def run(event, context=None):
# policies file should always be valid in functions so do loading naively
with open('config.json') as f:
policy_config = json.load(f)
if not policy_config or not policy_config.get('policies'):
log.error('Invalid policy config')
return False
options_overrides = \
policy_config['policies'][0].get('mode', {}).get('execution-options', {})
# if output_dir specified use that, otherwise make a temp directory
if 'output_dir' not in options_overrides:
options_overrides['output_dir'] = get_tmp_output_dir()
# merge all our options in
options = Config.empty(**options_overrides)
loader = PolicyLoader(options)
policies = loader.load_data(policy_config, 'config.json', validate=False)
if policies:
for p in policies:
log.info("running policy %s", p.name)
p.validate()
p.push(event, context)
return True
def eperm(provider, el, r=None):
if el.permissions:
return el.permissions
element_type = get_element_type(el)
if r is None or r.type is None:
# dummy resource type for policy
if provider == 'aws':
r = Bag({'type': 'kinesis'})
elif provider == 'gcp':
r = Bag({'type': 'instance'})
elif provider == 'azure':
r = Bag({'type': 'vm'})
# print(f'policy construction lookup {r.type}.{element_type}.{el.type}')
loader = PolicyLoader(Config.empty())
pdata = {
'name': f'permissions-{r.type}',
'resource': f'{provider}.{r.type}'
}
pdata[element_type] = get_element_data(element_type, el)
try:
pset = loader.load_data({'policies': [pdata]}, ':mem:', validate=False)
except Exception as e:
print(f'error loading {el} as {element_type}:{el.type} error: {e} \n {pdata}')
return []
el = get_policy_element(el, list(pset)[0])
return el.get_permissions()
def test_doc_examples(provider_name):
load_resources()
loader = PolicyLoader(Config.empty())
provider = clouds.get(provider_name)
policies = get_doc_policies(provider.resources)
for p in policies.values():
loader.load_data({'policies': [p]}, 'memory://')
for p in policies.values():
# Note max name size here is 54 if it a lambda policy given
# our default prefix custodian- to stay under 64 char limit on
# lambda function names. This applies to AWS and GCP, and
# afaict Azure.
if len(p['name']) >= 54 and 'mode' in p:
raise ValueError(
"doc policy exceeds name limit policy:%s" % (p['name']))