def test_get_actions_matching_condition_crud_and_wildcard_arn(self):
"""querying.actions.get_actions_matching_condition_crud_and_wildcard_arn"""
desired_results = [
"swf:pollforactivitytask",
"swf:pollfordecisiontask",
"swf:respondactivitytaskcompleted",
"swf:startworkflowexecution",
]
results = get_actions_matching_condition_crud_and_arn(
db_session, "swf:taskList.name", "Write", "*"
)
self.assertListEqual(desired_results, results)
# This one leverages a condition key that is partway through a string in the database
# - luckily, SQLAlchemy's ilike function allows us to find it anyway because it's a substring
# kms:CallerAccount,kms:EncryptionAlgorithm,kms:EncryptionContextKeys,kms:ViaService
desired_results = [
"kms:decrypt",
"kms:encrypt",
"kms:generatedatakey",
"kms:generatedatakeypair",
"kms:generatedatakeypairwithoutplaintext",
"kms:generatedatakeywithoutplaintext",
"kms:reencryptfrom",
"kms:reencryptto",
]
results = get_actions_matching_condition_crud_and_arn(
db_session, "kms:EncryptionAlgorithm", "Write", "*"
)
self.assertListEqual(desired_results, results)
def test_get_actions_matching_condition_crud_and_wildcard_arn(self):
"""querying.actions.get_actions_matching_condition_crud_and_wildcard_arn"""
desired_results = [
"swf:PollForActivityTask",
"swf:PollForDecisionTask",
"swf:RespondActivityTaskCompleted",
"swf:StartWorkflowExecution",
]
results = get_actions_matching_condition_crud_and_arn(
db_session, "swf:taskList.name", "Write", "*")
print(results)
self.assertListEqual(desired_results, results)
# This one leverages a condition key that is partway through a string in the database
# - luckily, SQLAlchemy's ilike function allows us to find it anyway because it's a substring
# kms:CallerAccount,kms:EncryptionAlgorithm,kms:EncryptionContextKeys,kms:ViaService
desired_results = [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKey",
"kms:GenerateDataKeyPair",
"kms:GenerateDataKeyPairWithoutPlaintext",
"kms:GenerateDataKeyWithoutPlaintext",
"kms:ReEncryptFrom",
"kms:ReEncryptTo",
]
print(results)
results = get_actions_matching_condition_crud_and_arn(
db_session, "kms:EncryptionAlgorithm", "Write", "*")
self.assertListEqual(desired_results, results)
def test_get_actions_matching_condition_crud_and_arn(self):
"""test_get_actions_matching_condition_crud_and_arn: Get a list of IAM Actions matching condition key,
CRUD level, and raw ARN"""
results = get_actions_matching_condition_crud_and_arn(
db_session, "elasticbeanstalk:InApplication", "List",
"arn:${Partition}:elasticbeanstalk:${Region}:${Account}:environment/${ApplicationName}/${EnvironmentName}"
)
desired_results = [
'elasticbeanstalk:describeenvironments',
]
self.assertListEqual(desired_results, results)
def test_get_actions_matching_condition_crud_and_arn(self):
"""querying.actions.get_actions_matching_condition_crud_and_arn"""
results = get_actions_matching_condition_crud_and_arn(
db_session,
"elasticbeanstalk:InApplication",
"List",
"arn:${Partition}:elasticbeanstalk:${Region}:${Account}:environment/${ApplicationName}/${EnvironmentName}",
)
desired_results = [
"elasticbeanstalk:describeenvironments",
]
self.assertListEqual(desired_results, results)
def test_get_actions_matching_condition_crud_and_wildcard_arn(self):
"""test_get_actions_matching_condition_crud_and_wildcard_arn: Get a list of IAM Actions matching condition key
, CRUD level, and raw ARN. Raw ARN equals * in this case"""
desired_results = [
'swf:pollforactivitytask', 'swf:pollfordecisiontask',
'swf:respondactivitytaskcompleted', 'swf:startworkflowexecution'
]
results = get_actions_matching_condition_crud_and_arn(
db_session, "swf:taskList.name", "Write", "*")
self.assertListEqual(desired_results, results)
# This one leverages a condition key that is partway through a string in the database
# - luckily, SQLAlchemy's ilike function allows us to find it anyway because it's a substring
# kms:CallerAccount,kms:EncryptionAlgorithm,kms:EncryptionContextKeys,kms:ViaService
desired_results = [
'kms:decrypt', 'kms:encrypt', 'kms:generatedatakey',
'kms:generatedatakeypair',
'kms:generatedatakeypairwithoutplaintext',
'kms:generatedatakeywithoutplaintext', 'kms:reencryptfrom',
'kms:reencryptto'
]
results = get_actions_matching_condition_crud_and_arn(
db_session, "kms:EncryptionAlgorithm", "Write", "*")
self.assertListEqual(desired_results, results)
#!/usr/bin/env python
from policy_sentry.shared.database import connect_db
from policy_sentry.querying.actions import get_actions_matching_condition_crud_and_arn
import json
if __name__ == '__main__':
db_session = connect_db('bundled')
results = get_actions_matching_condition_crud_and_arn(
db_session, "ram:ResourceArn", "Permissions management",
"arn:${Partition}:ram:${Region}:${Account}:resource-share/${ResourcePath}"
)
print(json.dumps(output, indent=4))
"""
Output:
[
'ram:createresourceshare'
]
"""