How to use the pycfmodel.model.resources.sqs_queue_policy.SQSQueuePolicy function in pycfmodel

To help you get started, we’ve selected a few pycfmodel examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github Skyscanner / pycfmodel / tests / resources / test_sqs_queue_policy.py View on Github external
def sqs_queue_policy():
    return SQSQueuePolicy(
        **{
            "Type": "AWS::SQS::QueuePolicy",
            "Properties": {
                "Queues": [{"Ref": "queue1"}],
                "PolicyDocument": {
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "NotAction": ["sqs:Break*"],
                            "Principal": {"AWS": "arn:aws:iam::111111111111:user/dave.mustaine"},
                            "Resource": "*",
                        }
github Skyscanner / cfripper / cfripper / rules / SQSQueuePolicyWildcardActionRule.py View on Github external
def invoke(self, cfmodel):
        for logical_id, resource in cfmodel.Resources.items():
            if isinstance(resource, SQSQueuePolicy) and resource.Properties.PolicyDocument.allowed_actions_with(
                re.compile(r"^(\w*:){0,1}\*$")
            ):
                self.add_failure(type(self).__name__, self.REASON.format(logical_id))
github Skyscanner / cfripper / cfripper / rules / sqs_queue_policy.py View on Github external
def invoke(self, cfmodel: CFModel, extras: Optional[Dict] = None) -> Result:
        result = Result()
        for logical_id, resource in cfmodel.Resources.items():
            if isinstance(resource, SQSQueuePolicy) and resource.Properties.PolicyDocument.allowed_principals_with(
                REGEX_HAS_STAR_OR_STAR_AFTER_COLON
            ):
                for statement in resource.Properties.PolicyDocument._statement_as_list():
                    if statement.Effect == "Allow" and statement.principals_with(REGEX_HAS_STAR_OR_STAR_AFTER_COLON):
                        if statement.Condition and statement.Condition.dict():
                            logger.warning(
                                f"Not adding {type(self).__name__} failure in {logical_id} "
                                f"because there are conditions: {statement.Condition}"
                            )
                        else:
                            self.add_failure_to_result(
                                result, self.REASON.format(logical_id), resource_ids={logical_id}
                            )
        return result
github Skyscanner / cfripper / cfripper / rules / SQSQueuePolicyNotPrincipalRule.py View on Github external
def invoke(self, cfmodel):
        for logical_id, resource in cfmodel.Resources.items():
            if isinstance(resource, SQSQueuePolicy):
                for statement in resource.Properties.PolicyDocument._statement_as_list():
                    if statement.NotPrincipal:
                        self.add_failure(type(self).__name__, self.REASON.format(logical_id))
github Skyscanner / pycfmodel / pycfmodel / model / resources / types.py View on Github external
from pycfmodel.model.resources.sns_topic_policy import SNSTopicPolicy
from pycfmodel.model.resources.sqs_queue_policy import SQSQueuePolicy

ResourceModels = Union[
    IAMGroup,
    IAMManagedPolicy,
    IAMPolicy,
    IAMRole,
    IAMUser,
    KMSKey,
    S3BucketPolicy,
    SecurityGroup,
    SecurityGroupEgress,
    SecurityGroupIngress,
    SNSTopicPolicy,
    SQSQueuePolicy,
]
github Skyscanner / pycfmodel / pycfmodel / model / resource_factory.py View on Github external
from .resources.kms_key import KMSKey


_RESOURCE_MAP = {
    "AWS::EC2::SecurityGroup": SecurityGroup,
    "AWS::EC2::SecurityGroupEgress": SecurityGroupEgress,
    "AWS::EC2::SecurityGroupIngress": SecurityGroupIngress,
    "AWS::IAM::Group": IAMGroup,
    "AWS::IAM::ManagedPolicy": IAMManagedPolicy,
    "AWS::IAM::Policy": IAMPolicy,
    "AWS::IAM::Role": IAMRole,
    "AWS::IAM::User": IAMUser,
    "AWS::KMS::Key": KMSKey,
    "AWS::S3::BucketPolicy": S3BucketPolicy,
    "AWS::SNS::TopicPolicy": SNSTopicPolicy,
    "AWS::SQS::QueuePolicy": SQSQueuePolicy,
}
_DEFAULT_RESOURCE = Resource


def create_resource(logical_id: str, value: Dict[str, Any]) -> Resource:
    resource = _RESOURCE_MAP.get(value.get("Type"), _DEFAULT_RESOURCE)
    return resource(logical_id, value)