Skip to content

Commit

Permalink
enrich iam_role_policy for aws_default middleware
Browse files Browse the repository at this point in the history
  • Loading branch information
Martin Guibert committed Jul 22, 2021
1 parent 2745d44 commit bcc56d0
Show file tree
Hide file tree
Showing 6 changed files with 57 additions and 43 deletions.
5 changes: 5 additions & 0 deletions pkg/middlewares/aws_defaults.go
View file
Expand Up @@ -59,6 +59,11 @@ func (m AwsDefaults) awsIamRolePolicyDefaults(remoteResources []resource.Resourc
}
}

if role == nil {
logrus.Warnf("Role for %s role policy not found. Is that supposed to happen ?", remoteResource.TerraformId())
continue
}

if match := strings.HasPrefix((*role.Attrs)["path"].(string), defaultIamRolePathPrefix); match {
resourcesToIgnore = append(resourcesToIgnore, remoteResource)
}
Expand Down
8 changes: 6 additions & 2 deletions pkg/remote/aws/iam_role_policy_enumerator.go
View file
@@ -1,6 +1,8 @@
package aws

import (
"fmt"

"github.com/cloudskiff/driftctl/pkg/remote/aws/repository"
remoteerror "github.com/cloudskiff/driftctl/pkg/remote/error"

Expand Down Expand Up @@ -41,8 +43,10 @@ func (e *IamRolePolicyEnumerator) Enumerate() ([]resource.Resource, error) {
results,
e.factory.CreateAbstractResource(
string(e.SupportedType()),
policy,
map[string]interface{}{},
fmt.Sprintf("%s:%s", policy.RoleName, policy.Policy),
map[string]interface{}{
"role": policy.RoleName,
},
),
)
}
Expand Down
17 changes: 11 additions & 6 deletions pkg/remote/aws/repository/iam_repository.go
View file
Expand Up @@ -16,7 +16,7 @@ type IAMRepository interface {
ListAllPolicies() ([]*iam.Policy, error)
ListAllRoles() ([]*iam.Role, error)
ListAllRolePolicyAttachments([]*iam.Role) ([]*AttachedRolePolicy, error)
ListAllRolePolicies([]*iam.Role) ([]string, error)
ListAllRolePolicies([]*iam.Role) ([]RolePolicy, error)
ListAllUserPolicyAttachments([]*iam.User) ([]*AttachedUserPolicy, error)
ListAllUserPolicies([]*iam.User) ([]string, error)
}
Expand Down Expand Up @@ -154,22 +154,22 @@ func (r *iamRepository) ListAllRolePolicyAttachments(roles []*iam.Role) ([]*Atta
return resources, nil
}

func (r *iamRepository) ListAllRolePolicies(roles []*iam.Role) ([]string, error) {
var resources []string
func (r *iamRepository) ListAllRolePolicies(roles []*iam.Role) ([]RolePolicy, error) {
var resources []RolePolicy
for _, role := range roles {
cacheKey := fmt.Sprintf("iamListAllRolePolicies_role_%s", *role.RoleName)
if v := r.cache.Get(cacheKey); v != nil {
resources = append(resources, v.([]string)...)
resources = append(resources, v.([]RolePolicy)...)
continue
}

roleResources := make([]string, 0)
roleResources := make([]RolePolicy, 0)
input := &iam.ListRolePoliciesInput{
RoleName: role.RoleName,
}
err := r.client.ListRolePoliciesPages(input, func(res *iam.ListRolePoliciesOutput, lastPage bool) bool {
for _, policy := range res.PolicyNames {
roleResources = append(roleResources, fmt.Sprintf("%s:%s", *input.RoleName, *policy))
roleResources = append(roleResources, RolePolicy{*policy, *input.RoleName})
}
return !lastPage
})
Expand Down Expand Up @@ -257,3 +257,8 @@ type AttachedRolePolicy struct {
iam.AttachedPolicy
RoleName string
}

type RolePolicy struct {
Policy string
RoleName string
}
42 changes: 21 additions & 21 deletions pkg/remote/aws/repository/iam_repository_test.go
View file
Expand Up @@ -412,17 +412,17 @@ func Test_IAMRepository_ListAllRolePolicyAttachments(t *testing.T) {
return false
}
callback(&iam.ListAttachedRolePoliciesOutput{AttachedPolicies: []*iam.AttachedPolicy{
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test-policy"),
PolicyName: aws.String("policy"),
},
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test-policy2"),
PolicyName: aws.String("policy2"),
},
}}, false)
callback(&iam.ListAttachedRolePoliciesOutput{AttachedPolicies: []*iam.AttachedPolicy{
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test-policy3"),
PolicyName: aws.String("policy3"),
},
Expand All @@ -440,17 +440,17 @@ func Test_IAMRepository_ListAllRolePolicyAttachments(t *testing.T) {
return false
}
callback(&iam.ListAttachedRolePoliciesOutput{AttachedPolicies: []*iam.AttachedPolicy{
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test-policy"),
PolicyName: aws.String("policy"),
},
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test-policy2"),
PolicyName: aws.String("policy2"),
},
}}, false)
callback(&iam.ListAttachedRolePoliciesOutput{AttachedPolicies: []*iam.AttachedPolicy{
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test-policy3"),
PolicyName: aws.String("policy3"),
},
Expand Down Expand Up @@ -544,7 +544,7 @@ func Test_IAMRepository_ListAllRolePolicies(t *testing.T) {
name string
roles []*iam.Role
mocks func(client *awstest.MockFakeIAM)
want []string
want []RolePolicy
wantErr error
}{
{
Expand Down Expand Up @@ -600,13 +600,13 @@ func Test_IAMRepository_ListAllRolePolicies(t *testing.T) {
return true
})).Once().Return(nil)
},
want: []string{
*aws.String("test_role_0:policy-role0-0"),
*aws.String("test_role_0:policy-role0-1"),
*aws.String("test_role_0:policy-role0-2"),
*aws.String("test_role_1:policy-role1-0"),
*aws.String("test_role_1:policy-role1-1"),
*aws.String("test_role_1:policy-role1-2"),
want: []RolePolicy{
{Policy: "policy-role0-0", RoleName: "test_role_0"},
{Policy: "policy-role0-1", RoleName: "test_role_0"},
{Policy: "policy-role0-2", RoleName: "test_role_0"},
{Policy: "policy-role1-0", RoleName: "test_role_1"},
{Policy: "policy-role1-1", RoleName: "test_role_1"},
{Policy: "policy-role1-2", RoleName: "test_role_1"},
},
},
}
Expand All @@ -628,7 +628,7 @@ func Test_IAMRepository_ListAllRolePolicies(t *testing.T) {
assert.NoError(t, err)
assert.Equal(t, got, cachedData)
for _, role := range tt.roles {
assert.IsType(t, []string{}, store.Get(fmt.Sprintf("iamListAllRolePolicies_role_%s", *role.RoleName)))
assert.IsType(t, []RolePolicy{}, store.Get(fmt.Sprintf("iamListAllRolePolicies_role_%s", *role.RoleName)))
}
}

Expand Down Expand Up @@ -670,17 +670,17 @@ func Test_IAMRepository_ListAllUserPolicyAttachments(t *testing.T) {
},
mock.MatchedBy(func(callback func(res *iam.ListAttachedUserPoliciesOutput, lastPage bool) bool) bool {
callback(&iam.ListAttachedUserPoliciesOutput{AttachedPolicies: []*iam.AttachedPolicy{
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test"),
PolicyName: aws.String("test-attach"),
},
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test2"),
PolicyName: aws.String("test-attach2"),
},
}}, false)
callback(&iam.ListAttachedUserPoliciesOutput{AttachedPolicies: []*iam.AttachedPolicy{
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test3"),
PolicyName: aws.String("test-attach3"),
},
Expand All @@ -694,17 +694,17 @@ func Test_IAMRepository_ListAllUserPolicyAttachments(t *testing.T) {
},
mock.MatchedBy(func(callback func(res *iam.ListAttachedUserPoliciesOutput, lastPage bool) bool) bool {
callback(&iam.ListAttachedUserPoliciesOutput{AttachedPolicies: []*iam.AttachedPolicy{
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test"),
PolicyName: aws.String("test-attach"),
},
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test2"),
PolicyName: aws.String("test-attach2"),
},
}}, false)
callback(&iam.ListAttachedUserPoliciesOutput{AttachedPolicies: []*iam.AttachedPolicy{
&iam.AttachedPolicy{
{
PolicyArn: aws.String("arn:aws:iam::526954929923:policy/test3"),
PolicyName: aws.String("test-attach3"),
},
Expand Down
12 changes: 6 additions & 6 deletions pkg/remote/aws/repository/mock_IAMRepository.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 8 additions & 8 deletions pkg/remote/iam_scanner_test.go
View file
Expand Up @@ -982,7 +982,7 @@ func TestIamRolePolicy(t *testing.T) {
},
}
repo.On("ListAllRoles").Return(roles, nil)
repo.On("ListAllRolePolicies", roles).Return([]string{}, nil)
repo.On("ListAllRolePolicies", roles).Return([]repository.RolePolicy{}, nil)
},
wantErr: nil,
},
Expand All @@ -999,13 +999,13 @@ func TestIamRolePolicy(t *testing.T) {
},
}
repo.On("ListAllRoles").Return(roles, nil)
repo.On("ListAllRolePolicies", roles).Return([]string{
*aws.String("test_role_0:policy-role0-0"),
*aws.String("test_role_0:policy-role0-1"),
*aws.String("test_role_0:policy-role0-2"),
*aws.String("test_role_1:policy-role1-0"),
*aws.String("test_role_1:policy-role1-1"),
*aws.String("test_role_1:policy-role1-2"),
repo.On("ListAllRolePolicies", roles).Return([]repository.RolePolicy{
{Policy: "policy-role0-0", RoleName: "test_role_0"},
{Policy: "policy-role0-1", RoleName: "test_role_0"},
{Policy: "policy-role0-2", RoleName: "test_role_0"},
{Policy: "policy-role1-0", RoleName: "test_role_1"},
{Policy: "policy-role1-1", RoleName: "test_role_1"},
{Policy: "policy-role1-2", RoleName: "test_role_1"},
}, nil).Once()
},
wantErr: nil,
Expand Down

0 comments on commit bcc56d0

Please sign in to comment.