1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

# Policy document helpers ======================================================
# Shared parsing for inline JSON policy documents in plan attributes.
# Used by STR, IAM, and EKM control packages.

package common.policydoc

# concat_array concatenates a list of strings into a comma-separated string,
# or returns empty_val if the list is empty. In case of concatenating a set,
# convert to a list before concatenating.
concat_array(items, empty_val) := empty_val if count(items) == 0
concat_array(items, empty_val) := concat(", ", items) if count(items) > 0

statements(raw) := as_list(json.unmarshal(raw).Statement)

as_list(x) := x if is_array(x)
as_list(x) := [x] if not is_array(x)

actions(stmt) := as_list(stmt.Action)
resources(stmt) := as_list(stmt.Resource)

public_principal(stmt) if stmt.Principal == "*"
public_principal(stmt) if stmt.Principal.AWS == "*"

public_principal(stmt) if {
	some p in as_list(stmt.Principal.AWS)
	p == "*"
}

allows_all_actions(stmt) if {
	some a in actions(stmt)
	a == "*"
}

allows_all_resources(stmt) if {
	some r in resources(stmt)
	r == "*"
}