Upgrade AWS IAM v1 client to v2 #509
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,147 @@ | ||
| package com.gu.janus.policy | ||
|
|
||
| import io.circe.syntax._ | ||
| import io.circe.{Encoder, Json, JsonObject} | ||
|
|
||
| import scala.collection.immutable.ListMap | ||
|
|
||
| /** This models the AWS IAM policy types and subtypes. | ||
| * | ||
| * See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html | ||
| * for the logic of the Json encoding. | ||
| */ | ||
| object Iam { | ||
|
There was a problem hiding this comment. Do we need this Iam object wrapper? No harm, I can see (minor) arguments both ways 👍 There was a problem hiding this comment. It seemed like a convenient reference to hold everything together. But can remove if you prefer - not strictly necessary. |
||
|
|
||
| sealed trait Effect | ||
| object Effect { | ||
| case object Allow extends Effect | ||
| case object Deny extends Effect | ||
|
|
||
| implicit val encoder: Encoder[Effect] = Encoder.instance { | ||
| case Allow => Json.fromString("Allow") | ||
| case Deny => Json.fromString("Deny") | ||
| } | ||
| } | ||
|
|
||
| case class Action(name: String) | ||
| object Action { | ||
| implicit val encoder: Encoder[Action] = Encoder[String].contramap(_.name) | ||
| } | ||
|
|
||
| case class Resource(id: String) | ||
| object Resource { | ||
| implicit val encoder: Encoder[Resource] = Encoder[String].contramap(_.id) | ||
| } | ||
|
|
||
| case class Condition( | ||
| key: String, | ||
| typeName: String, | ||
| conditionValues: Seq[String] | ||
| ) | ||
| object Condition { | ||
| implicit val encoder: Encoder[Condition] = Encoder.instance { condition => | ||
| Json.obj( | ||
| condition.typeName -> Json.obj( | ||
| condition.key -> Json.fromValues( | ||
| condition.conditionValues.map(Json.fromString) | ||
| ) | ||
| ) | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| case class Principal(id: String, provider: String) | ||
| object Principal { | ||
| implicit val encoder: Encoder[Principal] = Encoder.instance { principal => | ||
| Json.obj( | ||
| principal.provider -> Json.fromString(principal.id) | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| case class Statement( | ||
| effect: Effect, | ||
| actions: Seq[Action], | ||
| resources: Seq[Resource], | ||
| id: Option[String] = None, | ||
| conditions: Seq[Condition] = Nil, | ||
| principals: Seq[Principal] = Nil | ||
| ) | ||
| object Statement { | ||
| private def conditionsAsJson(conditions: Seq[Condition]): Json = { | ||
| val mergedConditions = conditions | ||
| .groupBy(_.typeName) | ||
| .view | ||
| .mapValues(conditions => | ||
| Json.obj( | ||
| conditions.map(condition => | ||
| condition.key -> Json.fromValues( | ||
| condition.conditionValues.map(Json.fromString) | ||
| ) | ||
| ): _* | ||
| ) | ||
| ) | ||
| .toMap | ||
| Json.fromJsonObject(JsonObject.fromMap(mergedConditions)) | ||
| } | ||
|
|
||
| private def principalsAsJson(principals: Seq[Principal]): Json = { | ||
| val principalMap = principals | ||
| .groupBy(_.provider) | ||
| .view | ||
| .mapValues(principals => | ||
| Json.fromValues( | ||
| principals.map(p => Json.fromString(p.id)) | ||
| ) | ||
| ) | ||
| .toMap | ||
| Json.fromJsonObject(JsonObject.fromMap(principalMap)) | ||
| } | ||
|
|
||
| implicit val encoder: Encoder[Statement] = Encoder.instance { statement => | ||
| // Using ListMap to preserve order of fields, which is easier to debug | ||
| val baseFields = ListMap( | ||
| "Effect" -> statement.effect.asJson, | ||
| "Action" -> statement.actions.asJson, | ||
| "Resource" -> statement.resources.asJson | ||
| ) | ||
|
|
||
| val withSid = statement.id.fold(baseFields)(id => | ||
|
There was a problem hiding this comment. Let's talk about Statement IDs! The current implementation adds unique SIDs using incrementing integers, so if we're going for compatibility we should keep that behaviour. However, for inline policies (which is what Janus produces) SIDs are not required and I was already considering removing them. Let's talk about the behaviour we want for now in this PR and in the future. However, this does tie into my other point about having a test that ensures we are maintining Janus Data config-file-compatibility during this change. There was a problem hiding this comment. On the face of it, removing the statement IDs looks sensible. I'm not sure where or how they're referenced. Let's discuss next week. There was a problem hiding this comment. Now statement IDs will be included in the output json representation if they're explicitly added to a Statement case class, otherwise they'll be omitted. |
||
| baseFields + ("Sid" -> Json.fromString(id)) | ||
| ) | ||
|
|
||
| val withConditions = | ||
| if (statement.conditions.nonEmpty) | ||
| withSid + ("Condition" -> conditionsAsJson(statement.conditions)) | ||
| else withSid | ||
|
|
||
| val withPrincipals = | ||
| if (statement.principals.nonEmpty) | ||
| withConditions + ("Principal" -> principalsAsJson( | ||
| statement.principals | ||
| )) | ||
| else withConditions | ||
|
|
||
| Json.fromJsonObject(JsonObject.fromMap(withPrincipals)) | ||
| } | ||
| } | ||
|
|
||
| case class Policy( | ||
| statements: Seq[Statement], | ||
| id: Option[String] = None | ||
| ) | ||
|
|
||
| object Policy { | ||
| private val PolicyVersion = "2012-10-17" | ||
|
|
||
| implicit val encoder: Encoder[Policy] = Encoder.instance { policy => | ||
| val baseObj = JsonObject( | ||
| "Version" -> Json.fromString(PolicyVersion), | ||
| "Statement" -> policy.statements.asJson | ||
| ) | ||
| Json.fromJsonObject( | ||
| policy.id.fold(baseObj)(id => baseObj.add("Id", Json.fromString(id))) | ||
| ) | ||
| } | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,6 @@ | ||
| package com.gu.janus.policy | ||
|
|
||
| import com.gu.janus.policy.Iam._ | ||
|
|
||
| object Statements { | ||
|
|
||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🥳