrXSLvWT5tFhWxoqwzhsJqS2E8uY,21524
-iam_validator/core/constants.py,sha256=cVBPgbXr4ALltH_NTSKsgBi6wmndLnOyUWhyBx0ZwrM,6113
-iam_validator/core/diff_parser.py,sha256=yjIplHywYWLr2lrGecwYraynmMerTpIjxFHy2a4itsM,11688
+iam_validator/core/constants.py,sha256=tHAZwINyB1wj_l5ZjnhFZ_LIA8S2C5lF-9CZtKijFac,6192
+iam_validator/core/diff_parser.py,sha256=5Jxa6WvQZtG5grblZeUH2OQ2R46tFLK-h8tvkHOSfLk,12110
+iam_validator/core/finding_fingerprint.py,sha256=NJIlu8NhdenWbLS7ww8LyWFasJgpKWN63-DprrNW7Zs,4353
 iam_validator/core/ignore_patterns.py,sha256=pZqDJBtkbck-85QK5eFPM5ZOPEKs3McRh3avqiCT5z0,10398
+iam_validator/core/ignore_processor.py,sha256=zgWfS-4BU4c_W6VxUxHIHorMtB5XzB410wZ3bbzVgH8,10686
+iam_validator/core/ignored_findings.py,sha256=b4PySz46so1rGKNt4prg2dkysHPfTJP4wsHYorVn1FA,12756
 iam_validator/core/label_manager.py,sha256=48CRASWg98wyjfVF_1pUzj6dm9itzmG7SeIWf0TSUfc,7502
-iam_validator/core/models.py,sha256=FhQ7fpX6T9AOvHsAPlBZL0NmPuPE_xghD3dp4cAGLZw,13534
+iam_validator/core/models.py,sha256=lXUadIsTpp_j0Vt89Ez7aJkTKs2GD2ty3Ukl2NeY9Zo,15680
 iam_validator/core/policy_checks.py,sha256=FNVuS2GTffwCjjrlupVIazC172gSxKYAAT_ObV6Apbo,8803
-iam_validator/core/policy_loader.py,sha256=2KJnXzGg3g9pDXWZHk3DO0xpZnZZ-wXWFEOdQ_naJ8s,17862
-iam_validator/core/pr_commenter.py,sha256=vDN9meq861nVpno-GyhGX4wnBE1Z7clCIhv6pq9rZGs,22755
-iam_validator/core/report.py,sha256=mi4zjlWHRakO2cTek5NCpiP92kUfJe_j5tAhB5yS02Q,36528
+iam_validator/core/policy_loader.py,sha256=iid3mGfDzSXASzKDqbLnrqJHBdVQvvebofVqNImsGKM,29201
+iam_validator/core/pr_commenter.py,sha256=BMTovWROjaxmhaNg-9emUGNFF_FGtrwYmCKvioh7x5M,32448
+iam_validator/core/report.py,sha256=uMhUYv-8mNoTMZzD0F2buSQTxr4YIRh8UMZjvFq9tmc,37312
 iam_validator/core/aws_service/__init__.py,sha256=UqMh4HUdGlx2QF5OoueJJ2UlCnhX4QW_x3KeE_bxRQc,735
 iam_validator/core/aws_service/cache.py,sha256=DPuOOPPJC867KAYgV1e0RyQs_k3mtefMdYli3jPaN64,3589
 iam_validator/core/aws_service/client.py,sha256=Zv7rIpEFdUCDXKGp3migPDkj8L5eZltgrGe64M2t2Ko,7336
-iam_validator/core/aws_service/fetcher.py,sha256=s_o8h6ua9gPdiV9-ElNs7YY0HlyoP0Ewtl71hTrhsZA,23340
+iam_validator/core/aws_service/fetcher.py,sha256=TD9qQ4tQF4xdEGhVVADGgF8QlXe15R3nAc2hWZnVoUw,23996
 iam_validator/core/aws_service/parsers.py,sha256=gJzR7HCD8ItCWCCbguTQIZpPEdj2rdMwC7LPhu7ve14,5174
 iam_validator/core/aws_service/patterns.py,sha256=gGc55Tn-EJ3cmcWtmYAZROUajKYz7DaMchYWGEhHpC0,1726
 iam_validator/core/aws_service/storage.py,sha256=PrfKdvF60IL7E_8xYs_XwFoAJPRcVYw57FVLHCoqwVk,10429
@@ -62,9 +67,10 @@ iam_validator/core/config/__init__.py,sha256=CWSyIA7kEyzrskEenjYbs9Iih10BXRpiY9H
 iam_validator/core/config/aws_api.py,sha256=HLIzOItQ0A37wxHcgWck6ZFO0wmNY8JNTiWMMK6JKYU,1248
 iam_validator/core/config/aws_global_conditions.py,sha256=gdmMxXGBy95B3uYUG-J7rnM6Ixgc6L7Y9Pcd2XAMb60,7170
 iam_validator/core/config/category_suggestions.py,sha256=fopaZ9kXDrsLgi_r0pERrLwgdPPJl5VIiKvXtQK9tj0,8583
+iam_validator/core/config/check_documentation.py,sha256=Adyt3Q4JSRlVNPWulXVlRIEorxXG_nt0mkPz_ySa8y4,15931
 iam_validator/core/config/condition_requirements.py,sha256=1CeQJfWV-Y2ImW0Mq9YdrgvH-hj9IXe0gVOm3B36Rc8,10655
-iam_validator/core/config/config_loader.py,sha256=qKD8aR8YAswaFf68pnYJLFNwKznvcc6lNxSQWU3i6SY,17713
-iam_validator/core/config/defaults.py,sha256=AdbqyUlsw4YViOWXFBENN3scoVx98hF6_dUKmfyZHNU,37057
+iam_validator/core/config/config_loader.py,sha256=M51apOv_JwRXC8VM0Spghu8ns-_qnbSoYQZWmgBP3Ww,24059
+iam_validator/core/config/defaults.py,sha256=poREMGKiDLWy9hSWfuWLPy6xXNLf9bkROUQ2A_cJIn4,38502
 iam_validator/core/config/principal_requirements.py,sha256=VCX7fBDgeDTJQyoz7_x7GI7Kf9O1Eu-sbihoHOrKv6o,15105
 iam_validator/core/config/sensitive_actions.py,sha256=uATDIp_TD3OQQlsYTZp79qd1mSK2Bf9hJ0JwcqLBr84,25344
 iam_validator/core/config/service_principals.py,sha256=8pys5H_yycVJ9KTyimAKFYBg83Aol2Iri53wiHjtnEM,3959
@@ -77,9 +83,9 @@ iam_validator/core/formatters/enhanced.py,sha256=GD7RIAL1hLDAsypCKECwDMGslAx2AaM
 iam_validator/core/formatters/html.py,sha256=j4sQi-wXiD9kCHldW5JCzbJe0frhiP5uQI9KlH3Sj_g,22994
 iam_validator/core/formatters/json.py,sha256=A7gZ8P32GEdbDvrSn6v56yQ4fOP_kyMaoFVXG2bgnew,939
 iam_validator/core/formatters/markdown.py,sha256=dk4STeY-tOEZsVrlmolIEqZvWYP9JhRtygxxNA49DEE,2293
-iam_validator/core/formatters/sarif.py,sha256=O3pn7whqFq5xxk-tuoqSb2k4Fk5ai_A2SKX_ph8GLV4,10469
+iam_validator/core/formatters/sarif.py,sha256=03MHSyuZm9FlzaPeWg7wH-UTzzCDhSy6vMPrFpFNkS8,18884
 iam_validator/integrations/__init__.py,sha256=7Hlor_X9j0NZaEjFuSvoXAAuSKQ-zgY19Rk-Dz3JpKo,616
-iam_validator/integrations/github_integration.py,sha256=hvAmoNLn4r9eglBw9KTnm4E-Or0weh_CM_tkuT2TFiI,36413
+iam_validator/integrations/github_integration.py,sha256=2pOjTVsLMymx-wU31Ly7JqODgNXf5U7lvteVqBpaRgE,67913
 iam_validator/integrations/ms_teams.py,sha256=t2PlWuTDb6GGH-eDU1jnOKd8D1w4FCB68bahGA7MJcE,14475
 iam_validator/sdk/__init__.py,sha256=AZLnfdn3A9AWb0pMhsbu3GAOAzt6rV7Fi3E3d9_3ZdI,6388
 iam_validator/sdk/arn_matching.py,sha256=HSDpLltOYISq-SoPebAlM89mKOaUaghq_04urchEFDA,12778
@@ -93,8 +99,8 @@ iam_validator/utils/__init__.py,sha256=NveA2F3G1E6-ANZzFr7J6Q6u5mogvMp862iFokmYu
 iam_validator/utils/cache.py,sha256=wOQKOBeoG6QqC5f0oXcHz63Cjtu_-SsSS-0pTSwyAiM,3254
 iam_validator/utils/regex.py,sha256=xHoMECttb7qaMhts-c9b0GIxdhHNZTt-UBr7wNhWfzg,6219
 iam_validator/utils/terminal.py,sha256=FsRaRMH_JAyDgXWBCOgOEhbS89cs17HCmKYoughq5io,724
-iam_policy_validator-1.13.1.dist-info/METADATA,sha256=L3ugvkQWQ6-jMphdTKx5BG9kIhKMj_JZpMG6NSbvu3Y,34456
-iam_policy_validator-1.13.1.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
-iam_policy_validator-1.13.1.dist-info/entry_points.txt,sha256=8HtWd8O7mvPiPdZR5YbzY8or_qcqLM4-pKaFdhtFT8M,62
-iam_policy_validator-1.13.1.dist-info/licenses/LICENSE,sha256=AMnbFTBDcK4_MITe2wiQBkj0vg-jjBBhsc43ydC7tt4,1098
-iam_policy_validator-1.13.1.dist-info/RECORD,,
+iam_policy_validator-1.14.1.dist-info/METADATA,sha256=lvh7lKnQzk57j2Q-42nEOZttkrTcjFLGQczq_zK8p5k,34456
+iam_policy_validator-1.14.1.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
+iam_policy_validator-1.14.1.dist-info/entry_points.txt,sha256=8HtWd8O7mvPiPdZR5YbzY8or_qcqLM4-pKaFdhtFT8M,62
+iam_policy_validator-1.14.1.dist-info/licenses/LICENSE,sha256=AMnbFTBDcK4_MITe2wiQBkj0vg-jjBBhsc43ydC7tt4,1098
+iam_policy_validator-1.14.1.dist-info/RECORD,,

iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.13.1"
+__version__ = "1.14.1"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
 _version_base = __version__.split("-", maxsplit=1)[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

iam_validator/checks/action_condition_enforcement.py

@@ -645,6 +645,7 @@ class ActionConditionEnforcementCheck(PolicyCheck):
                     action=", ".join(actions),
                     suggestion=f"Remove these forbidden actions. Found in: {', '.join(statement_refs)}. {description}",
                     line_number=stmt.line_number,
+                    field_name="action",
                 )
             )
 
@@ -683,6 +684,7 @@ class ActionConditionEnforcementCheck(PolicyCheck):
                     action=", ".join(sorted(set(found_actions))),
                     suggestion=f"Review these statements: {', '.join(statement_refs)}. {description}",
                     line_number=first_stmt.line_number,
+                    field_name="action",
                 )
             )
             return issues
@@ -772,6 +774,7 @@ class ActionConditionEnforcementCheck(PolicyCheck):
                     action=", ".join(sorted(all_actions)),
                     suggestion=f"Review these statements: {', '.join(statement_refs)}. {description}",
                     line_number=first_stmt.line_number,
+                    field_name="action",
                 )
             )
             return issues
@@ -1129,6 +1132,7 @@ class ActionConditionEnforcementCheck(PolicyCheck):
                             suggestion=suggestion,
                             example=example if example else None,
                             line_number=statement.line_number,
+                            field_name="condition",
                         )
                     )
 
@@ -1273,6 +1277,7 @@ class ActionConditionEnforcementCheck(PolicyCheck):
             suggestion=suggestion_text,
             example=example_code,
             line_number=statement.line_number,
+            field_name="condition",
         )
 
     def _build_suggestion(
@@ -1433,4 +1438,5 @@ class ActionConditionEnforcementCheck(PolicyCheck):
             condition_key=condition_key,
             suggestion=suggestion,
             line_number=statement.line_number,
+            field_name="condition",
         )

iam_validator/checks/action_resource_matching.py

@@ -24,6 +24,7 @@ Example:
 import re
 from typing import ClassVar
 
+from iam_validator.checks.utils.action_parser import get_action_case_insensitive, parse_action
 from iam_validator.core.aws_service import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
 from iam_validator.core.models import Statement, ValidationIssue
@@ -91,27 +92,25 @@ class ActionResourceMatchingCheck(PolicyCheck):
 
         # Check each action
         for action in actions:
-            # Skip wildcard actions
-            if action == "*" or ":" not in action:
-                continue
-
-            # Parse service and action name
-            try:
-                service, action_name = action.split(":", 1)
-            except ValueError:
-                continue  # Invalid action format, handled by action_validation
+            # Parse and validate action
+            parsed = parse_action(action)
+            if not parsed:
+                continue  # Invalid action format (or "*"), handled by action_validation
 
             # Skip wildcard actions
-            if "*" in service or "*" in action_name:
+            if parsed.has_wildcard:
                 continue
 
+            service = parsed.service
+            action_name = parsed.action_name
+
             # Get service definition
             service_detail = await fetcher.fetch_service_by_name(service)
             if not service_detail:
                 continue  # Unknown service, handled by action_validation
 
-            # Get action definition
-            action_detail = service_detail.actions.get(action_name)
+            # Get action definition (case-insensitive since AWS actions are case-insensitive)
+            action_detail = get_action_case_insensitive(service_detail.actions, action_name)
             if not action_detail:
                 continue  # Unknown action, handled by action_validation
 
@@ -262,6 +261,7 @@ class ActionResourceMatchingCheck(PolicyCheck):
             ),
             suggestion=suggestion,
             line_number=line_number,
+            field_name="resource",
         )
 
     def _get_suggestion(

iam_validator/checks/action_validation.py

@@ -60,6 +60,7 @@ class ActionValidationCheck(PolicyCheck):
                         message=error_msg or f"Invalid action: `{action}`",
                         action=action,
                         line_number=line_number,
+                        field_name="action",
                     )
                 )
 

iam_validator/checks/condition_key_validation.py

@@ -61,6 +61,7 @@ class ConditionKeyValidationCheck(PolicyCheck):
                                 condition_key=condition_key,
                                 line_number=line_number,
                                 suggestion=result.suggestion,
+                                field_name="condition",
                             )
                         )
                         # Only report once per condition key (not per action)
@@ -78,6 +79,7 @@ class ConditionKeyValidationCheck(PolicyCheck):
                                 action=action,
                                 condition_key=condition_key,
                                 line_number=line_number,
+                                field_name="condition",
                             )
                         )
                         # Only report once per condition key (not per action)

iam_validator/checks/condition_type_mismatch.py

@@ -108,6 +108,7 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                             statement_index=statement_idx,
                             issue_type="type_mismatch_usable",
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
                 # Check if operator type matches key type
@@ -124,6 +125,7 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                             issue_type="type_mismatch",
                             condition_key=condition_key,
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
 
@@ -141,6 +143,7 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                             issue_type="invalid_value_format",
                             condition_key=condition_key,
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
 

iam_validator/checks/full_wildcard.py

@@ -55,6 +55,7 @@ class FullWildcardCheck(PolicyCheck):
                     suggestion=suggestion,
                     example=example if example else None,
                     line_number=statement.line_number,
+                    field_name="action",  # Action is primary concern in full wildcard
                 )
             )
 

iam_validator/checks/mfa_condition_check.py

@@ -71,6 +71,7 @@ class MFAConditionCheck(PolicyCheck):
                             statement_index=statement_idx,
                             issue_type="mfa_antipattern_bool_false",
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
 
@@ -97,6 +98,7 @@ class MFAConditionCheck(PolicyCheck):
                             statement_index=statement_idx,
                             issue_type="mfa_antipattern_null_false",
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
 

iam_validator/checks/policy_structure.py

@@ -352,6 +352,7 @@ def validate_statement_structure(
                 message="`Statement` is missing the required `Effect` field",
                 suggestion="Add an `Effect` field with value `Allow` or `Deny`",
                 example='"Effect": "Allow"',
+                field_name="effect",
             )
         )
     elif statement_dict["Effect"] not in VALID_EFFECTS:
@@ -364,6 +365,7 @@ def validate_statement_structure(
                 message=f"Invalid `Effect` value: `{statement_dict['Effect']}`. Must be `Allow` or `Deny`",
                 suggestion="Change `Effect` to either `Allow` or `Deny`",
                 example='"Effect": "Allow"',
+                field_name="effect",
             )
         )
 
@@ -379,6 +381,7 @@ def validate_statement_structure(
                     message=f"`Sid` must be a `string`, not `{type(sid).__name__}`",
                     suggestion='Wrap the `Sid` value in quotes to make it a string: `"Sid": "AllowS3Access"`',
                     example='"Sid": "AllowS3Access"',
+                    field_name="sid",
                 )
             )
         elif not SID_PATTERN.match(sid):
@@ -393,6 +396,7 @@ def validate_statement_structure(
                     issue_type="invalid_sid_format",
                     message=f"`Sid` `{sid}` contains non-alphanumeric characters: `{invalid_chars}`",
                     suggestion="According to AWS IAM policy grammar, `Sid` should contain only alphanumeric characters `(A-Z, a-z, 0-9)`.",
+                    field_name="sid",
                 )
             )
 
@@ -406,6 +410,7 @@ def validate_statement_structure(
                 issue_type="principal_conflict",
                 message="`Statement` contains both `Principal` and `NotPrincipal` fields",
                 suggestion="Use either `Principal` or `NotPrincipal`, not both",
+                field_name="principal",
             )
         )
 
@@ -422,6 +427,7 @@ def validate_statement_structure(
                 issue_type="action_conflict",
                 message="`Statement` contains both `Action` and `NotAction` fields",
                 suggestion="Use either `Action` or `NotAction`, not both",
+                field_name="action",
             )
         )
     elif not has_action and not has_not_action:
@@ -434,6 +440,7 @@ def validate_statement_structure(
                 message="`Statement` is missing both `Action` and `NotAction` fields",
                 suggestion="Add either an `Action` or `NotAction` field to specify which AWS actions this statement applies to",
                 example=('"Action": [\n  "s3:GetObject",\n  "s3:PutObject"\n]'),
+                field_name="action",
             )
         )
 
@@ -450,6 +457,7 @@ def validate_statement_structure(
                 issue_type="resource_conflict",
                 message="`Statement` contains both `Resource` and `NotResource` fields",
                 suggestion="Use either `Resource` or `NotResource`, not both",
+                field_name="resource",
             )
         )
     elif not has_resource and not has_not_resource:
@@ -469,6 +477,7 @@ def validate_statement_structure(
                     message="`Statement` is missing both `Resource` and `NotResource` fields",
                     suggestion="Most policies require a `Resource` field. Add a `Resource` or `NotResource` field to specify which AWS resources this statement applies to.",
                     example=('"Resource": "*" OR "Resource": "arn:aws:s3:::my-bucket/*"'),
+                    field_name="resource",
                 )
             )
 

iam_validator/checks/policy_type_validation.py

@@ -98,6 +98,7 @@ async def execute_policy(
                         '  "Resource": "arn:aws:s3:::bucket/*"\n'
                         "}\n"
                         "```",
+                        field_name="principal",
                     )
                 )
 
@@ -127,6 +128,7 @@ async def execute_policy(
                         '  "Resource": "arn:aws:s3:::bucket/*"\n'
                         "}\n"
                         "```",
+                        field_name="principal",
                     )
                 )
 
@@ -160,6 +162,7 @@ async def execute_policy(
                         "  }\n"
                         "}\n"
                         "```",
+                        field_name="principal",
                     )
                 )
 
@@ -182,6 +185,7 @@ async def execute_policy(
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
                         suggestion="Change the `Effect` to `Deny` for this RCP statement.",
+                        field_name="effect",
                     )
                 )
 
@@ -201,6 +205,7 @@ async def execute_policy(
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
                         suggestion='Remove `NotPrincipal` and use `Principal: "*"` with `Condition` elements to restrict access.',
+                        field_name="principal",
                     )
                 )
             elif not has_principal:
@@ -215,6 +220,7 @@ async def execute_policy(
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
                         suggestion='Add `Principal: "*"` to this RCP statement.',
+                        field_name="principal",
                     )
                 )
             elif statement.principal != "*":
@@ -232,6 +238,7 @@ async def execute_policy(
                             statement_sid=statement.sid,
                             line_number=statement.line_number,
                             suggestion='Change `Principal` to `"*"` and use `Condition` elements to restrict access.',
+                            field_name="principal",
                         )
                     )
 
@@ -258,6 +265,7 @@ async def execute_policy(
                                     line_number=statement.line_number,
                                     suggestion="Replace `*` with service-specific actions from supported "
                                     f"services: {', '.join(f'`{a}`' for a in sorted(rcp_supported_services))}",
+                                    field_name="action",
                                 )
                             )
                         else:
@@ -282,6 +290,7 @@ async def execute_policy(
                             line_number=statement.line_number,
                             suggestion=f"Use only actions from supported RCP services: "
                             f"{', '.join(f'`{a}`' for a in sorted(rcp_supported_services))}",
+                            field_name="action",
                         )
                     )
 
@@ -297,6 +306,7 @@ async def execute_policy(
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
                         suggestion="Replace `NotAction` with `Action` element listing the specific actions to deny.",
+                        field_name="action",
                     )
                 )
 
@@ -314,6 +324,7 @@ async def execute_policy(
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
                         suggestion='Add `Resource: "*"` or specify specific resource ARNs.',
+                        field_name="resource",
                     )
                 )
 

iam_validator/checks/principal_validation.py

@@ -103,6 +103,7 @@ class PrincipalValidationCheck(PolicyCheck):
                         line_number=statement.line_number,
                         suggestion=f"Remove the `Principal` `{principal}` or add appropriate `Condition`s to restrict access. "
                         "Consider using more specific `Principal`s instead of `*` (wildcard).",
+                        field_name="principal",
                     )
                 )
                 continue
@@ -122,6 +123,7 @@ class PrincipalValidationCheck(PolicyCheck):
                         line_number=statement.line_number,
                         suggestion=f"Add `{principal}` to the `allowed_principals` list in your config, "
                         "or use a `Principal` that matches an allowed pattern.",
+                        field_name="principal",
                     )
                 )
                 continue
@@ -407,6 +409,7 @@ class PrincipalValidationCheck(PolicyCheck):
                             ),
                             suggestion=self._build_any_of_suggestion(any_of),
                             line_number=statement.line_number,
+                            field_name="principal",
                         )
                     )
 
@@ -568,6 +571,7 @@ class PrincipalValidationCheck(PolicyCheck):
             suggestion=suggestion_text,
             example=example_code,
             line_number=statement.line_number,
+            field_name="principal",
         )
 
     def _build_condition_suggestion(
@@ -700,4 +704,5 @@ class PrincipalValidationCheck(PolicyCheck):
             message=message,
             suggestion=suggestion,
             line_number=statement.line_number,
+            field_name="principal",
         )

iam_validator/checks/resource_validation.py

@@ -70,6 +70,7 @@ class ResourceValidationCheck(PolicyCheck):
                         resource=resource[:100] + "...",
                         suggestion="`ARN` is too long and may be invalid",
                         line_number=line_number,
+                        field_name="resource",
                     )
                 )
                 continue
@@ -98,6 +99,7 @@ class ResourceValidationCheck(PolicyCheck):
                                 resource=resource,
                                 suggestion="`ARN` should follow format: `arn:partition:service:region:account-id:resource` (template variables like `${aws_account_id}` are supported)",
                                 line_number=line_number,
+                                field_name="resource",
                             )
                         )
                     else:
@@ -111,6 +113,7 @@ class ResourceValidationCheck(PolicyCheck):
                                 resource=resource,
                                 suggestion="`ARN` should follow format: `arn:partition:service:region:account-id:resource`",
                                 line_number=line_number,
+                                field_name="resource",
                             )
                         )
             except Exception:  # pylint: disable=broad-exception-caught
@@ -125,6 +128,7 @@ class ResourceValidationCheck(PolicyCheck):
                         resource=resource,
                         suggestion="`ARN` validation failed - may contain unexpected characters",
                         line_number=line_number,
+                        field_name="resource",
                     )
                 )
 

iam_validator/checks/sensitive_action.py

@@ -266,6 +266,7 @@ class SensitiveActionCheck(PolicyCheck):
                     suggestion=suggestion_text,
                     example=example if example else None,
                     line_number=statement.line_number,
+                    field_name="action",
                 )
             )
 

iam_validator/checks/service_wildcard.py

@@ -2,6 +2,7 @@
 
 from typing import ClassVar
 
+from iam_validator.checks.utils.action_parser import parse_action
 from iam_validator.core.aws_service import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
 from iam_validator.core.models import Statement, ValidationIssue
@@ -36,9 +37,10 @@ class ServiceWildcardCheck(PolicyCheck):
             if action == "*":
                 continue
 
-            # Check if it's a service-level wildcard (e.g., "iam:*", "s3:*")
-            if ":" in action and action.endswith(":*"):
-                service = action.split(":")[0]
+            # Parse action and check if it's a service-level wildcard (e.g., "iam:*", "s3:*")
+            parsed = parse_action(action)
+            if parsed and parsed.action_name == "*":
+                service = parsed.service
 
                 # Check if this service is in the allowed list
                 if service not in allowed_services:
@@ -72,6 +74,7 @@ class ServiceWildcardCheck(PolicyCheck):
                             suggestion=suggestion,
                             example=example if example else None,
                             line_number=statement.line_number,
+                            field_name="action",
                         )
                     )
 

iam_validator/checks/set_operator_validation.py

@@ -103,6 +103,7 @@ class SetOperatorValidationCheck(PolicyCheck):
                             issue_type="set_operator_on_single_valued_key",
                             condition_key=condition_key,
                             line_number=line_number,
+                            field_name="condition",
                         )
                     )
 
@@ -123,6 +124,7 @@ class SetOperatorValidationCheck(PolicyCheck):
                                 issue_type="forallvalues_allow_without_null_check",
                                 condition_key=condition_key,
                                 line_number=line_number,
+                                field_name="condition",
                             )
                         )
 
@@ -142,6 +144,7 @@ class SetOperatorValidationCheck(PolicyCheck):
                                 statement_sid=statement_sid,
                                 statement_index=statement_idx,
                                 issue_type="foranyvalue_deny_without_null_check",
+                                field_name="condition",
                                 condition_key=condition_key,
                                 line_number=line_number,
                             )

iam_validator/checks/sid_uniqueness.py

@@ -70,6 +70,7 @@ def _check_sid_uniqueness_impl(policy: IAMPolicy, severity: str) -> list[Validat
                         message=issue_msg,
                         suggestion=suggestion,
                         line_number=statement.line_number,
+                        field_name="sid",
                     )
                 )
 
@@ -99,6 +100,7 @@ def _check_sid_uniqueness_impl(policy: IAMPolicy, severity: str) -> list[Validat
                     message=f"Statement ID `{duplicate_sid}` is used **{count} times** in this policy (found in statements `{statement_numbers}`)",
                     suggestion="Change this SID to a unique value. Statement IDs help identify and reference specific statements, so duplicates can cause confusion.",
                     line_number=statement.line_number,
+                    field_name="sid",
                 )
             )