Add `--resource-type` flag to `policy_sentry query action-table` command #261

reetasingh · 2020-10-18T08:26:28Z

What does this PR do?

Address #255 with the Bonus Points

Adding --resource-type flag to policy_sentry query action-table
Removing --wildcard-only flag from policy_sentry query action-table
Adding method get_actions_matching_arn_type
Modifying method get_actions_with_arn_type_and_access_level
Adding unit tests for the new methods added and methods modified
Adding integration tests for new --resource-type flag

What gif best describes this PR or how it makes you feel?

Completion checklist

CHANGELOG.md has been updated to reflect the changes
Additions and changes have unit tests
Unit tests, Pylint, security testing, and Integration tests are passing.. GitHub actions does this automatically
The pull request has been appropriately labeled using the provided PR labels

reetasingh · 2020-10-18T08:30:18Z

policy_sentry/querying/actions.py

-def get_actions_with_arn_type_and_access_level(
-    service_prefix, resource_type_name, access_level
-):
+def get_actions_matching_arn_type(service_prefix, resource_type_name):


new method added

reetasingh · 2020-10-18T08:35:16Z

@kmcquade let me know your thoughts on this PR

reetasingh · 2020-10-18T08:45:14Z

policy_sentry/querying/actions.py

+    results = []
+
+    if resource_type_name == '*':
+        return get_actions_at_access_level_that_support_wildcard_arns_only(service_prefix, access_level)


for resource_type_name == '*' calling the existing get_actions_at_access_level_that_support_wildcard_arns_only method

reetasingh · 2020-10-18T08:45:30Z

policy_sentry/querying/actions.py

    """
+    if resource_type_name == '*':
+        return get_actions_that_support_wildcard_arns_only(service_prefix)


for resource_type_name == '*' calling the existing get_actions_that_support_wildcard_arns_only method

in this way the get_actions_matching_arn_type will support both the case where resource_type_name='' or not ''

reetasingh · 2020-10-18T08:46:26Z

policy_sentry/querying/actions.py

    service_prefix_data = get_service_prefix_data(service_prefix)
    results = []

-    for action_name, action_data in service_prefix_data["privileges"].items():
-        if action_data["access_level"] == access_level:
+    if service_prefix == "all":


if resource_type_name !='*'

reetasingh · 2020-10-18T08:46:56Z

policy_sentry/querying/actions.py

+
+    if resource_type_name == '*':
+        return get_actions_at_access_level_that_support_wildcard_arns_only(service_prefix, access_level)
+


if resource_type_name !='*' this block will be executed

reetasingh · 2020-10-18T08:52:33Z

OutPut:

(venv) reetasingh-ltm8:policy_sentry reetasingh$ policy_sentry query action-table  --help
Usage: policy_sentry query action-table [OPTIONS]

  Query the Action Table from the Policy Sentry database

Options:
  --service TEXT                  Filter according to AWS service.  [required]
  --name TEXT                     The name of IAM Action. For example, if the
                                  action is "iam:ListUsers", supply
                                  "ListUsers" here.

  --access-level [read|write|list|tagging|permissions-management]
                                  Filter according to CRUD levels. Acceptable
                                  values are read, write, list, tagging,
                                  permissions-management

  --condition TEXT                Supply a condition key to show a list of all
                                  IAM actions that support the condition key.

  --resource-type TEXT            Supply a resource type to show a list of all
                                  IAM actions that support the resource type.

  --fmt [yaml|json]               Format output as YAML or JSON. Defaults to
                                  "yaml"

  -v, --verbosity LVL             Either CRITICAL, ERROR, WARNING, INFO or
                                  DEBUG

  --help                          Show this message and exit.
(venv) reetasingh-ltm8:policy_sentry reetasingh$

reetasingh · 2020-10-18T08:53:07Z

(venv) reetasingh-ltm8:policy_sentry reetasingh$ policy_sentry query action-table --service ssm --access-level write --resource-type parameter
Using the Local IAM definition: /Users/reetasingh/.policy_sentry/iam-definition.json. To leverage the bundled definition instead, remove the folder $HOME/.policy_sentry/
ssm WRITE actions that have the resource type PARAMETER:
[
    "ssm:DeleteParameter",
    "ssm:DeleteParameters",
    "ssm:LabelParameterVersion",
    "ssm:PutParameter"
]
(venv) reetasingh-ltm8:policy_sentry reetasingh$ policy_sentry query action-table --service secretsmanager --access-level list --resource-type '*'
Using the Local IAM definition: /Users/reetasingh/.policy_sentry/iam-definition.json. To leverage the bundled definition instead, remove the folder $HOME/.policy_sentry/
secretsmanager LIST actions that have the resource type *:
[
    "secretsmanager:ListSecrets"
]

reetasingh · 2020-10-18T08:55:33Z

(venv) reetasingh-ltm8:policy_sentry reetasingh$ policy_sentry query action-table --service secretsmanager  --resource-type '*'
Using the Local IAM definition: /Users/reetasingh/.policy_sentry/iam-definition.json. To leverage the bundled definition instead, remove the folder $HOME/.policy_sentry/
IAM actions under secretsmanager service that have the resource type *:
[
    "secretsmanager:GetRandomPassword",
    "secretsmanager:ListSecrets"
]
(venv) reetasingh-ltm8:policy_sentry reetasingh$

reetasingh · 2020-10-18T08:57:26Z

(venv) reetasingh-ltm8:policy_sentry reetasingh$ policy_sentry query action-table --service secretsmanager  --resource-type '*' --access-level read
Using the Local IAM definition: /Users/reetasingh/.policy_sentry/iam-definition.json. To leverage the bundled definition instead, remove the folder $HOME/.policy_sentry/
secretsmanager READ actions that have the resource type *:
[
    "secretsmanager:GetRandomPassword"
]

reetasingh · 2020-10-18T09:01:08Z

venv) reetasingh-ltm8:policy_sentry reetasingh$ policy_sentry query action-table --service ssm --resource-type parameter
Using the Local IAM definition: /Users/reetasingh/.policy_sentry/iam-definition.json. To leverage the bundled definition instead, remove the folder $HOME/.policy_sentry/
IAM actions under ssm service that have the resource type parameter:
[
    "ssm:AddTagsToResource",
    "ssm:DeleteParameter",
    "ssm:DeleteParameters",
    "ssm:GetParameter",
    "ssm:GetParameterHistory",
    "ssm:GetParameters",
    "ssm:GetParametersByPath",
    "ssm:LabelParameterVersion",
    "ssm:ListTagsForResource",
    "ssm:PutParameter",
    "ssm:RemoveTagsFromResource"
]

kmcquade · 2020-10-20T00:38:50Z

@reetasingh this looks awesome!

I'm good to merge this. But first - can you modify your PR so it updates the documentation for the query action-table section? https://policy-sentry.readthedocs.io/en/latest/querying/action-table/

reetasingh · 2020-10-20T01:04:30Z

https://policy-sentry.readthedocs.io/en/latest/querying/action-table/

@kmcquade updated docs f81e27c

…and (salesforce#261) * add resource type flag in query action-table * add unit test * updating doc for resource-type param

salesforce-cla bot added the cla:signed label Oct 18, 2020

reetasingh changed the title ~~Feature~~ Add --resource-type flag to policy_sentry query action-table command Oct 18, 2020

reetasingh commented Oct 18, 2020

View reviewed changes

reetasingh added 2 commits October 18, 2020 17:38

add resource type flag in query action-table

4c200f1

add unit test

3e6dabb

updating doc for resource-type param

f81e27c

kmcquade mentioned this pull request Oct 20, 2020

Version 0.9.0 Breaking Changes Documentation #251

Closed

reetasingh added the enhancement New feature or request label Oct 20, 2020

reetasingh requested a review from kmcquade October 20, 2020 01:15

updating master

1eb3c2b

kmcquade approved these changes Oct 20, 2020

View reviewed changes

kmcquade merged commit 8bb7a70 into salesforce:master Oct 20, 2020

kmcquade mentioned this pull request Oct 26, 2020

Add --resource-type flag to policy_sentry query action-table command #255

Closed

kmcquade mentioned this pull request Dec 8, 2020

Can't query all services for wildcard only anymore #296

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `--resource-type` flag to `policy_sentry query action-table` command #261

Add `--resource-type` flag to `policy_sentry query action-table` command #261

reetasingh commented Oct 18, 2020 •

edited

Loading

reetasingh Oct 18, 2020

reetasingh commented Oct 18, 2020

reetasingh Oct 18, 2020

reetasingh Oct 18, 2020

reetasingh Oct 18, 2020

reetasingh Oct 18, 2020

reetasingh Oct 18, 2020

reetasingh commented Oct 18, 2020

reetasingh commented Oct 18, 2020

reetasingh commented Oct 18, 2020

reetasingh commented Oct 18, 2020

reetasingh commented Oct 18, 2020

kmcquade commented Oct 20, 2020

reetasingh commented Oct 20, 2020


		if resource_type_name == '*':
		return get_actions_at_access_level_that_support_wildcard_arns_only(service_prefix, access_level)

Add --resource-type flag to policy_sentry query action-table command #261

Add --resource-type flag to policy_sentry query action-table command #261

Conversation

reetasingh commented Oct 18, 2020 • edited Loading

What does this PR do?

What gif best describes this PR or how it makes you feel?

Completion checklist

reetasingh Oct 18, 2020

Choose a reason for hiding this comment

reetasingh commented Oct 18, 2020

reetasingh Oct 18, 2020

Choose a reason for hiding this comment

reetasingh Oct 18, 2020

Choose a reason for hiding this comment

reetasingh Oct 18, 2020

Choose a reason for hiding this comment

reetasingh Oct 18, 2020

Choose a reason for hiding this comment

reetasingh Oct 18, 2020

Choose a reason for hiding this comment

reetasingh commented Oct 18, 2020

reetasingh commented Oct 18, 2020

reetasingh commented Oct 18, 2020

reetasingh commented Oct 18, 2020

reetasingh commented Oct 18, 2020

kmcquade commented Oct 20, 2020

reetasingh commented Oct 20, 2020

Add `--resource-type` flag to `policy_sentry query action-table` command #261

Add `--resource-type` flag to `policy_sentry query action-table` command #261

reetasingh commented Oct 18, 2020 •

edited

Loading