rule: aws_iam_policy_document - Sid string check

[andormarkus]

Hi Community,

The plugin currently does not validates aws_iam_policy_document sid_string.
Based on AWS documentation basic alphanumeric characters (A-Z,a-z,0-9) are the only allowed characters in the Sid value.

It would be great if there would be rule to check the sid_string.

Thanks,
Andor

[wata727]

#155 was a rule for the aws_iam_policy resource. This issue is a rule request for the aws_iam_policy_document data resource, so reopen the issue.

[gilbert-hsu]

Should we valid sid pattern even sid absent from statement ?

Error: The policy's sid ("") does not match "^[a-zA-Z0-9]+$". 
(aws_iam_policy_sid_invalid_characters)
  on iam-policy.tf line 22:
  22:   policy = <<EOF
  23: {
  24:   "Version": "2012-10-17",
  25:   "Statement": [
  26:     {
  27:       "Action": [],
  34:       "Effect": "Allow",
  35:       "Resource": "*"
  36:     }
  37:   ]
  38: }
  39: EOF

[wata727]

@gilbert-hsu Oops, this is a false positive. We have released v0.7.1 with this fix, so please try it.

[gilbert-hsu]

Thanks a lot！
v0.7.1 is fine in my environment！

[kyblik]

Got a failing use case even though this is a valid policy (notice the lack of [] in Statement):

resource "aws_iam_policy" "failing" {
  name   = "failing"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "*"
  }
}
EOF
}

resource "aws_iam_policy" "passing" {
  name   = "passing"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "*"
  }]
}
EOF
}

Error messages:

Failed to check ruleset. An error occurred:

Error: Failed to check `aws_iam_policy_sid_invalid_characters` rule: json: cannot unmarshal object into Go struct field AwsIAMPolicySidInvalidCharactersPolicyStruct.Statement of type []rules.AwsIAMPolicySidInvalidCharactersStatementStruct

Failed to check ruleset. An error occurred:

Error: Failed to check `aws_iam_policy_sid_invalid_characters` rule: json: cannot unmarshal object into Go struct field AwsIAMPolicySidInvalidCharactersPolicyStruct.Statement of type []rules.AwsIAMPolicySidInvalidCharactersStatementStruct

Failed to check ruleset. An error occurred:

Error: Failed to check `aws_iam_policy_sid_invalid_characters` rule: json: cannot unmarshal object into Go struct field AwsIAMPolicySidInvalidCharactersPolicyStruct.Statement of type []rules.AwsIAMPolicySidInvalidCharactersStatementStruct

Failed to check ruleset. An error occurred:

Error: Failed to check `aws_iam_policy_sid_invalid_characters` rule: json: cannot unmarshal object into Go struct field AwsIAMPolicySidInvalidCharactersPolicyStruct.Statement of type []rules.AwsIAMPolicySidInvalidCharactersStatementStruct

Failed to check ruleset. An error occurred:

Error: Failed to check `aws_iam_policy_sid_invalid_characters` rule: json: cannot unmarshal object into Go struct field AwsIAMPolicySidInvalidCharactersPolicyStruct.Statement of type []rules.AwsIAMPolicySidInvalidCharactersStatementStruct

Failed to check ruleset. An error occurred:

Error: Failed to check `aws_iam_policy_sid_invalid_characters` rule: json: cannot unmarshal object into Go struct field AwsIAMPolicySidInvalidCharactersPolicyStruct.Statement of type []rules.AwsIAMPolicySidInvalidCharactersStatementStruct

Version

TFLint version 0.32.1
+ ruleset.aws (0.7.1-bundled)