iam-policy-validator 1.15.2__py3-none-any.whl → 1.15.3__py3-none-any.whl

{iam_policy_validator-1.15.2.dist-info → iam_policy_validator-1.15.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.15.2
+Version: 1.15.3
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://boogy.github.io/iam-policy-validator

{iam_policy_validator-1.15.2.dist-info → iam_policy_validator-1.15.3.dist-info}/RECORD

@@ -1,6 +1,6 @@
 iam_validator/__init__.py,sha256=xHdUASOxFHwEXfT_GSr_KrkLlnxZ-pAAr1wW1PwAGko,693
 iam_validator/__main__.py,sha256=to_nz3n_IerJpVVZZ6WSFlFR5s_06J0csfPOTfQZG8g,197
-iam_validator/__version__.py,sha256=Bgc0qLeAX9DtaxWp2EJRUbZweOqF_-YeAxjCOs2BIuM,374
+iam_validator/__version__.py,sha256=2oTvvCnwbVqgXWNdEDQWe8-xj2ecUXJtl1jF_CIIGxk,374
 iam_validator/checks/__init__.py,sha256=wFU5Lz-ZIQBcn2y1u0Kl88B--vEO3btOOaTGPPSjJ74,2106
 iam_validator/checks/action_condition_enforcement.py,sha256=2-XUMbof9tQ7SHZNmAHMkR1DgbOIzY2eFWlp9S9dwLk,60625
 iam_validator/checks/action_resource_matching.py,sha256=qND0hfDgNoxFEdLWwrxOPVDfdj3k50nzedT2qF7nK7o,19428
@@ -8,8 +8,8 @@ iam_validator/checks/action_validation.py,sha256=gy9_mujYbojBboLk0WwuJYJjggrY2sR
 iam_validator/checks/condition_key_validation.py,sha256=5i8LqqV78SjWK6pLrbttWmeMAD4pDC12_FjTjx5dFSU,4024
 iam_validator/checks/condition_type_mismatch.py,sha256=KJp7zQHDd8VeTcfjcD-ur3S4070cXEDTWkFtxfp7CuE,10652
 iam_validator/checks/full_wildcard.py,sha256=0TkkHtV0MZ6nZtJRtGdn3wwOMM96TRyGO7l7mmdHNUo,2325
-iam_validator/checks/mfa_condition_check.py,sha256=y1LbqcvQ_fL2BPTNaKRQoBYM5hM7JET9cDPUOWKFEVs,4814
-iam_validator/checks/not_action_not_resource.py,sha256=WWKOCLCq7yxOG9tgi1n5xPpphTLZ9RfcfPwZ-TP6n9Y,8097
+iam_validator/checks/mfa_condition_check.py,sha256=EYOzESzsZVlxW9Pp6hSqPZkH0UT1h21SoZibBX7k_OU,7705
+iam_validator/checks/not_action_not_resource.py,sha256=18wB1NKaCj4X7o8xcTLmtFjsXFJLXTukzp1FhZzvMa8,9779
 iam_validator/checks/policy_size.py,sha256=eJd36Nj4gqWLIkQ5imhHR1hGtQ6T-iJsC22Wd1VSUf0,4681
 iam_validator/checks/policy_structure.py,sha256=LExdm93JeqsyhikWrh9lfJ9sBiZ4818Ts0-N3MwUrtk,22089
 iam_validator/checks/policy_type_validation.py,sha256=-Q2Yn_sa7Cba_Fb9ESxSL5qNbRpncuC7NQy7R_fdJtY,16521
@@ -112,8 +112,8 @@ iam_validator/utils/__init__.py,sha256=NveA2F3G1E6-ANZzFr7J6Q6u5mogvMp862iFokmYu
 iam_validator/utils/cache.py,sha256=wOQKOBeoG6QqC5f0oXcHz63Cjtu_-SsSS-0pTSwyAiM,3254
 iam_validator/utils/regex.py,sha256=xHoMECttb7qaMhts-c9b0GIxdhHNZTt-UBr7wNhWfzg,6219
 iam_validator/utils/terminal.py,sha256=FsRaRMH_JAyDgXWBCOgOEhbS89cs17HCmKYoughq5io,724
-iam_policy_validator-1.15.2.dist-info/METADATA,sha256=3YWLi7WFFLI4s-vCyjfkxJ8WB9QJCQthXl1-_isP9wE,34939
-iam_policy_validator-1.15.2.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
-iam_policy_validator-1.15.2.dist-info/entry_points.txt,sha256=VXAcx1evo9fuxX0Gtj3J2HnzWcBHSXugiZwBtQ1BXE0,162
-iam_policy_validator-1.15.2.dist-info/licenses/LICENSE,sha256=AMnbFTBDcK4_MITe2wiQBkj0vg-jjBBhsc43ydC7tt4,1098
-iam_policy_validator-1.15.2.dist-info/RECORD,,
+iam_policy_validator-1.15.3.dist-info/METADATA,sha256=r1dXILWhINVsEMyiTTC3IJpAEAoS0usdkBkt7lVe1og,34939
+iam_policy_validator-1.15.3.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
+iam_policy_validator-1.15.3.dist-info/entry_points.txt,sha256=VXAcx1evo9fuxX0Gtj3J2HnzWcBHSXugiZwBtQ1BXE0,162
+iam_policy_validator-1.15.3.dist-info/licenses/LICENSE,sha256=AMnbFTBDcK4_MITe2wiQBkj0vg-jjBBhsc43ydC7tt4,1098
+iam_policy_validator-1.15.3.dist-info/RECORD,,

iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.15.2"
+__version__ = "1.15.3"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
 _version_base = __version__.split("-", maxsplit=1)[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

iam_validator/checks/mfa_condition_check.py

@@ -75,7 +75,36 @@ class MFAConditionCheck(PolicyCheck):
                         )
                     )
 
-        # Check for anti-pattern #2: Null with aws:MultiFactorAuthPresent = false
+        # Check for anti-pattern #2: BoolIfExists with aws:MultiFactorAuthPresent = false
+        # This is MORE dangerous than Bool because it also matches when the key is missing
+        bool_if_exists_conditions = statement.condition.get("BoolIfExists", {})
+        for key, value in bool_if_exists_conditions.items():
+            if key.lower() == "aws:multifactorauthpresent":
+                # Normalize value to list
+                values = value if isinstance(value, list) else [value]
+                # Convert to lowercase strings for comparison
+                values_lower = [str(v).lower() for v in values]
+
+                if "false" in values_lower or False in values:
+                    issues.append(
+                        ValidationIssue(
+                            severity="high",  # Higher than default - this is worse than Bool
+                            message=(
+                                "**DANGEROUS MFA condition pattern detected.** "
+                                'Using `{"BoolIfExists": {"aws:MultiFactorAuthPresent": "false"}}` '
+                                "is MORE dangerous than using `Bool` because it also matches when "
+                                "the key is missing entirely (no MFA context in the request). "
+                                "This effectively allows access without any MFA verification."
+                            ),
+                            statement_sid=statement_sid,
+                            statement_index=statement_idx,
+                            issue_type="mfa_antipattern_boolif_exists_false",
+                            line_number=line_number,
+                            field_name="condition",
+                        )
+                    )
+
+        # Check for anti-pattern #3: Null with aws:MultiFactorAuthPresent = false
         null_conditions = statement.condition.get("Null", {})
         for key, value in null_conditions.items():
             if key.lower() == "aws:multifactorauthpresent":
@@ -102,4 +131,24 @@ class MFAConditionCheck(PolicyCheck):
                         )
                     )
 
+                # Check for anti-pattern #4: Null with aws:MultiFactorAuthPresent = true
+                # This means "key does NOT exist" = no MFA was used
+                if "true" in values_lower or True in values:
+                    issues.append(
+                        ValidationIssue(
+                            severity=self.get_severity(config),
+                            message=(
+                                "**Dangerous MFA condition pattern detected.** "
+                                'Using `{"Null": {"aws:MultiFactorAuthPresent": "true"}}` checks if the key '
+                                "does NOT exist, which means no MFA was provided in the request context. "
+                                "This condition allows access when MFA is absent."
+                            ),
+                            statement_sid=statement_sid,
+                            statement_index=statement_idx,
+                            issue_type="mfa_antipattern_null_true",
+                            line_number=line_number,
+                            field_name="condition",
+                        )
+                    )
+
         return issues

iam_validator/checks/not_action_not_resource.py

@@ -12,6 +12,13 @@ from iam_validator.core.check_registry import CheckConfig, PolicyCheck
 from iam_validator.core.models import Statement, ValidationIssue
 
 
+def _format_list_with_backticks(items: list[str], max_items: int = 3) -> str:
+    """Format a list of items with backticks for markdown rendering."""
+    formatted = [f"`{item}`" for item in items[:max_items]]
+    suffix = "..." if len(items) > max_items else ""
+    return ", ".join(formatted) + suffix
+
+
 class NotActionNotResourceCheck(PolicyCheck):
     """Checks for dangerous NotAction/NotResource patterns.
 
@@ -59,18 +66,18 @@ class NotActionNotResourceCheck(PolicyCheck):
                         statement_index=statement_idx,
                         issue_type="not_action_allow",
                         message=(
-                            "Statement uses NotAction with Allow effect. "
+                            "Statement uses `NotAction` with `Allow` effect. "
                             "This grants ALL actions except the listed ones. "
                             "While conditions are present, this pattern is still risky."
                         ),
                         suggestion=(
-                            "Consider using explicit Action lists instead of NotAction. "
-                            "If NotAction is required, ensure conditions are comprehensive."
+                            "Consider using explicit `Action` lists instead of `NotAction`. "
+                            "If `NotAction` is required, ensure conditions are comprehensive."
                         ),
                         example='{\n  "Effect": "Allow",\n  "Action": ["s3:GetObject", "s3:ListBucket"],\n  "Resource": "*"\n}',
                         line_number=statement.line_number,
                         field_name="action",
-                        action=", ".join(not_actions[:3]) + ("..." if len(not_actions) > 3 else ""),
+                        action=_format_list_with_backticks(not_actions, 3),
                     )
                 )
             else:
@@ -82,20 +89,19 @@ class NotActionNotResourceCheck(PolicyCheck):
                         statement_index=statement_idx,
                         issue_type="not_action_allow_no_condition",
                         message=(
-                            "Statement uses NotAction with Allow effect and NO conditions. "
-                            f"This grants ALL AWS actions except: {', '.join(not_actions[:5])}"
-                            f"{'...' if len(not_actions) > 5 else ''}. "
+                            "Statement uses `NotAction` with `Allow` effect and NO conditions. "
+                            f"This grants ALL AWS actions except: {_format_list_with_backticks(not_actions, 5)}. "
                             "This is equivalent to granting near-administrator access."
                         ),
                         suggestion=(
-                            "Replace NotAction with explicit Action list. "
-                            "If NotAction is required, add strict conditions like "
-                            "aws:SourceIp, aws:PrincipalArn, or aws:MultiFactorAuthPresent."
+                            "Replace `NotAction` with explicit `Action` list. "
+                            "If `NotAction` is required, add strict conditions like "
+                            "`aws:SourceIp`, `aws:PrincipalArn`, or `aws:MultiFactorAuthPresent`."
                         ),
                         example='{\n  "Effect": "Allow",\n  "Action": ["specific:Action"],\n  "Resource": "*",\n  "Condition": {\n    "Bool": {"aws:MultiFactorAuthPresent": "true"}\n  }\n}',
                         line_number=statement.line_number,
                         field_name="action",
-                        action=", ".join(not_actions[:3]) + ("..." if len(not_actions) > 3 else ""),
+                        action=_format_list_with_backticks(not_actions, 3),
                     )
                 )
 
@@ -113,24 +119,49 @@ class NotActionNotResourceCheck(PolicyCheck):
                         statement_index=statement_idx,
                         issue_type="not_resource_broad",
                         message=(
-                            "Statement uses NotResource with Allow effect and broad Resource. "
-                            f"This grants access to ALL resources except: {', '.join(not_resources[:3])}"
-                            f"{'...' if len(not_resources) > 3 else ''}."
+                            "Statement uses `NotResource` with `Allow` effect and broad `Resource`. "
+                            f"This grants access to ALL resources except: {_format_list_with_backticks(not_resources, 3)}."
                         ),
                         suggestion=(
-                            "Replace NotResource with explicit Resource ARNs. "
-                            "Using NotResource grants access to all current and future resources "
+                            "Replace `NotResource` with explicit `Resource` ARNs. "
+                            "Using `NotResource` grants access to all current and future resources "
                             "except those explicitly excluded."
                         ),
                         example='{\n  "Effect": "Allow",\n  "Action": ["s3:GetObject"],\n  "Resource": "arn:aws:s3:::my-bucket/*"\n}',
                         line_number=statement.line_number,
                         field_name="resource",
-                        resource=", ".join(not_resources[:3])
-                        + ("..." if len(not_resources) > 3 else ""),
+                        resource=_format_list_with_backticks(not_resources, 3),
                     )
                 )
 
-        # Check 3: NotAction with Deny - less dangerous but worth noting
+        # Check 3: Combined NotAction AND NotResource with Allow
+        # This is the most dangerous pattern - grants nearly all actions on nearly all resources
+        if not_actions and not_resources and effect == "Allow":
+            issues.append(
+                ValidationIssue(
+                    severity="critical",
+                    statement_sid=statement.sid,
+                    statement_index=statement_idx,
+                    issue_type="combined_not_action_not_resource",
+                    message=(
+                        "**CRITICAL:** Policy uses both `NotAction` AND `NotResource` with `Allow` effect. "
+                        f"This grants ALL actions except [{_format_list_with_backticks(not_actions, 3)}] "
+                        f"on ALL resources except [{_format_list_with_backticks(not_resources, 3)}]. "
+                        "This is equivalent to near-administrator access."
+                    ),
+                    suggestion=(
+                        "Rewrite using explicit `Action` and `Resource` lists instead of negations. "
+                        "The combination of `NotAction` + `NotResource` is almost always a mistake."
+                    ),
+                    example='{\n  "Effect": "Allow",\n  "Action": ["specific:Action"],\n  "Resource": "arn:aws:service:::specific-resource"\n}',
+                    line_number=statement.line_number,
+                    field_name="action",
+                    action=_format_list_with_backticks(not_actions, 3),
+                    resource=_format_list_with_backticks(not_resources, 3),
+                )
+            )
+
+        # Check 4: NotAction with Deny - less dangerous but worth noting
         # NotAction with Deny means "deny everything except these actions"
         # which is actually a valid deny pattern but should be reviewed
         if not_actions and effect == "Deny":
@@ -145,18 +176,17 @@ class NotActionNotResourceCheck(PolicyCheck):
                         statement_index=statement_idx,
                         issue_type="not_action_deny_review",
                         message=(
-                            "Statement uses NotAction with Deny effect on all resources. "
-                            f"This denies everything except: {', '.join(not_actions[:5])}"
-                            f"{'...' if len(not_actions) > 5 else ''}. "
+                            "Statement uses `NotAction` with `Deny` effect on all resources. "
+                            f"This denies everything except: {_format_list_with_backticks(not_actions, 5)}. "
                             "Review to ensure this is the intended behavior."
                         ),
                         suggestion=(
                             "Verify that allowing only these specific actions is intended. "
-                            "Consider if an explicit Allow list would be clearer."
+                            "Consider if an explicit `Allow` list would be clearer."
                         ),
                         line_number=statement.line_number,
                         field_name="action",
-                        action=", ".join(not_actions[:3]) + ("..." if len(not_actions) > 3 else ""),
+                        action=_format_list_with_backticks(not_actions, 3),
                     )
                 )