iam-policy-validator 1.7.1__tar.gz → 1.7.2__tar.gz

{iam_policy_validator-1.7.1 → iam_policy_validator-1.7.2}/.github/workflows/pre-release.yml

@@ -44,7 +44,7 @@ jobs:
     environment: prerelease # Requires approval from environment reviewers
     permissions:
       contents: write # Required for creating releases and tags
-      pull-requests: read # Required for reading PR info
+      pull-requests: write # Required for reading PR info and commenting
       id-token: write # Required for PyPI trusted publishing (test.pypi.org)
 
     steps:
@@ -173,10 +173,14 @@ jobs:
 
           cat PRERELEASE_NOTES.md
 
+      - name: Get current commit SHA
+        id: commit
+        run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+
       - name: Create GitHub Pre-Release
         uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2
         with:
-          name: "${{ steps.version.outputs.tag }} (Pre-release)"
+          name: "${{ steps.version.outputs.tag }}"
           tag_name: ${{ steps.version.outputs.tag }}
           body_path: PRERELEASE_NOTES.md
           files: |
@@ -185,7 +189,8 @@ jobs:
           draft: false
           prerelease: true
           generate_release_notes: false
-          target_commitish: ${{ steps.pr_info.outputs.branch }}
+          target_commitish: ${{ steps.commit.outputs.sha }}
+          make_latest: false
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

{iam_policy_validator-1.7.1 → iam_policy_validator-1.7.2}/Makefile

@@ -1,4 +1,4 @@
-.PHONY: help install dev clean test lint format type-check build publish publish-test version sync-defaults
+.PHONY: help install dev clean test lint format ruff type-check build publish publish-test version sync-defaults
 
 # Default target
 help:
@@ -14,6 +14,7 @@ help:
 	@echo "  make test             Run tests"
 	@echo "  make lint             Run linting checks"
 	@echo "  make format           Format code with ruff"
+	@echo "  make ruff             Format code with ruff (alias for format)"
 	@echo "  make type-check       Run mypy type checking"
 	@echo "  make check            Run all checks (lint + type + test)"
 	@echo ""
@@ -73,6 +74,8 @@ format:
 	@uv run ruff format iam_validator/
 	@uv run ruff check --fix iam_validator/
 
+ruff: format
+
 type-check:
 	uv run mypy iam_validator/
 

{iam_policy_validator-1.7.1 → iam_policy_validator-1.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.7.1
+Version: 1.7.2
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://github.com/boogy/iam-policy-validator/tree/main/docs
@@ -426,4 +426,3 @@ MIT License - see [LICENSE](LICENSE) file for details.
 ## 🆘 Support
 
 - **Issues**: [GitHub Issues](https://github.com/boogy/iam-policy-validator/issues)
-- **Discussions**: [GitHub Discussions](https://github.com/boogy/iam-policy-validator/discussions)

{iam_policy_validator-1.7.1 → iam_policy_validator-1.7.2}/README.md

@@ -384,4 +384,3 @@ MIT License - see [LICENSE](LICENSE) file for details.
 ## 🆘 Support
 
 - **Issues**: [GitHub Issues](https://github.com/boogy/iam-policy-validator/issues)
-- **Discussions**: [GitHub Discussions](https://github.com/boogy/iam-policy-validator/discussions)

{iam_policy_validator-1.7.1 → iam_policy_validator-1.7.2}/action.yaml

@@ -153,6 +153,17 @@ runs:
       run: uv sync --frozen
       shell: bash
 
+    - name: Display version information
+      working-directory: ${{ github.action_path }}
+      run: |
+        # Get version from package
+        VERSION=$(uv run python -c "from iam_validator.__version__ import __version__; print(__version__)")
+
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "🛡️ IAM Policy Validator ${VERSION}"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      shell: bash
+
     - name: Get current week for cache key
       id: week
       run: echo "week=$(date +%Y-W%V)" >> $GITHUB_OUTPUT

{iam_policy_validator-1.7.1 → iam_policy_validator-1.7.2}/docs/condition-requirements.md

@@ -97,16 +97,24 @@ description = IAM_PASS_ROLE_REQUIREMENT['required_conditions'][0]['description']
 ```python
 {
     "actions": ["iam:PassRole"],
-    "severity": "high",
+    "severity": "high",  # Optional: Override check-level severity
     "required_conditions": [{
         "condition_key": "iam:PassedToService",
-        "description": "Why needed",
-        "expected_value": "lambda.amazonaws.com",  # Optional
-        "operator": "StringEquals",  # Optional
+        "description": "Restrict which services can assume the role",  # User-facing explanation
+        "example": '{\n  "Condition": {\n    "StringEquals": {\n      "iam:PassedToService": "lambda.amazonaws.com"\n    }\n  }\n}',  # Optional: Shows in GitHub with ```json formatting
+        "expected_value": "lambda.amazonaws.com",  # Optional: Specific value to check
+        "operator": "StringEquals",  # Optional: Condition operator (default: StringEquals)
     }]
 }
 ```
 
+**Field Reference:**
+- `condition_key` (required) - The IAM condition key to enforce
+- `description` (optional) - Explanation shown to users (plain text suggestion)
+- `example` (optional) - Code example (formatted as ` ```json ` block in GitHub PR comments)
+- `expected_value` (optional) - Specific value the condition should have
+- `operator` (optional) - Condition operator type (default: "StringEquals")
+
 **Advanced Conditions:**
 ```python
 {

{iam_policy_validator-1.7.1 → iam_policy_validator-1.7.2}/docs/configuration.md

@@ -135,12 +135,14 @@ Tailor validation messages to your organization's guidelines. Each check support
 
 When configuring checks, you can customize these fields:
 
-| Field         | Purpose                                      | When Shown                     | Audience                        |
-| ------------- | -------------------------------------------- | ------------------------------ | ------------------------------- |
-| `description` | Technical description of what the check does | Documentation, check listings  | Developers maintaining the tool |
-| `message`     | Error/warning message when issue is detected | Validation reports, CLI output | End users fixing policies       |
-| `suggestion`  | Guidance on how to fix or mitigate the issue | Validation reports             | Developers implementing fixes   |
-| `example`     | Concrete code example showing before/after   | Validation reports             | Developers writing policy code  |
+| Field         | Purpose                                      | When Shown                     | Audience                        | GitHub Formatting |
+| ------------- | -------------------------------------------- | ------------------------------ | ------------------------------- | ----------------- |
+| `description` | Technical description of what the check does | Documentation, check listings  | Developers maintaining the tool | Plain text        |
+| `message`     | Error/warning message when issue is detected | Validation reports, CLI output | End users fixing policies       | Plain text        |
+| `suggestion`  | Guidance on how to fix or mitigate the issue | Validation reports, GitHub PRs | Developers implementing fixes   | Plain text        |
+| `example`     | Concrete code example showing before/after   | Validation reports, GitHub PRs | Developers writing policy code  | ` ```json ` block |
+
+**GitHub PR Comments:** The `example` field is automatically wrapped in ` ```json ` code blocks when posted to GitHub PR review comments, providing syntax highlighting and proper formatting. Console and enhanced output display examples as plain text.
 
 ### Field Progression
 
@@ -193,8 +195,7 @@ full_wildcard:
 
 ### Output Example
 
-When a validation issue is found, the fields appear in reports like this:
-
+**Console/Enhanced Output:**
 ```
 ❌ full_wildcard (CRITICAL)
 
@@ -208,15 +209,17 @@ Replace:
   "Resource": "*"
 
 With specific values:
-  "Action": [
-    "s3:GetObject",
-    "s3:PutObject"
-  ],
-  "Resource": [
-    "arn:aws:s3:::my-bucket/*"
-  ]
+  "Action": ["s3:GetObject", "s3:PutObject"],
+  "Resource": ["arn:aws:s3:::my-bucket/*"]
 ```
 
+**GitHub PR Comment:**
+The same issue in a GitHub PR review comment automatically formats the example with syntax highlighting:
+
+<img width="600" alt="GitHub PR comment with formatted JSON" src="https://github.com/user-attachments/assets/example.png">
+
+The `example` field is wrapped in ` ```json ` blocks for proper GitHub markdown rendering, while suggestion remains plain text.
+
 ### Template Placeholders
 
 Some checks support dynamic placeholders in messages that get replaced with actual values when issues are detected. This allows you to create flexible, context-aware validation messages.
@@ -420,16 +423,28 @@ wildcard_action:
 
 ### Field Availability by Check
 
-Not all checks support all fields. Most common fields:
+Not all checks support all customizable fields:
+
+**Universal Fields (all checks):**
+- ✅ `enabled` - Enable/disable the check
+- ✅ `severity` - Override severity level
+- ✅ `description` - Technical description (internal documentation)
+
+**Configurable Message Fields (security & wildcard checks):**
+- ✅ `message` - Custom error/warning text
+  - Supported by: `wildcard_action`, `wildcard_resource`, `full_wildcard`, `service_wildcard`, `sensitive_action`
+- ✅ `suggestion` - Custom guidance text (plain text)
+  - Supported by: `wildcard_action`, `wildcard_resource`, `full_wildcard`, `service_wildcard`, `sensitive_action`
+- ✅ `example` - Custom code example (formatted as ` ```json ` in GitHub)
+  - Supported by: `wildcard_action`, `wildcard_resource`, `full_wildcard`, `service_wildcard`, `sensitive_action`
+
+**Advanced Checks (per-requirement customization):**
+- `action_condition_enforcement` - Each requirement can have `description` and `example` (see [condition-requirements.md](condition-requirements.md))
+- `principal_validation` - Each principal requirement can have `description` and `example` in the `required_conditions` block
 
-- ✅ `description` - Supported by all checks
-- ✅ `severity` - Supported by all checks
-- ✅ `enabled` - Supported by all checks
-- ⚠️ `message` - Supported by most checks (wildcards, sensitive actions, etc.)
-- ⚠️ `suggestion` - Supported by security checks
-- ⚠️ `example` - Supported by security checks
+**Note:** Validation checks (e.g., `action_validation`, `condition_key_validation`, `resource_validation`) generate messages automatically based on AWS service definitions and do not support custom message fields.
 
-**Default Messages:** See [defaults.py](../iam_validator/core/config/defaults.py) for all built-in messages and fields
+**Default Messages:** See [defaults.py](../iam_validator/core/config/defaults.py) for all built-in messages and available fields per check
 
 ## Principal Validation
 

iam_policy_validator-1.7.2/examples/iam-test-policies/identity-policies/terraform-template-policy.json

@@ -0,0 +1,44 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "PassExecRoleToLambda",
+      "Effect": "Allow",
+      "Action": [
+        "iam:GetRole",
+        "iam:PassRole"
+      ],
+      "Resource": "arn:aws:iam::${aws_account_id}:role/lambda-exec-role"
+    },
+    {
+      "Sid": "ReadExecRole",
+      "Effect": "Allow",
+      "Action": "iam:GetRole",
+      "Resource": "arn:aws:iam::${aws_account_id}:role/${environment}-*"
+    },
+    {
+      "Sid": "DDKeysSecret",
+      "Effect": "Allow",
+      "Action": [
+        "secretsmanager:DescribeSecret",
+        "secretsmanager:GetResourcePolicy"
+      ],
+      "Resource": "arn:aws:secretsmanager:*:${aws_account_id}:secret:main/datadog/api-key/platform/plaintext-*"
+    },
+    {
+      "Sid": "S3BucketAccess",
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:PutObject"
+      ],
+      "Resource": "arn:aws:s3:::${bucket_name}/*"
+    },
+    {
+      "Sid": "CloudFormationTemplate",
+      "Effect": "Allow",
+      "Action": "iam:GetRole",
+      "Resource": "arn:aws:iam::${AWS::AccountId}:role/CloudFormationRole"
+    }
+  ]
+}

iam_policy_validator-1.7.2/examples/iam-test-policies/wrong_actions_mismatch/correct-condition-wrong-key.json

@@ -0,0 +1,16 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "ExampleWithWrongConditionKey",
+      "Effect": "Allow",
+      "Action": ["s3:PutObject"],
+      "Resource": "arn:aws:s3:::example-bucket/*",
+      "Condition": {
+        "StringEquals": {
+          "iam:PassedToService": "lambda.amazonaws.com"
+        }
+      }
+    }
+  ]
+}

{iam_policy_validator-1.7.1 → iam_policy_validator-1.7.2}/examples/iam-test-policies/wrong_actions_mismatch/dynamodb-wrong-resources.json

@@ -5,22 +5,19 @@
       "Sid": "GetItemWithIndexARN",
       "Effect": "Allow",
       "Action": "dynamodb:GetItem",
-      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable/index/*",
-      "Comment": "WRONG: dynamodb:GetItem requires table ARN, not index ARN"
+      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable/index/*"
     },
     {
       "Sid": "QueryWithStreamARN",
       "Effect": "Allow",
       "Action": "dynamodb:Query",
-      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable/stream/*",
-      "Comment": "WRONG: dynamodb:Query requires table ARN, not stream ARN"
+      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable/stream/*"
     },
     {
       "Sid": "DeleteTableWithBackupARN",
       "Effect": "Allow",
       "Action": "dynamodb:DeleteTable",
-      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable/backup/*",
-      "Comment": "WRONG: dynamodb:DeleteTable requires table ARN only"
+      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable/backup/*"
     }
   ]
 }

{iam_policy_validator-1.7.1 → iam_policy_validator-1.7.2}/examples/iam-test-policies/wrong_actions_mismatch/ec2-wrong-resources.json

@@ -5,29 +5,25 @@
       "Sid": "TerminateInstancesWithVolumeARN",
       "Effect": "Allow",
       "Action": "ec2:TerminateInstances",
-      "Resource": "arn:aws:ec2:us-east-1:123456789012:volume/*",
-      "Comment": "WRONG: ec2:TerminateInstances requires instance ARN, not volume ARN"
+      "Resource": "arn:aws:ec2:us-east-1:123456789012:volume/*"
     },
     {
       "Sid": "DeleteVolumeWithInstanceARN",
       "Effect": "Allow",
       "Action": "ec2:DeleteVolume",
-      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
-      "Comment": "WRONG: ec2:DeleteVolume requires volume ARN, not instance ARN"
+      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
     },
     {
       "Sid": "CreateSnapshotWithInstanceARN",
       "Effect": "Allow",
       "Action": "ec2:CreateSnapshot",
-      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
-      "Comment": "WRONG: ec2:CreateSnapshot requires volume ARN"
+      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
     },
     {
       "Sid": "AttachVolumeWithSnapshotARN",
       "Effect": "Allow",
       "Action": "ec2:AttachVolume",
-      "Resource": "arn:aws:ec2:us-east-1:123456789012:snapshot/*",
-      "Comment": "WRONG: ec2:AttachVolume requires volume and instance ARNs"
+      "Resource": "arn:aws:ec2:us-east-1:123456789012:snapshot/*"
     }
   ]
 }

iam_policy_validator-1.7.2/examples/iam-test-policies/wrong_actions_mismatch/iam-wrong-resources.json

@@ -0,0 +1,35 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "GetUserWithRoleARN",
+      "Effect": "Allow",
+      "Action": "iam:GetUser",
+      "Resource": "arn:aws:iam::123456789012:role/*"
+    },
+    {
+      "Sid": "GetRoleWithUserARN",
+      "Effect": "Allow",
+      "Action": "iam:GetRole",
+      "Resource": "arn:aws:iam::123456789012:user/*"
+    },
+    {
+      "Sid": "GetPolicyWithUserARN",
+      "Effect": "Allow",
+      "Action": "iam:GetPolicy",
+      "Resource": "arn:aws:iam::123456789012:user/TestUser"
+    },
+    {
+      "Sid": "CreateUserWithSpecificARN",
+      "Effect": "Allow",
+      "Action": "iam:CreateUser",
+      "Resource": "arn:aws:iam::123456789012:user/SpecificUser"
+    },
+    {
+      "Sid": "DeleteRoleWithGroupARN",
+      "Effect": "Allow",
+      "Action": "iam:DeleteRole",
+      "Resource": "arn:aws:iam::123456789012:group/*"
+    }
+  ]
+}

{iam_policy_validator-1.7.1 → iam_policy_validator-1.7.2}/examples/iam-test-policies/wrong_actions_mismatch/lambda-wrong-resources.json

@@ -5,22 +5,19 @@
       "Sid": "InvokeFunctionWithLayerARN",
       "Effect": "Allow",
       "Action": "lambda:InvokeFunction",
-      "Resource": "arn:aws:lambda:us-east-1:123456789012:layer:my-layer:*",
-      "Comment": "WRONG: lambda:InvokeFunction requires function ARN, not layer ARN"
+      "Resource": "arn:aws:lambda:us-east-1:123456789012:layer:my-layer:*"
     },
     {
       "Sid": "GetLayerVersionWithFunctionARN",
       "Effect": "Allow",
       "Action": "lambda:GetLayerVersion",
-      "Resource": "arn:aws:lambda:us-east-1:123456789012:function:my-function",
-      "Comment": "WRONG: lambda:GetLayerVersion requires layer version ARN"
+      "Resource": "arn:aws:lambda:us-east-1:123456789012:function:my-function"
     },
     {
       "Sid": "DeleteFunctionWithEventSourceARN",
       "Effect": "Allow",
       "Action": "lambda:DeleteFunction",
-      "Resource": "arn:aws:lambda:us-east-1:123456789012:event-source-mapping:*",
-      "Comment": "WRONG: lambda:DeleteFunction requires function ARN"
+      "Resource": "arn:aws:lambda:us-east-1:123456789012:event-source-mapping:*"
     }
   ]
 }

iam_policy_validator-1.7.2/examples/iam-test-policies/wrong_actions_mismatch/s3-wrong-resources.json

@@ -0,0 +1,35 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "GetObjectWithBucketARN",
+      "Effect": "Allow",
+      "Action": "s3:GetObject",
+      "Resource": "arn:aws:s3:::my-bucket"
+    },
+    {
+      "Sid": "ListBucketWithObjectARN",
+      "Effect": "Allow",
+      "Action": "s3:ListBucket",
+      "Resource": "arn:aws:s3:::my-bucket/*"
+    },
+    {
+      "Sid": "PutObjectWithBucketARN",
+      "Effect": "Allow",
+      "Action": "s3:PutObject",
+      "Resource": "arn:aws:s3:::my-bucket"
+    },
+    {
+      "Sid": "DeleteObjectWithBucketARN",
+      "Effect": "Allow",
+      "Action": "s3:DeleteObject",
+      "Resource": "arn:aws:s3:::my-bucket"
+    },
+    {
+      "Sid": "DeleteBucketWithObjectARN",
+      "Effect": "Allow",
+      "Action": "s3:DeleteBucket",
+      "Resource": "arn:aws:s3:::my-bucket/*"
+    }
+  ]
+}

iam_policy_validator-1.7.2/examples/iam-test-policies/wrong_actions_mismatch/sqs-sns-wrong-resources.json

@@ -0,0 +1,23 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "SendMessageToSNSTopic",
+      "Effect": "Allow",
+      "Action": "sqs:SendMessage",
+      "Resource": "arn:aws:sns:us-east-1:123456789012:MyTopic"
+    },
+    {
+      "Sid": "PublishToSQSQueue",
+      "Effect": "Allow",
+      "Action": "sns:Publish",
+      "Resource": "arn:aws:sqs:us-east-1:123456789012:MyQueue"
+    },
+    {
+      "Sid": "DeleteQueueWithTopicARN",
+      "Effect": "Allow",
+      "Action": "sqs:DeleteQueue",
+      "Resource": "arn:aws:sns:us-east-1:123456789012:*"
+    }
+  ]
+}

iam_policy_validator-1.7.2/examples/iam-test-policies/wrong_actions_mismatch/typo-condition-field.json

@@ -0,0 +1,16 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "ExampleWithTypo",
+      "Effect": "Allow",
+      "Action": ["s3:PutObject"],
+      "Resource": "arn:aws:s3:::example-bucket/*",
+      "Ciondition": {
+        "StringEquals": {
+          "iam:PassedToService": "lambda.amazonaws.com"
+        }
+      }
+    }
+  ]
+}

iam_policy_validator-1.7.2/iam_validator/__version__.py

@@ -0,0 +1,9 @@
+"""Version information for IAM Validator.
+
+This file is the single source of truth for the package version.
+"""
+
+__version__ = "1.7.2"
+# Parse version, handling pre-release suffixes like -rc, -alpha, -beta
+_version_base = __version__.split("-")[0]  # Remove pre-release suffix if present
+__version_info__ = tuple(int(part) for part in _version_base.split("."))

{iam_policy_validator-1.7.1 → iam_policy_validator-1.7.2}/iam_validator/checks/action_condition_enforcement.py

@@ -349,7 +349,10 @@ class ActionConditionEnforcementCheck(PolicyCheck):
         return issues
 
     async def _check_action_match(
-        self, statement_actions: list[str], requirement: dict[str, Any], fetcher: AWSServiceFetcher
+        self,
+        statement_actions: list[str],
+        requirement: dict[str, Any],
+        fetcher: AWSServiceFetcher,
     ) -> tuple[bool, list[str]]:
         """
         Check if statement actions match the requirement.
@@ -766,6 +769,10 @@ class ActionConditionEnforcementCheck(PolicyCheck):
             or self.get_severity(config)  # Global check severity
         )
 
+        suggestion_text, example_code = self._build_suggestion(
+            condition_key, description, example, expected_value, operator
+        )
+
         return ValidationIssue(
             severity=severity,
             statement_sid=statement.sid,
@@ -774,9 +781,8 @@ class ActionConditionEnforcementCheck(PolicyCheck):
             message=f"{message_prefix} Action(s) {matching_actions} require condition '{condition_key}'",
             action=", ".join(matching_actions),
             condition_key=condition_key,
-            suggestion=self._build_suggestion(
-                condition_key, description, example, expected_value, operator
-            ),
+            suggestion=suggestion_text,
+            example=example_code,
             line_number=statement.line_number,
         )
 
@@ -787,19 +793,20 @@ class ActionConditionEnforcementCheck(PolicyCheck):
         example: str,
         expected_value: Any = None,
         operator: str = "StringEquals",
-    ) -> str:
-        """Build a helpful suggestion for adding the missing condition."""
-        parts = []
+    ) -> tuple[str, str]:
+        """Build suggestion and example for adding the missing condition.
 
-        if description:
-            parts.append(description)
+        Returns:
+            Tuple of (suggestion_text, example_code)
+        """
+        suggestion = description if description else f"Add condition: {condition_key}"
 
         # Build example based on condition key type
         if example:
-            parts.append(f"Example:\n```json\n{example}\n```")
+            example_code = example
         else:
             # Auto-generate example
-            example_lines = ['Add to "Condition" block:', f'  "{operator}": {{']
+            example_lines = [f'  "{operator}": {{']
 
             if isinstance(expected_value, list):
                 value_str = (
@@ -826,9 +833,9 @@ class ActionConditionEnforcementCheck(PolicyCheck):
             example_lines.append(f'    "{condition_key}": {value_str}')
             example_lines.append("  }")
 
-            parts.append("\n".join(example_lines))
+            example_code = "\n".join(example_lines)
 
-        return ". ".join(parts) if parts else f"Add condition: {condition_key}"
+        return suggestion, example_code
 
     def _build_any_of_suggestion(self, any_of_conditions: list[dict[str, Any]]) -> str:
         """Build suggestion for any_of conditions."""