IAM 策略语法校验和解析器
这是一个简单的IAM政策库,可以让您安全地解析并导航IAM政策,而不用担心解析政策或验证语法的更困难的细节.
这个将来可能会更新,允许修改政策,现在只读.
验证策略语法 validatePolicySyntax
validatePolicySyntax 是一个语法 linter, 并且不会验证该策略是逻辑的, 安全的, 或者正确的 .
这将带走任何对象并返回一系列发现。 如果数组为空,则策略有效.
import { validatePolicySyntax } from '@cloud-copilot/iam-policy'
validatePolicySyntax({
Version: '2012-10-17',
Statement: [
{
Sid: 'VisualEditor0',
Effect: 'Allow',
Action: 's3:GetObject',
Resource: 'arn:aws:s3:::mybucket/*'
}
]
}) // []
validatePolicySyntax({
Version: '2012-10-17',
Statement: [
{
Sid: 7,
Effect: 'Allow',
Action: 's3:GetObject',
Resource: 'arn:aws:s3:::mybucket/*'
}
]
}) // [{ message: 'Found data type number allowed type(s) are string', path: 'Statement[0].Sid'}]
/* It will attempt to find as many issues as possible in one pass */
validatePolicySyntax({
Version: '2012-10-17',
Comment: 'Jacob is kewl',
Statement: [
{
Sid: 'SomeStatement',
Effect: 7,
Action: 's3:GetObject',
Resource: 'arn:aws:s3:::mybucket/*'
},
{
Sid: 'SomeStatement',
Effect: ['Allow'],
Action: 's3:GetObject',
Resource: 'arn:aws:s3:::mybucket/*',
Condition: {
NumericLessThan: {
's3:max-keys': 7
},
StringLike: {
's3:authType': new RegExp(/REST.*/),
'aws:TagKeys/Foo': ['Bar*', 'Baz*']
}
}
}
]
}) /*
[
{ message: 'Invalid key Comment', path: 'Comment' },
{ message: 'Effect must be present and exactly "Allow" or "Deny"', path: 'Statement[0].Effect' },
{ message: 'Effect must be present and exactly "Allow" or "Deny"', path: 'Statement[1].Effect' },
{ message: 'Found data type object allowed type(s) are string, boolean, number', path: 'Statement[1].Condition.StringLike.s3:authType' }
]
*/
验证特定政策类型
有一些功能可以验证具体的政策类型,这些功能可以进行所有的一般政策验证,并对具体的政策类型进行额外检查. 例如,服务控制政策只允许在效果被拒绝时使用条件要素.
validateIdentityPolicy(policy: any): ValidationError[]validateServiceControlPolicy(policy: any): ValidationError[]validateResourcePolicy(policy: any): ValidationError[]validateTrustPolicy(policy: any): ValidationError[]validateResourceControlPolicy(policy: any): ValidationError[]validateEndpointPolicy(policy: any): ValidationError[]validateSessionPolicy(policy: any): ValidationError[]
IAM 政策分析和处理 loadPolicy
loadPolicy 不验证政策,如果需要先于时间使用验证 validatePolicySyntax。 。 。 .
将政策元素规范化,这些元素是对象/对象的阵列或弦/弦的阵列
import { loadPolicy } from '@cloud-copilot/iam-policy'
//Statement can be an array of objects
const policyOne = {
Version: '2012-10-17',
Statement: [
{
Sid: 'ArrayStatement',
Effect: 'Allow',
Action: ['s3:GetObject'],
Resource: 'arn:aws:s3:::government-secrets/*'
}
]
}
//Statement can also be a single object
const policyTwo = {
Version: '2012-10-17',
Statement: {
Sid: 'ObjectStatement',
Effect: 'Allow',
Action: ['s3:GetObject'],
Resource: 'arn:aws:s3:::government-secrets/*'
}
}
//In both cases you can use the `statements` function to get an array of statements
const p1 = loadPolicy(policyOne)
const p2 = loadPolicy(policyTwo)
console.log(p1.statements()[0].sid()) //ArrayStatement
console.log(p2.statements()[0].sid()) //ObjectStatement
对条件价值、主要价值和资源也有类似的支持.
相互排斥或任择政策要素
在机构间咨询小组的政策中,有一些相互排斥的要素。 比如,你不能有一个 Principal (单位:千美元) NotPrincipal 在同一声明中。 有些要素是完全可选的。 我们利用Typescript类型系统来确保您只访问经确认存在于策略中的数据.
import{ loadPolicy } from '@cloud-copilot/iam-policy'
const actionPolicy = {
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"s3:GetObject",
],
"Resource": "arn:aws:s3:::government-secrets/*"
}
};
const p = loadPolicy(actionPolicy);
const statement = p.statements()[0]; // Get the first statement out
statement.actions() // Compile time error because Statement does not the `actions` function
if(statement.isActionStatement()) {
// Type is narrowed to ActionStatement so `actions` is now available
statement.actions() /
}
if(statement.isNotActionStatement()) {
// Will not exectue because the statement does not have a NotAction element
}
isNotActionStatement 检查“不行动”元素的存在,而不是反向 isActionStatement. 声明有可能对双方都是虚假的 isActionStatement 财务报告和审定财务报表 isNotActionStatement 如果报表中缺少两个要素.
也有类似的支持 Action, (中文(简体) ), NotAction, (中文(简体) ), Principal, (中文(简体) ), NotPrincipal, (中文(简体) ), Resource,以及 NotResource 要素.
平整复合结构
将复杂元素平整为一团同质物体来简化. 例如:主值可以是字符串或对象;对象值可以是字符串或数组的字符串. 我们把这些物体平整成一系列物体, 类似于您在地球政策中定义的物体.
import { loadPolicy } from '@cloud-copilot/iam-policy'
const principalPolicy = {
Version: '2012-10-17',
Statement: {
Effect: 'Allow',
Principal: {
AWS: ['arn:aws:iam::123456789012:root', 'arn:aws:iam::123456789013:user/FoxMulder'],
CanonicalUser: '79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be',
Federated: 'cognito-identity.amazonaws.com'
},
Action: ['s3:GetObject'],
Resource: 'arn:aws:s3:::government-secrets/*'
}
}
const p = loadPolicy(principalPolicy)
const statement = p.statements()[0] // Get the first statement out
if (statement.isPrincipalStatement()) {
//Get an array of 4 Principal objects with a type and value
const principals = statement.principals()
principals[0].type() //AWS
principals[0].value() //arn:aws:iam::123456789012:root
//and so on
principals[3].type() //Federated
principals[3].value() //cognito-identity.amazonaws.com
}
还有类似的平面 Condition 键.
import { loadPolicy } from '@cloud-copilot/iam-policy'
const principalPolicy = {
Version: '2012-10-17',
Statement: {
Effect: 'Allow',
Principal: {
AWS: 'arn:aws:iam::123456789012:root'
},
Action: ['s3:GetObject'],
Resource: 'arn:aws:s3:::government-secrets/*',
Condition: {
StringEquals: {
's3:prefix': 'home/${aws:username}',
'aws:PrincipalOrgID': 'o-1234567890'
},
StringLike: {
's3:authType': 'REST*',
'aws:TagKeys/Foo': ['Bar*', 'Baz*']
}
}
}
}
const p = loadPolicy(principalPolicy)
const statement = p.statements()[0] // Get the first statement out
const conditions = statement.conditions()
conditions[0].operation().value() //StringEquals
conditions[0].conditionKey() //s3:prefix
conditions[0].conditionValues() //[ home/${aws:username} ]
//and so on
conditions[3].operation().value() //StringLike
conditions[3].conditionKey() //aws:TagKeys/Foo
conditions[3].conditionValues() // [Bar*, Baz*]