@Test public void checkCannotAssumeOneOfTheRoles() { Role instanceProfileRole = new Role(); InstanceProfile instanceProfile = new InstanceProfile().withArn("instanceProfileArn") .withRoles(instanceProfileRole); Role role1 = new Role().withArn("role1Arn"); Role role2 = new Role().withArn("role2Arn"); Collection<Role> roles = Arrays.asList(role1, role2); EvaluationResult evalResult1 = new EvaluationResult() .withEvalDecision(PolicyEvaluationDecisionType.Allowed) .withEvalResourceName(role1.getArn()); EvaluationResult evalResult2 = new EvaluationResult() .withEvalDecision(PolicyEvaluationDecisionType.ImplicitDeny) .withEvalResourceName(role2.getArn()); when(iam.simulatePrincipalPolicy(any(SimulatePrincipalPolicyRequest.class))) .thenReturn(new SimulatePrincipalPolicyResult().withEvaluationResults(evalResult1)) .thenReturn(new SimulatePrincipalPolicyResult().withEvaluationResults(evalResult2)); ValidationResultBuilder validationResultBuilder = new ValidationResultBuilder(); assertThat(awsIDBrokerAssumeRoleValidator.canAssumeRoles(iam, instanceProfile, roles, validationResultBuilder)).isFalse(); ValidationResult validationResult = validationResultBuilder.build(); assertThat(validationResult.hasError()).isTrue(); assertThat(validationResult.getErrors()).isEqualTo(Collections.singletonList( String.format("IDBroker instance profile (%s) doesn't have permissions to assume the role(s): %s", instanceProfile.getArn(), Collections.singletonList(role2.getArn())))); }
public boolean canAssumeRoles(AmazonIdentityManagement iam, InstanceProfile instanceProfile, Collection<Role> roles, ValidationResultBuilder resultBuilder) { Collection<String> roleArns = roles.stream().map(Role::getArn).collect(Collectors.toCollection(TreeSet::new)); for (Role instanceProfileRole : instanceProfile.getRoles()) { try { List<EvaluationResult> evaluationResults = awsIamService.simulatePrincipalPolicy(iam, instanceProfileRole.getArn(), ASSUME_ROLE_ACTION, roleArns); for (EvaluationResult evaluationResult : evaluationResults) { if (PolicyEvaluationDecisionType.Allowed.toString().equals(evaluationResult.getEvalDecision())) { roleArns.remove(evaluationResult.getEvalResourceName()); } } } catch (AmazonIdentityManagementException e) { LOGGER.error("Unable to check assume role from instance profile {} for roles {} due to {}", instanceProfile.getArn(), roleArns, e.getMessage(), e); return true; } if (roleArns.isEmpty()) { return true; } } if (roleArns.isEmpty()) { return true; } else { resultBuilder.error( String.format("IDBroker instance profile (%s) doesn't have permissions to assume " + "the role(s): %s", instanceProfile.getArn(), roleArns)); return false; } }
AwsIDBrokerAssumeRoleValidator { public boolean canAssumeRoles(AmazonIdentityManagement iam, InstanceProfile instanceProfile, Collection<Role> roles, ValidationResultBuilder resultBuilder) { Collection<String> roleArns = roles.stream().map(Role::getArn).collect(Collectors.toCollection(TreeSet::new)); for (Role instanceProfileRole : instanceProfile.getRoles()) { try { List<EvaluationResult> evaluationResults = awsIamService.simulatePrincipalPolicy(iam, instanceProfileRole.getArn(), ASSUME_ROLE_ACTION, roleArns); for (EvaluationResult evaluationResult : evaluationResults) { if (PolicyEvaluationDecisionType.Allowed.toString().equals(evaluationResult.getEvalDecision())) { roleArns.remove(evaluationResult.getEvalResourceName()); } } } catch (AmazonIdentityManagementException e) { LOGGER.error("Unable to check assume role from instance profile {} for roles {} due to {}", instanceProfile.getArn(), roleArns, e.getMessage(), e); return true; } if (roleArns.isEmpty()) { return true; } } if (roleArns.isEmpty()) { return true; } else { resultBuilder.error( String.format("IDBroker instance profile (%s) doesn't have permissions to assume " + "the role(s): %s", instanceProfile.getArn(), roleArns)); return false; } } }
AwsIDBrokerAssumeRoleValidator { public boolean canAssumeRoles(AmazonIdentityManagement iam, InstanceProfile instanceProfile, Collection<Role> roles, ValidationResultBuilder resultBuilder) { Collection<String> roleArns = roles.stream().map(Role::getArn).collect(Collectors.toCollection(TreeSet::new)); for (Role instanceProfileRole : instanceProfile.getRoles()) { try { List<EvaluationResult> evaluationResults = awsIamService.simulatePrincipalPolicy(iam, instanceProfileRole.getArn(), ASSUME_ROLE_ACTION, roleArns); for (EvaluationResult evaluationResult : evaluationResults) { if (PolicyEvaluationDecisionType.Allowed.toString().equals(evaluationResult.getEvalDecision())) { roleArns.remove(evaluationResult.getEvalResourceName()); } } } catch (AmazonIdentityManagementException e) { LOGGER.error("Unable to check assume role from instance profile {} for roles {} due to {}", instanceProfile.getArn(), roleArns, e.getMessage(), e); return true; } if (roleArns.isEmpty()) { return true; } } if (roleArns.isEmpty()) { return true; } else { resultBuilder.error( String.format("IDBroker instance profile (%s) doesn't have permissions to assume " + "the role(s): %s", instanceProfile.getArn(), roleArns)); return false; } }  }
AwsIDBrokerAssumeRoleValidator { public boolean canAssumeRoles(AmazonIdentityManagement iam, InstanceProfile instanceProfile, Collection<Role> roles, ValidationResultBuilder resultBuilder) { Collection<String> roleArns = roles.stream().map(Role::getArn).collect(Collectors.toCollection(TreeSet::new)); for (Role instanceProfileRole : instanceProfile.getRoles()) { try { List<EvaluationResult> evaluationResults = awsIamService.simulatePrincipalPolicy(iam, instanceProfileRole.getArn(), ASSUME_ROLE_ACTION, roleArns); for (EvaluationResult evaluationResult : evaluationResults) { if (PolicyEvaluationDecisionType.Allowed.toString().equals(evaluationResult.getEvalDecision())) { roleArns.remove(evaluationResult.getEvalResourceName()); } } } catch (AmazonIdentityManagementException e) { LOGGER.error("Unable to check assume role from instance profile {} for roles {} due to {}", instanceProfile.getArn(), roleArns, e.getMessage(), e); return true; } if (roleArns.isEmpty()) { return true; } } if (roleArns.isEmpty()) { return true; } else { resultBuilder.error( String.format("IDBroker instance profile (%s) doesn't have permissions to assume " + "the role(s): %s", instanceProfile.getArn(), roleArns)); return false; } }  boolean canAssumeRoles(AmazonIdentityManagement iam, InstanceProfile instanceProfile,
            Collection<Role> roles, ValidationResultBuilder resultBuilder); }
AwsIDBrokerAssumeRoleValidator { public boolean canAssumeRoles(AmazonIdentityManagement iam, InstanceProfile instanceProfile, Collection<Role> roles, ValidationResultBuilder resultBuilder) { Collection<String> roleArns = roles.stream().map(Role::getArn).collect(Collectors.toCollection(TreeSet::new)); for (Role instanceProfileRole : instanceProfile.getRoles()) { try { List<EvaluationResult> evaluationResults = awsIamService.simulatePrincipalPolicy(iam, instanceProfileRole.getArn(), ASSUME_ROLE_ACTION, roleArns); for (EvaluationResult evaluationResult : evaluationResults) { if (PolicyEvaluationDecisionType.Allowed.toString().equals(evaluationResult.getEvalDecision())) { roleArns.remove(evaluationResult.getEvalResourceName()); } } } catch (AmazonIdentityManagementException e) { LOGGER.error("Unable to check assume role from instance profile {} for roles {} due to {}", instanceProfile.getArn(), roleArns, e.getMessage(), e); return true; } if (roleArns.isEmpty()) { return true; } } if (roleArns.isEmpty()) { return true; } else { resultBuilder.error( String.format("IDBroker instance profile (%s) doesn't have permissions to assume " + "the role(s): %s", instanceProfile.getArn(), roleArns)); return false; } }  boolean canAssumeRoles(AmazonIdentityManagement iam, InstanceProfile instanceProfile,
            Collection<Role> roles, ValidationResultBuilder resultBuilder);  }