iam-policy-validator 1.7.1__py3-none-any.whl → 1.8.0__py3-none-any.whl

iam_validator/checks/action_resource_matching.py

@@ -21,6 +21,8 @@ Example:
     This check will report: s3:GetObject requires arn:aws:s3:::mybucket/*
 """
 
+import re
+
 from iam_validator.core.aws_fetcher import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
 from iam_validator.core.models import Statement, ValidationIssue
@@ -86,6 +88,10 @@ class ActionResourceMatchingCheck(PolicyCheck):
         statement_sid = statement.sid
         line_number = statement.line_number
 
+        # Skip if no resources to validate (e.g., trust policies don't have Resource field)
+        if not resources:
+            return issues
+
         # Skip if we have a wildcard resource (handled by other checks)
         if "*" in resources:
             return issues
@@ -231,18 +237,23 @@ class ActionResourceMatchingCheck(PolicyCheck):
         if reason:
             message = reason
         elif all_required_formats and len(all_required_formats) > 1:
-            types = ", ".join(f["type"] for f in all_required_formats)
+            types = ", ".join(f"`{f['type']}`" for f in all_required_formats)
             message = (
-                f"No resources match for action '{action}'. This action requires one of: {types}"
+                f"No resources match for action `{action}`. This action requires one of: {types}"
             )
         else:
             message = (
-                f"No resources match for action '{action}'. "
-                f"This action requires resource type: {required_type}"
+                f"No resources match for action `{action}`. "
+                f"This action requires resource type: `{required_type}`"
             )
 
         # Build suggestion with examples
-        suggestion = self._get_suggestion(action, required_format, provided_resources)
+        suggestion = self._get_suggestion(
+            action=action,
+            required_format=required_format,
+            provided_resources=provided_resources,
+            all_required_formats=all_required_formats,
+        )
 
         return ValidationIssue(
             severity=self.get_severity(config),
@@ -265,6 +276,7 @@ class ActionResourceMatchingCheck(PolicyCheck):
         action: str,
         required_format: str,
         provided_resources: list[str],
+        all_required_formats: list[dict] | None = None,
     ) -> str:
         """
         Generate helpful suggestion for fixing the mismatch.
@@ -281,44 +293,75 @@ class ActionResourceMatchingCheck(PolicyCheck):
         # Special case: Wildcard resource
         if required_format == "*":
             return (
-                f'Action {action} can only use Resource: "*" (wildcard).\n'
+                f'Action `{action}` can only use Resource: `"*"` (wildcard).\n'
                 f"  This action does not support resource-level permissions.\n"
-                f'  Example: "Resource": "*"'
+                f'  Example: "Resource": `"*"`'
             )
 
-        # Extract resource type from ARN pattern
-        # Pattern format: arn:${Partition}:service:${Region}:${Account}:resourceType/...
-        # Examples:
-        #   arn:${Partition}:s3:::${BucketName}/${ObjectName} -> object
-        #   arn:${Partition}:iam::${Account}:user/${UserName} -> user
-        resource_type = self._extract_resource_type_from_pattern(required_format)
-
-        # Build service-specific suggestion
+        # Build service-specific suggestion with proper markdown formatting
         suggestion_parts = []
 
-        # Add action description
-        suggestion_parts.append(f"Action {action} requires {resource_type} resource type.")
+        # If multiple resource types are valid, show all of them
+        if all_required_formats and len(all_required_formats) > 1:
+            resource_types = [fmt["type"] for fmt in all_required_formats]
+            suggestion_parts.append(
+                f"Action `{action}` requires one of these resource types: {', '.join(f'`{t}`' for t in resource_types)}"
+            )
+            suggestion_parts.append("")
 
-        # Add expected format
-        suggestion_parts.append(f"  Expected format: {required_format}")
+            # Show format and example for each resource type
+            for fmt in all_required_formats:
+                resource_type = fmt["type"]
+                arn_format = fmt["format"]
 
-        # Add practical example based on the pattern
-        example = self._generate_example_arn(required_format)
-        if example:
-            suggestion_parts.append(f"  Example: {example}")
+                suggestion_parts.append(
+                    f"**Option {all_required_formats.index(fmt) + 1}: `{resource_type}` resource**"
+                )
+                suggestion_parts.append("```")
+                suggestion_parts.append(arn_format)
+                suggestion_parts.append("```")
 
-        # Add helpful context for common patterns
-        context = self._get_resource_context(action_name, resource_type, required_format)
-        if context:
-            suggestion_parts.append(f"  {context}")
+                # Add practical example
+                example = self._generate_example_arn(arn_format)
+                if example:
+                    suggestion_parts.append(f"Example: `{example}`")
 
-        suggestion = "\n".join(suggestion_parts)
+                suggestion_parts.append("")
+        else:
+            # Single resource type - show detailed info
+            # Extract resource type from ARN pattern
+            # Pattern format: arn:${Partition}:service:${Region}:${Account}:resourceType/...
+            # Examples:
+            #   arn:${Partition}:s3:::${BucketName}/${ObjectName} -> object
+            #   arn:${Partition}:iam::${Account}:user/${UserName} -> user
+            resource_type = self._extract_resource_type_from_pattern(required_format)
+
+            # Add action description
+            suggestion_parts.append(f"Action `{action}` requires `{resource_type}` resource type.")
+            suggestion_parts.append("")
+
+            # Add expected format in code block
+            suggestion_parts.append("**Expected format:**")
+            suggestion_parts.append(f"```\n{required_format}\n```")
+
+            # Add practical example based on the pattern
+            example = self._generate_example_arn(required_format)
+            if example:
+                suggestion_parts.append("**Example:**")
+                suggestion_parts.append(f"```\n{example}\n```")
+
+            # Add helpful context for common patterns
+            context = self._get_resource_context(action_name, resource_type, required_format)
+            if context:
+                suggestion_parts.append(f"**Note:** {context}")
 
         # Add current resources to help user understand the mismatch
         if provided_resources and len(provided_resources) <= 3:
-            current = ", ".join(provided_resources)
-            suggestion += f"\n  Current resources: {current}"
+            suggestion_parts.append("**Current resources:**")
+            for resource in provided_resources:
+                suggestion_parts.append(f"- `{resource}`")
 
+        suggestion = "\n".join(suggestion_parts)
         return suggestion
 
     def _extract_resource_type_from_pattern(self, pattern: str) -> str:
@@ -340,17 +383,14 @@ class ActionResourceMatchingCheck(PolicyCheck):
 
         # Extract resource type (part before / or entire string)
         if "/" in resource_part:
-            resource_type = resource_part.split("/")[0]
+            resource_type = resource_part.split("/", maxsplit=1)[0]
         elif ":" in resource_part:
-            resource_type = resource_part.split(":")[0]
+            resource_type = resource_part.split(":", maxsplit=1)[0]
         else:
             resource_type = resource_part
 
         # Remove template variables like ${...}
-        import re
-
         resource_type = re.sub(r"\$\{[^}]+\}", "", resource_type)
-
         return resource_type.strip() or "resource"
 
     def _generate_example_arn(self, pattern: str) -> str:
@@ -359,8 +399,6 @@ class ActionResourceMatchingCheck(PolicyCheck):
 
         Converts AWS template variables to realistic examples.
         """
-        import re
-
         example = pattern
 
         # Common substitutions

iam_validator/checks/action_validation.py

@@ -63,7 +63,7 @@ class ActionValidationCheck(PolicyCheck):
                         statement_sid=statement_sid,
                         statement_index=statement_idx,
                         issue_type="invalid_action",
-                        message=error_msg or f"Invalid action: {action}",
+                        message=error_msg or f"Invalid action: `{action}`",
                         action=action,
                         line_number=line_number,
                     )

iam_validator/checks/condition_key_validation.py

@@ -52,26 +52,26 @@ class ConditionKeyValidationCheck(PolicyCheck):
                         continue
 
                     # Validate against action and resource types
-                    is_valid, error_msg, warning_msg = await fetcher.validate_condition_key(
-                        action, condition_key, resources
-                    )
+                    result = await fetcher.validate_condition_key(action, condition_key, resources)
 
-                    if not is_valid:
+                    if not result.is_valid:
                         issues.append(
                             ValidationIssue(
                                 severity=self.get_severity(config),
                                 statement_sid=statement_sid,
                                 statement_index=statement_idx,
                                 issue_type="invalid_condition_key",
-                                message=error_msg or f"Invalid condition key: {condition_key}",
+                                message=result.error_message
+                                or f"Invalid condition key: `{condition_key}`",
                                 action=action,
                                 condition_key=condition_key,
                                 line_number=line_number,
+                                suggestion=result.suggestion,
                             )
                         )
                         # Only report once per condition key (not per action)
                         break
-                    elif warning_msg and warn_on_global_keys:
+                    elif result.warning_message and warn_on_global_keys:
                         # Add warning for global condition keys with action-specific keys
                         # Only if warn_on_global_condition_keys is enabled
                         issues.append(
@@ -80,7 +80,7 @@ class ConditionKeyValidationCheck(PolicyCheck):
                                 statement_sid=statement_sid,
                                 statement_index=statement_idx,
                                 issue_type="global_condition_key_with_action_specific",
-                                message=warning_msg,
+                                message=result.warning_message,
                                 action=action,
                                 condition_key=condition_key,
                                 line_number=line_number,

iam_validator/checks/condition_type_mismatch.py

@@ -72,7 +72,7 @@ class ConditionTypeMismatchCheck(PolicyCheck):
         # Check each condition operator and its keys/values
         for operator, conditions in statement.condition.items():
             # Normalize the operator and get its expected type
-            base_operator, operator_type, set_prefix = normalize_operator(operator)
+            base_operator, operator_type, _set_prefix = normalize_operator(operator)
 
             if operator_type is None:
                 # Unknown operator - this will be caught by another check
@@ -107,8 +107,8 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                         ValidationIssue(
                             severity="warning",
                             message=(
-                                f"Type mismatch (usable but not recommended): Operator '{operator}' expects "
-                                f"{operator_type} values, but condition key '{condition_key}' is type {key_type}. "
+                                f"Type mismatch (usable but not recommended): Operator `{operator}` expects "
+                                f"`{operator_type}` values, but condition key `{condition_key}` is type `{key_type}`. "
                                 f"Consider using an ARN-specific operator like ArnEquals or ArnLike instead."
                             ),
                             statement_sid=statement_sid,
@@ -123,8 +123,8 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                         ValidationIssue(
                             severity=self.get_severity(config),
                             message=(
-                                f"Type mismatch: Operator '{operator}' expects {operator_type} values, "
-                                f"but condition key '{condition_key}' is type {key_type}."
+                                f"Type mismatch: Operator `{operator}` expects `{operator_type}` values, "
+                                f"but condition key `{condition_key}` is type `{key_type}`."
                             ),
                             statement_sid=statement_sid,
                             statement_index=statement_idx,
@@ -141,7 +141,7 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                         ValidationIssue(
                             severity=self.get_severity(config),
                             message=(
-                                f"Invalid value format for condition key '{condition_key}': {error_msg}"
+                                f"Invalid value format for condition key `{condition_key}`: {error_msg}"
                             ),
                             statement_sid=statement_sid,
                             statement_index=statement_idx,
@@ -172,7 +172,9 @@ class ConditionTypeMismatchCheck(PolicyCheck):
         Returns:
             Type string or None if not found
         """
-        from iam_validator.core.config.aws_global_conditions import get_global_conditions
+        from iam_validator.core.config.aws_global_conditions import (  # pylint: disable=import-outside-toplevel
+            get_global_conditions,
+        )
 
         # Check if it's a global condition key
         global_conditions = get_global_conditions()
@@ -227,7 +229,7 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                                         if condition_key_obj.types:
                                             return condition_key_obj.types[0]
 
-            except Exception:
+            except Exception:  # pylint: disable=broad-exception-caught
                 # If we can't look up the action, skip it
                 continue
 

iam_validator/checks/full_wildcard.py

@@ -43,19 +43,12 @@ class FullWildcardCheck(PolicyCheck):
                 "message",
                 "Statement allows all actions on all resources - CRITICAL SECURITY RISK",
             )
-            suggestion_text = config.config.get(
+            suggestion = config.config.get(
                 "suggestion",
                 "This grants full administrative access. Replace both wildcards with specific actions and resources to follow least-privilege principle",
             )
             example = config.config.get("example", "")
 
-            # Combine suggestion + example
-            suggestion = (
-                f"{suggestion_text}\nExample:\n```json\n{example}\n```"
-                if example
-                else suggestion_text
-            )
-
             issues.append(
                 ValidationIssue(
                     severity=self.get_severity(config),
@@ -64,6 +57,7 @@ class FullWildcardCheck(PolicyCheck):
                     issue_type="security_risk",
                     message=message,
                     suggestion=suggestion,
+                    example=example if example else None,
                     line_number=statement.line_number,
                 )
             )

iam_validator/checks/mfa_condition_check.py

@@ -70,11 +70,11 @@ class MFAConditionCheck(PolicyCheck):
                         ValidationIssue(
                             severity=self.get_severity(config),
                             message=(
-                                "Dangerous MFA condition pattern detected. "
-                                'Using {"Bool": {"aws:MultiFactorAuthPresent": "false"}} does not enforce MFA '
-                                "because aws:MultiFactorAuthPresent may not exist in the request context. "
-                                'Consider using {"Bool": {"aws:MultiFactorAuthPresent": "true"}} in an Allow statement, '
-                                "or use BoolIfExists in a Deny statement."
+                                "**Dangerous MFA condition pattern detected.** "
+                                'Using `{"Bool": {"aws:MultiFactorAuthPresent": "false"}}` does not enforce MFA '
+                                "because `aws:MultiFactorAuthPresent` may not exist in the request context. "
+                                'Consider using `{"Bool": {"aws:MultiFactorAuthPresent": "true"}}` in an Allow statement, '
+                                "or use `BoolIfExists` in a Deny statement."
                             ),
                             statement_sid=statement_sid,
                             statement_index=statement_idx,
@@ -97,10 +97,10 @@ class MFAConditionCheck(PolicyCheck):
                         ValidationIssue(
                             severity=self.get_severity(config),
                             message=(
-                                "Dangerous MFA condition pattern detected. "
-                                'Using {"Null": {"aws:MultiFactorAuthPresent": "false"}} only checks if the key exists, '
+                                "**Dangerous MFA condition pattern detected.** "
+                                'Using `{"Null": {"aws:MultiFactorAuthPresent": "false"}}` only checks if the key exists, '
                                 "not whether MFA was actually used. This does not enforce MFA. "
-                                'Consider using {"Bool": {"aws:MultiFactorAuthPresent": "true"}} in an Allow statement instead.'
+                                'Consider using `{"Bool": {"aws:MultiFactorAuthPresent": "true"}}` in an Allow statement instead.'
                             ),
                             statement_sid=statement_sid,
                             statement_index=statement_idx,