You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
687 lines
21 KiB
687 lines
21 KiB
package policy
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestConditionSetOperators(t *testing.T) {
|
|
engine := setupTestPolicyEngine(t)
|
|
|
|
t.Run("ForAnyValue:StringEquals", func(t *testing.T) {
|
|
trustPolicy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowOIDC",
|
|
Effect: "Allow",
|
|
Action: []string{"sts:AssumeRoleWithWebIdentity"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"ForAnyValue:StringEquals": {
|
|
"oidc:roles": []string{"Dev.SeaweedFS.TestBucket.ReadWrite", "Dev.SeaweedFS.Admin"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
// Match: Admin is in the requested roles
|
|
evalCtxMatch := &EvaluationContext{
|
|
Principal: "web-identity-user",
|
|
Action: "sts:AssumeRoleWithWebIdentity",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"oidc:roles": []string{"Dev.SeaweedFS.Admin", "OtherRole"},
|
|
},
|
|
}
|
|
resultMatch, err := engine.EvaluateTrustPolicy(context.Background(), trustPolicy, evalCtxMatch)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultMatch.Effect)
|
|
|
|
// No Match
|
|
evalCtxNoMatch := &EvaluationContext{
|
|
Principal: "web-identity-user",
|
|
Action: "sts:AssumeRoleWithWebIdentity",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"oidc:roles": []string{"OtherRole1", "OtherRole2"},
|
|
},
|
|
}
|
|
resultNoMatch, err := engine.EvaluateTrustPolicy(context.Background(), trustPolicy, evalCtxNoMatch)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectDeny, resultNoMatch.Effect)
|
|
|
|
// No Match: Empty context for ForAnyValue (should deny)
|
|
evalCtxEmpty := &EvaluationContext{
|
|
Principal: "web-identity-user",
|
|
Action: "sts:AssumeRoleWithWebIdentity",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"oidc:roles": []string{},
|
|
},
|
|
}
|
|
resultEmpty, err := engine.EvaluateTrustPolicy(context.Background(), trustPolicy, evalCtxEmpty)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectDeny, resultEmpty.Effect, "ForAnyValue should deny when context is empty")
|
|
})
|
|
|
|
t.Run("ForAllValues:StringEquals", func(t *testing.T) {
|
|
trustPolicyAll := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowOIDCAll",
|
|
Effect: "Allow",
|
|
Action: []string{"sts:AssumeRoleWithWebIdentity"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"ForAllValues:StringEquals": {
|
|
"oidc:roles": []string{"RoleA", "RoleB", "RoleC"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
// Match: All requested roles ARE in the allowed set
|
|
evalCtxAllMatch := &EvaluationContext{
|
|
Principal: "web-identity-user",
|
|
Action: "sts:AssumeRoleWithWebIdentity",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"oidc:roles": []string{"RoleA", "RoleB"},
|
|
},
|
|
}
|
|
resultAllMatch, err := engine.EvaluateTrustPolicy(context.Background(), trustPolicyAll, evalCtxAllMatch)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultAllMatch.Effect)
|
|
|
|
// Fail: RoleD is NOT in the allowed set
|
|
evalCtxAllFail := &EvaluationContext{
|
|
Principal: "web-identity-user",
|
|
Action: "sts:AssumeRoleWithWebIdentity",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"oidc:roles": []string{"RoleA", "RoleD"},
|
|
},
|
|
}
|
|
resultAllFail, err := engine.EvaluateTrustPolicy(context.Background(), trustPolicyAll, evalCtxAllFail)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectDeny, resultAllFail.Effect)
|
|
|
|
// Vacuously true: Request has NO roles
|
|
evalCtxEmpty := &EvaluationContext{
|
|
Principal: "web-identity-user",
|
|
Action: "sts:AssumeRoleWithWebIdentity",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"oidc:roles": []string{},
|
|
},
|
|
}
|
|
resultEmpty, err := engine.EvaluateTrustPolicy(context.Background(), trustPolicyAll, evalCtxEmpty)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultEmpty.Effect)
|
|
})
|
|
|
|
t.Run("ForAllValues:NumericEqualsVacuouslyTrue", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowNumericAll",
|
|
Effect: "Allow",
|
|
Action: []string{"sts:AssumeRole"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"ForAllValues:NumericEquals": {
|
|
"aws:MultiFactorAuthAge": []string{"3600", "7200"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
// Vacuously true: Request has NO MFA age info
|
|
evalCtxEmpty := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "sts:AssumeRole",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:MultiFactorAuthAge": []string{},
|
|
},
|
|
}
|
|
resultEmpty, err := engine.EvaluateTrustPolicy(context.Background(), policy, evalCtxEmpty)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultEmpty.Effect, "Should allow when numeric context is empty for ForAllValues")
|
|
})
|
|
|
|
t.Run("ForAllValues:BoolVacuouslyTrue", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowBoolAll",
|
|
Effect: "Allow",
|
|
Action: []string{"sts:AssumeRole"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"ForAllValues:Bool": {
|
|
"aws:SecureTransport": "true",
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
// Vacuously true
|
|
evalCtxEmpty := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "sts:AssumeRole",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:SecureTransport": []interface{}{},
|
|
},
|
|
}
|
|
resultEmpty, err := engine.EvaluateTrustPolicy(context.Background(), policy, evalCtxEmpty)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultEmpty.Effect, "Should allow when bool context is empty for ForAllValues")
|
|
})
|
|
|
|
t.Run("ForAllValues:DateVacuouslyTrue", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowDateAll",
|
|
Effect: "Allow",
|
|
Action: []string{"sts:AssumeRole"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"ForAllValues:DateGreaterThan": {
|
|
"aws:CurrentTime": "2020-01-01T00:00:00Z",
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
// Vacuously true
|
|
evalCtxEmpty := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "sts:AssumeRole",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:CurrentTime": []interface{}{},
|
|
},
|
|
}
|
|
resultEmpty, err := engine.EvaluateTrustPolicy(context.Background(), policy, evalCtxEmpty)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultEmpty.Effect, "Should allow when date context is empty for ForAllValues")
|
|
})
|
|
|
|
t.Run("ForAllValues:DateWithLabelsAsStrings", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowDateStrings",
|
|
Effect: "Allow",
|
|
Action: []string{"sts:AssumeRole"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"ForAllValues:DateGreaterThan": {
|
|
"aws:CurrentTime": "2020-01-01T00:00:00Z",
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
evalCtx := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "sts:AssumeRole",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:CurrentTime": []string{"2021-01-01T00:00:00Z", "2022-01-01T00:00:00Z"},
|
|
},
|
|
}
|
|
result, err := engine.EvaluateTrustPolicy(context.Background(), policy, evalCtx)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, result.Effect, "Should allow when date context is a slice of strings")
|
|
})
|
|
|
|
t.Run("ForAllValues:BoolWithLabelsAsStrings", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowBoolStrings",
|
|
Effect: "Allow",
|
|
Action: []string{"sts:AssumeRole"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"ForAllValues:Bool": {
|
|
"aws:SecureTransport": "true",
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
evalCtx := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "sts:AssumeRole",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:SecureTransport": []string{"true", "true"},
|
|
},
|
|
}
|
|
result, err := engine.EvaluateTrustPolicy(context.Background(), policy, evalCtx)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, result.Effect, "Should allow when bool context is a slice of strings")
|
|
})
|
|
|
|
t.Run("StringEqualsIgnoreCaseWithVariable", func(t *testing.T) {
|
|
policyDoc := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowVar",
|
|
Effect: "Allow",
|
|
Action: []string{"s3:GetObject"},
|
|
Resource: []string{"arn:aws:s3:::bucket/*"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"StringEqualsIgnoreCase": {
|
|
"s3:prefix": "${aws:username}/",
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
err := engine.AddPolicy("", "var-policy", policyDoc)
|
|
require.NoError(t, err)
|
|
|
|
evalCtx := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/ALICE/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"s3:prefix": "ALICE/",
|
|
"aws:username": "alice",
|
|
},
|
|
}
|
|
|
|
result, err := engine.Evaluate(context.Background(), "", evalCtx, []string{"var-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, result.Effect, "Should allow when variable expands and matches case-insensitively")
|
|
})
|
|
|
|
t.Run("StringLike:CaseSensitivity", func(t *testing.T) {
|
|
policyDoc := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowCaseSensitiveLike",
|
|
Effect: "Allow",
|
|
Action: []string{"s3:GetObject"},
|
|
Resource: []string{"arn:aws:s3:::bucket/*"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"StringLike": {
|
|
"s3:prefix": "Project/*",
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
err := engine.AddPolicy("", "like-policy", policyDoc)
|
|
require.NoError(t, err)
|
|
|
|
// Match: Case sensitive match
|
|
evalCtxMatch := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/Project/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"s3:prefix": "Project/data",
|
|
},
|
|
}
|
|
resultMatch, err := engine.Evaluate(context.Background(), "", evalCtxMatch, []string{"like-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultMatch.Effect, "Should allow when case matches exactly")
|
|
|
|
// Fail: Case insensitive match (should fail for StringLike)
|
|
evalCtxFail := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/project/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"s3:prefix": "project/data", // lowercase 'p'
|
|
},
|
|
}
|
|
resultFail, err := engine.Evaluate(context.Background(), "", evalCtxFail, []string{"like-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectDeny, resultFail.Effect, "Should deny when case does not match for StringLike")
|
|
})
|
|
|
|
t.Run("NumericNotEquals:Logic", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "DenySpecificAges",
|
|
Effect: "Allow",
|
|
Action: []string{"sts:AssumeRole"},
|
|
Resource: []string{"*"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"ForAllValues:NumericNotEquals": {
|
|
"aws:MultiFactorAuthAge": []string{"3600", "7200"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
err := engine.AddPolicy("", "numeric-not-equals-policy", policy)
|
|
require.NoError(t, err)
|
|
|
|
// Fail: One age matches an excluded value (3600)
|
|
evalCtxFail := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "sts:AssumeRole",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:MultiFactorAuthAge": []string{"3600", "1800"},
|
|
},
|
|
}
|
|
resultFail, err := engine.Evaluate(context.Background(), "", evalCtxFail, []string{"numeric-not-equals-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectDeny, resultFail.Effect, "Should deny when one age matches an excluded value")
|
|
|
|
// Pass: No age matches any excluded value
|
|
evalCtxPass := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "sts:AssumeRole",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:MultiFactorAuthAge": []string{"1800", "900"},
|
|
},
|
|
}
|
|
resultPass, err := engine.Evaluate(context.Background(), "", evalCtxPass, []string{"numeric-not-equals-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultPass.Effect, "Should allow when no age matches excluded values")
|
|
})
|
|
|
|
t.Run("DateNotEquals:Logic", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "DenySpecificTimes",
|
|
Effect: "Allow",
|
|
Action: []string{"sts:AssumeRole"},
|
|
Resource: []string{"*"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"ForAllValues:DateNotEquals": {
|
|
"aws:CurrentTime": []string{"2024-01-01T00:00:00Z", "2024-01-02T00:00:00Z"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
err := engine.AddPolicy("", "date-not-equals-policy", policy)
|
|
require.NoError(t, err)
|
|
|
|
// Fail: One time matches an excluded value
|
|
evalCtxFail := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "sts:AssumeRole",
|
|
Resource: "arn:aws:iam::role/test-role",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:CurrentTime": []string{"2024-01-01T00:00:00Z", "2024-01-03T00:00:00Z"},
|
|
},
|
|
}
|
|
resultFail, err := engine.Evaluate(context.Background(), "", evalCtxFail, []string{"date-not-equals-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectDeny, resultFail.Effect, "Should deny when one date matches an excluded value")
|
|
})
|
|
|
|
t.Run("IpAddress:SetOperators", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowSpecificIPs",
|
|
Effect: "Allow",
|
|
Action: []string{"s3:GetObject"},
|
|
Resource: []string{"*"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"ForAllValues:IpAddress": {
|
|
"aws:SourceIp": []string{"192.168.1.0/24", "10.0.0.1"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
err := engine.AddPolicy("", "ip-set-policy", policy)
|
|
require.NoError(t, err)
|
|
|
|
// Match: All source IPs are in allowed ranges
|
|
evalCtxMatch := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:SourceIp": []string{"192.168.1.10", "10.0.0.1"},
|
|
},
|
|
}
|
|
resultMatch, err := engine.Evaluate(context.Background(), "", evalCtxMatch, []string{"ip-set-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultMatch.Effect)
|
|
|
|
// Fail: One source IP is NOT in allowed ranges
|
|
evalCtxFail := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:SourceIp": []string{"192.168.1.10", "172.16.0.1"},
|
|
},
|
|
}
|
|
resultFail, err := engine.Evaluate(context.Background(), "", evalCtxFail, []string{"ip-set-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectDeny, resultFail.Effect)
|
|
|
|
// ForAnyValue: IPAddress
|
|
policyAny := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowAnySpecificIPs",
|
|
Effect: "Allow",
|
|
Action: []string{"s3:GetObject"},
|
|
Resource: []string{"*"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"ForAnyValue:IpAddress": {
|
|
"aws:SourceIp": []string{"192.168.1.0/24"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
err = engine.AddPolicy("", "ip-any-policy", policyAny)
|
|
require.NoError(t, err)
|
|
|
|
evalCtxAnyMatch := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:SourceIp": []string{"192.168.1.10", "172.16.0.1"},
|
|
},
|
|
}
|
|
resultAnyMatch, err := engine.Evaluate(context.Background(), "", evalCtxAnyMatch, []string{"ip-any-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultAnyMatch.Effect)
|
|
})
|
|
|
|
t.Run("IpAddress:SingleStringValue", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowSingleIP",
|
|
Effect: "Allow",
|
|
Action: []string{"s3:GetObject"},
|
|
Resource: []string{"*"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"IpAddress": {
|
|
"aws:SourceIp": "192.168.1.1",
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
err := engine.AddPolicy("", "ip-single-policy", policy)
|
|
require.NoError(t, err)
|
|
|
|
evalCtxMatch := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:SourceIp": "192.168.1.1",
|
|
},
|
|
}
|
|
resultMatch, err := engine.Evaluate(context.Background(), "", evalCtxMatch, []string{"ip-single-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultMatch.Effect)
|
|
|
|
evalCtxNoMatch := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:SourceIp": "10.0.0.1",
|
|
},
|
|
}
|
|
resultNoMatch, err := engine.Evaluate(context.Background(), "", evalCtxNoMatch, []string{"ip-single-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectDeny, resultNoMatch.Effect)
|
|
})
|
|
|
|
t.Run("Bool:StringSlicePolicyValues", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowWithBoolStrings",
|
|
Effect: "Allow",
|
|
Action: []string{"s3:GetObject"},
|
|
Resource: []string{"*"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"Bool": {
|
|
"aws:SecureTransport": []string{"true", "false"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
err := engine.AddPolicy("", "bool-string-slice-policy", policy)
|
|
require.NoError(t, err)
|
|
|
|
evalCtx := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"aws:SecureTransport": "true",
|
|
},
|
|
}
|
|
result, err := engine.Evaluate(context.Background(), "", evalCtx, []string{"bool-string-slice-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, result.Effect)
|
|
})
|
|
|
|
t.Run("StringEqualsIgnoreCase:StringSlicePolicyValues", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowWithIgnoreCaseStrings",
|
|
Effect: "Allow",
|
|
Action: []string{"s3:GetObject"},
|
|
Resource: []string{"*"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"StringEqualsIgnoreCase": {
|
|
"s3:x-amz-server-side-encryption": []string{"AES256", "aws:kms"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
err := engine.AddPolicy("", "string-ignorecase-slice-policy", policy)
|
|
require.NoError(t, err)
|
|
|
|
evalCtx := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"s3:x-amz-server-side-encryption": "aes256",
|
|
},
|
|
}
|
|
result, err := engine.Evaluate(context.Background(), "", evalCtx, []string{"string-ignorecase-slice-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, result.Effect)
|
|
})
|
|
|
|
t.Run("IpAddress:CustomContextKey", func(t *testing.T) {
|
|
policy := &PolicyDocument{
|
|
Version: "2012-10-17",
|
|
Statement: []Statement{
|
|
{
|
|
Sid: "AllowCustomIPKey",
|
|
Effect: "Allow",
|
|
Action: []string{"s3:GetObject"},
|
|
Resource: []string{"*"},
|
|
Condition: map[string]map[string]interface{}{
|
|
"IpAddress": {
|
|
"custom:VpcIp": "10.0.0.0/16",
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
err := engine.AddPolicy("", "ip-custom-key-policy", policy)
|
|
require.NoError(t, err)
|
|
|
|
evalCtxMatch := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"custom:VpcIp": "10.0.5.1",
|
|
},
|
|
}
|
|
resultMatch, err := engine.Evaluate(context.Background(), "", evalCtxMatch, []string{"ip-custom-key-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectAllow, resultMatch.Effect)
|
|
|
|
evalCtxNoMatch := &EvaluationContext{
|
|
Principal: "user",
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/file.txt",
|
|
RequestContext: map[string]interface{}{
|
|
"custom:VpcIp": "192.168.1.1",
|
|
},
|
|
}
|
|
resultNoMatch, err := engine.Evaluate(context.Background(), "", evalCtxNoMatch, []string{"ip-custom-key-policy"})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, EffectDeny, resultNoMatch.Effect)
|
|
})
|
|
}
|