src/kelp/__init__.py
def compare_permissions(functions):
    """Compare permissions provisioned vs permissions used"""
    logger.info("Comparing permissions requested vs used")
    logger.debug(functions)
    lp = True
    for function in functions.values():
        logger.info(f"Checking {function['name']}")
        # Get and potentially fix policy
        policy = function["policy"]
        lp_policy = function["lp_policy"]
        if type(policy["Resource"]) == list:
            policy["Resource"] = policy["Resource"][0]
        if type(lp_policy["Resource"]) == list:
            lp_policy["Resource"] = lp_policy["Resource"][0]

        # Check Effect, Action, and Resources
        if policy["Effect"] != lp_policy["Effect"]:
            logger.info(f"  Effect {policy['Effect']} != {lp_policy['Effect']}")
            lp = False
        if policy["Action"] != lp_policy["Action"]:
            logger.info(f"  Action {policy['Action']} != {lp_policy['Action']}")
            lp = False
        if policy["Resource"] != lp_policy["Resource"]:
            logger.info(f"  Resource: {policy['Resource']} != {lp_policy['Resource']}")
            lp = False
        if lp:
            logger.success(f"Lambda {function['name']} has a least privileged IAM role ✓")
            continue

        logger.error(f"Lambda {function['name']} doesn't have a least privileged IAM role")
        logger.error(f"The role was: {json.dumps(policy,indent=2)}")
        logger.success(f"The role should be: {json.dumps(lp_policy,indent=2)}")
Compare permissions provisioned vs permissions used
Compare permissions provisioned vs permissions used
Compare permissions provisioned vs permissions used
def compare_permissions(functions):
    logger.info("Comparing permissions requested vs used")
    logger.debug(functions)
    lp = True
    for function in functions.values():
        logger.info(f"Checking {function['name']}")
        policy = function["policy"]
        lp_policy = function["lp_policy"]
        if type(policy["Resource"]) == list:
            policy["Resource"] = policy["Resource"][0]
        if type(lp_policy["Resource"]) == list:
            lp_policy["Resource"] = lp_policy["Resource"][0]
        if policy["Effect"] != lp_policy["Effect"]:
            logger.info(f"  Effect {policy['Effect']} != {lp_policy['Effect']}")
            lp = False
        if policy["Action"] != lp_policy["Action"]:
            logger.info(f"  Action {policy['Action']} != {lp_policy['Action']}")
            lp = False
        if policy["Resource"] != lp_policy["Resource"]:
            logger.info(f"  Resource: {policy['Resource']} != {lp_policy['Resource']}")
            lp = False
        if lp:
            logger.success(f"Lambda {function['name']} has a least privileged IAM role ✓")
            continue
        logger.error(f"Lambda {function['name']} doesn't have a least privileged IAM role")
        logger.error(f"The role was: {json.dumps(policy,indent=2)}")
        logger.success(f"The role should be: {json.dumps(lp_policy,indent=2)}")
def compare_permissions ( functions ) : logger . info ( "Comparing permissions requested vs used" ) logger . debug ( functions ) lp = True for function in functions . values ( ) : logger . info ( f"Checking {function['name']}" ) policy = function [ "policy" ] lp_policy = function [ "lp_policy" ] if type ( policy [ "Resource" ] ) == list : policy [ "Resource" ] = policy [ "Resource" ] [ 0 ] if type ( lp_policy [ "Resource" ] ) == list : lp_policy [ "Resource" ] = lp_policy [ "Resource" ] [ 0 ] if policy [ "Effect" ] != lp_policy [ "Effect" ] : logger . info ( f"  Effect {policy['Effect']} != {lp_policy['Effect']}" ) lp = False if policy [ "Action" ] != lp_policy [ "Action" ] : logger . info ( f"  Action {policy['Action']} != {lp_policy['Action']}" ) lp = False if policy [ "Resource" ] != lp_policy [ "Resource" ] : logger . info ( f"  Resource: {policy['Resource']} != {lp_policy['Resource']}" ) lp = False if lp : logger . success ( f"Lambda {function['name']} has a least privileged IAM role ✓") continue logger . error ( f"Lambda {function['name']} doesn't have a least privileged IAM role" ) logger . error ( f"The role was: {json.dumps(policy,indent=2)}" ) logger . success ( f"The role should be: {json.dumps(lp_policy,indent=2)}" )
Compare permissions provisioned vs permissions used
Compare permissions provisioned vs permissions used
"""Compare permissions provisioned vs permissions used""" # Get and potentially fix policy # Check Effect, Action, and Resources
functions