diff --git a/docs/rules/aws_iam_policy_too_long_policy.md b/docs/rules/aws_iam_policy_too_long_policy.md new file mode 100644 index 00000000..69d6ed30 --- /dev/null +++ b/docs/rules/aws_iam_policy_too_long_policy.md @@ -0,0 +1,35 @@ +# aws_iam_policy_too_long_policy + +This makes sure that a IAM policy is not longer than the 6144 AWS character limit. + +## Example + +```hcl +resource "aws_iam_policy" "policy" { + name = "test_policy" + path = "/" + description = "My test policy" + policy = < 6144 { + runner.EmitIssueOnExpr( + r, + fmt.Sprintf("The policy length is %d characters and is limited to 6144 characters.", len(policy)), + attribute.Expr, + ) + } + return nil + }) + }) +} diff --git a/rules/aws_iam_policy_too_long_policy_test.go b/rules/aws_iam_policy_too_long_policy_test.go new file mode 100644 index 00000000..d4f86c5f --- /dev/null +++ b/rules/aws_iam_policy_too_long_policy_test.go @@ -0,0 +1,77 @@ +package rules + +import ( + "math/rand" + "testing" + "time" + + hcl "github.com/hashicorp/hcl/v2" + "github.com/terraform-linters/tflint-plugin-sdk/helper" +) + +var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ") + +func randSeq(n int) string { + b := make([]rune, n) + for i := range b { + b[i] = letters[rand.Intn(len(letters))] + } + return string(b) +} + +func Test_AwsIAMPolicyTooLongPolicy(t *testing.T) { + rand.Seed(time.Now().UnixNano()) + cases := []struct { + Name string + Content string + Expected helper.Issues + }{ + { + Name: "policy is too long", + Content: ` +resource "aws_iam_policy" "policy" { + name = "test_policy" + path = "/" + description = "My test policy" + policy = </*"" + } + ] + } +EOF +} +`, + Expected: helper.Issues{ + { + Rule: NewAwsIAMPolicyTooLongPolicyRule(), + Message: "The policy length is 6145 characters and is limited to 6144 characters.", + Range: hcl.Range{ + Filename: "resource.tf", + Start: hcl.Pos{Line: 6, Column: 11}, + End: hcl.Pos{Line: 19, Column: 4}, + }, + }, + }, + }, + } + + rule := NewAwsIAMPolicyTooLongPolicyRule() + + for _, tc := range cases { + runner := helper.TestRunner(t, map[string]string{"resource.tf": tc.Content}) + + if err := rule.Check(runner); err != nil { + t.Fatalf("Unexpected error occurred: %s", err) + } + + helper.AssertIssues(t, tc.Expected, runner.Issues) + } +} diff --git a/rules/provider.go b/rules/provider.go index 158253f0..65b78a02 100644 --- a/rules/provider.go +++ b/rules/provider.go @@ -33,4 +33,5 @@ var Rules = append([]tflint.Rule{ NewAwsElastiCacheReplicationGroupInvalidTypeRule(), NewAwsElastiCacheReplicationGroupPreviousTypeRule(), NewAwsIAMPolicySidInvalidCharactersRule(), + NewAwsIAMPolicyTooLongPolicyRule(), }, models.Rules...)