Skip to content

Commit

Permalink
fix linting
Browse files Browse the repository at this point in the history
  • Loading branch information
gruebel committed Oct 5, 2023
1 parent b8cd1b1 commit 16ea818
Show file tree
Hide file tree
Showing 4 changed files with 23 additions and 16 deletions.
2 changes: 1 addition & 1 deletion cloudsplaining/scan/authorization_details.py
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ def inline_policies(self) -> Dict[str, Dict[str, Any]]:
return results

@property
def links(self) -> Dict[str, str]:
def links(self) -> Dict[str, str | None]:
"""Return a dictionary of the action names as keys and their API documentation links as values"""
results = {}
unique_action_names = set()
Expand Down
2 changes: 1 addition & 1 deletion cloudsplaining/scan/managed_policy_detail.py
Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,7 @@ def account_id(self) -> str: # pragma: no cover
if is_aws_managed(self.arn):
return "N/A"
else:
return get_account_from_arn(self.arn) # type: ignore
return get_account_from_arn(self.arn)

def getFindingLinks(self, findings: List[Dict[str, Any]]) -> Dict[Any, str]:
links = {}
Expand Down
30 changes: 18 additions & 12 deletions cloudsplaining/scan/statement_detail.py
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

from cached_property import cached_property

from policy_sentry.analysis.analyze import determine_actions_to_expand
from policy_sentry.analysis.expand import determine_actions_to_expand
from policy_sentry.querying.actions import (
remove_actions_not_matching_access_level,
get_actions_matching_arn,
Expand Down Expand Up @@ -33,7 +33,12 @@ class StatementDetail:
Analyzes individual statements within a policy
"""

def __init__(self, statement: Dict[str, Any], flag_conditional_statements: bool = False, flag_resource_arn_statements: bool = False) -> None:
def __init__(
self,
statement: Dict[str, Any],
flag_conditional_statements: bool = False,
flag_resource_arn_statements: bool = False,
) -> None:
self.json = statement
self.statement = statement
self.effect = statement["Effect"]
Expand Down Expand Up @@ -78,7 +83,8 @@ def _resources(self) -> List[str]:

def _not_action(self) -> List[str]:
"""Holds the NotAction details.
We won't do anything with it - but we will flag it as something for the assessor to triage."""
We won't do anything with it - but we will flag it as something for the assessor to triage.
"""
not_action = self.statement.get("NotAction")
if not not_action:
return []
Expand All @@ -88,7 +94,8 @@ def _not_action(self) -> List[str]:

def _not_resource(self) -> List[str]:
"""Holds the NotResource details.
We won't do anything with it - but we will flag it as something for the assessor to triage."""
We won't do anything with it - but we will flag it as something for the assessor to triage.
"""
not_resource = self.statement.get("NotResource")
if not not_resource:
return []
Expand All @@ -98,7 +105,7 @@ def _not_resource(self) -> List[str]:

# @property
def _not_action_effective_actions(self) -> Optional[List[str]]:
"""If NotAction is used, calculate the allowed actions - i.e., what it would be """
"""If NotAction is used, calculate the allowed actions - i.e., what it would be"""
effective_actions = []
if not self.not_action:
return None
Expand Down Expand Up @@ -149,7 +156,8 @@ def _not_action_effective_actions(self) -> Optional[List[str]]:
@property
def has_not_resource_with_allow(self) -> bool:
"""Per the AWS documentation, the NotResource should NEVER be used with the Allow Effect.
See documentation here. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notresource.html#notresource-element-combinations"""
See documentation here. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notresource.html#notresource-element-combinations
"""
if self.not_resource and self.effect_allow:
logger.warning(
"Per the AWS documentation, the NotResource should never be used with the "
Expand Down Expand Up @@ -198,9 +206,8 @@ def permissions_management_actions_without_constraints(self) -> List[str]:
do not have resource constraints"""
result = []
if (
(not self.has_resource_constraints or self.flag_resource_arn_statements) and
not self.has_condition
):
not self.has_resource_constraints or self.flag_resource_arn_statements
) and not self.has_condition:
result = remove_actions_not_matching_access_level(
self.restrictable_actions, "Permissions management"
)
Expand All @@ -213,9 +220,8 @@ def write_actions_without_constraints(self) -> List[str]:
do not have resource constraints"""
result = []
if (
(not self.has_resource_constraints or self.flag_resource_arn_statements) and
not self.has_condition
):
not self.has_resource_constraints or self.flag_resource_arn_statements
) and not self.has_condition:
result = remove_actions_not_matching_access_level(
self.restrictable_actions, "Write"
)
Expand Down
5 changes: 3 additions & 2 deletions cloudsplaining/shared/utils.py
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,10 @@ def remove_wildcard_only_actions(actions_list: List[str]) -> List[str]:
continue # pragma: no cover
action_data = get_action_data(service_prefix, action_name)
if action_data:
if len(action_data.get(service_prefix)) == 0:
service_data_len = len(action_data.get(service_prefix, []))
if service_data_len == 0:
pass # pragma: no cover
elif len(action_data.get(service_prefix)) == 1:
elif service_data_len == 1:
if action_data[service_prefix][0]["resource_arn_format"] == "*":
pass
else:
Expand Down

0 comments on commit 16ea818

Please sign in to comment.