iam-policy-validator 1.15.3__tar.gz → 1.15.5__tar.gz

{iam_policy_validator-1.15.3 → iam_policy_validator-1.15.5}/CHANGELOG.md

@@ -13,6 +13,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.15.4] - 2025-01-27
+
+### Fixed
+
+**Code Quality Improvements**
+
+- Remove duplicate `asyncio` import in query command (CodeQL: py/repeated-import)
+- Fix unused `action_list` variable in wildcard resource check (CodeQL: py/unused-local-variable)
+  - Now includes the action list in error messages for better context
+
+---
+
+## [1.15.3] - 2025-01-27
+
+### Added
+
+**Enhanced NotAction/NotResource Detection**
+
+- New **critical** severity check for combined `NotAction` + `NotResource` with `Allow` effect
+  - Detects near-administrator access patterns that grant all actions except a few on all resources except a few
+  - Example: `{"Effect": "Allow", "NotAction": ["iam:DeleteUser"], "NotResource": ["arn:aws:s3:::bucket/*"]}`
+- Improved message formatting with markdown backticks for better GitHub PR comment rendering
+
+**MFA Condition Anti-Pattern Detection**
+
+- Detect `BoolIfExists` with `aws:MultiFactorAuthPresent = false` (**high** severity)
+  - More dangerous than `Bool` because it also matches when the key is missing entirely
+- Detect `Null` with `aws:MultiFactorAuthPresent = true` (warning)
+  - Checks if key doesn't exist, meaning no MFA was provided in the request context
+
+---
+
 ## [1.15.2] - 2025-01-26
 
 ### Added

{iam_policy_validator-1.15.3 → iam_policy_validator-1.15.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.15.3
+Version: 1.15.5
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://boogy.github.io/iam-policy-validator

{iam_policy_validator-1.15.3 → iam_policy_validator-1.15.5}/action.yaml

@@ -56,11 +56,36 @@ inputs:
     required: false
     default: ""
 
+  upload-sarif:
+    description: "Upload SARIF results to GitHub Code Scanning (requires format: sarif and output-file to be set)"
+    required: false
+    default: "false"
+
   recursive:
     description: "Recursively search directories for policy files"
     required: false
     default: "true"
 
+  stream:
+    description: "Process files one-by-one (memory efficient for large repos with many policies)"
+    required: false
+    default: "false"
+
+  batch-size:
+    description: "Number of policies to process per batch when streaming (default: 10)"
+    required: false
+    default: "10"
+
+  summary:
+    description: "Show Executive Summary section in enhanced format output"
+    required: false
+    default: "false"
+
+  severity-breakdown:
+    description: "Show Issue Severity Breakdown section in enhanced format output"
+    required: false
+    default: "false"
+
   use-access-analyzer:
     description: "Use AWS IAM Access Analyzer for validation (requires AWS credentials)"
     required: false
@@ -72,7 +97,7 @@ inputs:
     default: "us-east-1"
 
   policy-type:
-    description: "Policy type for Access Analyzer (IDENTITY_POLICY, RESOURCE_POLICY, SERVICE_CONTROL_POLICY, RESOURCE_CONTROL_POLICY)"
+    description: "Policy type (IDENTITY_POLICY, RESOURCE_POLICY, TRUST_POLICY, SERVICE_CONTROL_POLICY, RESOURCE_CONTROL_POLICY)"
     required: false
     default: "IDENTITY_POLICY"
 
@@ -388,6 +413,20 @@ runs:
           ARGS="$ARGS --no-recursive"
         fi
 
+        # Add streaming mode flags
+        if [ "${{ inputs.stream }}" = "true" ]; then
+          ARGS="$ARGS --stream --batch-size ${{ inputs.batch-size }}"
+        fi
+
+        # Add enhanced output flags
+        if [ "${{ inputs.summary }}" = "true" ]; then
+          ARGS="$ARGS --summary"
+        fi
+
+        if [ "${{ inputs.severity-breakdown }}" = "true" ]; then
+          ARGS="$ARGS --severity-breakdown"
+        fi
+
         # Add fail-on-warnings flag
         if [ "${{ inputs.fail-on-warnings }}" = "true" ]; then
           ARGS="$ARGS --fail-on-warnings"
@@ -526,3 +565,10 @@ runs:
         name: iam-policy-validation-report
         path: ${{ github.workspace }}/${{ inputs.output-file }}
         retention-days: 30
+
+    - name: Upload SARIF to GitHub Code Scanning
+      if: always() && inputs.upload-sarif == 'true' && inputs.format == 'sarif' && inputs.output-file != ''
+      uses: github/codeql-action/upload-sarif@e6985fd516cce3b1a0e8db34a4013d2e50a1e252 # v4.32.0
+      with:
+        sarif_file: ${{ github.workspace }}/${{ inputs.output-file }}
+        category: iam-policy-validation

{iam_policy_validator-1.15.3 → iam_policy_validator-1.15.5}/docs/api-reference/models.md

@@ -43,19 +43,30 @@ Represents a validation issue found in a policy.
 
 ```python
 class ValidationIssue(BaseModel):
+    # Core fields
     severity: str              # error, warning, critical, high, medium, low
     statement_index: int       # Statement number (0-based)
-    issue_type: str            # Issue category
+    issue_type: str            # Issue category (e.g., "invalid_action", "overly_permissive")
     message: str               # Human-readable description
-    check_id: str | None       # Check that found this
-    statement_sid: str | None  # Statement ID
-    action: str | None         # Action involved
-    resource: str | None       # Resource involved
-    condition_key: str | None  # Condition key involved
-    suggestion: str | None     # How to fix
-    example: str | None        # Code example
-    line_number: int | None    # Line in source file
-    field_name: str | None     # Field name (action, resource, etc.)
+    check_id: str | None       # Check that found this (e.g., "wildcard_action")
+    statement_sid: str | None  # Statement ID if present
+
+    # Context fields
+    action: str | None         # Action involved in the issue
+    resource: str | None       # Resource involved in the issue
+    condition_key: str | None  # Condition key involved in the issue
+    field_name: str | None     # Field name: "action", "resource", "condition", "principal", "effect", "sid"
+    line_number: int | None    # Line number in source file
+
+    # Guidance fields
+    suggestion: str | None     # How to fix the issue
+    example: str | None        # Code example (JSON/YAML)
+
+    # Enhanced finding quality fields
+    risk_explanation: str | None      # Why this is a security risk
+    documentation_url: str | None     # Link to AWS docs or runbook
+    remediation_steps: list[str] | None  # Step-by-step fix guidance
+    risk_category: str | None         # Category: "privilege_escalation", "data_exfiltration", etc.
 ```
 
 ## PolicyValidationResult