iam-policy-validator 1.5.0__py3-none-any.whl → 1.6.0__py3-none-any.whl

iam_validator/checks/condition_type_mismatch.py

@@ -0,0 +1,259 @@
+"""Condition Type Mismatch Check.
+
+Validates that condition operators match the expected types for condition keys and values.
+"""
+
+from iam_validator.core.aws_fetcher import AWSServiceFetcher
+from iam_validator.core.check_registry import CheckConfig, PolicyCheck
+from iam_validator.core.condition_validators import (
+    normalize_operator,
+    translate_type,
+    validate_value_for_type,
+)
+from iam_validator.core.models import Statement, ValidationIssue
+
+
+class ConditionTypeMismatchCheck(PolicyCheck):
+    """Check for type mismatches between operators, keys, and values."""
+
+    @property
+    def check_id(self) -> str:
+        """Unique identifier for this check."""
+        return "condition_type_mismatch"
+
+    @property
+    def description(self) -> str:
+        """Description of what this check does."""
+        return "Validates condition operator types match key types and value formats"
+
+    @property
+    def default_severity(self) -> str:
+        """Default severity level for issues found by this check."""
+        return "error"
+
+    async def execute(
+        self,
+        statement: Statement,
+        statement_idx: int,
+        fetcher: AWSServiceFetcher,
+        config: CheckConfig,
+    ) -> list[ValidationIssue]:
+        """
+        Execute the condition type mismatch check.
+
+        Validates:
+        1. Operator type matches condition key type
+        2. Condition values match the expected type format
+
+        Args:
+            statement: The IAM statement to check
+            statement_idx: Index of this statement in the policy
+            fetcher: AWS service fetcher for looking up condition key types
+            config: Check configuration
+
+        Returns:
+            List of validation issues found
+        """
+        issues = []
+
+        # Only check statements with conditions
+        if not statement.condition:
+            return issues
+
+        # Skip Null operator - it's special and doesn't need type validation
+        # (Null just checks if a key exists or doesn't exist)
+        skip_operators = {"Null"}
+
+        statement_sid = statement.sid
+        line_number = statement.line_number
+        actions = statement.get_actions()
+        resources = statement.get_resources()
+
+        # Check each condition operator and its keys/values
+        for operator, conditions in statement.condition.items():
+            # Normalize the operator and get its expected type
+            base_operator, operator_type, set_prefix = normalize_operator(operator)
+
+            if operator_type is None:
+                # Unknown operator - this will be caught by another check
+                continue
+
+            if base_operator in skip_operators:
+                continue
+
+            # Check each condition key
+            for condition_key, condition_values in conditions.items():
+                # Normalize values to a list
+                values = (
+                    condition_values if isinstance(condition_values, list) else [condition_values]
+                )
+
+                # Get the expected type for this condition key
+                key_type = await self._get_condition_key_type(
+                    fetcher, condition_key, actions, resources
+                )
+
+                if key_type is None:
+                    # Unknown condition key - will be caught by condition_key_validation check
+                    continue
+
+                # Normalize the key type
+                key_type = translate_type(key_type)
+                operator_type = translate_type(operator_type)
+
+                # Special case: String operators with ARN types (usable but not recommended)
+                if operator_type == "String" and key_type == "ARN":
+                    issues.append(
+                        ValidationIssue(
+                            severity="warning",
+                            message=(
+                                f"Type mismatch (usable but not recommended): Operator '{operator}' expects "
+                                f"{operator_type} values, but condition key '{condition_key}' is type {key_type}. "
+                                f"Consider using an ARN-specific operator like ArnEquals or ArnLike instead."
+                            ),
+                            statement_sid=statement_sid,
+                            statement_index=statement_idx,
+                            issue_type="type_mismatch_usable",
+                            line_number=line_number,
+                        )
+                    )
+                # Check if operator type matches key type
+                elif not self._types_compatible(operator_type, key_type):
+                    issues.append(
+                        ValidationIssue(
+                            severity=self.get_severity(config),
+                            message=(
+                                f"Type mismatch: Operator '{operator}' expects {operator_type} values, "
+                                f"but condition key '{condition_key}' is type {key_type}."
+                            ),
+                            statement_sid=statement_sid,
+                            statement_index=statement_idx,
+                            issue_type="type_mismatch",
+                            condition_key=condition_key,
+                            line_number=line_number,
+                        )
+                    )
+
+                # Validate that the values match the expected type format
+                is_valid, error_msg = validate_value_for_type(key_type, values)
+                if not is_valid:
+                    issues.append(
+                        ValidationIssue(
+                            severity=self.get_severity(config),
+                            message=(
+                                f"Invalid value format for condition key '{condition_key}': {error_msg}"
+                            ),
+                            statement_sid=statement_sid,
+                            statement_index=statement_idx,
+                            issue_type="invalid_value_format",
+                            condition_key=condition_key,
+                            line_number=line_number,
+                        )
+                    )
+
+        return issues
+
+    async def _get_condition_key_type(
+        self,
+        fetcher: AWSServiceFetcher,
+        condition_key: str,
+        actions: list[str],
+        resources: list[str],
+    ) -> str | None:
+        """
+        Get the expected type for a condition key by checking global keys and service definitions.
+
+        Args:
+            fetcher: AWS service fetcher
+            condition_key: The condition key to look up
+            actions: List of actions from the statement
+            resources: List of resources from the statement
+
+        Returns:
+            Type string or None if not found
+        """
+        from iam_validator.core.config.aws_global_conditions import get_global_conditions
+
+        # Check if it's a global condition key
+        global_conditions = get_global_conditions()
+        key_type = global_conditions.get_key_type(condition_key)
+        if key_type:
+            return key_type
+
+        # Check service-specific and action-specific condition keys
+        for action in actions:
+            if action == "*":
+                continue
+
+            try:
+                service_prefix, action_name = fetcher.parse_action(action)
+                service_detail = await fetcher.fetch_service_by_name(service_prefix)
+
+                # Check service-level condition keys
+                if condition_key in service_detail.condition_keys:
+                    condition_key_obj = service_detail.condition_keys[condition_key]
+                    if condition_key_obj.types:
+                        return condition_key_obj.types[0]
+
+                # Check action-level condition keys
+                if action_name in service_detail.actions:
+                    action_detail = service_detail.actions[action_name]
+
+                    # For action-specific keys, we need to check the service condition keys list
+                    if (
+                        action_detail.action_condition_keys
+                        and condition_key in action_detail.action_condition_keys
+                    ):
+                        if condition_key in service_detail.condition_keys:
+                            condition_key_obj = service_detail.condition_keys[condition_key]
+                            if condition_key_obj.types:
+                                return condition_key_obj.types[0]
+
+                    # Check resource-specific condition keys
+                    if resources and action_detail.resources:
+                        for res_req in action_detail.resources:
+                            resource_name = res_req.get("Name", "")
+                            if not resource_name:
+                                continue
+
+                            resource_type = service_detail.resources.get(resource_name)
+                            if resource_type and resource_type.condition_keys:
+                                if condition_key in resource_type.condition_keys:
+                                    # Resource condition keys reference service condition keys
+                                    if condition_key in service_detail.condition_keys:
+                                        condition_key_obj = service_detail.condition_keys[
+                                            condition_key
+                                        ]
+                                        if condition_key_obj.types:
+                                            return condition_key_obj.types[0]
+
+            except Exception:
+                # If we can't look up the action, skip it
+                continue
+
+        return None
+
+    def _types_compatible(self, operator_type: str, key_type: str) -> bool:
+        """
+        Check if an operator type is compatible with a key type.
+
+        Note: String/ARN compatibility is handled separately with a warning,
+        so this method returns False for that combination.
+
+        Args:
+            operator_type: Type expected by the operator
+            key_type: Type of the condition key
+
+        Returns:
+            True if compatible
+        """
+        # Exact match
+        if operator_type == key_type:
+            return True
+
+        # EpochTime can accept both Date and Numeric
+        # (this is a special case mentioned in Parliament)
+        if key_type == "Date" and operator_type == "Numeric":
+            return True
+
+        return False

iam_validator/checks/mfa_condition_check.py

@@ -0,0 +1,112 @@
+"""MFA Condition Anti-Pattern Check.
+
+Detects dangerous MFA-related condition patterns that may not enforce MFA as intended.
+"""
+
+from iam_validator.core.check_registry import CheckConfig, PolicyCheck
+from iam_validator.core.models import Statement, ValidationIssue
+
+
+class MFAConditionCheck(PolicyCheck):
+    """Check for MFA condition anti-patterns."""
+
+    @property
+    def check_id(self) -> str:
+        """Unique identifier for this check."""
+        return "mfa_condition_antipattern"
+
+    @property
+    def description(self) -> str:
+        """Description of what this check does."""
+        return "Detects dangerous MFA-related condition patterns"
+
+    @property
+    def default_severity(self) -> str:
+        """Default severity level for issues found by this check."""
+        return "warning"
+
+    async def execute(
+        self, statement: Statement, statement_idx: int, fetcher, config: CheckConfig
+    ) -> list[ValidationIssue]:
+        """
+        Execute the MFA condition anti-pattern check.
+
+        Common anti-patterns:
+        1. Using Bool with aws:MultiFactorAuthPresent = false
+           Problem: The key may not exist in the request, so condition doesn't enforce anything
+
+        2. Using Null with aws:MultiFactorAuthPresent = false
+           Problem: This only checks if the key exists, not if MFA was used
+
+        Args:
+            statement: The IAM statement to check
+            statement_idx: Index of this statement in the policy
+            fetcher: AWS service fetcher (not used in this check)
+            config: Check configuration
+
+        Returns:
+            List of validation issues found
+        """
+        issues = []
+
+        # Only check statements with conditions
+        if not statement.condition:
+            return issues
+
+        statement_sid = statement.sid
+        line_number = statement.line_number
+
+        # Check for anti-pattern #1: Bool with aws:MultiFactorAuthPresent = false
+        bool_conditions = statement.condition.get("Bool", {})
+        for key, value in bool_conditions.items():
+            if key.lower() == "aws:multifactorauthpresent":
+                # Normalize value to list
+                values = value if isinstance(value, list) else [value]
+                # Convert to lowercase strings for comparison
+                values_lower = [str(v).lower() for v in values]
+
+                if "false" in values_lower or False in values:
+                    issues.append(
+                        ValidationIssue(
+                            severity=self.get_severity(config),
+                            message=(
+                                "Dangerous MFA condition pattern detected. "
+                                'Using {"Bool": {"aws:MultiFactorAuthPresent": "false"}} does not enforce MFA '
+                                "because aws:MultiFactorAuthPresent may not exist in the request context. "
+                                'Consider using {"Bool": {"aws:MultiFactorAuthPresent": "true"}} in an Allow statement, '
+                                "or use BoolIfExists in a Deny statement."
+                            ),
+                            statement_sid=statement_sid,
+                            statement_index=statement_idx,
+                            issue_type="mfa_antipattern_bool_false",
+                            line_number=line_number,
+                        )
+                    )
+
+        # Check for anti-pattern #2: Null with aws:MultiFactorAuthPresent = false
+        null_conditions = statement.condition.get("Null", {})
+        for key, value in null_conditions.items():
+            if key.lower() == "aws:multifactorauthpresent":
+                # Normalize value to list
+                values = value if isinstance(value, list) else [value]
+                # Convert to lowercase strings for comparison
+                values_lower = [str(v).lower() for v in values]
+
+                if "false" in values_lower or False in values:
+                    issues.append(
+                        ValidationIssue(
+                            severity=self.get_severity(config),
+                            message=(
+                                "Dangerous MFA condition pattern detected. "
+                                'Using {"Null": {"aws:MultiFactorAuthPresent": "false"}} only checks if the key exists, '
+                                "not whether MFA was actually used. This does not enforce MFA. "
+                                'Consider using {"Bool": {"aws:MultiFactorAuthPresent": "true"}} in an Allow statement instead.'
+                            ),
+                            statement_sid=statement_sid,
+                            statement_index=statement_idx,
+                            issue_type="mfa_antipattern_null_false",
+                            line_number=line_number,
+                        )
+                    )
+
+        return issues

iam_validator/checks/sensitive_action.py

@@ -10,6 +10,7 @@ from iam_validator.checks.utils.sensitive_action_matcher import (
 from iam_validator.checks.utils.wildcard_expansion import expand_wildcard_actions
 from iam_validator.core.aws_fetcher import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
+from iam_validator.core.config.sensitive_actions import get_category_for_action
 from iam_validator.core.models import Statement, ValidationIssue
 
 if TYPE_CHECKING:
@@ -31,6 +32,69 @@ class SensitiveActionCheck(PolicyCheck):
     def default_severity(self) -> str:
         return "medium"
 
+    def _get_severity_for_action(self, action: str, config: CheckConfig) -> str:
+        """
+        Get severity for a specific action, considering category-based overrides.
+
+        Args:
+            action: The AWS action to check
+            config: Check configuration
+
+        Returns:
+            Severity level for the action (considers category overrides)
+        """
+        # Check if category severities are configured
+        category_severities = config.config.get("category_severities", {})
+        if not category_severities:
+            return self.get_severity(config)
+
+        # Get the category for this action
+        category = get_category_for_action(action)
+        if category and category in category_severities:
+            return category_severities[category]
+
+        # Fall back to default severity
+        return self.get_severity(config)
+
+    def _get_category_specific_suggestion(
+        self, action: str, config: CheckConfig
+    ) -> tuple[str, str]:
+        """
+        Get category-specific suggestion and example for an action.
+
+        Args:
+            action: The AWS action to check
+            config: Check configuration
+
+        Returns:
+            Tuple of (suggestion_text, example_text) tailored to the action's category
+        """
+        category = get_category_for_action(action)
+
+        # Get category suggestions from config (ABAC-focused by default)
+        # See: iam_validator/core/config/category_suggestions.py
+        category_suggestions = config.config.get("category_suggestions", {})
+
+        # Get category-specific content or fall back to generic ABAC guidance
+        if category and category in category_suggestions:
+            return (
+                category_suggestions[category]["suggestion"],
+                category_suggestions[category]["example"],
+            )
+
+        # Generic ABAC fallback for uncategorized actions
+        return (
+            "Add IAM conditions to limit when this action can be used. Use ABAC for scalability:\n"
+            "• Match principal tags to resource tags (aws:PrincipalTag/X = aws:ResourceTag/X)\n"
+            "• Require MFA (aws:MultiFactorAuthPresent = true)\n"
+            "• Restrict by IP (aws:SourceIp) or VPC (aws:SourceVpc)",
+            '"Condition": {\n'
+            '  "StringEquals": {\n'
+            '    "aws:PrincipalTag/owner": "${aws:ResourceTag/owner}"\n'
+            "  }\n"
+            "}",
+        )
+
     async def execute(
         self,
         statement: Statement,
@@ -72,18 +136,26 @@ class SensitiveActionCheck(PolicyCheck):
                 )
                 message = message_template.format(actions=action_list)
 
-            suggestion_text = config.config.get(
-                "suggestion",
-                "Add IAM conditions to limit when this action can be used. Consider: ABAC (ResourceTag OR RequestTag matching ${aws:PrincipalTag}), IP restrictions (aws:SourceIp), MFA requirements (aws:MultiFactorAuthPresent), or time-based restrictions (aws:CurrentTime)",
+            # Get category-specific suggestion and example (or use config defaults)
+            # Use the first matched action to determine the category
+            suggestion_text, example = self._get_category_specific_suggestion(
+                matched_actions[0], config
             )
-            example = config.config.get("example", "")
 
             # Combine suggestion + example
-            suggestion = f"{suggestion_text}\nExample:\n{example}" if example else suggestion_text
+            suggestion = f"{suggestion_text}\n\nExample:\n{example}" if example else suggestion_text
+
+            # Determine severity based on the highest severity action in the list
+            # If single action, use its category severity
+            # If multiple actions, use the highest severity among them
+            severity = self.get_severity(config)  # Default
+            if matched_actions:
+                # Get severity for first action (or highest if we want to be more sophisticated)
+                severity = self._get_severity_for_action(matched_actions[0], config)
 
             issues.append(
                 ValidationIssue(
-                    severity=self.get_severity(config),
+                    severity=severity,
                     statement_sid=statement.sid,
                     statement_index=statement_idx,
                     issue_type="missing_condition",

iam_validator/checks/set_operator_validation.py

@@ -0,0 +1,157 @@
+"""Set Operator Validation Check.
+
+Validates proper usage of ForAllValues and ForAnyValue set operators in IAM policies.
+
+Based on AWS IAM best practices:
+https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-single-vs-multi-valued-context-keys.html
+"""
+
+from iam_validator.core.aws_fetcher import AWSServiceFetcher
+from iam_validator.core.check_registry import CheckConfig, PolicyCheck
+from iam_validator.core.condition_validators import (
+    is_multivalued_context_key,
+    normalize_operator,
+)
+from iam_validator.core.models import Statement, ValidationIssue
+
+
+class SetOperatorValidationCheck(PolicyCheck):
+    """Check for proper usage of ForAllValues and ForAnyValue set operators."""
+
+    @property
+    def check_id(self) -> str:
+        """Unique identifier for this check."""
+        return "set_operator_validation"
+
+    @property
+    def description(self) -> str:
+        """Description of what this check does."""
+        return "Validates proper usage of ForAllValues and ForAnyValue set operators"
+
+    @property
+    def default_severity(self) -> str:
+        """Default severity level for issues found by this check."""
+        return "error"
+
+    async def execute(
+        self,
+        statement: Statement,
+        statement_idx: int,
+        fetcher: AWSServiceFetcher,
+        config: CheckConfig,
+    ) -> list[ValidationIssue]:
+        """
+        Execute the set operator validation check.
+
+        Validates:
+        1. ForAllValues/ForAnyValue not used with single-valued context keys (anti-pattern)
+        2. ForAllValues with Allow effect includes Null condition check (security)
+        3. ForAnyValue with Deny effect includes Null condition check (predictability)
+
+        Args:
+            statement: The IAM statement to check
+            statement_idx: Index of this statement in the policy
+            fetcher: AWS service fetcher (unused but required by interface)
+            config: Check configuration
+
+        Returns:
+            List of validation issues found
+        """
+        issues = []
+
+        # Only check statements with conditions
+        if not statement.condition:
+            return issues
+
+        statement_sid = statement.sid
+        line_number = statement.line_number
+        effect = statement.effect
+
+        # Track which condition keys have set operators and Null checks
+        set_operator_keys: dict[str, str] = {}  # key -> operator prefix
+        null_checked_keys: set[str] = set()
+
+        # First pass: Identify set operators and Null checks
+        for operator, conditions in statement.condition.items():
+            base_operator, operator_type, set_prefix = normalize_operator(operator)
+
+            # Track Null checks
+            if base_operator == "Null":
+                for condition_key in conditions.keys():
+                    null_checked_keys.add(condition_key)
+
+            # Track set operators
+            if set_prefix in ["ForAllValues", "ForAnyValue"]:
+                for condition_key in conditions.keys():
+                    set_operator_keys[condition_key] = set_prefix
+
+        # Second pass: Validate set operator usage
+        for operator, conditions in statement.condition.items():
+            base_operator, operator_type, set_prefix = normalize_operator(operator)
+
+            if not set_prefix:
+                continue
+
+            # Check each condition key used with a set operator
+            for condition_key, condition_values in conditions.items():
+                # Issue 1: Set operator used with single-valued context key (anti-pattern)
+                if not is_multivalued_context_key(condition_key):
+                    issues.append(
+                        ValidationIssue(
+                            severity=self.get_severity(config),
+                            message=(
+                                f"Set operator '{set_prefix}' should not be used with single-valued "
+                                f"condition key '{condition_key}'. This can lead to overly permissive policies. "
+                                f"Set operators are designed for multivalued context keys like 'aws:TagKeys'. "
+                                f"See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-single-vs-multi-valued-context-keys.html"
+                            ),
+                            statement_sid=statement_sid,
+                            statement_index=statement_idx,
+                            issue_type="set_operator_on_single_valued_key",
+                            condition_key=condition_key,
+                            line_number=line_number,
+                        )
+                    )
+
+                # Issue 2: ForAllValues with Allow effect without Null check (security risk)
+                if set_prefix == "ForAllValues" and effect == "Allow":
+                    if condition_key not in null_checked_keys:
+                        issues.append(
+                            ValidationIssue(
+                                severity="warning",
+                                message=(
+                                    f"Security risk: ForAllValues with Allow effect on '{condition_key}' "
+                                    f"should include a Null condition check. Without it, requests with missing "
+                                    f'\'{condition_key}\' will be granted access. Add: \'"Null": {{"{condition_key}": "false"}}\'. '
+                                    f"See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-single-vs-multi-valued-context-keys.html"
+                                ),
+                                statement_sid=statement_sid,
+                                statement_index=statement_idx,
+                                issue_type="forallvalues_allow_without_null_check",
+                                condition_key=condition_key,
+                                line_number=line_number,
+                            )
+                        )
+
+                # Issue 3: ForAnyValue with Deny effect without Null check (unpredictable)
+                if set_prefix == "ForAnyValue" and effect == "Deny":
+                    if condition_key not in null_checked_keys:
+                        issues.append(
+                            ValidationIssue(
+                                severity="warning",
+                                message=(
+                                    f"Unpredictable behavior: ForAnyValue with Deny effect on '{condition_key}' "
+                                    f"should include a Null condition check. Without it, requests with missing "
+                                    f"'{condition_key}' will evaluate to 'No match' instead of denying access. "
+                                    f'Add: \'"Null": {{"{condition_key}": "false"}}\'. '
+                                    f"See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-single-vs-multi-valued-context-keys.html"
+                                ),
+                                statement_sid=statement_sid,
+                                statement_index=statement_idx,
+                                issue_type="foranyvalue_deny_without_null_check",
+                                condition_key=condition_key,
+                                line_number=line_number,
+                            )
+                        )
+
+        return issues