forked from TrueCloudLab/policy-engine
[#4] Add IAM policy unmarshaler
This commit is contained in:
parent
5ebb2e694c
commit
88cf807951
5 changed files with 847 additions and 30 deletions
227
iam/converter.go
Normal file
227
iam/converter.go
Normal file
|
|
@ -0,0 +1,227 @@
|
||||||
|
package iam
|
||||||
|
|
||||||
|
import (
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"strconv"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
policyengine "git.frostfs.info/TrueCloudLab/policy-engine"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
FrostFSPrincipal = "FrostFS"
|
||||||
|
|
||||||
|
RequestOwnerProperty = "Owner"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
// String condition operators.
|
||||||
|
CondStringEquals string = "StringEquals"
|
||||||
|
CondStringNotEquals string = "StringNotEquals"
|
||||||
|
CondStringEqualsIgnoreCase string = "StringEqualsIgnoreCase"
|
||||||
|
CondStringNotEqualsIgnoreCase string = "StringNotEqualsIgnoreCase"
|
||||||
|
CondStringLike string = "StringLike"
|
||||||
|
CondStringNotLike string = "StringNotLike"
|
||||||
|
|
||||||
|
// Numeric condition operators.
|
||||||
|
CondNumericEquals string = "NumericEquals"
|
||||||
|
CondNumericNotEquals string = "NumericNotEquals"
|
||||||
|
CondNumericLessThan string = "NumericLessThan"
|
||||||
|
CondNumericLessThanEquals string = "NumericLessThanEquals"
|
||||||
|
CondNumericGreaterThan string = "NumericGreaterThan"
|
||||||
|
CondNumericGreaterThanEquals string = "NumericGreaterThanEquals"
|
||||||
|
|
||||||
|
// Date condition operators.
|
||||||
|
CondDateEquals string = "DateEquals"
|
||||||
|
CondDateNotEquals string = "DateNotEquals"
|
||||||
|
CondDateLessThan string = "DateLessThan"
|
||||||
|
CondDateLessThanEquals string = "DateLessThanEquals"
|
||||||
|
CondDateGreaterThan string = "DateGreaterThan"
|
||||||
|
CondDateGreaterThanEquals string = "DateGreaterThanEquals"
|
||||||
|
|
||||||
|
// Bolean condition operators.
|
||||||
|
CondBool string = "Bool"
|
||||||
|
|
||||||
|
// IP address condition operators.
|
||||||
|
CondIPAddress string = "IpAddress"
|
||||||
|
CondNotIPAddress string = "NotIpAddress"
|
||||||
|
|
||||||
|
// ARN condition operators.
|
||||||
|
CondArnEquals string = "ArnEquals"
|
||||||
|
CondArnLike string = "ArnLike"
|
||||||
|
CondArnNotEquals string = "ArnNotEquals"
|
||||||
|
CondArnNotLike string = "ArnNotLike"
|
||||||
|
)
|
||||||
|
|
||||||
|
func (p Policy) ToChain() (*policyengine.Chain, error) {
|
||||||
|
var chain policyengine.Chain
|
||||||
|
|
||||||
|
for _, statement := range p.Statement {
|
||||||
|
status := policyengine.AccessDenied
|
||||||
|
if statement.Effect == AllowEffect {
|
||||||
|
status = policyengine.Allow
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(statement.Principal) != 1 {
|
||||||
|
return nil, errors.New("currently supported exactly one principal type")
|
||||||
|
}
|
||||||
|
|
||||||
|
var principals []string
|
||||||
|
var op policyengine.ConditionType
|
||||||
|
if _, ok := statement.Principal[Wildcard]; ok {
|
||||||
|
principals = []string{Wildcard}
|
||||||
|
op = policyengine.CondStringLike
|
||||||
|
} else if frostfsPrincipals, ok := statement.Principal[FrostFSPrincipal]; ok {
|
||||||
|
principals = frostfsPrincipals
|
||||||
|
op = policyengine.CondStringEquals
|
||||||
|
} else {
|
||||||
|
return nil, errors.New("currently supported only FrostFS or all (wildcard) principals")
|
||||||
|
}
|
||||||
|
|
||||||
|
var conditions []policyengine.Condition
|
||||||
|
for _, principal := range principals {
|
||||||
|
conditions = append(conditions, policyengine.Condition{
|
||||||
|
Op: op,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: RequestOwnerProperty,
|
||||||
|
Value: principal,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
conds, err := statement.Conditions.ToChainCondition()
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
conditions = append(conditions, conds...)
|
||||||
|
|
||||||
|
r := policyengine.Rule{
|
||||||
|
Status: status,
|
||||||
|
Action: statement.Action,
|
||||||
|
Resource: statement.Resource,
|
||||||
|
Any: true,
|
||||||
|
Condition: conditions,
|
||||||
|
}
|
||||||
|
chain.Rules = append(chain.Rules, r)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &chain, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c Conditions) ToChainCondition() ([]policyengine.Condition, error) {
|
||||||
|
var conditions []policyengine.Condition
|
||||||
|
|
||||||
|
var convertValue convertFunction
|
||||||
|
|
||||||
|
for op, KVs := range c {
|
||||||
|
var condType policyengine.ConditionType
|
||||||
|
|
||||||
|
switch {
|
||||||
|
case strings.HasPrefix(op, "String"):
|
||||||
|
convertValue = noConvertFunction
|
||||||
|
switch op {
|
||||||
|
case CondStringEquals:
|
||||||
|
condType = policyengine.CondStringEquals
|
||||||
|
case CondStringNotEquals:
|
||||||
|
condType = policyengine.CondStringNotEquals
|
||||||
|
case CondStringEqualsIgnoreCase:
|
||||||
|
condType = policyengine.CondStringEqualsIgnoreCase
|
||||||
|
case CondStringNotEqualsIgnoreCase:
|
||||||
|
condType = policyengine.CondStringNotEqualsIgnoreCase
|
||||||
|
case CondStringLike:
|
||||||
|
condType = policyengine.CondStringLike
|
||||||
|
case CondStringNotLike:
|
||||||
|
condType = policyengine.CondStringNotLike
|
||||||
|
default:
|
||||||
|
return nil, fmt.Errorf("unsupported condition operator: '%s'", op)
|
||||||
|
}
|
||||||
|
case strings.HasPrefix(op, "Arn"):
|
||||||
|
convertValue = noConvertFunction
|
||||||
|
switch op {
|
||||||
|
case CondArnEquals:
|
||||||
|
condType = policyengine.CondStringEquals
|
||||||
|
case CondArnNotEquals:
|
||||||
|
condType = policyengine.CondStringNotEquals
|
||||||
|
case CondArnLike:
|
||||||
|
condType = policyengine.CondStringLike
|
||||||
|
case CondArnNotLike:
|
||||||
|
condType = policyengine.CondStringNotLike
|
||||||
|
default:
|
||||||
|
return nil, fmt.Errorf("unsupported condition operator: '%s'", op)
|
||||||
|
}
|
||||||
|
case strings.HasPrefix(op, "Numeric"):
|
||||||
|
// TODO
|
||||||
|
case strings.HasPrefix(op, "Date"):
|
||||||
|
convertValue = dateConvertFunction
|
||||||
|
switch op {
|
||||||
|
case CondDateEquals:
|
||||||
|
condType = policyengine.CondStringEquals
|
||||||
|
case CondDateNotEquals:
|
||||||
|
condType = policyengine.CondStringNotEquals
|
||||||
|
case CondDateLessThan:
|
||||||
|
condType = policyengine.CondStringLessThan
|
||||||
|
case CondDateLessThanEquals:
|
||||||
|
condType = policyengine.CondStringLessThanEquals
|
||||||
|
case CondDateGreaterThan:
|
||||||
|
condType = policyengine.CondStringGreaterThan
|
||||||
|
case CondDateGreaterThanEquals:
|
||||||
|
condType = policyengine.CondStringGreaterThanEquals
|
||||||
|
default:
|
||||||
|
return nil, fmt.Errorf("unsupported condition operator: '%s'", op)
|
||||||
|
}
|
||||||
|
case op == CondBool:
|
||||||
|
convertValue = noConvertFunction
|
||||||
|
condType = policyengine.CondStringEqualsIgnoreCase
|
||||||
|
case op == CondIPAddress:
|
||||||
|
// todo consider using converters
|
||||||
|
// "203.0.113.0/24" -> "203.0.113.*",
|
||||||
|
// "2001:DB8:1234:5678::/64" -> "2001:DB8:1234:5678:*"
|
||||||
|
// or having specific condition type for IP
|
||||||
|
convertValue = noConvertFunction
|
||||||
|
condType = policyengine.CondStringLike
|
||||||
|
case op == CondNotIPAddress:
|
||||||
|
convertValue = noConvertFunction
|
||||||
|
condType = policyengine.CondStringNotLike
|
||||||
|
default:
|
||||||
|
return nil, fmt.Errorf("unsupported condition operator: '%s'", op)
|
||||||
|
}
|
||||||
|
|
||||||
|
for key, values := range KVs {
|
||||||
|
for _, val := range values {
|
||||||
|
converted, err := convertValue(val)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
conditions = append(conditions, policyengine.Condition{
|
||||||
|
Op: condType,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: key,
|
||||||
|
Value: converted,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return conditions, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
type convertFunction func(string) (string, error)
|
||||||
|
|
||||||
|
func noConvertFunction(val string) (string, error) {
|
||||||
|
return val, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func dateConvertFunction(val string) (string, error) {
|
||||||
|
if _, err := strconv.ParseInt(val, 10, 64); err == nil {
|
||||||
|
return val, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
parsed, err := time.Parse(time.RFC3339, val)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
|
||||||
|
return strconv.FormatInt(parsed.UTC().Unix(), 10), nil
|
||||||
|
}
|
||||||
270
iam/converter_test.go
Normal file
270
iam/converter_test.go
Normal file
|
|
@ -0,0 +1,270 @@
|
||||||
|
package iam
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
policyengine "git.frostfs.info/TrueCloudLab/policy-engine"
|
||||||
|
"github.com/stretchr/testify/require"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestConverters(t *testing.T) {
|
||||||
|
t.Run("valid policy", func(t *testing.T) {
|
||||||
|
p := Policy{
|
||||||
|
Version: "2012-10-17",
|
||||||
|
Statement: []Statement{{
|
||||||
|
Principal: map[string][]string{
|
||||||
|
FrostFSPrincipal: {"arn:aws:iam::111122223333:user/JohnDoe"},
|
||||||
|
},
|
||||||
|
Effect: AllowEffect,
|
||||||
|
Action: []string{"s3:PutObject"},
|
||||||
|
Resource: []string{"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"},
|
||||||
|
Conditions: map[string]Condition{
|
||||||
|
CondStringEquals: {
|
||||||
|
"s3:RequestObjectTag/Department": {"Finance"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
}
|
||||||
|
|
||||||
|
expected := &policyengine.Chain{Rules: []policyengine.Rule{
|
||||||
|
{
|
||||||
|
Status: policyengine.Allow,
|
||||||
|
Action: p.Statement[0].Action,
|
||||||
|
Resource: p.Statement[0].Resource,
|
||||||
|
Any: true,
|
||||||
|
Condition: []policyengine.Condition{
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringEquals,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: RequestOwnerProperty,
|
||||||
|
Value: "arn:aws:iam::111122223333:user/JohnDoe",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringEquals,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "s3:RequestObjectTag/Department",
|
||||||
|
Value: "Finance",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}}
|
||||||
|
|
||||||
|
chain, err := p.ToChain()
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Equal(t, expected, chain)
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("invalid policy (unsupported principal type)", func(t *testing.T) {
|
||||||
|
p := Policy{
|
||||||
|
Version: "2012-10-17",
|
||||||
|
Statement: []Statement{{
|
||||||
|
Principal: map[string][]string{
|
||||||
|
"AWS": {"arn:aws:iam::111122223333:user/JohnDoe"},
|
||||||
|
},
|
||||||
|
Effect: AllowEffect,
|
||||||
|
Action: []string{"s3:PutObject"},
|
||||||
|
Resource: []string{"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"},
|
||||||
|
}},
|
||||||
|
}
|
||||||
|
|
||||||
|
_, err := p.ToChain()
|
||||||
|
require.Error(t, err)
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("invalid policy (missing principal)", func(t *testing.T) {
|
||||||
|
p := Policy{
|
||||||
|
Version: "2012-10-17",
|
||||||
|
Statement: []Statement{{
|
||||||
|
Principal: map[string][]string{},
|
||||||
|
Effect: AllowEffect,
|
||||||
|
Action: []string{"s3:PutObject"},
|
||||||
|
Resource: []string{"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"},
|
||||||
|
}},
|
||||||
|
}
|
||||||
|
|
||||||
|
_, err := p.ToChain()
|
||||||
|
require.Error(t, err)
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("check policy conditions", func(t *testing.T) {
|
||||||
|
p := Policy{
|
||||||
|
Version: "2012-10-17",
|
||||||
|
Statement: []Statement{{
|
||||||
|
Principal: map[string][]string{"*": nil},
|
||||||
|
Effect: AllowEffect,
|
||||||
|
Action: []string{"s3:PutObject"},
|
||||||
|
Resource: []string{"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"},
|
||||||
|
Conditions: Conditions{
|
||||||
|
CondStringEquals: {"key1": {"val0", "val1"}},
|
||||||
|
CondStringNotEquals: {"key2": {"val2"}},
|
||||||
|
CondStringEqualsIgnoreCase: {"key3": {"val3"}},
|
||||||
|
CondStringNotEqualsIgnoreCase: {"key4": {"val4"}},
|
||||||
|
CondStringLike: {"key5": {"val5"}},
|
||||||
|
CondStringNotLike: {"key6": {"val6"}},
|
||||||
|
CondDateEquals: {"key7": {"2006-01-02T15:04:05+07:00"}},
|
||||||
|
CondDateNotEquals: {"key8": {"2006-01-02T15:04:05Z"}},
|
||||||
|
CondDateLessThan: {"key9": {"2006-01-02T15:04:05+06:00"}},
|
||||||
|
CondDateLessThanEquals: {"key10": {"2006-01-02T15:04:05+03:00"}},
|
||||||
|
CondDateGreaterThan: {"key11": {"2006-01-02T15:04:05-01:00"}},
|
||||||
|
CondDateGreaterThanEquals: {"key12": {"2006-01-02T15:04:05-03:00"}},
|
||||||
|
CondBool: {"key13": {"True"}},
|
||||||
|
CondIPAddress: {"key14": {"val14"}},
|
||||||
|
CondNotIPAddress: {"key15": {"val15"}},
|
||||||
|
CondArnEquals: {"key16": {"val16"}},
|
||||||
|
CondArnLike: {"key17": {"val17"}},
|
||||||
|
CondArnNotEquals: {"key18": {"val18"}},
|
||||||
|
CondArnNotLike: {"key19": {"val19"}},
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
}
|
||||||
|
|
||||||
|
expected := &policyengine.Chain{Rules: []policyengine.Rule{
|
||||||
|
{
|
||||||
|
Status: policyengine.Allow,
|
||||||
|
Action: p.Statement[0].Action,
|
||||||
|
Resource: p.Statement[0].Resource,
|
||||||
|
Any: true,
|
||||||
|
Condition: []policyengine.Condition{
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringLike,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: RequestOwnerProperty,
|
||||||
|
Value: "*",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringEquals,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key1",
|
||||||
|
Value: "val0",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringEquals,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key1",
|
||||||
|
Value: "val1",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringNotEquals,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key2",
|
||||||
|
Value: "val2",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringEqualsIgnoreCase,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key3",
|
||||||
|
Value: "val3",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringNotEqualsIgnoreCase,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key4",
|
||||||
|
Value: "val4",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringLike,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key5",
|
||||||
|
Value: "val5",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringNotLike,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key6",
|
||||||
|
Value: "val6",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringEquals,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key7",
|
||||||
|
Value: "1136189045",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringNotEquals,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key8",
|
||||||
|
Value: "1136214245",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringLessThan,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key9",
|
||||||
|
Value: "1136192645",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringLessThanEquals,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key10",
|
||||||
|
Value: "1136203445",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringGreaterThan,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key11",
|
||||||
|
Value: "1136217845",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringGreaterThanEquals,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key12",
|
||||||
|
Value: "1136225045",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringEqualsIgnoreCase,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key13",
|
||||||
|
Value: "True",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringLike,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key14",
|
||||||
|
Value: "val14",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringNotLike,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key15",
|
||||||
|
Value: "val15",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringEquals,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key16",
|
||||||
|
Value: "val16",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringLike,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key17",
|
||||||
|
Value: "val17",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringNotEquals,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key18",
|
||||||
|
Value: "val18",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Op: policyengine.CondStringNotLike,
|
||||||
|
Object: policyengine.ObjectRequest,
|
||||||
|
Key: "key19",
|
||||||
|
Value: "val19",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}}
|
||||||
|
|
||||||
|
chain, err := p.ToChain()
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
for i, rule := range chain.Rules {
|
||||||
|
expectedRule := expected.Rules[i]
|
||||||
|
require.Equal(t, expectedRule.Action, rule.Action)
|
||||||
|
require.Equal(t, expectedRule.Any, rule.Any)
|
||||||
|
require.Equal(t, expectedRule.Resource, rule.Resource)
|
||||||
|
require.Equal(t, expectedRule.Status, rule.Status)
|
||||||
|
require.ElementsMatch(t, expectedRule.Condition, rule.Condition)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
177
iam/policy.go
Normal file
177
iam/policy.go
Normal file
|
|
@ -0,0 +1,177 @@
|
||||||
|
package iam
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
type (
|
||||||
|
// Policy grammar https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_grammar.html
|
||||||
|
// Currently 'NotPrincipal', 'NotAction' and 'NotResource' are not supported (so cannot be unmarshalled).
|
||||||
|
Policy struct {
|
||||||
|
Version string `json:"Version,omitempty"`
|
||||||
|
ID string `json:"Id,omitempty"`
|
||||||
|
Statement Statements `json:"Statement"`
|
||||||
|
}
|
||||||
|
|
||||||
|
Statements []Statement
|
||||||
|
|
||||||
|
Statement struct {
|
||||||
|
SID string `json:"Sid,omitempty"`
|
||||||
|
Principal Principal `json:"Principal,omitempty"`
|
||||||
|
Effect Effect `json:"Effect"`
|
||||||
|
Action Action `json:"Action"`
|
||||||
|
Resource Resource `json:"Resource"`
|
||||||
|
Conditions Conditions `json:"Condition,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
Principal map[string][]string
|
||||||
|
|
||||||
|
Effect string
|
||||||
|
|
||||||
|
Action []string
|
||||||
|
|
||||||
|
Resource []string
|
||||||
|
|
||||||
|
Conditions map[string]Condition
|
||||||
|
|
||||||
|
Condition map[string][]string
|
||||||
|
)
|
||||||
|
|
||||||
|
const Wildcard = "*"
|
||||||
|
|
||||||
|
const (
|
||||||
|
AllowEffect Effect = "Allow"
|
||||||
|
DenyEffect Effect = "Deny"
|
||||||
|
)
|
||||||
|
|
||||||
|
func (s *Statements) UnmarshalJSON(data []byte) error {
|
||||||
|
var list []Statement
|
||||||
|
if err := json.Unmarshal(data, &list); err == nil {
|
||||||
|
*s = list
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
var elem Statement
|
||||||
|
if err := json.Unmarshal(data, &elem); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
*s = []Statement{elem}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (p *Principal) UnmarshalJSON(data []byte) error {
|
||||||
|
*p = make(Principal)
|
||||||
|
|
||||||
|
var str string
|
||||||
|
|
||||||
|
if err := json.Unmarshal(data, &str); err == nil {
|
||||||
|
if str != Wildcard {
|
||||||
|
return errors.New("invalid IAM string principal")
|
||||||
|
}
|
||||||
|
(*p)[Wildcard] = nil
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
m := make(map[string]interface{})
|
||||||
|
if err := json.Unmarshal(data, &m); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
for key, val := range m {
|
||||||
|
element, ok := val.(string)
|
||||||
|
if ok {
|
||||||
|
(*p)[key] = []string{element}
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
list, ok := val.([]interface{})
|
||||||
|
if !ok {
|
||||||
|
return errors.New("invalid principal format")
|
||||||
|
}
|
||||||
|
|
||||||
|
resList := make([]string, len(list))
|
||||||
|
for i := range list {
|
||||||
|
val, ok := list[i].(string)
|
||||||
|
if !ok {
|
||||||
|
return errors.New("invalid principal format")
|
||||||
|
}
|
||||||
|
resList[i] = val
|
||||||
|
}
|
||||||
|
|
||||||
|
(*p)[key] = resList
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *Action) UnmarshalJSON(data []byte) error {
|
||||||
|
var list []string
|
||||||
|
if err := json.Unmarshal(data, &list); err == nil {
|
||||||
|
*a = list
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
var elem string
|
||||||
|
if err := json.Unmarshal(data, &elem); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
*a = []string{elem}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *Resource) UnmarshalJSON(data []byte) error {
|
||||||
|
var list []string
|
||||||
|
if err := json.Unmarshal(data, &list); err == nil {
|
||||||
|
*r = list
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
var elem string
|
||||||
|
if err := json.Unmarshal(data, &elem); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
*r = []string{elem}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *Condition) UnmarshalJSON(data []byte) error {
|
||||||
|
*c = make(Condition)
|
||||||
|
|
||||||
|
m := make(map[string]interface{})
|
||||||
|
if err := json.Unmarshal(data, &m); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
for key, val := range m {
|
||||||
|
element, ok := val.(string)
|
||||||
|
if ok {
|
||||||
|
(*c)[key] = []string{element}
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
list, ok := val.([]interface{})
|
||||||
|
if !ok {
|
||||||
|
return errors.New("invalid principal format")
|
||||||
|
}
|
||||||
|
|
||||||
|
resList := make([]string, len(list))
|
||||||
|
for i := range list {
|
||||||
|
val, ok := list[i].(string)
|
||||||
|
if !ok {
|
||||||
|
return errors.New("invalid principal format")
|
||||||
|
}
|
||||||
|
resList[i] = val
|
||||||
|
}
|
||||||
|
|
||||||
|
(*c)[key] = resList
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
173
iam/policy_test.go
Normal file
173
iam/policy_test.go
Normal file
|
|
@ -0,0 +1,173 @@
|
||||||
|
package iam
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/stretchr/testify/require"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestUnmarshalIAMPolicy(t *testing.T) {
|
||||||
|
t.Run("simple fields", func(t *testing.T) {
|
||||||
|
policy := `{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Id": "PutObjPolicy",
|
||||||
|
"Statement": {
|
||||||
|
"Sid": "DenyObjectsThatAreNotSSEKMS",
|
||||||
|
"Principal": "*",
|
||||||
|
"Effect": "Deny",
|
||||||
|
"Action": "s3:PutObject",
|
||||||
|
"Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
|
||||||
|
"Condition": {
|
||||||
|
"Null": {
|
||||||
|
"s3:x-amz-server-side-encryption-aws-kms-key-id": "true"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}`
|
||||||
|
|
||||||
|
expected := Policy{
|
||||||
|
Version: "2012-10-17",
|
||||||
|
ID: "PutObjPolicy",
|
||||||
|
Statement: []Statement{{
|
||||||
|
SID: "DenyObjectsThatAreNotSSEKMS",
|
||||||
|
Principal: map[string][]string{
|
||||||
|
"*": nil,
|
||||||
|
},
|
||||||
|
Effect: DenyEffect,
|
||||||
|
Action: []string{"s3:PutObject"},
|
||||||
|
Resource: []string{"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"},
|
||||||
|
Conditions: map[string]Condition{
|
||||||
|
"Null": {
|
||||||
|
"s3:x-amz-server-side-encryption-aws-kms-key-id": {"true"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
}
|
||||||
|
|
||||||
|
var p Policy
|
||||||
|
err := json.Unmarshal([]byte(policy), &p)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Equal(t, expected, p)
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("complex fields", func(t *testing.T) {
|
||||||
|
policy := `{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [{
|
||||||
|
"Principal":{
|
||||||
|
"AWS":[
|
||||||
|
"arn:aws:iam::111122223333:user/JohnDoe"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"s3:PutObject"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"
|
||||||
|
],
|
||||||
|
"Condition": {
|
||||||
|
"StringEquals": {
|
||||||
|
"s3:RequestObjectTag/Department": ["Finance"]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}]
|
||||||
|
}`
|
||||||
|
|
||||||
|
expected := Policy{
|
||||||
|
Version: "2012-10-17",
|
||||||
|
Statement: []Statement{{
|
||||||
|
Principal: map[string][]string{
|
||||||
|
"AWS": {"arn:aws:iam::111122223333:user/JohnDoe"},
|
||||||
|
},
|
||||||
|
Effect: AllowEffect,
|
||||||
|
Action: []string{"s3:PutObject"},
|
||||||
|
Resource: []string{"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"},
|
||||||
|
Conditions: map[string]Condition{
|
||||||
|
"StringEquals": {
|
||||||
|
"s3:RequestObjectTag/Department": {"Finance"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
}
|
||||||
|
|
||||||
|
var p Policy
|
||||||
|
err := json.Unmarshal([]byte(policy), &p)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Equal(t, expected, p)
|
||||||
|
|
||||||
|
raw, err := json.Marshal(expected)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.JSONEq(t, policy, string(raw))
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("check principal AWS", func(t *testing.T) {
|
||||||
|
policy := `{
|
||||||
|
"Statement": [{
|
||||||
|
"Principal":{
|
||||||
|
"AWS":"arn:aws:iam::111122223333:user/JohnDoe"
|
||||||
|
}
|
||||||
|
}]
|
||||||
|
}`
|
||||||
|
|
||||||
|
expected := Policy{
|
||||||
|
Statement: []Statement{{
|
||||||
|
Principal: map[string][]string{
|
||||||
|
"AWS": {"arn:aws:iam::111122223333:user/JohnDoe"},
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
}
|
||||||
|
|
||||||
|
var p Policy
|
||||||
|
err := json.Unmarshal([]byte(policy), &p)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Equal(t, expected, p)
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("native example", func(t *testing.T) {
|
||||||
|
policy := `
|
||||||
|
{
|
||||||
|
"Version": "xyz",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"native:*",
|
||||||
|
"s3:PutObject",
|
||||||
|
"s3:GetObject"
|
||||||
|
],
|
||||||
|
"Resource": ["*"],
|
||||||
|
"Principal": {"FrostFS": ["did:frostfs:039e3ee771a223361fe7862f532e9511b57baaae3c3e2622682e99d0e660f7671"]},
|
||||||
|
"Condition": {"StringEquals": {"native::object::attribute": "iamuser-admin"}}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}`
|
||||||
|
|
||||||
|
var p Policy
|
||||||
|
err := json.Unmarshal([]byte(policy), &p)
|
||||||
|
require.NoError(t, err)
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("condition array", func(t *testing.T) {
|
||||||
|
policy := `
|
||||||
|
{
|
||||||
|
"Statement": [{
|
||||||
|
"Condition": {"StringLike": {"ec2:InstanceType": ["t1.*", "t2.*", "m3.*"]}}
|
||||||
|
}]
|
||||||
|
}`
|
||||||
|
|
||||||
|
expected := Policy{
|
||||||
|
Statement: []Statement{{
|
||||||
|
Conditions: map[string]Condition{
|
||||||
|
"StringLike": {"ec2:InstanceType": {"t1.*", "t2.*", "m3.*"}},
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
}
|
||||||
|
|
||||||
|
var p Policy
|
||||||
|
err := json.Unmarshal([]byte(policy), &p)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.Equal(t, expected, p)
|
||||||
|
})
|
||||||
|
}
|
||||||
30
policy.go
30
policy.go
|
|
@ -1,30 +0,0 @@
|
||||||
package policyengine
|
|
||||||
|
|
||||||
//{
|
|
||||||
// "Version": "xyz",
|
|
||||||
// "Policy": [
|
|
||||||
// {
|
|
||||||
// "Effect": "Allow",
|
|
||||||
// "Action": [
|
|
||||||
// "native:*",
|
|
||||||
// "s3:PutObject",
|
|
||||||
// "s3:GetObject"
|
|
||||||
// ],
|
|
||||||
// "Resource": ["*"],
|
|
||||||
// "Principal": ["did:frostfs:039e3ee771a223361fe7862f532e9511b57baaae3c3e2622682e99d0e660f7671"],
|
|
||||||
// "Condition": [ {"StringEquals": {"native::object::attribute", "iamuser-admin"}]
|
|
||||||
// }
|
|
||||||
// ]
|
|
||||||
//}
|
|
||||||
|
|
||||||
// type Policy struct {
|
|
||||||
// Rules []Rule `json:"Policy"`
|
|
||||||
// }
|
|
||||||
|
|
||||||
// type AWSRule struct {
|
|
||||||
// Effect string `json:"Effect"`
|
|
||||||
// Action []string `json:"Action"`
|
|
||||||
// Resource []string `json:"Resource"`
|
|
||||||
// Principal []string `json:"Principal"`
|
|
||||||
// Condition []Condition `json:"Condition"`
|
|
||||||
// }
|
|
||||||
Loading…
Reference in a new issue