'alert when an IAM Object has a policy containing \'NotAction\'.
NotAction combined with an "Effect": "Allow" often provides more privilege
than is desired.'

def library_check_iamobj_has_notaction(self, iamobj_item, policies_key='InlinePolicies', multiple_policies=True):

    tag = '{0}    contains    NotAction.'.format(self.i_am_singular)
    def check_statement(statement):
        if (statement['Effect'] == 'Allow'):
            if ('NotAction' in statement):
                self.add_issue(10, tag, iamobj_item, notes=json.dumps(statement['NotAction']))
    if multiple_policies:
        _iterate_over_sub_policies(iamobj_item.config.get(policies_key, {}), check_statement)
    else:
        _iterate_over_statements(iamobj_item.config[policies_key], check_statement)
