Migrate IAM list entities for policy operation#13841
Conversation
LocalStack Community integration with Pro 2 files ±0 2 suites ±0 2m 43s ⏱️ -5s For more details on these failures, see this check. Results for commit d6bb002. ± Comparison against base commit dfd4cef. |
Test Results (amd64) - Integration, Bootstrap 5 files ±0 5 suites ±0 11m 41s ⏱️ +23s For more details on these failures, see this check. Results for commit d6bb002. ± Comparison against base commit dfd4cef. |
pinzon
left a comment
There was a problem hiding this comment.
LGTM. I only have one question.
| PolicyRole(RoleName=role["RoleName"], RoleId=role["RoleId"]) | ||
| ) | ||
|
|
||
| # Search groups (groups don't support PermissionsBoundary) |
There was a problem hiding this comment.
question: are we sure this doesn't raise an exception? listing with entity_type == group and policy_usage_filter == Permissions boundary
There was a problem hiding this comment.
Just checked, it does not, it is just empty.
Motivation
One thing still missing from the policy implementation was the
list_entities_for_policyoperation - it was deliberately left out, since it makes little sense without all the entities implemented.Changes
Design Decisions
No index for reverse lookups: The current model stores policy ARNs on entities. For
list_entities_for_policy, we iterate through all entities. This is acceptable because:PolicyUsageFilter handling:
PermissionsBoundary, we need to check thePermissionsBoundaryfield on users and rolesLocalManagedPolicy vs AWSManagedPolicy filter:
Tests
Existing tests in
test_iam_policies.py::TestListEntitiesForPolicy:test_list_entities_for_policy: Tests filtering by Role, User, Group, LocalManagedPolicy, and no filtertest_list_entities_for_policy_errors: Tests error case for non-existent policyRelated
Closes UNC-295