@Test public void testGetPolicy() { assertThat(awsIamService.getPolicy("abc", Collections.emptyMap())).isNull(); Policy expectedPolicyNoReplacements = new Policy().withStatements( new Statement(Effect.Allow).withId("FullObjectAccessUnderAuditDir") .withActions(S3Actions.GetObject, S3Actions.PutObject) .withResources(new Resource("arn:aws:s3:::${STORAGE_LOCATION_BASE}/ranger/audit/*")), new Statement(Effect.Allow).withId("LimitedAccessToDataLakeBucket") .withActions(S3Actions.AbortMultipartUpload, S3Actions.ListObjects, S3Actions.ListBucketMultipartUploads) .withResources(new Resource("arn:aws:s3:::${DATALAKE_BUCKET}")) ); assertThat(awsIamService.getPolicy("aws-cdp-ranger-audit-s3-policy.json", Collections.emptyMap()).toJson()).isEqualTo(expectedPolicyNoReplacements.toJson()); Policy expectedPolicyWithReplacements = new Policy().withStatements( new Statement(Effect.Allow).withId("FullObjectAccessUnderAuditDir") .withActions(S3Actions.GetObject, S3Actions.PutObject) .withResources(new Resource("arn:aws:s3:::mybucket/mycluster/ranger/audit/*")), new Statement(Effect.Allow).withId("LimitedAccessToDataLakeBucket") .withActions(S3Actions.AbortMultipartUpload, S3Actions.ListObjects, S3Actions.ListBucketMultipartUploads) .withResources(new Resource("arn:aws:s3:::mybucket")) ); Map<String, String> policyReplacements = new HashMap<>(); policyReplacements.put("${STORAGE_LOCATION_BASE}", "mybucket/mycluster"); policyReplacements.put("${DATALAKE_BUCKET}", "mybucket"); assertThat(awsIamService.getPolicy("aws-cdp-ranger-audit-s3-policy.json", policyReplacements).toJson()).isEqualTo(expectedPolicyWithReplacements.toJson()); }
public Policy getPolicy(String policyFileName, Map<String, String> replacements) { Policy policy = null; try { String policyJsonTemplate = getResourceFileAsString(POLICY_BASE_LOCATION + policyFileName); String policyJson = handleTemplateReplacements(policyJsonTemplate, replacements); if (policyJson != null) { policy = Policy.fromJson(policyJson); } } catch (IOException e) { LOGGER.debug("Unable to load policy json", e); } return policy; }
AwsIamService { public Policy getPolicy(String policyFileName, Map<String, String> replacements) { Policy policy = null; try { String policyJsonTemplate = getResourceFileAsString(POLICY_BASE_LOCATION + policyFileName); String policyJson = handleTemplateReplacements(policyJsonTemplate, replacements); if (policyJson != null) { policy = Policy.fromJson(policyJson); } } catch (IOException e) { LOGGER.debug("Unable to load policy json", e); } return policy; } }
AwsIamService { public Policy getPolicy(String policyFileName, Map<String, String> replacements) { Policy policy = null; try { String policyJsonTemplate = getResourceFileAsString(POLICY_BASE_LOCATION + policyFileName); String policyJson = handleTemplateReplacements(policyJsonTemplate, replacements); if (policyJson != null) { policy = Policy.fromJson(policyJson); } } catch (IOException e) { LOGGER.debug("Unable to load policy json", e); } return policy; }  }
AwsIamService { public Policy getPolicy(String policyFileName, Map<String, String> replacements) { Policy policy = null; try { String policyJsonTemplate = getResourceFileAsString(POLICY_BASE_LOCATION + policyFileName); String policyJson = handleTemplateReplacements(policyJsonTemplate, replacements); if (policyJson != null) { policy = Policy.fromJson(policyJson); } } catch (IOException e) { LOGGER.debug("Unable to load policy json", e); } return policy; }  InstanceProfile getInstanceProfile(AmazonIdentityManagement iam, String instanceProfileArn,
            ValidationResultBuilder validationResultBuilder); Set<Role> getValidRoles(AmazonIdentityManagement iam, Set<String> roleArns,
            ValidationResultBuilder validationResultBuilder); Role getRole(AmazonIdentityManagement iam, String roleArn,
            ValidationResultBuilder validationResultBuilder); Policy getAssumeRolePolicy(Role role); Policy getPolicy(String policyFileName, Map<String, String> replacements); SortedSet<String> getStatementActions(Statement statement); SortedSet<String> getStatementResources(Statement statement); List<EvaluationResult> simulatePrincipalPolicy(AmazonIdentityManagement iam,
            String policySourceArn, Collection<String> actionNames, Collection<String> resourceArns); List<EvaluationResult> validateRolePolicies(AmazonIdentityManagement iam, Role role,
            Collection<Policy> policies); }
AwsIamService { public Policy getPolicy(String policyFileName, Map<String, String> replacements) { Policy policy = null; try { String policyJsonTemplate = getResourceFileAsString(POLICY_BASE_LOCATION + policyFileName); String policyJson = handleTemplateReplacements(policyJsonTemplate, replacements); if (policyJson != null) { policy = Policy.fromJson(policyJson); } } catch (IOException e) { LOGGER.debug("Unable to load policy json", e); } return policy; }  InstanceProfile getInstanceProfile(AmazonIdentityManagement iam, String instanceProfileArn,
            ValidationResultBuilder validationResultBuilder); Set<Role> getValidRoles(AmazonIdentityManagement iam, Set<String> roleArns,
            ValidationResultBuilder validationResultBuilder); Role getRole(AmazonIdentityManagement iam, String roleArn,
            ValidationResultBuilder validationResultBuilder); Policy getAssumeRolePolicy(Role role); Policy getPolicy(String policyFileName, Map<String, String> replacements); SortedSet<String> getStatementActions(Statement statement); SortedSet<String> getStatementResources(Statement statement); List<EvaluationResult> simulatePrincipalPolicy(AmazonIdentityManagement iam,
            String policySourceArn, Collection<String> actionNames, Collection<String> resourceArns); List<EvaluationResult> validateRolePolicies(AmazonIdentityManagement iam, Role role,
            Collection<Policy> policies);  }