This message was deleted.

You need to do your verifications inside apply()s. This pseudo-code might help?

validateResource: validateResourceOfType(aws.s3.BucketPolicy, (policy, args, reportViolation) => {
  policy.statements.apply((statements: PolicyStatement[]) => {
    statements.forEach(statement => {
      if (statement.principals.length == 1 && statement.principals[0] == "*" && statement.conditions.length == 0) {
        reportViolation(`Statement ${statement.sid} allows any principal but has no conditions applied`);
      }
    });
  });
})

(Code completely untested.. it's just pseudo-code..)

policy

here is an

UnwrappedObject<aws.s3.BucketPolicyArgs>

, and

policy.policy

(which contains the Statement) is a

string | UnwrappedObject<aws.iam.PolicyDocument>

. For me, it ends up a

string

, which means you’ll have to JSON.parse it (and then cast that) to examine its contents. This seems to work for me:

...
validateResource: validateResourceOfType(aws.s3.BucketPolicy, (policy, args, reportViolation) => {
    const policyDoc = JSON.parse(policy.policy as string) as UnwrappedObject<aws.iam.PolicyDocument>;

    const violations = policyDoc.Statement
        .filter(statement => statement.Principal === "*");

    if (violations.length > 0) {
        reportViolation("Hey -- don't do that.");
    }
}),
...

I think aws,iam.PolicyDocument should be an implicit cast-with-marshalling thanks to some Pulumi magic.. if not, then maybe an issue should be raised? It works in Role and other places that use PolicyDocuments.

That may well be, too. Here’s what I see, at least, in my IDE:

And you can't just cast it to an aws.iam.PolicyDocument? Darn. That'd be nice...

Yeah, I agree. I’ll see if I can file something to consider for this one. Thanks!

@little-cartoon-10569 and @miniature-musician-31262 Thanks for the help. We appreciate it. We also discovered that it always comes in as a

string

and we can do the parsing @miniature-musician-31262 suggested. Thanks again.