pycfmodel 1.1.2__tar.gz → 1.1.3__tar.gz

{pycfmodel-1.1.2 → pycfmodel-1.1.3}/PKG-INFO

@@ -1,9 +1,13 @@
 Metadata-Version: 2.4
 Name: pycfmodel
-Version: 1.1.2
+Version: 1.1.3
 Summary: A python model for Cloud Formation scripts
 Author-email: Skyscanner Security <security@skyscanner.net>
 Project-URL: Homepage, https://github.com/Skyscanner/pycfmodel
+Project-URL: Repository, https://github.com/Skyscanner/pycfmodel
+Project-URL: Bug Tracker, https://github.com/Skyscanner/pycfmodel/issues
+Project-URL: Documentation, https://pycfmodel.readthedocs.io
+Project-URL: Changelog, https://github.com/Skyscanner/pycfmodel/releases
 Requires-Python: >=3.9.0
 Description-Content-Type: text/markdown
 License-File: LICENSE.md

pycfmodel-1.1.3/pycfmodel/model/base.py

@@ -0,0 +1,18 @@
+from pydantic import BaseModel, ConfigDict, model_validator
+
+from pycfmodel.utils import is_resolvable_dict
+
+
+class CustomModel(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+
+class FunctionDict(BaseModel):
+    model_config = ConfigDict(extra="allow")
+
+    @model_validator(mode="before")
+    @classmethod
+    def check_if_valid_function(cls, values):
+        if not is_resolvable_dict(values):
+            raise ValueError("FunctionDict should only have 1 key and be a function")
+        return values

pycfmodel-1.1.3/pycfmodel/model/cf_model.py

@@ -0,0 +1,141 @@
+from datetime import date
+from typing import Any, ClassVar, Collection, Dict, List, Optional, Type, Union
+
+from pydantic import Field
+from typing_extensions import Annotated
+
+from pycfmodel.action_expander import expand_actions
+from pycfmodel.constants import AWS_NOVALUE
+from pycfmodel.model.base import CustomModel
+from pycfmodel.model.parameter import Parameter
+from pycfmodel.model.resources.generic_resource import GenericResource
+from pycfmodel.model.resources.resource import Resource
+from pycfmodel.model.resources.types import ResourceModels
+from pycfmodel.model.types import Resolvable
+from pycfmodel.resolver import _extended_bool, resolve
+
+AllResourcesType = Annotated[Union[ResourceModels, GenericResource], Field(union_mode="left_to_right")]
+
+
+class CFModel(CustomModel):
+    """
+    Template that describes AWS infrastructure.
+
+    Properties:
+
+    - AWSTemplateFormatVersion
+    - Conditions: Conditions that control behaviour of the template.
+    - Description: Description for the template.
+    - Mappings: A 3 level mapping of keys and associated values.
+    - Metadata: Additional information about the template.
+    - Outputs: Output values of the template.
+    - Parameters: Parameters to the template.
+    - Resources: Stack resources and their properties.
+    - Rules
+    - Transform: For serverless applications, specifies the version of the AWS Serverless Application Model (AWS SAM) to use.
+
+    More info at [AWS Docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-anatomy.html)
+    """
+
+    AWSTemplateFormatVersion: Optional[date] = None
+    Conditions: Optional[Dict] = {}
+    Description: Optional[str] = None
+    Mappings: Optional[Dict[str, Dict[str, Dict[str, Any]]]] = {}
+    Metadata: Optional[Dict[str, Any]] = None
+    Outputs: Optional[Dict[str, Dict[str, Union[str, Dict]]]] = {}
+    Parameters: Optional[Dict[str, Parameter]] = {}
+    Resources: Dict[str, Resolvable[AllResourcesType]] = {}
+    Rules: Optional[Dict] = {}
+    Transform: Optional[Union[str, List[str]]] = None
+
+    PSEUDO_PARAMETERS: ClassVar[Dict[str, Union[str, List[str]]]] = {
+        # default pseudo parameters
+        "AWS::AccountId": "123456789012",
+        "AWS::NotificationARNs": [],
+        "AWS::NoValue": AWS_NOVALUE,
+        "AWS::Partition": "aws",
+        "AWS::Region": "eu-west-1",
+        "AWS::StackId": "",
+        "AWS::StackName": "",
+        "AWS::URLSuffix": "amazonaws.com",
+    }
+
+    def resolve(self, extra_params=None) -> "CFModel":
+        """
+        Resolve all intrinsic functions on the template.
+
+        Arguments:
+            extra_params: Values of parameters passed to the Cloudformation.
+
+        Returns:
+            A new CFModel.
+        """
+        extra_params = {} if extra_params is None else extra_params
+        # default parameters
+        params = {}
+        for key, parameter in self.Parameters.items():
+            passed_value = extra_params.pop(key, None)
+            ref_value = parameter.get_ref_value(passed_value)
+            if ref_value is not None:
+                params[key] = ref_value
+
+        extended_parameters = {**self.PSEUDO_PARAMETERS, **params, **extra_params}
+        dict_value = self.model_dump()
+
+        conditions = dict_value.pop("Conditions", {})
+        resolved_conditions = {}
+        for key, value in conditions.items():
+            resolved_conditions.update(
+                {key: _extended_bool(resolve(value, extended_parameters, self.Mappings, resolved_conditions))}
+            )
+
+        resources = dict_value.pop("Resources")
+        resolved_resources = {
+            key: resolve(value, extended_parameters, self.Mappings, resolved_conditions)
+            for key, value in resources.items()
+            if value.get("Condition") is None
+            or (value.get("Condition") is not None and resolved_conditions.get(value["Condition"], True))
+        }
+        return CFModel(**dict_value, Conditions=resolved_conditions, Resources=resolved_resources)
+
+    def expand_actions(self) -> "CFModel":
+        """
+        Returns a model which has expanded all wildcards (`*`) to get all implied actions for every resource.
+        For example:\n
+          - a model containing `s3:*` will be expanded to list all the possible S3 actions.
+          - a model containing `s3:Get*` will be expanded to all the `Get*` actions only.
+
+        This method can handle the cases of both `Action` and `NotAction`.
+
+        [Known AWS Actions](https://github.com/Skyscanner/pycfmodel/blob/master/pycfmodel/cloudformation_actions.py).
+        These known actions can be updated by executing:
+
+        ```
+        python3 scripts/generate_cloudformation_actions_file.py
+        ```
+        """
+        dict_value = self.model_dump()
+
+        resources = dict_value.pop("Resources")
+        expanded_resources = {key: expand_actions(value) for key, value in resources.items()}
+
+        return CFModel(**dict_value, Resources=expanded_resources)
+
+    def resources_filtered_by_type(
+        self, allowed_types: Collection[Union[str, Type[Resource]]]
+    ) -> Dict[str, Dict[str, Resource]]:
+        """
+        Filtered resources based on types.
+
+        Arguments:
+            allowed_types: Collection of desired types.
+
+        Returns:
+            Dictionary where key is the logical id and value is the resource.
+        """
+        result = {}
+        allowed_resource_classes = tuple(x for x in allowed_types if isinstance(x, type))
+        for resource_name, resource in self.Resources.items():
+            if isinstance(resource, allowed_resource_classes) or resource.Type in allowed_types:
+                result[resource_name] = resource
+        return result

pycfmodel-1.1.3/pycfmodel/model/generic.py

@@ -0,0 +1,92 @@
+import json
+from contextlib import suppress
+from typing import Union
+
+from pydantic import BaseModel, ConfigDict, Field, ValidationError, field_validator, model_validator
+from typing_extensions import Annotated
+
+from pycfmodel.model.base import FunctionDict
+from pycfmodel.model.resources.properties.types import Properties
+from pycfmodel.model.types import (
+    InstanceOrListOf,
+    Resolvable,
+    ResolvableArnOrList,
+    ResolvableBoolOrList,
+    ResolvableDateOrList,
+    ResolvableDatetimeOrList,
+    ResolvableIntOrList,
+    ResolvableIPOrList,
+    ResolvableStrOrList,
+)
+
+AuxType = Annotated[
+    Union[
+        FunctionDict,
+        Properties,
+        ResolvableBoolOrList,
+        ResolvableIntOrList,
+        ResolvableDateOrList,
+        ResolvableDatetimeOrList,  # Date can be parsed as Datetime in pydantic v2 so should be ordered accordingly
+        ResolvableIPOrList,
+        ResolvableArnOrList,
+        ResolvableStrOrList,
+    ],
+    Field(union_mode="left_to_right"),
+]
+
+
+class _Auxiliar(BaseModel):
+    aux: AuxType
+
+    @field_validator("aux", mode="before")
+    @classmethod
+    def validate_string_property_formatted_as_json(cls, value):
+        """
+        We have detected some properties that are defined as String in CloudFormation but including a
+        PolicyDocument in them, such as:
+        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-resourcepolicy.html#cfn-logs-resourcepolicy-policydocument
+        For that, we try to parse them to a JSON to be evaluated then to a known property.
+        If we fail to parse it, it means the property is a String without a JSON in it, we return the property as it is.
+        """
+        if isinstance(value, str):
+            try:
+                return json.loads(value)
+            except Exception:
+                return value
+        return value
+
+    @classmethod
+    def cast(cls, value):
+        with suppress(ValidationError):
+            value = _Auxiliar(aux=value).aux
+
+        if isinstance(value, list):
+            auxiliar_list = []
+            for v in value:
+                v = _Auxiliar.cast(v)
+                if isinstance(v, dict):
+                    v = Generic.model_validate(v)
+                auxiliar_list.append(v)
+            value = auxiliar_list
+
+        if isinstance(value, dict):
+            value = Generic.model_validate(value)
+
+        return value
+
+
+class Generic(BaseModel):
+    """Any property under this class will be cast to an existing model of `pycfmodel` if possible."""
+
+    model_config = ConfigDict(extra="allow")
+
+    @model_validator(mode="before")
+    @classmethod
+    def casting(cls, values):
+        if isinstance(values, dict):
+            return {k: _Auxiliar.cast(v) for k, v in values.items()}
+        raise ValueError(f"Not supported type: {type(values)}")
+
+
+ResolvableGeneric = Resolvable[Generic]
+ResolvableGenericOrList = InstanceOrListOf[ResolvableGeneric]

pycfmodel-1.1.3/pycfmodel/model/parameter.py

@@ -0,0 +1,54 @@
+from typing import Any, ClassVar, List, Optional
+
+from pydantic import PositiveInt
+
+from pycfmodel.model.base import CustomModel
+
+
+class Parameter(CustomModel):
+    """
+    CloudFormation Parameter object representation
+    """
+
+    NO_ECHO_NO_DEFAULT: ClassVar[str] = "NO_ECHO_NO_DEFAULT"
+    NO_ECHO_WITH_DEFAULT: ClassVar[str] = "NO_ECHO_WITH_DEFAULT"
+    NO_ECHO_WITH_VALUE: ClassVar[str] = "NO_ECHO_WITH_VALUE"
+    AllowedPattern: Optional[str] = None
+    AllowedValues: Optional[List] = None
+    ConstraintDescription: Optional[str] = None
+    Default: Optional[Any] = None
+    Description: Optional[str] = None
+    MaxLength: Optional[PositiveInt] = None
+    MaxValue: Optional[PositiveInt] = None
+    MinLength: Optional[int] = None
+    MinValue: Optional[int] = None
+    NoEcho: Optional[bool] = None
+    Type: str
+
+    def get_ref_value(self, provided_value=None) -> Optional[str]:
+        """
+        Calculates the parameter value to be used in the template.
+
+        - If `NoEcho` property is set, it uses a constant value.
+        - If it is a list of numbers or a comma delimited list, returns the string version of each element in a list.
+        - Returns None if `provided_value` and `Default` are `None`.
+
+        Arguments:
+            provided_value: Value injected in the template
+
+        Returns:
+            The computed value.
+        """
+        value = provided_value if provided_value is not None else self.Default
+        if self.NoEcho:
+            if provided_value is not None:
+                return self.NO_ECHO_WITH_VALUE
+            elif self.Default:
+                return self.NO_ECHO_WITH_DEFAULT
+            else:
+                return self.NO_ECHO_NO_DEFAULT
+
+        elif self.Type in ["List<Number>", "CommaDelimitedList"]:
+            return value.split(",")
+
+        return value if value is None else str(value)

pycfmodel-1.1.3/pycfmodel/model/resources/ec2_vpc_endpoint_policy.py

@@ -0,0 +1,53 @@
+from typing import List, Literal, Optional
+
+from pycfmodel.model.base import CustomModel
+from pycfmodel.model.resources.properties.policy_document import PolicyDocument as resource_policy_document
+from pycfmodel.model.resources.resource import Resource
+from pycfmodel.model.types import Resolvable, ResolvableBool, ResolvableStr
+from pycfmodel.model.utils import OptionallyNamedPolicyDocument
+
+
+class EC2VpcEndpointPolicyProperties(CustomModel):
+    """
+    Properties:
+
+    - PolicyDocument: A [policy document][pycfmodel.model.resources.properties.policy_document.PolicyDocument] object.
+    - PrivateDnsEnabled: Indicate whether to associate a private hosted zone with the specified VPC.
+    - RouteTableIds: One or more route table IDs.
+    - SecurityGroupIds: The ID of one or more security groups to associate with the endpoint network interface.
+    - ServiceName: The service name.
+    - SubnetIds: The ID of one or more subnets in which to create an endpoint network interface.
+    - VpcEndpointType: The type of endpoint.
+    - VpcId: The ID of the VPC in which the endpoint will be used.
+
+    More info at [AWS Docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpcendpoint.html)
+    """
+
+    PolicyDocument: Optional[Resolvable[resource_policy_document]] = None
+    PrivateDnsEnabled: Optional[ResolvableBool] = None
+    RouteTableIds: Optional[Resolvable[List[ResolvableStr]]] = None
+    SecurityGroupIds: Optional[Resolvable[List[ResolvableStr]]] = None
+    ServiceName: ResolvableStr
+    SubnetIds: Optional[Resolvable[List[ResolvableStr]]] = None
+    VpcEndpointType: Optional[ResolvableStr] = None
+    VpcId: ResolvableStr
+
+
+class EC2VpcEndpointPolicy(Resource):
+    """
+    Properties:
+
+    - Properties: An [EC2 VPC Policy Endpoint Properties][pycfmodel.model.resources.ec2_vpc_endpoint_policy.EC2VpcEndpointPolicyProperties]
+    object.
+
+    More info at [AWS Docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpcendpoint.html)
+    """
+
+    Type: Literal["AWS::EC2::VPCEndpoint"]
+    Properties: Resolvable[EC2VpcEndpointPolicyProperties]
+
+    @property
+    def policy_documents(self) -> List[OptionallyNamedPolicyDocument]:
+        if not self.Properties.PolicyDocument:
+            return []
+        return [OptionallyNamedPolicyDocument(name=None, policy_document=self.Properties.PolicyDocument)]

pycfmodel-1.1.3/pycfmodel/model/resources/es_domain.py

@@ -0,0 +1,61 @@
+from typing import List, Literal, Optional
+
+from pycfmodel.model.base import CustomModel
+from pycfmodel.model.generic import ResolvableGeneric
+from pycfmodel.model.resources.properties.policy_document import PolicyDocument
+from pycfmodel.model.resources.properties.tag import Tag
+from pycfmodel.model.resources.resource import Resource
+from pycfmodel.model.types import Resolvable, ResolvableStr
+
+
+class ESDomainProperties(CustomModel):
+    """
+    Properties:
+
+    - AccessPolicies: A [policy document][pycfmodel.model.resources.properties.policy_document.PolicyDocument] object.
+    - AdvancedOptions: Additional options to specify for the OpenSearch Service domain.
+    - AdvancedSecurityOptions: Specifies options for fine-grained access control.
+    - CognitoOptions: Configures OpenSearch Service to use Amazon Cognito authentication for OpenSearch Dashboards.
+    - DomainEndpointOptions: Specifies additional options for the domain endpoint, such as whether to require HTTPS for all traffic or whether to use a custom endpoint rather than the default endpoint.
+    - DomainName: A name for the OpenSearch Service domain.
+    - EBSOptions: The configurations of Amazon Elastic Block Store (Amazon EBS) volumes that are attached to data nodes in the OpenSearch Service domain.
+    - ElasticsearchClusterConfig: ElasticsearchClusterConfig is a property of the AWS::Elasticsearch::Domain resource that configures the cluster of an Amazon OpenSearch Service domain.
+    - ElasticsearchVersion: The version of Elasticsearch to use, such as 2.3. If not specified, 1.5 is used as the default.
+    - EncryptionAtRestOptions: Whether the domain should encrypt data at rest, and if so, the AWS Key Management Service key to use.
+    - LogPublishingOptions: An object with one or more of the following keys: SEARCH_SLOW_LOGS, ES_APPLICATION_LOGS, INDEX_SLOW_LOGS, AUDIT_LOGS, depending on the types of logs you want to publish. Each key needs a valid LogPublishingOption value.
+    - NodeToNodeEncryptionOptions: Specifies whether node-to-node encryption is enabled.
+    - SnapshotOptions: DEPRECATED. The automated snapshot configuration for the OpenSearch Service domain indices.
+    - Tags: An arbitrary set of tags (key–value pairs) to associate with the OpenSearch Service domain.
+    - VPCOptions: The virtual private cloud (VPC) configuration for the OpenSearch Service domain.
+
+    More info at [AWS Docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticsearch-domain.html)
+    """
+
+    AccessPolicies: Optional[Resolvable[PolicyDocument]] = None
+    AdvancedOptions: Optional[ResolvableGeneric] = None
+    AdvancedSecurityOptions: Optional[ResolvableGeneric] = None
+    CognitoOptions: Optional[ResolvableGeneric] = None
+    DomainEndpointOptions: Optional[ResolvableGeneric] = None
+    DomainName: Optional[ResolvableStr] = None
+    EBSOptions: Optional[ResolvableGeneric] = None
+    ElasticsearchClusterConfig: Optional[ResolvableGeneric] = None
+    ElasticsearchVersion: Optional[ResolvableStr] = None
+    EncryptionAtRestOptions: Optional[ResolvableGeneric] = None
+    LogPublishingOptions: Optional[ResolvableGeneric] = None
+    NodeToNodeEncryptionOptions: Optional[ResolvableGeneric] = None
+    SnapshotOptions: Optional[ResolvableGeneric] = None
+    Tags: Optional[Resolvable[List[Tag]]] = None
+    VPCOptions: Optional[ResolvableGeneric] = None
+
+
+class ESDomain(Resource):
+    """
+    Properties:
+
+    - Properties: An [ESDomainProperties][pycfmodel.model.resources.es_domain.ESDomainProperties] object.
+
+    More info at [AWS Docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticsearch-domain.html)
+    """
+
+    Type: Literal["AWS::Elasticsearch::Domain"]
+    Properties: Resolvable[ESDomainProperties]

pycfmodel-1.1.3/pycfmodel/model/resources/generic_resource.py

@@ -0,0 +1,39 @@
+import logging
+from typing import ClassVar, Optional
+
+from pydantic import ConfigDict, field_validator
+
+from pycfmodel.model.generic import Generic
+from pycfmodel.model.resources.resource import Resource
+
+logger = logging.getLogger(__name__)
+
+
+class GenericResource(Resource):
+    """
+    This class is used for all resource types that don't have a dedicated class.
+    Setting _strict to False will allow creation of GenericResources that have an explicit model class,
+    this is very useful to work around incomplete model definitions or things that are not implemented yet
+    like AWS:NoValue. _strict defaults to True. In that case you can't instantiate GenericResources when
+    there's a model for that type of resource.
+    """
+
+    Type: Optional[str] = None  # Optional to handle cases like "AWS::CloudFormation::Authentication"
+    Properties: Optional[Generic] = None
+
+    model_config = ConfigDict(extra="allow")
+    _strict: ClassVar[bool] = True
+
+    @field_validator("Type", mode="before")
+    @classmethod
+    def check_type(cls, value, values, **kwargs):
+        from pycfmodel.model.resources.types import ResourceModels
+
+        existing_resource_types = {
+            klass.model_fields["Type"].annotation.__args__[0] for klass in ResourceModels.__args__[0].__args__
+        }
+        if value in existing_resource_types and cls._strict:
+            raise ValueError(f"Instantiation of GenericResource from {value} in {values} not allowed")
+        else:
+            logger.warning(f"Instantiation of GenericResource from {value} in {values}")
+        return value

pycfmodel-1.1.3/pycfmodel/model/resources/iam_group.py

@@ -0,0 +1,46 @@
+from typing import List, Literal, Optional
+
+from pycfmodel.model.base import CustomModel
+from pycfmodel.model.resources.properties.policy import Policy
+from pycfmodel.model.resources.resource import Resource
+from pycfmodel.model.types import Resolvable, ResolvableStr
+from pycfmodel.model.utils import OptionallyNamedPolicyDocument
+
+
+class IAMGroupProperties(CustomModel):
+    """
+    Properties:
+
+    - GroupName: Name of the group.
+    - ManagedPolicyArns: ARN of the IAM policies to attach.
+    - Path: Path to the group. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html).
+    - Policies: Inline policies embedded in the IAM group.
+
+    More info at [AWS Docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-group.html)
+    """
+
+    GroupName: Optional[ResolvableStr] = None
+    ManagedPolicyArns: Optional[Resolvable[List[ResolvableStr]]] = None
+    Path: Optional[ResolvableStr] = None
+    Policies: Optional[Resolvable[List[Resolvable[Policy]]]] = None
+
+
+class IAMGroup(Resource):
+    """
+    Properties:
+
+    - Properties: A [IAM Group properties][pycfmodel.model.resources.iam_group.IAMGroupProperties] object.
+
+    More info at [AWS Docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-group.html)
+    """
+
+    Type: Literal["AWS::IAM::Group"]
+    Properties: Optional[Resolvable[IAMGroupProperties]] = None
+
+    @property
+    def policy_documents(self) -> List[OptionallyNamedPolicyDocument]:
+        result = []
+        policies = self.Properties.Policies if self.Properties and self.Properties.Policies else []
+        for policy in policies:
+            result.append(OptionallyNamedPolicyDocument(name=policy.PolicyName, policy_document=policy.PolicyDocument))
+        return result

pycfmodel-1.1.3/pycfmodel/model/resources/iam_managed_policy.py

@@ -0,0 +1,52 @@
+from typing import List, Literal, Optional
+
+from pycfmodel.model.base import CustomModel
+from pycfmodel.model.resources.properties.policy_document import PolicyDocument
+from pycfmodel.model.resources.resource import Resource
+from pycfmodel.model.types import Resolvable, ResolvableStr
+from pycfmodel.model.utils import OptionallyNamedPolicyDocument
+
+
+class IAMManagedPolicyProperties(CustomModel):
+    """
+    Properties:
+
+    - Description: Description of the policy.
+    - Groups: Friendly name of the IAM groups to attach the policy to.
+    - ManagedPolicyName: Name of the policy.
+    - Path: Path to the policy.
+    - PolicyDocument: A [policy document][pycfmodel.model.resources.properties.policy_document.PolicyDocument] object.
+    - Roles: Friendly name of the IAM roles to attach the policy to.
+    - Users: Friendly name of the IAM users to attach the policy to.
+
+    More info at [AWS Docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html)
+    """
+
+    Description: Optional[ResolvableStr] = None
+    Groups: Optional[Resolvable[List[ResolvableStr]]] = None
+    ManagedPolicyName: Optional[ResolvableStr] = None
+    Path: Optional[ResolvableStr] = None
+    PolicyDocument: Resolvable[PolicyDocument]
+    Roles: Optional[Resolvable[List[ResolvableStr]]] = None
+    Users: Optional[Resolvable[List[ResolvableStr]]] = None
+
+
+class IAMManagedPolicy(Resource):
+    """
+    Properties:
+
+    - Properties: A [IAM Managed Policy properties][pycfmodel.model.resources.iam_managed_policy.IAMManagedPolicyProperties] object.
+
+    More info at [AWS Docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html)
+    """
+
+    Type: Literal["AWS::IAM::ManagedPolicy"]
+    Properties: Resolvable[IAMManagedPolicyProperties]
+
+    @property
+    def policy_documents(self) -> List[OptionallyNamedPolicyDocument]:
+        return [
+            OptionallyNamedPolicyDocument(
+                name=self.Properties.ManagedPolicyName, policy_document=self.Properties.PolicyDocument
+            )
+        ]

pycfmodel-1.1.3/pycfmodel/model/resources/iam_policy.py

@@ -0,0 +1,48 @@
+from typing import List, Literal, Optional
+
+from pycfmodel.model.base import CustomModel
+from pycfmodel.model.resources.properties.policy_document import PolicyDocument
+from pycfmodel.model.resources.resource import Resource
+from pycfmodel.model.types import Resolvable, ResolvableStr, ResolvableStrOrList
+from pycfmodel.model.utils import OptionallyNamedPolicyDocument
+
+
+class IAMPolicyProperties(CustomModel):
+    """
+    Properties:
+
+    - Groups: Friendly name of the IAM groups to attach the policy to.
+    - PolicyDocument: A [policy document][pycfmodel.model.resources.properties.policy_document.PolicyDocument] object.
+    - PolicyName: Name of the policy.
+    - Roles: Friendly name of the IAM roles to attach the policy to.
+    - Users: Friendly name of the IAM users to attach the policy to.
+
+    More info at [AWS Docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html)
+    """
+
+    Groups: Optional[ResolvableStrOrList] = None
+    PolicyDocument: Resolvable[PolicyDocument]
+    PolicyName: ResolvableStr
+    Roles: Optional[ResolvableStrOrList] = None
+    Users: Optional[ResolvableStrOrList] = None
+
+
+class IAMPolicy(Resource):
+    """
+    Properties:
+
+    - Properties: A [IAM Policy properties][pycfmodel.model.resources.iam_policy.IAMPolicyProperties] object.
+
+    More info at [AWS Docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html)
+    """
+
+    Type: Literal["AWS::IAM::Policy"]
+    Properties: Resolvable[IAMPolicyProperties]
+
+    @property
+    def policy_documents(self) -> List[OptionallyNamedPolicyDocument]:
+        return [
+            OptionallyNamedPolicyDocument(
+                name=self.Properties.PolicyName, policy_document=self.Properties.PolicyDocument
+            )
+        ]