handle conditions in IAM policies; add spectro policies

Author: TylerGillson

api/v1alpha1/awsvalidator_types.go

@@ -17,6 +17,8 @@ limitations under the License.
 package v1alpha1
 
 import (
+	"fmt"
+
 	valid8orv1alpha1 "github.com/spectrocloud-labs/valid8or/api/v1alpha1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -36,20 +38,31 @@ type AwsAuth struct {
 }
 
 type IamRule struct {
-	IamRole string `json:"iamRole,omitempty"`
-	// Policies []awspolicy.AwsPolicy `json:"iamPolicies,omitempty"`
-	Policies []PolicyDocument `json:"iamPolicies,omitempty"`
+	IamRole  string           `json:"iamRole"`
+	Policies []PolicyDocument `json:"iamPolicies"`
 }
 
 type PolicyDocument struct {
+	Name       string           `json:"name"`
 	Version    string           `json:"version"`
 	Statements []StatementEntry `json:"statements"`
 }
 
 type StatementEntry struct {
-	Effect   string   `json:"effect"`
-	Actions  []string `json:"actions"`
-	Resource string   `json:"resource"`
+	Condition *Condition `json:"condition,omitempty"`
+	Effect    string     `json:"effect"`
+	Actions   []string   `json:"actions"`
+	Resources []string   `json:"resources"`
+}
+
+type Condition struct {
+	Type   string   `json:"type"`
+	Key    string   `json:"key"`
+	Values []string `json:"values"`
+}
+
+func (c *Condition) String() string {
+	return fmt.Sprintf("%s: %s=%s", c.Type, c.Key, c.Values)
 }
 
 type TagRule struct {

api/v1alpha1/zz_generated.deepcopy.go

@@ -47,35 +47,57 @@ spec:
                 items:
                   properties:
                     iamPolicies:
-                      description: Policies []awspolicy.AwsPolicy `json:"iamPolicies,omitempty"`
                       items:
                         properties:
+                          name:
+                            type: string
                           statements:
                             items:
                               properties:
                                 actions:
                                   items:
                                     type: string
                                   type: array
+                                condition:
+                                  properties:
+                                    key:
+                                      type: string
+                                    type:
+                                      type: string
+                                    values:
+                                      items:
+                                        type: string
+                                      type: array
+                                  required:
+                                  - key
+                                  - type
+                                  - values
+                                  type: object
                                 effect:
                                   type: string
-                                resource:
-                                  type: string
+                                resources:
+                                  items:
+                                    type: string
+                                  type: array
                               required:
                               - actions
                               - effect
-                              - resource
+                              - resources
                               type: object
                             type: array
                           version:
                             type: string
                         required:
+                        - name
                         - statements
                         - version
                         type: object
                       type: array
                     iamRole:
                       type: string
+                  required:
+                  - iamPolicies
+                  - iamRole
                   type: object
                 type: array
               tagRules:

config/crd/bases/validation.spectrocloud.labs_awsvalidators.yaml

@@ -5,13 +5,24 @@ metadata:
 spec:
   auth:
     secretName: aws-creds
-  region: us-west-2
   iamRules:
   - iamPolicies:
-    - statements:
+    - name: Failing Policy
+      statements:
       - actions:
         - "cognito-sync:ListDatasets"
         effect: Allow
-        resource: "*"
+        resources:
+        - "*"
+      - actions:
+        - "iam:PassRole"
+        condition:
+          type: StringEquals
+          key: "iam:PassedToService"
+          values:
+          - fake.amazonaws.com
+        effect: Allow
+        resources:
+        - "*"
       version: "2012-10-17"
     iamRole: SpectroCloudRole