Escaping colon character in key

[N0rb3rtT]

Hi All,

I am new to Rego and I got a task at hand to evaluate AWS IAM policies, look for specific strings within each policies and fail / pass based on the result.

So far everything works as expected except when the AWS IAM policy got a colon in the key:

"StringEquals": {
    "connect:InstanceId": [
                        "123456",
                        "987654"
                    ]
                }

I tested two different scenarios in playground:

1.) Replaced colon with underscore between "connect" and "InstanceId" to ensure that my policy gets evaluated correctly:

Policy:

package demo

default result = "fail"

expectedStatementInstanceId := ["123456", "987654"]

result = "pass" {
	expectedStatementInstanceId == input.Statement[0].Condition.StringEquals.connect_InstanceId
}

Input:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement",
            "Effect": "Allow",
            "Action": "connect:GetFederationToken",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "connect_InstanceId": [
                        "123456",
                        "987654"
                    ]
                }
            }
        }
    ]
}

Output:

{
    "expectedStatementInstanceId": [
        "123456",
        "987654"
    ],
    "result": "pass"
}

Expected behaviour.

2.) Used original AWS IAM policy with colon between "connect" and "InstanceId":

Policy:

package demo

default result = "fail"

expectedStatementInstanceId := ["123456", "987654"]

result = "pass" {
	expectedStatementInstanceId == input.Statement[0].Condition.StringEquals.connect:InstanceId
}

Input:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement",
            "Effect": "Allow",
            "Action": "connect:GetFederationToken",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "connect:InstanceId": [
                        "123456",
                        "987654"
                    ]
                }
            }
        }
    ]
}

Output:

1 error occurred: policy.rego:8: rego_parse_error: unexpected : token: expected \n or ; or }
	expectedStatementInstanceId == input.Statement[0].Condition.StringEquals.connect:InstanceId

Error evaluating.

I would like to know if there is a way to escape the colon character between "connect" and "InstanceID" when I am writing a policy in Rego?

Thank you. 😊

[anderseknert]

input.Statement[0].Condition.StringEquals["connect:InstanceId"]

🙂

[N0rb3rtT]

You are a star, thank you very much! 😉 👍