Update IAM policy checks to validate resources (aws-cloudformation#2023)

omkhegde · May 27, 2021 · f576bd5 · f576bd5
1 parent 14d5d41
commit f576bd5
Show file tree

Hide file tree

Showing 4 changed files with 29 additions and 3 deletions.
diff --git a/src/cfnlint/rules/resources/iam/Policy.py b/src/cfnlint/rules/resources/iam/Policy.py
@@ -5,7 +5,7 @@
 import json
 from datetime import date
 import six
-from cfnlint.helpers import convert_dict
+from cfnlint.helpers import convert_dict, FUNCTIONS_SINGLE
 from cfnlint.rules import CloudFormationLintRule
 from cfnlint.rules import RuleMatch
 
@@ -154,6 +154,23 @@ def _check_policy_statement(self, branch, statement, is_identity_policy, resourc
                 matches.append(
                     RuleMatch(branch[:], message))
 
+        resources = statement.get('Resource', [])
+        if isinstance(resources, six.string_types):
+            resources = [resources]
+
+        for index, resource in enumerate(resources):
+            if isinstance(resource, dict):
+                if len(resource) == 1:
+                    for k in resource.keys():
+                        if k not in FUNCTIONS_SINGLE:
+                            message = 'IAM Policy statement Resource incorrectly formatted'
+                            matches.append(
+                                RuleMatch(branch[:] + ['Resource', index], message))
+                else:
+                    message = 'IAM Policy statement Resource incorrectly formatted'
+                    matches.append(
+                        RuleMatch(branch[:] + ['Resource', index], message))
+
         return(matches)
 
     def match_resource_properties(self, properties, resourcetype, path, cfn):

diff --git a/.../templates/bad/properties_iam_policy.yaml → ...mplates/bad/resources/iam/iam_policy.yaml b/.../templates/bad/properties_iam_policy.yaml → ...mplates/bad/resources/iam/iam_policy.yaml
@@ -22,6 +22,15 @@ Resources:
         - Resource: '*'
           Effect: 'NotAllow'
           Principal: [123456789012]
+        - Effect: Allow
+          Action:
+          - cloudwatch:*
+          Resource:
+          - Effect: Allow
+          - Effect: Allow
+            Action:
+            - cloudwatch:*
+            Resource: '*'
   rIamPolicy:
     Type: AWS::IAM::Policy
     Properties:

diff --git a/test/unit/module/config/test_config_mixin.py b/test/unit/module/config/test_config_mixin.py
@@ -158,7 +158,7 @@ def test_config_expand_ignore_templates(self, yaml_mock):
         # test defaults
         self.assertNotIn(
             'test/fixtures/templates/bad/resources/iam/resource_policy.yaml', config.templates)
-        self.assertEqual(len(config.templates), 4)
+        self.assertEqual(len(config.templates), 5)
 
     @patch('cfnlint.config.ConfigFileArgs._read_config', create=True)
     def test_config_merge(self, yaml_mock):

diff --git a/test/unit/rules/resources/iam/test_iam_policy.py b/test/unit/rules/resources/iam/test_iam_policy.py
@@ -24,7 +24,7 @@ def test_file_positive(self):
 
     def test_file_negative(self):
         """Test failure"""
-        self.helper_file_negative('test/fixtures/templates/bad/properties_iam_policy.yaml', 10)
+        self.helper_file_negative('test/fixtures/templates/bad/resources/iam/iam_policy.yaml', 12)
 
     def test_file_resource_negative(self):
         """Test failure"""