sundowndev
/
driftctl
mirror of https://github.com/sundowndev/driftctl.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1458 from snyk/feat/add_aws_iam_group_policy 

feat: add support for `iam_group_policy`
main
Elie 2022-04-04 15:45:03 +02:00 committed by GitHub
parent 0270e7c574 bbedd4725c
commit 2e31ee5530
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
17 changed files with 172310 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/iac/terraform/state/terraform_state_reader_test.go
View File

@ -129,6 +129,7 @@ func TestTerraformStateReader_AWS_Resources(t *testing.T) {
{name: "IAM role policy", dirName: "aws_iam_role_policy_multiple", wantErr: false},
{name: "IAM role policy attachment", dirName: "aws_iam_role_policy_attachment", wantErr: false},
{name: "IAM user policy attachment", dirName: "aws_iam_user_policy_attachment", wantErr: false},
{name: "IAM group policy", dirName: "aws_iam_group_policy", wantErr: false},
{name: "VPC security group rule", dirName: "aws_vpc_security_group_rule", wantErr: false},
{name: "route table", dirName: "aws_route_table", wantErr: false},
{name: "route table associations", dirName: "aws_route_assoc", wantErr: false},

12
pkg/iac/terraform/state/test/aws_iam_group_policy/results.golden.json Executable file
View File

@ -0,0 +1,12 @@
[
{
"Id": "developers:my_developer_policy",
"Type": "aws_iam_group_policy",
"Attrs": {
"group": "developers",
"id": "developers:my_developer_policy",
"name": "my_developer_policy",
"policy": "{\"Statement\":[{\"Action\":[\"ec2:Describe*\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}],\"Version\":\"2012-10-17\"}"
}
}
]

171757
pkg/iac/terraform/state/test/aws_iam_group_policy/schema.golden.json Executable file
View File

File diff suppressed because it is too large Load Diff

32
pkg/iac/terraform/state/test/aws_iam_group_policy/terraform.tfstate Normal file
View File

@ -0,0 +1,32 @@
{
"version": 4,
"terraform_version": "1.1.6",
"serial": 16,
"lineage": "f4b4fc7c-0808-f110-3f67-fe15e7daec97",
"outputs": {},
"resources": [
{
"mode": "managed",
"type": "aws_iam_group_policy",
"name": "my_developer_policy",
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"group": "developers",
"id": "developers:my_developer_policy",
"name": "my_developer_policy",
"name_prefix": null,
"policy": "{\"Statement\":[{\"Action\":[\"ec2:Describe*\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}],\"Version\":\"2012-10-17\"}"
},
"sensitive_attributes": [],
"private": "bnVsbA==",
"dependencies": [
"aws_iam_group.my_developers"
]
}
]
}
]
}

51
pkg/remote/aws/iam_group_policy_enumerator.go Normal file
View File

@ -0,0 +1,51 @@
package aws
import (
"github.com/snyk/driftctl/pkg/remote/aws/repository"
remoteerror "github.com/snyk/driftctl/pkg/remote/error"
"github.com/snyk/driftctl/pkg/resource"
"github.com/snyk/driftctl/pkg/resource/aws"
)
type IamGroupPolicyEnumerator struct {
repository repository.IAMRepository
factory resource.ResourceFactory
}
func NewIamGroupPolicyEnumerator(repo repository.IAMRepository, factory resource.ResourceFactory) *IamGroupPolicyEnumerator {
return &IamGroupPolicyEnumerator{
repository: repo,
factory: factory,
}
}
func (e *IamGroupPolicyEnumerator) SupportedType() resource.ResourceType {
return aws.AwsIamGroupPolicyResourceType
}
func (e *IamGroupPolicyEnumerator) Enumerate() ([]*resource.Resource, error) {
groups, err := e.repository.ListAllGroups()
if err != nil {
// TODO Use constant instead of string for `aws_iam_group` here when we'll add support for the group resource
return nil, remoteerror.NewResourceListingErrorWithType(err, string(e.SupportedType()), "aws_iam_group")
}
groupPolicies, err := e.repository.ListAllGroupPolicies(groups)
if err != nil {
return nil, remoteerror.NewResourceListingError(err, string(e.SupportedType()))
}
results := make([]*resource.Resource, 0, len(groupPolicies))
for _, groupPolicy := range groupPolicies {
results = append(
results,
e.factory.CreateAbstractResource(
string(e.SupportedType()),
groupPolicy,
map[string]interface{}{},
),
)
}
return results, err
}

1
pkg/remote/aws/init.go
View File

@ -177,6 +177,7 @@ func Init(version string, alerter *alerter.Alerter,
remoteLibrary.AddDetailsFetcher(aws.AwsIamRolePolicyResourceType, common.NewGenericDetailsFetcher(aws.AwsIamRolePolicyResourceType, provider, deserializer))
remoteLibrary.AddEnumerator(NewIamUserPolicyAttachmentEnumerator(iamRepository, factory))
remoteLibrary.AddDetailsFetcher(aws.AwsIamUserPolicyAttachmentResourceType, common.NewGenericDetailsFetcher(aws.AwsIamUserPolicyAttachmentResourceType, provider, deserializer))
remoteLibrary.AddEnumerator(NewIamGroupPolicyEnumerator(iamRepository, factory))
remoteLibrary.AddEnumerator(NewECRRepositoryEnumerator(ecrRepository, factory))
remoteLibrary.AddDetailsFetcher(aws.AwsEcrRepositoryResourceType, common.NewGenericDetailsFetcher(aws.AwsEcrRepositoryResourceType, provider, deserializer))

56
pkg/remote/aws/repository/iam_repository.go
View File

@ -19,6 +19,8 @@ type IAMRepository interface {
ListAllRolePolicies([]*iam.Role) ([]RolePolicy, error)
ListAllUserPolicyAttachments([]*iam.User) ([]*AttachedUserPolicy, error)
ListAllUserPolicies([]*iam.User) ([]string, error)
ListAllGroups() ([]*iam.Group, error)
ListAllGroupPolicies([]*iam.Group) ([]string, error)
}
type iamRepository struct {
@ -255,6 +257,60 @@ func (r *iamRepository) ListAllUserPolicies(users []*iam.User) ([]string, error)
return resources, nil
}
func (r *iamRepository) ListAllGroups() ([]*iam.Group, error) {
cacheKey := "iamListAllGroups"
v := r.cache.GetAndLock(cacheKey)
defer r.cache.Unlock(cacheKey)
if v != nil {
return v.([]*iam.Group), nil
}
var resources []*iam.Group
input := &iam.ListGroupsInput{}
err := r.client.ListGroupsPages(input, func(res *iam.ListGroupsOutput, lastPage bool) bool {
resources = append(resources, res.Groups...)
return !lastPage
})
if err != nil {
return nil, err
}
r.cache.Put(cacheKey, resources)
return resources, nil
}
func (r *iamRepository) ListAllGroupPolicies(groups []*iam.Group) ([]string, error) {
var resources []string
for _, group := range groups {
cacheKey := fmt.Sprintf("iamListAllGroupPolicies_group_%s", *group.GroupName)
if v := r.cache.Get(cacheKey); v != nil {
resources = append(resources, v.([]string)...)
continue
}
groupResources := make([]string, 0)
input := &iam.ListGroupPoliciesInput{
GroupName: group.GroupName,
}
err := r.client.ListGroupPoliciesPages(input, func(res *iam.ListGroupPoliciesOutput, lastPage bool) bool {
for _, polName := range res.PolicyNames {
groupResources = append(groupResources, fmt.Sprintf("%s:%s", *input.GroupName, *polName))
}
return !lastPage
})
if err != nil {
return nil, err
}
r.cache.Put(cacheKey, groupResources)
resources = append(resources, groupResources...)
}
return resources, nil
}
type AttachedUserPolicy struct {
iam.AttachedPolicy
UserName string

183
pkg/remote/aws/repository/iam_repository_test.go
View File

@ -915,3 +915,186 @@ func Test_IAMRepository_ListAllUserPolicies(t *testing.T) {
})
}
}
func Test_IAMRepository_ListAllGroups(t *testing.T) {
tests := []struct {
name string
mocks func(client *awstest.MockFakeIAM)
want []*iam.Group
wantErr error
}{
{
name: "List groups with multiple pages",
mocks: func(client *awstest.MockFakeIAM) {
client.On("ListGroupsPages",
&iam.ListGroupsInput{},
mock.MatchedBy(func(callback func(res *iam.ListGroupsOutput, lastPage bool) bool) bool {
callback(&iam.ListGroupsOutput{Groups: []*iam.Group{
{
GroupName: aws.String("group1"),
},
{
GroupName: aws.String("group2"),
},
}}, false)
callback(&iam.ListGroupsOutput{Groups: []*iam.Group{
{
GroupName: aws.String("group3"),
},
{
GroupName: aws.String("group4"),
},
}}, true)
return true
})).Return(nil).Once()
},
want: []*iam.Group{
{
GroupName: aws.String("group1"),
},
{
GroupName: aws.String("group2"),
},
{
GroupName: aws.String("group3"),
},
{
GroupName: aws.String("group4"),
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
store := cache.New(1)
client := &awstest.MockFakeIAM{}
tt.mocks(client)
r := &iamRepository{
client: client,
cache: store,
}
got, err := r.ListAllGroups()
assert.Equal(t, tt.wantErr, err)
if err == nil {
// Check that results were cached
cachedData, err := r.ListAllGroups()
assert.NoError(t, err)
assert.Equal(t, got, cachedData)
assert.IsType(t, []*iam.Group{}, store.Get("iamListAllGroups"))
}
changelog, err := diff.Diff(got, tt.want)
assert.Nil(t, err)
if len(changelog) > 0 {
for _, change := range changelog {
t.Errorf("%s: %v -> %v", strings.Join(change.Path, "."), change.From, change.To)
}
t.Fail()
}
})
}
}
func Test_IAMRepository_ListAllGroupPolicies(t *testing.T) {
tests := []struct {
name string
groups []*iam.Group
mocks func(client *awstest.MockFakeIAM)
want []string
wantErr error
}{
{
name: "List only group policies with multiple pages",
groups: []*iam.Group{
{
GroupName: aws.String("group1"),
},
{
GroupName: aws.String("group2"),
},
},
mocks: func(client *awstest.MockFakeIAM) {
firstMockCalled := false
client.On("ListGroupPoliciesPages",
&iam.ListGroupPoliciesInput{
GroupName: aws.String("group1"),
},
mock.MatchedBy(func(callback func(res *iam.ListGroupPoliciesOutput, lastPage bool) bool) bool {
if firstMockCalled {
return false
}
callback(&iam.ListGroupPoliciesOutput{PolicyNames: []*string{
aws.String("policy1"),
aws.String("policy2"),
aws.String("policy3"),
}}, false)
callback(&iam.ListGroupPoliciesOutput{PolicyNames: []*string{
aws.String("policy4"),
}}, true)
firstMockCalled = true
return true
})).Return(nil).Once()
client.On("ListGroupPoliciesPages",
&iam.ListGroupPoliciesInput{
GroupName: aws.String("group2"),
},
mock.MatchedBy(func(callback func(res *iam.ListGroupPoliciesOutput, lastPage bool) bool) bool {
callback(&iam.ListGroupPoliciesOutput{PolicyNames: []*string{
aws.String("policy2"),
aws.String("policy22"),
aws.String("policy23"),
}}, false)
callback(&iam.ListGroupPoliciesOutput{PolicyNames: []*string{
aws.String("policy24"),
}}, true)
return true
})).Return(nil).Once()
},
want: []string{
*aws.String("group1:policy1"),
*aws.String("group1:policy2"),
*aws.String("group1:policy3"),
*aws.String("group1:policy4"),
*aws.String("group2:policy2"),
*aws.String("group2:policy22"),
*aws.String("group2:policy23"),
*aws.String("group2:policy24"),
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
store := cache.New(2)
client := &awstest.MockFakeIAM{}
tt.mocks(client)
r := &iamRepository{
client: client,
cache: store,
}
got, err := r.ListAllGroupPolicies(tt.groups)
assert.Equal(t, tt.wantErr, err)
if err == nil {
// Check that results were cached
cachedData, err := r.ListAllGroupPolicies(tt.groups)
assert.NoError(t, err)
assert.Equal(t, got, cachedData)
for _, group := range tt.groups {
assert.IsType(t, []string{}, store.Get(fmt.Sprintf("iamListAllGroupPolicies_group_%s", *group.GroupName)))
}
}
changelog, err := diff.Diff(got, tt.want)
assert.Nil(t, err)
if len(changelog) > 0 {
for _, change := range changelog {
t.Errorf("%s: %v -> %v", strings.Join(change.Path, "."), change.From, change.To)
}
t.Fail()
}
})
}
}

48
pkg/remote/aws/repository/mock_IAMRepository.go
View File

@ -1,4 +1,4 @@
// Code generated by mockery v0.0.0-dev. DO NOT EDIT.
// Code generated by mockery v2.10.0. DO NOT EDIT.
package repository
@ -35,6 +35,52 @@ func (_m *MockIAMRepository) ListAllAccessKeys(_a0 []*iam.User) ([]*iam.AccessKe
return r0, r1
}
// ListAllGroupPolicies provides a mock function with given fields: _a0
func (_m *MockIAMRepository) ListAllGroupPolicies(_a0 []*iam.Group) ([]string, error) {
ret := _m.Called(_a0)
var r0 []string
if rf, ok := ret.Get(0).(func([]*iam.Group) []string); ok {
r0 = rf(_a0)
} else {
if ret.Get(0) != nil {
r0 = ret.Get(0).([]string)
}
}
var r1 error
if rf, ok := ret.Get(1).(func([]*iam.Group) error); ok {
r1 = rf(_a0)
} else {
r1 = ret.Error(1)
}
return r0, r1
}
// ListAllGroups provides a mock function with given fields:
func (_m *MockIAMRepository) ListAllGroups() ([]*iam.Group, error) {
ret := _m.Called()
var r0 []*iam.Group
if rf, ok := ret.Get(0).(func() []*iam.Group); ok {
r0 = rf()
} else {
if ret.Get(0) != nil {
r0 = ret.Get(0).([]*iam.Group)
}
}
var r1 error
if rf, ok := ret.Get(1).(func() error); ok {
r1 = rf()
} else {
r1 = ret.Error(1)
}
return r0, r1
}
// ListAllPolicies provides a mock function with given fields:
func (_m *MockIAMRepository) ListAllPolicies() ([]*iam.Policy, error) {
ret := _m.Called()

81
pkg/remote/aws_iam_scanner_test.go
View File

@ -1163,3 +1163,84 @@ func TestIamRolePolicy(t *testing.T) {
})
}
}
func TestIamGroupPolicy(t *testing.T) {
dummyError := errors.New("this is an error")
tests := []struct {
test string
mocks func(*repository.MockIAMRepository)
assertExpected func(t *testing.T, got []*resource.Resource)
wantErr error
}{
{
test: "multiple groups, with multiples policies",
mocks: func(repository *repository.MockIAMRepository) {
repository.On("ListAllGroups").Return(nil, nil)
repository.On("ListAllGroupPolicies", []*iam.Group(nil)).
Return([]string{"group1:policy1", "group2:policy2"}, nil)
},
assertExpected: func(t *testing.T, got []*resource.Resource) {
assert.Len(t, got, 2)
assert.Equal(t, resourceaws.AwsIamGroupPolicyResourceType, got[0].ResourceType())
assert.Equal(t, "group1:policy1", got[0].ResourceId())
assert.Equal(t, resourceaws.AwsIamGroupPolicyResourceType, got[1].ResourceType())
assert.Equal(t, "group2:policy2", got[1].ResourceId())
},
},
{
test: "cannot list groups",
mocks: func(repository *repository.MockIAMRepository) {
repository.On("ListAllGroups").Return(nil, dummyError)
},
// TODO Use constant instead of string for `aws_iam_group` here when we'll add support for the group resource
wantErr: remoteerr.NewResourceListingErrorWithType(dummyError, resourceaws.AwsIamGroupPolicyResourceType, "aws_iam_group"),
},
{
test: "cannot list policies",
mocks: func(repository *repository.MockIAMRepository) {
repository.On("ListAllGroups").Return(nil, nil)
repository.On("ListAllGroupPolicies", []*iam.Group(nil)).Return(nil, dummyError)
},
wantErr: remoteerr.NewResourceListingError(dummyError, resourceaws.AwsIamGroupPolicyResourceType),
},
}
providerVersion := "3.19.0"
schemaRepository := testresource.InitFakeSchemaRepository("aws", providerVersion)
resourceaws.InitResourcesMetadata(schemaRepository)
factory := terraform.NewTerraformResourceFactory(schemaRepository)
for _, c := range tests {
t.Run(c.test, func(tt *testing.T) {
scanOptions := ScannerOptions{}
remoteLibrary := common.NewRemoteLibrary()
// Initialize mocks
alerter := &mocks.AlerterInterface{}
fakeRepo := &repository.MockIAMRepository{}
c.mocks(fakeRepo)
var repo repository.IAMRepository = fakeRepo
remoteLibrary.AddEnumerator(remoteaws.NewIamGroupPolicyEnumerator(
repo, factory,
))
testFilter := &filter.MockFilter{}
testFilter.On("IsTypeIgnored", mock.Anything).Return(false)
s := NewScanner(remoteLibrary, alerter, scanOptions, testFilter)
got, err := s.Resources()
assert.Equal(tt, c.wantErr, err)
if err != nil {
return
}
c.assertExpected(tt, got)
alerter.AssertExpectations(tt)
fakeRepo.AssertExpectations(tt)
testFilter.AssertExpectations(tt)
})
}
}

3
pkg/resource/aws/aws_iam_group_policy.go Normal file
View File

@ -0,0 +1,3 @@
package aws
const AwsIamGroupPolicyResourceType = "aws_iam_group_policy"

30
pkg/resource/aws/aws_iam_group_policy_test.go Normal file
View File

@ -0,0 +1,30 @@
package aws_test
import (
"testing"
"github.com/snyk/driftctl/test"
"github.com/snyk/driftctl/test/acceptance"
)
func TestAcc_Aws_IamGoupPolicy(t *testing.T) {
acceptance.Run(t, acceptance.AccTestCase{
TerraformVersion: "0.15.5",
Paths: []string{"./testdata/acc/aws_iam_group_policy"},
Args: []string{"scan"},
Checks: []acceptance.AccCheck{
{
Env: map[string]string{
"AWS_REGION": "us-east-1",
},
Check: func(result *test.ScanResult, stdout string, err error) {
if err != nil {
t.Fatal(err)
}
result.AssertInfrastructureIsInSync()
result.AssertManagedCount(1)
},
},
},
})
}

1
pkg/resource/aws/metadata_test.go
View File

@ -70,6 +70,7 @@ func TestAWS_Metadata_Flags(t *testing.T) {
AwsIamUserResourceType: {resource.FlagDeepMode},
AwsIamUserPolicyResourceType: {resource.FlagDeepMode},
AwsIamUserPolicyAttachmentResourceType: {resource.FlagDeepMode},
AwsIamGroupPolicyResourceType: {},
AwsInstanceResourceType: {resource.FlagDeepMode},
AwsInternetGatewayResourceType: {resource.FlagDeepMode},
AwsKeyPairResourceType: {resource.FlagDeepMode},

2
pkg/resource/aws/testdata/acc/aws_iam_group_policy/.driftignore vendored Normal file
View File

@ -0,0 +1,2 @@
*
!aws_iam_group_policy

20
pkg/resource/aws/testdata/acc/aws_iam_group_policy/.terraform.lock.hcl vendored Normal file
View File

@ -0,0 +1,20 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/aws" {
version = "3.19.0"
constraints = "3.19.0"
hashes = [
"h1:+7Vi7p13+cnrxjXbfJiTimGSFR97xCaQwkkvWcreLns=",
"zh:185a5259153eb9ee4699d4be43b3d509386b473683392034319beee97d470c3b",
"zh:2d9a0a01f93e8d16539d835c02b8b6e1927b7685f4076e96cb07f7dd6944bc6c",
"zh:703f6da36b1b5f3497baa38fccaa7765fb8a2b6440344e4c97172516b49437dd",
"zh:770855565462abadbbddd98cb357d2f1a8f30f68a358cb37cbd5c072cb15b377",
"zh:8008db43149fe4345301f81e15e6d9ddb47aa5e7a31648f9b290af96ad86e92a",
"zh:8cdd27d375da6dcb7687f1fed126b7c04efce1671066802ee876dbbc9c66ec79",
"zh:be22ae185005690d1a017c1b909e0d80ab567e239b4f06ecacdba85080667c1c",
"zh:d2d02e72dbd80f607636cd6237a6c862897caabc635c7b50c0cb243d11246723",
"zh:d8f125b66a1eda2555c0f9bbdf12036a5f8d073499a22ca9e4812b68067fea31",
"zh:f5a98024c64d5d2973ff15b093725a074c0cb4afde07ef32c542e69f17ac90bc",
]
}

32
pkg/resource/aws/testdata/acc/aws_iam_group_policy/terraform.tf vendored Normal file
View File

@ -0,0 +1,32 @@
provider "aws" {
region = "us-east-1"
}
terraform {
required_providers {
aws = "3.19.0"
}
}
resource "aws_iam_group" "my_developers" {
name = "developers"
path = "/users/"
}
resource "aws_iam_group_policy" "my_developer_policy" {
name = "my_developer_policy"
group = aws_iam_group.my_developers.name
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = [
"ec2:Describe*",
]
Effect = "Allow"
Resource = "*"
},
]
})
}

1
pkg/resource/resource_types.go
View File

@ -52,6 +52,7 @@ var supportedTypes = map[string]ResourceTypeMeta{
"aws_iam_user_policy_attachment": {children: []ResourceType{
"aws_iam_policy_attachment",
}},
"aws_iam_group_policy": {},
"aws_instance": {children: []ResourceType{
"aws_ebs_volume",
}},