iam-policy-validator 1.15.3__tar.gz → 1.15.4__tar.gz

{iam_policy_validator-1.15.3 → iam_policy_validator-1.15.4}/CHANGELOG.md

@@ -13,6 +13,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.15.4] - 2025-01-27
+
+### Fixed
+
+**Code Quality Improvements**
+
+- Remove duplicate `asyncio` import in query command (CodeQL: py/repeated-import)
+- Fix unused `action_list` variable in wildcard resource check (CodeQL: py/unused-local-variable)
+  - Now includes the action list in error messages for better context
+
+---
+
+## [1.15.3] - 2025-01-27
+
+### Added
+
+**Enhanced NotAction/NotResource Detection**
+
+- New **critical** severity check for combined `NotAction` + `NotResource` with `Allow` effect
+  - Detects near-administrator access patterns that grant all actions except a few on all resources except a few
+  - Example: `{"Effect": "Allow", "NotAction": ["iam:DeleteUser"], "NotResource": ["arn:aws:s3:::bucket/*"]}`
+- Improved message formatting with markdown backticks for better GitHub PR comment rendering
+
+**MFA Condition Anti-Pattern Detection**
+
+- Detect `BoolIfExists` with `aws:MultiFactorAuthPresent = false` (**high** severity)
+  - More dangerous than `Bool` because it also matches when the key is missing entirely
+- Detect `Null` with `aws:MultiFactorAuthPresent = true` (warning)
+  - Checks if key doesn't exist, meaning no MFA was provided in the request context
+
+---
+
 ## [1.15.2] - 2025-01-26
 
 ### Added

{iam_policy_validator-1.15.3 → iam_policy_validator-1.15.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.15.3
+Version: 1.15.4
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://boogy.github.io/iam-policy-validator

{iam_policy_validator-1.15.3 → iam_policy_validator-1.15.4}/action.yaml

@@ -56,11 +56,36 @@ inputs:
     required: false
     default: ""
 
+  upload-sarif:
+    description: "Upload SARIF results to GitHub Code Scanning (requires format: sarif and output-file to be set)"
+    required: false
+    default: "false"
+
   recursive:
     description: "Recursively search directories for policy files"
     required: false
     default: "true"
 
+  stream:
+    description: "Process files one-by-one (memory efficient for large repos with many policies)"
+    required: false
+    default: "false"
+
+  batch-size:
+    description: "Number of policies to process per batch when streaming (default: 10)"
+    required: false
+    default: "10"
+
+  summary:
+    description: "Show Executive Summary section in enhanced format output"
+    required: false
+    default: "false"
+
+  severity-breakdown:
+    description: "Show Issue Severity Breakdown section in enhanced format output"
+    required: false
+    default: "false"
+
   use-access-analyzer:
     description: "Use AWS IAM Access Analyzer for validation (requires AWS credentials)"
     required: false
@@ -72,7 +97,7 @@ inputs:
     default: "us-east-1"
 
   policy-type:
-    description: "Policy type for Access Analyzer (IDENTITY_POLICY, RESOURCE_POLICY, SERVICE_CONTROL_POLICY, RESOURCE_CONTROL_POLICY)"
+    description: "Policy type (IDENTITY_POLICY, RESOURCE_POLICY, TRUST_POLICY, SERVICE_CONTROL_POLICY, RESOURCE_CONTROL_POLICY)"
     required: false
     default: "IDENTITY_POLICY"
 
@@ -388,6 +413,20 @@ runs:
           ARGS="$ARGS --no-recursive"
         fi
 
+        # Add streaming mode flags
+        if [ "${{ inputs.stream }}" = "true" ]; then
+          ARGS="$ARGS --stream --batch-size ${{ inputs.batch-size }}"
+        fi
+
+        # Add enhanced output flags
+        if [ "${{ inputs.summary }}" = "true" ]; then
+          ARGS="$ARGS --summary"
+        fi
+
+        if [ "${{ inputs.severity-breakdown }}" = "true" ]; then
+          ARGS="$ARGS --severity-breakdown"
+        fi
+
         # Add fail-on-warnings flag
         if [ "${{ inputs.fail-on-warnings }}" = "true" ]; then
           ARGS="$ARGS --fail-on-warnings"
@@ -526,3 +565,10 @@ runs:
         name: iam-policy-validation-report
         path: ${{ github.workspace }}/${{ inputs.output-file }}
         retention-days: 30
+
+    - name: Upload SARIF to GitHub Code Scanning
+      if: always() && inputs.upload-sarif == 'true' && inputs.format == 'sarif' && inputs.output-file != ''
+      uses: github/codeql-action/upload-sarif@e6985fd516cce3b1a0e8db34a4013d2e50a1e252 # v4.32.0
+      with:
+        sarif_file: ${{ github.workspace }}/${{ inputs.output-file }}
+        category: iam-policy-validation

{iam_policy_validator-1.15.3 → iam_policy_validator-1.15.4}/iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.15.3"
+__version__ = "1.15.4"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
 _version_base = __version__.split("-", maxsplit=1)[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

{iam_policy_validator-1.15.3 → iam_policy_validator-1.15.4}/iam_validator/checks/wildcard_resource.py

@@ -234,7 +234,7 @@ class WildcardResourceCheck(PolicyCheck):
                 else:
                     action_list = ", ".join(f"`{a}`" for a in sorted_actions[:5])
                     action_list += f" (+{len(sorted_actions) - 5} more)"
-                message = 'Statement applies to all resources (`"*"`)'
+                message = f'Statement applies to all resources (`"*"`) with actions that typically require specific resources: {action_list}'
 
                 # Add adjustment reason if present
                 if adjustment_reason:

{iam_policy_validator-1.15.3 → iam_policy_validator-1.15.4}/iam_validator/commands/query.py

@@ -900,8 +900,6 @@ note:
 
 # For testing
 if __name__ == "__main__":
-    import asyncio
-
     cmd = QueryCommand()
     arg_parser = argparse.ArgumentParser()
     cmd.add_arguments(arg_parser)