iam-policy-validator 1.7.2__py3-none-any.whl → 1.9.0__py3-none-any.whl

iam_validator/checks/policy_type_validation.py

@@ -11,6 +11,7 @@ This check runs automatically based on:
 2. Auto-detection: If any statement has a Principal, provides helpful guidance
 """
 
+from iam_validator.core.constants import RCP_SUPPORTED_SERVICES
 from iam_validator.core.models import IAMPolicy, ValidationIssue
 
 
@@ -30,6 +31,10 @@ async def execute_policy(
     """
     issues = []
 
+    # Handle policies with no statements
+    if not policy.statement:
+        return issues
+
     # Check if any statement has Principal
     has_any_principal = any(
         stmt.principal is not None or stmt.not_principal is not None for stmt in policy.statement
@@ -37,24 +42,36 @@ async def execute_policy(
 
     # If policy has Principal but type is IDENTITY_POLICY (default), provide helpful info
     if has_any_principal and policy_type == "IDENTITY_POLICY":
+        # Check if it's a trust policy
+        from iam_validator.checks.policy_structure import is_trust_policy
+
+        if is_trust_policy(policy):
+            hint_msg = (
+                "Policy contains assume role actions - this is a TRUST POLICY. "
+                "Use `--policy-type TRUST_POLICY` for proper validation (suppresses missing Resource warnings, "
+                "enables trust-specific validation)"
+            )
+            suggestion_msg = "iam-validator validate --path <file> --policy-type TRUST_POLICY"
+        else:
+            hint_msg = "Policy contains Principal element - this suggests it's a RESOURCE POLICY. Use `--policy-type RESOURCE_POLICY`"
+            suggestion_msg = "iam-validator validate --path <file> --policy-type RESOURCE_POLICY"
+
         issues.append(
             ValidationIssue(
                 severity="info",
                 issue_type="policy_type_hint",
-                message="Policy contains Principal element - this suggests it's a resource policy. "
-                "Use --policy-type RESOURCE_POLICY for proper validation.",
+                message=hint_msg,
                 statement_index=0,
                 statement_sid=None,
                 line_number=None,
-                suggestion="If this is a resource policy (S3 bucket policy, SNS topic policy, etc.), "
-                "run validation with: iam-validator validate --path <file> --policy-type RESOURCE_POLICY",
+                suggestion=suggestion_msg,
             )
         )
         # Don't run further checks if we're just hinting
         return issues
 
-    # Resource policies MUST have Principal
-    if policy_type == "RESOURCE_POLICY":
+    # Resource policies and Trust policies MUST have Principal
+    if policy_type in ("RESOURCE_POLICY", "TRUST_POLICY"):
         for idx, statement in enumerate(policy.statement):
             has_principal = statement.principal is not None or statement.not_principal is not None
 
@@ -63,13 +80,13 @@ async def execute_policy(
                     ValidationIssue(
                         severity="error",
                         issue_type="missing_principal",
-                        message="Resource policy statement missing required Principal element. "
+                        message="Resource policy statement missing required `Principal` element. "
                         "Resource-based policies (S3 bucket policies, SNS topic policies, etc.) "
-                        "must include a Principal element to specify who can access the resource.",
+                        "must include a `Principal` element to specify who can access the resource.",
                         statement_index=idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
-                        suggestion="Add a Principal element to specify who can access this resource.\n"
+                        suggestion="Add a `Principal` element to specify who can access this resource.\n"
                         "Example:\n"
                         "```json\n"
                         "{\n"
@@ -94,14 +111,14 @@ async def execute_policy(
                     ValidationIssue(
                         severity="warning",
                         issue_type="unexpected_principal",
-                        message="Identity policy should not contain Principal element. "
+                        message="Identity policy should not contain `Principal` element. "
                         "Identity-based policies (attached to IAM users, groups, or roles) "
-                        "do not need a Principal element because the principal is implicit "
+                        "do not need a `Principal` element because the principal is implicit "
                         "(the entity the policy is attached to).",
                         statement_index=idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
-                        suggestion="Remove the Principal element from this identity policy statement.\n"
+                        suggestion="Remove the `Principal` element from this identity policy statement.\n"
                         "Example:\n"
                         "```json\n"
                         "{\n"
@@ -123,13 +140,13 @@ async def execute_policy(
                     ValidationIssue(
                         severity="error",
                         issue_type="invalid_principal",
-                        message="Service Control Policy must not contain Principal element. "
+                        message="Service Control Policy must not contain `Principal` element. "
                         "Service Control Policies (SCPs) in AWS Organizations do not support "
-                        "the Principal element. They apply to all principals in the organization or OU.",
+                        "the `Principal` element. They apply to all principals in the organization or OU.",
                         statement_index=idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
-                        suggestion="Remove the Principal element from this SCP statement.\n"
+                        suggestion="Remove the `Principal` element from this SCP statement.\n"
                         "Example:\n"
                         "```json\n"
                         "{\n"
@@ -148,8 +165,8 @@ async def execute_policy(
 
     # Resource Control Policies (RCPs) have very strict requirements
     elif policy_type == "RESOURCE_CONTROL_POLICY":
-        # RCP supported services (as of 2025)
-        rcp_supported_services = {"s3", "sts", "sqs", "secretsmanager", "kms"}
+        # Use the centralized list of RCP supported services from constants
+        rcp_supported_services = RCP_SUPPORTED_SERVICES
 
         for idx, statement in enumerate(policy.statement):
             # 1. Effect MUST be Deny (only RCPFullAWSAccess can use Allow)
@@ -158,13 +175,13 @@ async def execute_policy(
                     ValidationIssue(
                         severity="error",
                         issue_type="invalid_rcp_effect",
-                        message="Resource Control Policy statement must have Effect: Deny. "
-                        "For RCPs that you create, the Effect value must be 'Deny'. "
-                        "Only the AWS-managed RCPFullAWSAccess policy can use 'Allow'.",
+                        message="Resource Control Policy statement must have `Effect: Deny`. "
+                        "For RCPs that you create, the `Effect` value must be `Deny`. "
+                        "Only the AWS-managed `RCPFullAWSAccess` policy can use `Allow`.",
                         statement_index=idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
-                        suggestion='Change the Effect to "Deny" for this RCP statement.',
+                        suggestion="Change the `Effect` to `Deny` for this RCP statement.",
                     )
                 )
 
@@ -177,14 +194,13 @@ async def execute_policy(
                     ValidationIssue(
                         severity="error",
                         issue_type="invalid_rcp_not_principal",
-                        message="Resource Control Policy must not contain NotPrincipal element. "
-                        "RCPs only support Principal with value '*'. Use Condition elements "
+                        message="Resource Control Policy must not contain `NotPrincipal` element. "
+                        "RCPs only support `Principal` with value `*`. Use `Condition` elements "
                         "to restrict specific principals.",
                         statement_index=idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
-                        suggestion="Remove NotPrincipal and use Principal: '*' with Condition "
-                        "elements to restrict access.",
+                        suggestion='Remove `NotPrincipal` and use `Principal: "*"` with `Condition` elements to restrict access.',
                     )
                 )
             elif not has_principal:
@@ -192,13 +208,13 @@ async def execute_policy(
                     ValidationIssue(
                         severity="error",
                         issue_type="missing_rcp_principal",
-                        message="Resource Control Policy statement must have Principal: '*'. "
-                        "RCPs require the Principal element with value '*'. Use Condition "
+                        message='Resource Control Policy statement must have `Principal: "*"`. '
+                        'RCPs require the `Principal` element with value `"*"`. Use `Condition` '
                         "elements to restrict specific principals.",
                         statement_index=idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
-                        suggestion='Add Principal: "*" to this RCP statement.',
+                        suggestion='Add `Principal: "*"` to this RCP statement.',
                     )
                 )
             elif statement.principal != "*":
@@ -209,13 +225,13 @@ async def execute_policy(
                         ValidationIssue(
                             severity="error",
                             issue_type="invalid_rcp_principal",
-                            message="Resource Control Policy Principal must be '*'. "
-                            f"Found: {statement.principal}. RCPs can only specify '*' in the "
-                            "Principal element. Use Condition elements to restrict specific principals.",
+                            message=f'Resource Control Policy `Principal` must be `"*"`. '
+                            f'Found: `{statement.principal}`. RCPs can only specify `"*"` in the '
+                            "`Principal` element. Use `Condition` elements to restrict specific principals.",
                             statement_index=idx,
                             statement_sid=statement.sid,
                             line_number=statement.line_number,
-                            suggestion='Change Principal to "*" and use Condition elements to restrict access.',
+                            suggestion='Change `Principal` to `"*"` and use `Condition` elements to restrict access.',
                         )
                     )
 
@@ -234,14 +250,14 @@ async def execute_policy(
                                 ValidationIssue(
                                     severity="error",
                                     issue_type="invalid_rcp_wildcard_action",
-                                    message="Resource Control Policy must not use '*' alone in Action element. "
-                                    "Customer-managed RCPs cannot use '*' as the action wildcard. "
-                                    "Use service-specific wildcards like 's3:*' instead.",
+                                    message="Resource Control Policy must not use `*` alone in `Action` element. "
+                                    "Customer-managed RCPs cannot use `*` as the action wildcard. "
+                                    "Use service-specific wildcards like `s3:*` instead.",
                                     statement_index=idx,
                                     statement_sid=statement.sid,
                                     line_number=statement.line_number,
-                                    suggestion="Replace '*' with service-specific actions from supported "
-                                    f"services: {', '.join(sorted(rcp_supported_services))}",
+                                    suggestion="Replace `*` with service-specific actions from supported "
+                                    f"services: {', '.join(f'`{a}`' for a in sorted(rcp_supported_services))}",
                                 )
                             )
                         else:
@@ -259,13 +275,13 @@ async def execute_policy(
                             severity="error",
                             issue_type="unsupported_rcp_service",
                             message=f"Resource Control Policy contains actions from unsupported services: "
-                            f"{', '.join(unsupported_actions)}. RCPs only support these services: "
-                            f"{', '.join(sorted(rcp_supported_services))}",
+                            f"{', '.join(f'`{a}`' for a in unsupported_actions)}. RCPs only support these services: "
+                            f"{', '.join(f'`{a}`' for a in sorted(rcp_supported_services))}",
                             statement_index=idx,
                             statement_sid=statement.sid,
                             line_number=statement.line_number,
                             suggestion=f"Use only actions from supported RCP services: "
-                            f"{', '.join(sorted(rcp_supported_services))}",
+                            f"{', '.join(f'`{a}`' for a in sorted(rcp_supported_services))}",
                         )
                     )
 
@@ -275,13 +291,12 @@ async def execute_policy(
                     ValidationIssue(
                         severity="error",
                         issue_type="invalid_rcp_not_action",
-                        message="Resource Control Policy must not contain NotAction element. "
-                        "RCPs do not support NotAction. Use Action element instead.",
+                        message="Resource Control Policy must not contain `NotAction` element. "
+                        "RCPs do not support `NotAction`. Use `Action` element instead.",
                         statement_index=idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
-                        suggestion="Replace NotAction with Action element listing the specific "
-                        "actions to deny.",
+                        suggestion="Replace `NotAction` with `Action` element listing the specific actions to deny.",
                     )
                 )
 
@@ -294,11 +309,11 @@ async def execute_policy(
                     ValidationIssue(
                         severity="error",
                         issue_type="missing_rcp_resource",
-                        message="Resource Control Policy statement must have Resource or NotResource element.",
+                        message="Resource Control Policy statement must have `Resource` or `NotResource` element.",
                         statement_index=idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
-                        suggestion='Add Resource: "*" or specify specific resource ARNs.',
+                        suggestion='Add `Resource: "*"` or specify specific resource ARNs.',
                     )
                 )
 

iam_validator/checks/principal_validation.py

@@ -4,60 +4,53 @@ Validates Principal elements in resource-based policies for security best practi
 This check enforces:
 - Blocked principals (e.g., public access via "*")
 - Allowed principals whitelist (optional)
-- Required conditions for specific principals (simple format)
-- Rich condition requirements for principals (advanced format with all_of/any_of)
+- Rich condition requirements for principals (supports any_of/all_of/none_of)
 - Service principal validation
 
-Only runs for RESOURCE_POLICY type policies.
-
-Configuration supports TWO formats:
-
-1. Simple format (backward compatible):
-   require_conditions_for:
-     "*": ["aws:SourceArn", "aws:SourceAccount"]
-     "arn:aws:iam::*:root": ["aws:PrincipalOrgID"]
-
-2. Advanced format with rich condition requirements:
-   principal_condition_requirements:
-     - principals:
-         - "*"
-       severity: critical
-       required_conditions:
-         all_of:
-           - condition_key: "aws:SourceArn"
-             description: "Limit by source ARN"
-           - condition_key: "aws:SourceAccount"
-
-     - principals:
-         - "arn:aws:iam::*:root"
-       required_conditions:
-         - condition_key: "aws:PrincipalOrgID"
-           expected_value: "o-xxxxx"
-           operator: "StringEquals"
+Only runs for RESOURCE_POLICY and TRUST_POLICY types.
+
+Configuration format:
+
+principal_condition_requirements:
+  - principals:
+      - "*"  # Can be a list of principal patterns
+    severity: critical  # Optional: override default severity
+    required_conditions:
+      any_of:  # At least ONE of these conditions must be present
+        - condition_key: "aws:SourceArn"
+          description: "Limit by source ARN"
+        - condition_key: "aws:SourceAccount"
+          expected_value: "123456789012"  # Optional: validate specific value
+          operator: "StringEquals"  # Optional: validate specific operator
+
+  - principals:
+      - "arn:aws:iam::*:root"
+    required_conditions:
+      all_of:  # ALL of these conditions must be present
+        - condition_key: "aws:PrincipalOrgID"
+          expected_value: "o-xxxxx"
+        - condition_key: "aws:SourceAccount"
+
+Supports: any_of, all_of, none_of, and expected_value (single value or list)
 """
 
 import fnmatch
-from typing import Any
+from typing import Any, ClassVar
 
-from iam_validator.core.aws_fetcher import AWSServiceFetcher
+from iam_validator.core.aws_service import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
+from iam_validator.core.config.service_principals import is_aws_service_principal
 from iam_validator.core.models import Statement, ValidationIssue
 
 
 class PrincipalValidationCheck(PolicyCheck):
     """Validates Principal elements in resource policies."""
 
-    @property
-    def check_id(self) -> str:
-        return "principal_validation"
-
-    @property
-    def description(self) -> str:
-        return "Validates Principal elements in resource policies for security best practices"
-
-    @property
-    def default_severity(self) -> str:
-        return "high"
+    check_id: ClassVar[str] = "principal_validation"
+    description: ClassVar[str] = (
+        "Validates Principal elements in resource policies for security best practices"
+    )
+    default_severity: ClassVar[str] = "high"
 
     async def execute(
         self,
@@ -83,22 +76,13 @@ class PrincipalValidationCheck(PolicyCheck):
         if statement.principal is None and statement.not_principal is None:
             return issues
 
-        # Get configuration
+        # Get configuration (defaults match defaults.py)
         blocked_principals = config.config.get("blocked_principals", ["*"])
         allowed_principals = config.config.get("allowed_principals", [])
-        require_conditions_for = config.config.get("require_conditions_for", {})
         principal_condition_requirements = config.config.get("principal_condition_requirements", [])
-        allowed_service_principals = config.config.get(
-            "allowed_service_principals",
-            [
-                "cloudfront.amazonaws.com",
-                "s3.amazonaws.com",
-                "sns.amazonaws.com",
-                "lambda.amazonaws.com",
-                "logs.amazonaws.com",
-                "events.amazonaws.com",
-            ],
-        )
+        # Default: "aws:*" allows ALL AWS service principals (*.amazonaws.com)
+        # This matches the default in defaults.py:251
+        allowed_service_principals = config.config.get("allowed_service_principals", ["aws:*"])
 
         # Extract principals from statement
         principals = self._extract_principals(statement)
@@ -117,8 +101,8 @@ class PrincipalValidationCheck(PolicyCheck):
                         statement_index=statement_idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
-                        suggestion=f"Remove the principal `{principal}` or add appropriate conditions to restrict access. "
-                        "Consider using more specific principals instead of wildcards.",
+                        suggestion=f"Remove the `Principal` `{principal}` or add appropriate `Condition`s to restrict access. "
+                        "Consider using more specific `Principal`s instead of `*` (wildcard).",
                     )
                 )
                 continue
@@ -131,42 +115,18 @@ class PrincipalValidationCheck(PolicyCheck):
                     ValidationIssue(
                         severity=self.get_severity(config),
                         issue_type="unauthorized_principal",
-                        message=f"Principal not in allowed list: `{principal}`. "
-                        f"Only principals in the `allowed_principals` whitelist are permitted.",
+                        message=f"`Principal` not in allowed list: `{principal}`. "
+                        f"Only principals in the `allowed_principals` allow-list are permitted.",
                         statement_index=statement_idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
-                        suggestion=f"Add '{principal}' to the allowed_principals list in your config, "
-                        "or use a principal that matches an allowed pattern.",
+                        suggestion=f"Add `{principal}` to the `allowed_principals` list in your config, "
+                        "or use a `Principal` that matches an allowed pattern.",
                     )
                 )
                 continue
 
-            # Check simple format: require_conditions_for (backward compatible)
-            required_conditions = self._get_required_conditions(principal, require_conditions_for)
-            if required_conditions:
-                missing_conditions = self._check_required_conditions(statement, required_conditions)
-                if missing_conditions:
-                    issues.append(
-                        ValidationIssue(
-                            severity=self.get_severity(config),
-                            issue_type="missing_principal_conditions",
-                            message=f"Principal `{principal}` requires conditions: {', '.join(f'`{c}`' for c in missing_conditions)}. "
-                            f"This principal must have these condition keys to restrict access.",
-                            statement_index=statement_idx,
-                            statement_sid=statement.sid,
-                            line_number=statement.line_number,
-                            suggestion=f"Add conditions to restrict access:\n"
-                            f"Example:\n"
-                            f'"Condition": {{\n'
-                            f'  "StringEquals": {{\n'
-                            f'    "{missing_conditions[0]}": "value"\n'
-                            f"  }}\n"
-                            f"}}",
-                        )
-                    )
-
-        # Check advanced format: principal_condition_requirements
+        # Check principal_condition_requirements (supports any_of/all_of/none_of)
         if principal_condition_requirements:
             condition_issues = self._validate_principal_condition_requirements(
                 statement,
@@ -197,7 +157,7 @@ class PrincipalValidationCheck(PolicyCheck):
                 principals.append(statement.principal)
             elif isinstance(statement.principal, dict):
                 # Dict with AWS, Service, Federated, etc.
-                for key, value in statement.principal.items():
+                for _, value in statement.principal.items():
                     if isinstance(value, str):
                         principals.append(value)
                     elif isinstance(value, list):
@@ -208,7 +168,7 @@ class PrincipalValidationCheck(PolicyCheck):
             if isinstance(statement.not_principal, str):
                 principals.append(statement.not_principal)
             elif isinstance(statement.not_principal, dict):
-                for key, value in statement.not_principal.items():
+                for _, value in statement.not_principal.items():
                     if isinstance(value, str):
                         principals.append(value)
                     elif isinstance(value, list):
@@ -224,13 +184,17 @@ class PrincipalValidationCheck(PolicyCheck):
         Args:
             principal: The principal to check
             blocked_list: List of blocked principal patterns
-            service_whitelist: List of allowed service principals
+            service_whitelist: List of allowed service principals (supports "aws:*" for all AWS services)
 
         Returns:
             True if the principal is blocked
         """
-        # Service principals are never blocked
-        if principal in service_whitelist:
+        # Check if service_whitelist contains "aws:*" (allow all AWS service principals)
+        if "aws:*" in service_whitelist and is_aws_service_principal(principal):
+            return False
+
+        # Service principals in explicit whitelist are never blocked
+        if is_aws_service_principal(principal) and principal in service_whitelist:
             return False
 
         # Check against blocked list (supports wildcards)
@@ -253,13 +217,17 @@ class PrincipalValidationCheck(PolicyCheck):
         Args:
             principal: The principal to check
             allowed_list: List of allowed principal patterns
-            service_whitelist: List of allowed service principals
+            service_whitelist: List of allowed service principals (supports "aws:*" for all AWS services)
 
         Returns:
             True if the principal is allowed
         """
-        # Service principals are always allowed
-        if principal in service_whitelist:
+        # Check if service_whitelist contains "aws:*" (allow all AWS service principals)
+        if "aws:*" in service_whitelist and is_aws_service_principal(principal):
+            return True
+
+        # Service principals in explicit whitelist are always allowed
+        if is_aws_service_principal(principal) and principal in service_whitelist:
             return True
 
         # Check against allowed list (supports wildcards)
@@ -274,52 +242,6 @@ class PrincipalValidationCheck(PolicyCheck):
 
         return False
 
-    def _get_required_conditions(
-        self, principal: str, requirements: dict[str, list[str]]
-    ) -> list[str]:
-        """Get required condition keys for a principal.
-
-        Args:
-            principal: The principal to check
-            requirements: Dict mapping principal patterns to required condition keys
-
-        Returns:
-            List of required condition keys
-        """
-        for pattern, condition_keys in requirements.items():
-            # Special case: "*" pattern should only match literal "*" (public access)
-            if pattern == "*":
-                if principal == "*":
-                    return condition_keys
-            elif fnmatch.fnmatch(principal, pattern):
-                return condition_keys
-        return []
-
-    def _check_required_conditions(
-        self, statement: Statement, required_keys: list[str]
-    ) -> list[str]:
-        """Check if statement has required condition keys.
-
-        Args:
-            statement: The statement to check
-            required_keys: List of required condition keys
-
-        Returns:
-            List of missing condition keys
-        """
-        if not statement.condition:
-            return required_keys
-
-        # Flatten all condition keys from all condition operators
-        present_keys = set()
-        for operator_conditions in statement.condition.values():
-            if isinstance(operator_conditions, dict):
-                present_keys.update(operator_conditions.keys())
-
-        # Find missing keys
-        missing = [key for key in required_keys if key not in present_keys]
-        return missing
-
     def _validate_principal_condition_requirements(
         self,
         statement: Statement,
@@ -480,8 +402,8 @@ class PrincipalValidationCheck(PolicyCheck):
                             statement_index=statement_idx,
                             issue_type="missing_principal_condition_any_of",
                             message=(
-                                f"Principals {matching_principals} require at least ONE of these conditions: "
-                                f"{', '.join(condition_keys)}"
+                                f"`Principal`s `{', '.join(f'`{p}`' for p in matching_principals)}` require at least ONE of these conditions: "
+                                f"{', '.join(f'`{c}`' for c in condition_keys)}"
                             ),
                             suggestion=self._build_any_of_suggestion(any_of),
                             line_number=statement.line_number,
@@ -642,7 +564,7 @@ class PrincipalValidationCheck(PolicyCheck):
             statement_sid=statement.sid,
             statement_index=statement_idx,
             issue_type="missing_principal_condition",
-            message=f"{message_prefix} Principal(s) {matching_principals} require condition '{condition_key}'",
+            message=f"{message_prefix} Principal(s) {', '.join(f'`{p}`' for p in matching_principals)} require condition `{condition_key}`",
             suggestion=suggestion_text,
             example=example_code,
             line_number=statement.line_number,
@@ -668,7 +590,7 @@ class PrincipalValidationCheck(PolicyCheck):
         Returns:
             Tuple of (suggestion_text, example_code)
         """
-        suggestion = description if description else f"Add condition: {condition_key}"
+        suggestion = description if description else f"Add condition: `{condition_key}`"
 
         # Build example based on condition key type
         if example:
@@ -723,11 +645,11 @@ class PrincipalValidationCheck(PolicyCheck):
             description = cond.get("description", "")
             expected_value = cond.get("expected_value")
 
-            option = f"\nOption {i}: {condition_key}"
+            option = f"\n- **Option {i}**: `{condition_key}`"
             if description:
                 option += f" - {description}"
             if expected_value is not None:
-                option += f" (value: {expected_value})"
+                option += f" (value: `{expected_value}`)"
 
             suggestions.append(option)
 
@@ -759,11 +681,12 @@ class PrincipalValidationCheck(PolicyCheck):
         description = condition_requirement.get("description", "")
         expected_value = condition_requirement.get("expected_value")
 
-        message = f"FORBIDDEN: Principal(s) {matching_principals} must NOT have condition '{condition_key}'"
+        matching_principals_str = ", ".join(f"`{p}`" for p in matching_principals)
+        message = f"FORBIDDEN: `Principal`s `{matching_principals_str}` must NOT have `Condition` `{condition_key}`"
         if expected_value is not None:
-            message += f" with value '{expected_value}'"
+            message += f" with value `{expected_value}`"
 
-        suggestion = f"Remove the '{condition_key}' condition from the statement"
+        suggestion = f"Remove the `{condition_key}` `Condition` from the statement"
         if description:
             suggestion += f". {description}"