@Test public void test()throws Exception{ AttachedPolicy attachedPolicies = new AttachedPolicy(); attachedPolicies.setPolicyName("IAMFullAccess"); List<AttachedPolicy> policies = new ArrayList<>(); policies.add(attachedPolicies); ListAttachedRolePoliciesResult result = new ListAttachedRolePoliciesResult(); result.setAttachedPolicies(policies); result.setIsTruncated(false); AttachedPolicy attachedPolicies1 = new AttachedPolicy(); attachedPolicies1.setPolicyName("AdministratorAccess"); List<AttachedPolicy> policies1 = new ArrayList<>(); policies1.add(attachedPolicies1); ListAttachedRolePoliciesResult result1 = new ListAttachedRolePoliciesResult(); result1.setAttachedPolicies(policies1); result1.setIsTruncated(false); AttachedPolicy attachedPolicies2 = new AttachedPolicy(); attachedPolicies2.setPolicyArn("123"); List<AttachedPolicy> policies2 = new ArrayList<>(); policies2.add(attachedPolicies2); ListAttachedRolePoliciesResult result2 = new ListAttachedRolePoliciesResult(); result2.setAttachedPolicies(policies2); result2.setIsTruncated(false); List<AttachedPolicy> policies3 = new ArrayList<>(); ListAttachedRolePoliciesResult result3 = new ListAttachedRolePoliciesResult(); result3.setAttachedPolicies(policies3); result3.setIsTruncated(false); Policy policy = new Policy(); policy.setPolicyId("policyId"); GetPolicyResult policyResult = new GetPolicyResult(); policyResult.setPolicy(policy); PolicyVersion policyVersion = new PolicyVersion(); policyVersion.setVersionId("versionId"); policyVersion.setIsDefaultVersion(true); policyVersion.setDocument("{\"ag\":\"aws-all\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"iam:*\"]}],\"from\":0,\"searchtext\":\"\",\"size\":25}"); GetPolicyVersionResult versionResult = new GetPolicyVersionResult(); versionResult.setPolicyVersion(policyVersion); GetPolicyResult policyResult1 = new GetPolicyResult(); policyResult1.setPolicy(policy); PolicyVersion policyVersion1 = new PolicyVersion(); policyVersion1.setVersionId("versionId"); policyVersion1.setIsDefaultVersion(true); policyVersion1.setDocument("{\"ag\":\"aws-all\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"iam:*\"]},\"from\":0,\"searchtext\":\"\",\"size\":25}"); GetPolicyVersionResult versionResult1 = new GetPolicyVersionResult(); versionResult1.setPolicyVersion(policyVersion1); mockStatic(PacmanUtils.class); when(PacmanUtils.doesAllHaveValue(anyString(),anyString(),anyString())).thenReturn( true); when(PacmanUtils.splitStringToAList(anyString(),anyString())).thenReturn(CommonTestUtils.getListString()); Map<String,Object>map=new HashMap<String, Object>(); map.put("client", identityManagementClient); IAMAccessGrantForNonAdminAccountRule spy = Mockito.spy(new IAMAccessGrantForNonAdminAccountRule()); Mockito.doReturn(map).when((BaseRule)spy).getClientFor(anyObject(), anyString(), anyObject()); when(identityManagementClient.getPolicy(anyObject())).thenReturn(policyResult); when(identityManagementClient.listAttachedRolePolicies(anyObject())).thenReturn(result); when(identityManagementClient.getPolicyVersion(anyObject())).thenReturn(versionResult1); spy.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")); when(identityManagementClient.getPolicy(anyObject())).thenReturn(policyResult); when(identityManagementClient.listAttachedRolePolicies(anyObject())).thenReturn(result); when(identityManagementClient.getPolicyVersion(anyObject())).thenReturn(versionResult); spy.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")); when(identityManagementClient.listAttachedRolePolicies(anyObject())).thenReturn(result1); spy.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")); when(identityManagementClient.listAttachedRolePolicies(anyObject())).thenReturn(result2); spy.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")); when(identityManagementClient.listAttachedRolePolicies(anyObject())).thenReturn(result3); spy.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")); spy.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getAnotherMapString("r_123 ")); mockStatic(URLDecoder.class); when(URLDecoder.decode(anyString(),anyString())).thenThrow(new UnsupportedEncodingException()); assertThatThrownBy( () -> iamAccessGrantForNonAdminAccountRule.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(InvalidInputException.class); when(PacmanUtils.doesAllHaveValue(anyString(),anyString(),anyString())).thenReturn( false); assertThatThrownBy( () -> iamAccessGrantForNonAdminAccountRule.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(InvalidInputException.class); }
public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========IAMAccessGrantForNonAdminAccountRule started========="); Map<String, String> ruleParamforIAM = new HashMap<>(); ruleParamforIAM.putAll(ruleParam); ruleParamforIAM.put("region", "us-west-2"); Map<String, Object> map = null; AmazonIdentityManagementClient iamClient = null; String roleIdentifyingString = ruleParamforIAM .get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String roleName = resourceAttributes.get(PacmanRuleConstants.ROLE_NAME); String adminRolesToCompare = ruleParamforIAM .get(PacmanRuleConstants.ADMIN_ROLES_TO_COMPARE); String severity = ruleParamforIAM.get(PacmanRuleConstants.SEVERITY); String category = ruleParamforIAM.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(adminRolesToCompare, severity, category)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } Annotation annotation = null; List<AttachedPolicy> attachedRolePolicies = new ArrayList<>(); String message = null; List<String> adminRoleListToCompare = PacmanUtils.splitStringToAList( adminRolesToCompare, ","); try { map = getClientFor(AWSService.IAM, roleIdentifyingString, ruleParamforIAM); iamClient = (AmazonIdentityManagementClient) map .get(PacmanSdkConstants.CLIENT); } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } if (!adminRoleListToCompare.contains(roleName)) { ListAttachedRolePoliciesRequest request = new ListAttachedRolePoliciesRequest(); ListAttachedRolePoliciesResult result = null; request.setRoleName(roleName); do { result = iamClient.listAttachedRolePolicies(request); attachedRolePolicies.addAll(result.getAttachedPolicies()); request.setMarker(result.getMarker()); } while (result.isTruncated()); if (!CollectionUtils.isNullOrEmpty(attachedRolePolicies)) { if (isValidPoliciesForNonAdminRole(attachedRolePolicies) || isIAMFullAccessFoundAfterThoroughCheck(iamClient, attachedRolePolicies)) { message = "Role " + roleName + " has IAM full access"; logger.warn(message); annotation = Annotation.buildAnnotation(ruleParam, Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION, "Non-admin roles with IAMFullAccess found"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "Non-admin roles with IAMFullAccess found"); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } else { logger.info(roleName , "This Role has no policies attached"); } } else { logger.info("Admin role found"); } return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }
IAMAccessGrantForNonAdminAccountRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========IAMAccessGrantForNonAdminAccountRule started========="); Map<String, String> ruleParamforIAM = new HashMap<>(); ruleParamforIAM.putAll(ruleParam); ruleParamforIAM.put("region", "us-west-2"); Map<String, Object> map = null; AmazonIdentityManagementClient iamClient = null; String roleIdentifyingString = ruleParamforIAM .get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String roleName = resourceAttributes.get(PacmanRuleConstants.ROLE_NAME); String adminRolesToCompare = ruleParamforIAM .get(PacmanRuleConstants.ADMIN_ROLES_TO_COMPARE); String severity = ruleParamforIAM.get(PacmanRuleConstants.SEVERITY); String category = ruleParamforIAM.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(adminRolesToCompare, severity, category)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } Annotation annotation = null; List<AttachedPolicy> attachedRolePolicies = new ArrayList<>(); String message = null; List<String> adminRoleListToCompare = PacmanUtils.splitStringToAList( adminRolesToCompare, ","); try { map = getClientFor(AWSService.IAM, roleIdentifyingString, ruleParamforIAM); iamClient = (AmazonIdentityManagementClient) map .get(PacmanSdkConstants.CLIENT); } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } if (!adminRoleListToCompare.contains(roleName)) { ListAttachedRolePoliciesRequest request = new ListAttachedRolePoliciesRequest(); ListAttachedRolePoliciesResult result = null; request.setRoleName(roleName); do { result = iamClient.listAttachedRolePolicies(request); attachedRolePolicies.addAll(result.getAttachedPolicies()); request.setMarker(result.getMarker()); } while (result.isTruncated()); if (!CollectionUtils.isNullOrEmpty(attachedRolePolicies)) { if (isValidPoliciesForNonAdminRole(attachedRolePolicies) || isIAMFullAccessFoundAfterThoroughCheck(iamClient, attachedRolePolicies)) { message = "Role " + roleName + " has IAM full access"; logger.warn(message); annotation = Annotation.buildAnnotation(ruleParam, Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION, "Non-admin roles with IAMFullAccess found"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "Non-admin roles with IAMFullAccess found"); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } else { logger.info(roleName , "This Role has no policies attached"); } } else { logger.info("Admin role found"); } return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); } }
IAMAccessGrantForNonAdminAccountRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========IAMAccessGrantForNonAdminAccountRule started========="); Map<String, String> ruleParamforIAM = new HashMap<>(); ruleParamforIAM.putAll(ruleParam); ruleParamforIAM.put("region", "us-west-2"); Map<String, Object> map = null; AmazonIdentityManagementClient iamClient = null; String roleIdentifyingString = ruleParamforIAM .get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String roleName = resourceAttributes.get(PacmanRuleConstants.ROLE_NAME); String adminRolesToCompare = ruleParamforIAM .get(PacmanRuleConstants.ADMIN_ROLES_TO_COMPARE); String severity = ruleParamforIAM.get(PacmanRuleConstants.SEVERITY); String category = ruleParamforIAM.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(adminRolesToCompare, severity, category)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } Annotation annotation = null; List<AttachedPolicy> attachedRolePolicies = new ArrayList<>(); String message = null; List<String> adminRoleListToCompare = PacmanUtils.splitStringToAList( adminRolesToCompare, ","); try { map = getClientFor(AWSService.IAM, roleIdentifyingString, ruleParamforIAM); iamClient = (AmazonIdentityManagementClient) map .get(PacmanSdkConstants.CLIENT); } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } if (!adminRoleListToCompare.contains(roleName)) { ListAttachedRolePoliciesRequest request = new ListAttachedRolePoliciesRequest(); ListAttachedRolePoliciesResult result = null; request.setRoleName(roleName); do { result = iamClient.listAttachedRolePolicies(request); attachedRolePolicies.addAll(result.getAttachedPolicies()); request.setMarker(result.getMarker()); } while (result.isTruncated()); if (!CollectionUtils.isNullOrEmpty(attachedRolePolicies)) { if (isValidPoliciesForNonAdminRole(attachedRolePolicies) || isIAMFullAccessFoundAfterThoroughCheck(iamClient, attachedRolePolicies)) { message = "Role " + roleName + " has IAM full access"; logger.warn(message); annotation = Annotation.buildAnnotation(ruleParam, Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION, "Non-admin roles with IAMFullAccess found"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "Non-admin roles with IAMFullAccess found"); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } else { logger.info(roleName , "This Role has no policies attached"); } } else { logger.info("Admin role found"); } return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }  }
IAMAccessGrantForNonAdminAccountRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========IAMAccessGrantForNonAdminAccountRule started========="); Map<String, String> ruleParamforIAM = new HashMap<>(); ruleParamforIAM.putAll(ruleParam); ruleParamforIAM.put("region", "us-west-2"); Map<String, Object> map = null; AmazonIdentityManagementClient iamClient = null; String roleIdentifyingString = ruleParamforIAM .get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String roleName = resourceAttributes.get(PacmanRuleConstants.ROLE_NAME); String adminRolesToCompare = ruleParamforIAM .get(PacmanRuleConstants.ADMIN_ROLES_TO_COMPARE); String severity = ruleParamforIAM.get(PacmanRuleConstants.SEVERITY); String category = ruleParamforIAM.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(adminRolesToCompare, severity, category)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } Annotation annotation = null; List<AttachedPolicy> attachedRolePolicies = new ArrayList<>(); String message = null; List<String> adminRoleListToCompare = PacmanUtils.splitStringToAList( adminRolesToCompare, ","); try { map = getClientFor(AWSService.IAM, roleIdentifyingString, ruleParamforIAM); iamClient = (AmazonIdentityManagementClient) map .get(PacmanSdkConstants.CLIENT); } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } if (!adminRoleListToCompare.contains(roleName)) { ListAttachedRolePoliciesRequest request = new ListAttachedRolePoliciesRequest(); ListAttachedRolePoliciesResult result = null; request.setRoleName(roleName); do { result = iamClient.listAttachedRolePolicies(request); attachedRolePolicies.addAll(result.getAttachedPolicies()); request.setMarker(result.getMarker()); } while (result.isTruncated()); if (!CollectionUtils.isNullOrEmpty(attachedRolePolicies)) { if (isValidPoliciesForNonAdminRole(attachedRolePolicies) || isIAMFullAccessFoundAfterThoroughCheck(iamClient, attachedRolePolicies)) { message = "Role " + roleName + " has IAM full access"; logger.warn(message); annotation = Annotation.buildAnnotation(ruleParam, Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION, "Non-admin roles with IAMFullAccess found"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "Non-admin roles with IAMFullAccess found"); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } else { logger.info(roleName , "This Role has no policies attached"); } } else { logger.info("Admin role found"); } return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }  RuleResult execute(final Map<String, String> ruleParam,
            Map<String, String> resourceAttributes); @Override String getHelpText(); }
IAMAccessGrantForNonAdminAccountRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========IAMAccessGrantForNonAdminAccountRule started========="); Map<String, String> ruleParamforIAM = new HashMap<>(); ruleParamforIAM.putAll(ruleParam); ruleParamforIAM.put("region", "us-west-2"); Map<String, Object> map = null; AmazonIdentityManagementClient iamClient = null; String roleIdentifyingString = ruleParamforIAM .get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String roleName = resourceAttributes.get(PacmanRuleConstants.ROLE_NAME); String adminRolesToCompare = ruleParamforIAM .get(PacmanRuleConstants.ADMIN_ROLES_TO_COMPARE); String severity = ruleParamforIAM.get(PacmanRuleConstants.SEVERITY); String category = ruleParamforIAM.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(adminRolesToCompare, severity, category)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } Annotation annotation = null; List<AttachedPolicy> attachedRolePolicies = new ArrayList<>(); String message = null; List<String> adminRoleListToCompare = PacmanUtils.splitStringToAList( adminRolesToCompare, ","); try { map = getClientFor(AWSService.IAM, roleIdentifyingString, ruleParamforIAM); iamClient = (AmazonIdentityManagementClient) map .get(PacmanSdkConstants.CLIENT); } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } if (!adminRoleListToCompare.contains(roleName)) { ListAttachedRolePoliciesRequest request = new ListAttachedRolePoliciesRequest(); ListAttachedRolePoliciesResult result = null; request.setRoleName(roleName); do { result = iamClient.listAttachedRolePolicies(request); attachedRolePolicies.addAll(result.getAttachedPolicies()); request.setMarker(result.getMarker()); } while (result.isTruncated()); if (!CollectionUtils.isNullOrEmpty(attachedRolePolicies)) { if (isValidPoliciesForNonAdminRole(attachedRolePolicies) || isIAMFullAccessFoundAfterThoroughCheck(iamClient, attachedRolePolicies)) { message = "Role " + roleName + " has IAM full access"; logger.warn(message); annotation = Annotation.buildAnnotation(ruleParam, Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION, "Non-admin roles with IAMFullAccess found"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "Non-admin roles with IAMFullAccess found"); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } else { logger.info(roleName , "This Role has no policies attached"); } } else { logger.info("Admin role found"); } return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }  RuleResult execute(final Map<String, String> ruleParam,
            Map<String, String> resourceAttributes); @Override String getHelpText();  }