Skip to content

Cannot use skip-resource-constraints: with --minimize #405

Open
@jtdoepke

Description

@jtdoepke

Evaluating a CRUD policy template with the skip-resource-constraints: key and the --minimize flag set results in an error. For example:

mode: crud
name: 'Example'

wildcard-only:
  service-read: ['s3']
  service-list: ['s3']

skip-resource-constraints:
 - 's3:GetBucketVersioning'

results in

$ policy_sentry --version
policy_sentry, version 0.12.3

$ policy_sentry write-policy --input-file example.yaml --minimize=0

Traceback (most recent call last):
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/policy_sentry/util/arns.py", line 165, in parse_arn
    "partition": elements[1],
IndexError: list index out of range

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/jdoepke/.local/bin/policy_sentry", line 8, in <module>
    sys.exit(main())
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/policy_sentry/bin/cli.py", line 26, in main
    policy_sentry()
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/click/core.py", line 1137, in __call__
    return self.main(*args, **kwargs)
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/click/core.py", line 1062, in main
    rv = self.invoke(ctx)
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/click/core.py", line 1668, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/click/core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/click/core.py", line 763, in invoke
    return __callback(*args, **kwargs)
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/policy_sentry/command/write_policy.py", line 111, in write_policy
    policy = write_policy_with_template(cfg, min_length)
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/policy_sentry/command/write_policy.py", line 135, in write_policy_with_template
    policy = sid_group.process_template(cfg, minimize)
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/policy_sentry/writing/sid_group.py", line 560, in process_template
    rendered_policy = self.get_rendered_policy(minimize)
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/policy_sentry/writing/sid_group.py", line 262, in get_rendered_policy
    arn_details = parse_arn(stmt['Resource'][0])
  File "/home/jdoepke/.local/pipx/venvs/policy-sentry/lib/python3.8/site-packages/policy_sentry/util/arns.py", line 173, in parse_arn
    raise Exception("IndexError: The provided ARN '%s' is invalid. Please provide a valid ARN." % arn)
Exception: IndexError: The provided ARN '*' is invalid. Please provide a valid ARN.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions