Skip to content

Commit 58bb37c

Browse files
ammokhovammokhov
authored
Fixing Guard Rules (#63)
1 parent 4be1074 commit 58bb37c

File tree

3 files changed

+170
-22
lines changed

3 files changed

+170
-22
lines changed

‎src/rpdk/guard_rail/rule_library/permissions/schema-linter-core-permission-rules.guard

Lines changed: 100 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,38 @@ rule ensure_resource_create_handler_exists_and_have_permissions {
1212
}
1313
>>
1414

15-
handlers.create.permissions.* {
16-
this != %wildcard_notation
15+
handlers.create.permissions exists
16+
<<
17+
{
18+
"result": "NON_COMPLIANT",
19+
"check_id": "PER002",
20+
"message": "Resource create handler MUST have permissions list specified"
21+
}
22+
>>
23+
24+
when handlers.create.permissions exists {
25+
handlers.create.permissions !empty
1726
<<
1827
{
1928
"result": "NON_COMPLIANT",
2029
"check_id": "PER002",
21-
"message": "Resource MUST NOT specify wildcard permissions for create handler"
30+
"message": "Resource create handler MUST have non-empty permissions"
2231
}
2332
>>
2433
}
34+
35+
when handlers.create.permissions !empty {
36+
handlers.create.permissions.* {
37+
this != %wildcard_notation
38+
<<
39+
{
40+
"result": "NON_COMPLIANT",
41+
"check_id": "PER002",
42+
"message": "Resource MUST NOT specify wildcard permissions for create handler"
43+
}
44+
>>
45+
}
46+
}
2547
}
2648

2749
rule ensure_resource_read_handler_exists_and_have_permissions {
@@ -34,16 +56,38 @@ rule ensure_resource_read_handler_exists_and_have_permissions {
3456
}
3557
>>
3658

37-
handlers.read.permissions.* {
38-
this != %wildcard_notation
59+
handlers.read.permissions exists
60+
<<
61+
{
62+
"result": "NON_COMPLIANT",
63+
"check_id": "PER004",
64+
"message": "Resource read handler MUST have permissions list specified"
65+
}
66+
>>
67+
68+
when handlers.read.permissions exists {
69+
handlers.read.permissions !empty
3970
<<
4071
{
4172
"result": "NON_COMPLIANT",
4273
"check_id": "PER004",
43-
"message": "Resource MUST NOT specify wildcard permissions for read handler"
74+
"message": "Resource read handler MUST have non-empty permissions"
4475
}
4576
>>
4677
}
78+
79+
when handlers.read.permissions !empty {
80+
handlers.read.permissions.* {
81+
this != %wildcard_notation
82+
<<
83+
{
84+
"result": "NON_COMPLIANT",
85+
"check_id": "PER004",
86+
"message": "Resource MUST NOT specify wildcard permissions for read handler"
87+
}
88+
>>
89+
}
90+
}
4791
}
4892

4993
rule ensure_resource_update_handler_exists_and_have_permissions {
@@ -102,16 +146,38 @@ rule ensure_resource_delete_handler_exists_and_have_permissions {
102146
}
103147
>>
104148

105-
handlers.delete.permissions.* {
106-
this != %wildcard_notation
149+
handlers.delete.permissions exists
150+
<<
151+
{
152+
"result": "NON_COMPLIANT",
153+
"check_id": "PER009",
154+
"message": "Resource delete handler MUST have permissions list specified"
155+
}
156+
>>
157+
158+
when handlers.delete.permissions exists {
159+
handlers.delete.permissions !empty
107160
<<
108161
{
109162
"result": "NON_COMPLIANT",
110163
"check_id": "PER009",
111-
"message": "Resource MUST NOT specify wildcard permissions for delete handler"
164+
"message": "Resource delete handler MUST have non-empty permissions"
112165
}
113166
>>
114167
}
168+
169+
when handlers.delete.permissions !empty {
170+
handlers.delete.permissions.* {
171+
this != %wildcard_notation
172+
<<
173+
{
174+
"result": "NON_COMPLIANT",
175+
"check_id": "PER009",
176+
"message": "Resource MUST NOT specify wildcard permissions for delete handler"
177+
}
178+
>>
179+
}
180+
}
115181
}
116182

117183
rule ensure_resource_list_handler_exists_and_have_permissions {
@@ -124,14 +190,36 @@ rule ensure_resource_list_handler_exists_and_have_permissions {
124190
}
125191
>>
126192

127-
handlers.list.permissions.* {
128-
this != %wildcard_notation
193+
handlers.list.permissions exists
194+
<<
195+
{
196+
"result": "NON_COMPLIANT",
197+
"check_id": "PER011",
198+
"message": "Resource list handler MUST have permissions list specified"
199+
}
200+
>>
201+
202+
when handlers.list.permissions exists {
203+
handlers.list.permissions !empty
129204
<<
130205
{
131206
"result": "NON_COMPLIANT",
132207
"check_id": "PER011",
133-
"message": "Resource MUST NOT specify wildcard permissions for list handler"
208+
"message": "Resource list handler MUST have non-empty permissions"
134209
}
135210
>>
136211
}
212+
213+
when handlers.list.permissions !empty {
214+
handlers.list.permissions.* {
215+
this != %wildcard_notation
216+
<<
217+
{
218+
"result": "NON_COMPLIANT",
219+
"check_id": "PER011",
220+
"message": "Resource MUST NOT specify wildcard permissions for list handler"
221+
}
222+
>>
223+
}
224+
}
137225
}

‎tests/integ/data/sample-schema.json

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -135,16 +135,16 @@
135135
"permissions": [
136136
"kms:CreateKey",
137137
"kms:EnableKeyRotation",
138-
"kms:DisableKey",
139-
"kms:TagResource"
138+
"kms:DisableKey*",
139+
"kms:TagResource*"
140140
]
141141
},
142142
"read": {
143143
"permissions": [
144144
"kms:DescribeKey",
145145
"kms:GetKeyPolicy",
146-
"kms:GetKeyRotationStatus",
147-
"kms:ListResourceTags"
146+
"kms:GetKeyRotationStatus*",
147+
"kms:ListResourceTags*"
148148
]
149149
},
150150
"update": {
@@ -156,20 +156,20 @@
156156
"kms:EnableKeyRotation",
157157
"kms:PutKeyPolicy",
158158
"kms:TagResource",
159-
"kms:UntagResource",
160-
"kms:UpdateKeyDescription"
159+
"kms:UntagResource*",
160+
"kms:UpdateKeyDescription*"
161161
]
162162
},
163163
"delete": {
164164
"permissions": [
165-
"kms:DescribeKey",
166-
"kms:ScheduleKeyDeletion"
165+
"kms:DescribeKey*",
166+
"kms:ScheduleKeyDeletion*"
167167
]
168168
},
169169
"list": {
170170
"permissions": [
171-
"kms:ListKeys",
172-
"kms:DescribeKey"
171+
"kms:ListKeys*",
172+
"kms:DescribeKey*"
173173
]
174174
}
175175
}

‎tests/integ/runner/test_integ_runner.py

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,66 @@
6464
path="",
6565
)
6666
},
67+
"ensure_resource_create_handler_exists_and_have_permissions": {
68+
GuardRuleResult(
69+
check_id="PER002",
70+
message="Resource MUST NOT specify wildcard permissions for create handler",
71+
path="/handlers/create/permissions/3",
72+
),
73+
GuardRuleResult(
74+
check_id="PER002",
75+
message="Resource MUST NOT specify wildcard permissions for create handler",
76+
path="/handlers/create/permissions/2",
77+
),
78+
},
79+
"ensure_resource_update_handler_exists_and_have_permissions": {
80+
GuardRuleResult(
81+
check_id="PER007",
82+
message="Resource MUST NOT specify wildcard permissions for update handler",
83+
path="/handlers/update/permissions/7",
84+
),
85+
GuardRuleResult(
86+
check_id="PER007",
87+
message="Resource MUST NOT specify wildcard permissions for update handler",
88+
path="/handlers/update/permissions/8",
89+
),
90+
},
91+
"ensure_resource_read_handler_exists_and_have_permissions": {
92+
GuardRuleResult(
93+
check_id="PER004",
94+
message="Resource MUST NOT specify wildcard permissions for read handler",
95+
path="/handlers/read/permissions/2",
96+
),
97+
GuardRuleResult(
98+
check_id="PER004",
99+
message="Resource MUST NOT specify wildcard permissions for read handler",
100+
path="/handlers/read/permissions/3",
101+
),
102+
},
103+
"ensure_resource_delete_handler_exists_and_have_permissions": {
104+
GuardRuleResult(
105+
check_id="PER009",
106+
message="Resource MUST NOT specify wildcard permissions for delete handler",
107+
path="/handlers/delete/permissions/1",
108+
),
109+
GuardRuleResult(
110+
check_id="PER009",
111+
message="Resource MUST NOT specify wildcard permissions for delete handler",
112+
path="/handlers/delete/permissions/0",
113+
),
114+
},
115+
"ensure_resource_list_handler_exists_and_have_permissions": {
116+
GuardRuleResult(
117+
check_id="PER011",
118+
message="Resource MUST NOT specify wildcard permissions for list handler",
119+
path="/handlers/list/permissions/1",
120+
),
121+
GuardRuleResult(
122+
check_id="PER011",
123+
message="Resource MUST NOT specify wildcard permissions for list handler",
124+
path="/handlers/list/permissions/0",
125+
),
126+
},
67127
},
68128
{
69129
"ensure_properties_do_not_support_multitype": {

0 commit comments

Comments
 (0)