Support 'NotPrincipal', 'NotAction' and 'NotResource' in IAM policy #11

New issue

Closed

opened 2023-10-27 07:36:25 +00:00 by dkirillov · 2 comments

dkirillov commented

2023-10-27 07:36:25 +00:00

Member

Consider supporting parsing NotPrincipal, NotAction and NotResource from iam grammar https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_grammar.html

Consider supporting parsing `NotPrincipal`, `NotAction` and `NotResource` from iam grammar https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_grammar.html

dkirillov referenced this issue

2023-10-27 07:36:58 +00:00

[#4] Add IAM policy unmarshaler #5

fyrchik commented

2023-10-27 07:50:57 +00:00

Owner

I think we could have fields for actions and resources (currently they are matched like StringLike, can be inverted.
Also if there are multiple actions to match, does NotAction matches not any of these or not all of these?
For principal -- if it is a part of a condition, we can invert the operators during translation, right?

I think we could have fields for actions and resources (currently they are matched like `StringLike`, can be inverted. Also if there are multiple actions to match, does `NotAction` matches `not any of these` or `not all of these`? For principal -- if it is a part of a condition, we can invert the operators during translation, right?

dkirillov self-assigned this 2023-10-30 06:36:28 +00:00

dkirillov commented

2023-10-30 07:20:53 +00:00

Author

Member

Also if there are multiple actions to match, does NotAction matches not any of these or not all of these?

If there are multiple actions in a policy (under the NotAction section), this means that the policy only applies to requests that attempt to perform any other action not mentioned in the policy.

Or did you mean multiple actions in request (but it seems request can have only one action )?

> Also if there are multiple actions to match, does `NotAction` matches `not any of these` or `not all of these`? If there are multiple actions in a policy (under the `NotAction` section), this means that the policy only applies to requests that attempt to perform any other action not mentioned in the policy. Or did you mean multiple actions in request (but it seems request can have only [one action](https://git.frostfs.info/TrueCloudLab/policy-engine/src/commit/31a308ea61fb9b478773c988548f352ccf453913/resource.go#L8) )?

dkirillov referenced this issue from a pull request that will close it,

2023-10-30 13:36:08 +00:00

feature/11-support_notprincipal #12

dkirillov referenced this issue from a commit

2023-11-02 11:24:06 +00:00

[#11] Support inverted action and resource

dkirillov referenced this issue from a commit

2023-11-02 11:24:06 +00:00

[#11] iam: Support 'NotPrincipal', 'NotAction', 'NotResource'

dkirillov referenced this issue from a commit

2023-11-02 11:56:12 +00:00

[#11] iam: Support 'NotPrincipal', 'NotAction', 'NotResource'