def test_add_by_list_of_actions(self):
actions_test_data_1 = ["kms:CreateCustomKeyStore", "kms:CreateGrant"]
sid_group = SidGroup()
sid_group.add_by_list_of_actions(actions_test_data_1)
output = sid_group.get_rendered_policy()
desired_output = {
"Version":
"2012-10-17",
"Statement": [
{
"Sid":
"KmsPermissionsmanagementKey",
"Effect":
"Allow",
"Action": ["kms:CreateGrant"],
"Resource":
["arn:${Partition}:kms:${Region}:${Account}:key/${KeyId}"],
},
{
"Sid":
"MultMultNone",
"Effect":
"Allow",
"Action": [
"cloudhsm:DescribeClusters",
"kms:CreateCustomKeyStore",
],
"Resource": ["*"],
},
],
}
print(json.dumps(output, indent=4))
self.maxDiff = None
self.assertDictEqual(output, desired_output)
def test_resource_restriction_plus_dependent_action(self):
"""
test_resource_restriction_plus_dependent_action
"""
# Given iam:generateorganizationsaccessreport with resource constraint, make sure these are added:
# organizations:DescribePolicy,organizations:ListChildren,organizations:ListParents,
# organizations:ListPoliciesForTarget,organizations:ListRoots,organizations:ListTargetsForPolicy
actions_test_data_1 = ["iam:generateorganizationsaccessreport"]
sid_group = SidGroup()
sid_group.add_by_list_of_actions(actions_test_data_1)
output = sid_group.get_rendered_policy()
# print(json.dumps(rendered_policy, indent=4))
desired_output = {
"Version":
"2012-10-17",
"Statement": [
{
"Effect":
"Allow",
"Action": [
"organizations:DescribePolicy",
"organizations:ListChildren",
"organizations:ListParents",
"organizations:ListPoliciesForTarget",
"organizations:ListRoots",
"organizations:ListTargetsForPolicy",
],
"Resource": ["*"],
"Sid":
"MultMultNone",
},
{
"Sid":
"IamReadAccessreport",
"Effect":
"Allow",
"Action": ["iam:GenerateOrganizationsAccessReport"],
"Resource": [
"arn:${Partition}:iam::${Account}:access-report/${EntityPath}"
],
},
],
}
self.maxDiff = None
print(json.dumps(output, indent=4))
self.assertDictEqual(output, desired_output)