Repository navigation
fix(E3530): flag NotPrincipal, group ARNs, and string "*" in role trust policies - #4862
Conversation
|
Hi team, on this fix(E3530) PR: the [CI] Test PR workflow run on the current head is still parked waiting for a first-time-contributor approval (action_required). Could a maintainer approve the run so CI can proceed? Thanks. |
|
Hi @kddejong, friendly follow up: the CI runs on this PR are still parked at the first-time-contributor approval gate (action_required), so the checks cannot start until a maintainer approves the run. Could you approve it when you have a moment? Thanks! |
…st policies The trust schema reused the general Principal definitions, so three shapes that IAM CreateRole rejects passed E3530 silently: a NotPrincipal statement, an IAM group ARN as the AWS principal, and the bare string form Principal "*". Tighten policy_trust.json for trust policies only: require Principal (drop the NotPrincipal alternative), reject the string form with a trust-specific object-only Principal, and drop the group alternative from the trust principal ARN patterns. The identity and resource policy schemas are untouched. Fixes aws-cloudformation#4857 Signed-off-by: Varshith Puli <pulivarshit@gmail.com>
3819fd7 to
033b8bc
Compare
TrustAwsPrincipalArn was written before aws-cloudformation#4927 widened the shared principal pattern, so merging reintroduced the false positive on sts root and federated-user ARNs. Take the sts branch from policy.json; the iam branch still omits group deliberately. Also wrap an over-length assertion and cover the CanonicalUser, Federated and Service keys, which were copied without tests.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4862 +/- ##
=======================================
Coverage 94.74% 94.74%
=======================================
Files 442 442
Lines 16105 16105
Branches 3125 3125
=======================================
Hits 15258 15258
Misses 468 468
Partials 379 379
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Summary
E3530 validates
AWS::IAM::Roletrust policies againstpolicy_trust.json, which reused the generalPrincipaldefinitions. Three shapes that IAMCreateRolerejects therefore passed silently, and the stack failed at deploy time. This tightens the trust schema so E3530 flags each of them.Changes (policy_trust.json only; identity and resource policy schemas untouched)
NotPrincipalis no longer an allowed statement property in trust policies, andPrincipalis now required (previouslyrequiredXorwithNotPrincipal). ANotPrincipalstatement now reports E3530.TrustPrincipaldefinition: object-only, so the bare string formPrincipal: "*"is rejected. The object form{"AWS": "*"}stays valid.TrustAwsPrincipalArn: same alternatives as the general definition minus the IAMgroupbranch, so group ARNs are rejected while root, user, role, assumed-role, account ID, and CloudFront ARNs stay valid.Testing
test/unit/rules/resources/iam/test_trust_policy.py: each of the three issue shapes produces zero findings before the fix and E3530 after; valid shapes (root, account ID, user, role, assumed-role, service, federated,{"AWS": "*"}object form, principal lists) verified unaffected.test/unit/rules/resources/: 1323 passed.notprincipal.yamlandprincipal-star-string.yaml, and on the literal group-ARN form. (The!Subgroup form surfaces W1031 warnings instead: the Sub cannot be statically resolved to a concrete ARN at lint time, so the schema check cannot produce a definitive E3530 there.)Fixes #4857