Hello all, My team is writing a

ResourceValidationPolicy

for CrossGuard that is looking for S3 Bucket Policies that would allow public traffic. We are running into complications with the

PolicyDocument.Statement

being a type of

Input<Input<PolicyStatement>[]>

. How can we get at the

PolicyStatement

fields to verify things like

PolicyStatement.Principal

is not set to

*

without a

PolicyStatement.Condition

? Thanks in advance for the help.

You need to do your verifications inside apply()s. This pseudo-code might help?

validateResource: validateResourceOfType(aws.s3.BucketPolicy, (policy, args, reportViolation) => {
  policy.statements.apply((statements: PolicyStatement[]) => {
    statements.forEach(statement => {
      if (statement.principals.length == 1 && statement.principals[0] == "*" && statement.conditions.length == 0) {
        reportViolation(`Statement ${statement.sid} allows any principal but has no conditions applied`);
      }
    });
  });
})

(Code completely untested.. it's just pseudo-code..)

policy

here is an

UnwrappedObject<aws.s3.BucketPolicyArgs>

, and

policy.policy

(which contains the Statement) is a

string | UnwrappedObject<aws.iam.PolicyDocument>

. For me, it ends up a

string

, which means you’ll have to JSON.parse it (and then cast that) to examine its contents. This seems to work for me:

...
validateResource: validateResourceOfType(aws.s3.BucketPolicy, (policy, args, reportViolation) => {
    const policyDoc = JSON.parse(policy.policy as string) as UnwrappedObject<aws.iam.PolicyDocument>;

    const violations = policyDoc.Statement
        .filter(statement => statement.Principal === "*");

    if (violations.length > 0) {
        reportViolation("Hey -- don't do that.");
    }
}),
...

I think aws,iam.PolicyDocument should be an implicit cast-with-marshalling thanks to some Pulumi magic.. if not, then maybe an issue should be raised? It works in Role and other places that use PolicyDocuments.

That may well be, too. Here’s what I see, at least, in my IDE:

And you can't just cast it to an aws.iam.PolicyDocument? Darn. That'd be nice...

Yeah, I agree. I’ll see if I can file something to consider for this one. Thanks!

@little-cartoon-10569 and @miniature-musician-31262 Thanks for the help. We appreciate it. We also discovered that it always comes in as a

string

and we can do the parsing @miniature-musician-31262 suggested. Thanks again.