'alert when an IAM Object has a policy allowing \'iam:PassRole\'.
This allows the object to pass any role specified in the resource block to an ec2 instance.'

def library_check_iamobj_has_iam_passrole(self, iamobj_item, policies_key='InlinePolicies', multiple_policies=True):

    tag = '{0}    has    iam:PassRole    privileges.'.format(self.i_am_singular)
    def check_statement(statement):
        if (statement['Effect'] == 'Allow'):
            if (('Action' in statement) and (type(statement['Action']) is list)):
                for action in statement['Action']:
                    if (action.lower() == 'iam:passrole'):
                        self.add_issue(9, tag, iamobj_item, notes=json.dumps(statement))
            elif (('Action' in statement) and (statement['Action'].lower() == 'iam:passrole')):
                self.add_issue(9, tag, iamobj_item, notes=json.dumps(statement))
    if multiple_policies:
        _iterate_over_sub_policies(iamobj_item.config.get(policies_key, {}), check_statement)
    else:
        _iterate_over_statements(iamobj_item.config[policies_key], check_statement)
