INFRA-4009 | Ankit Bhardwaj | add validation for restrictive policy (#723)

This commit is contained in:
Ankit Bhardwaj Bhardwaj
2024-11-20 15:39:46 +05:30
committed by GitHub
parent 2ab3117047
commit 54639c71a1

View File

@@ -30,12 +30,15 @@ function isS3WildcardAction(action: string | string[]): boolean {
function createContextError(context: any, message: string): boolean {
return context.createError({ message });
}
function isPrincipalRestrictive(principal: any): boolean {
return principal === '*' || principal?.AWS === '*' || principal?.AWS?.includes('*');
}
function isStatementTooRestrictive(statements: any): boolean {
return statements.some(
(statement: any) =>
statement.Principal === '*' &&
statement.Effect === 'Deny' &&
isPrincipalRestrictive(statement.Principal) &&
isS3WildcardAction(statement.Action),
);
}