Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validator for duplicate names in iamResource trait #2293

Merged
merged 7 commits into from
May 22, 2024
Merged
Show file tree
Hide file tree
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
/*
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License").
* You may not use this file except in compliance with the License.
* A copy of the License is located at
*
* http://aws.amazon.com/apache2.0
*
* or in the "license" file accompanying this file. This file is distributed
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied. See the License for the specific language governing
* permissions and limitations under the License.
*/

package software.amazon.smithy.aws.iam.traits;

import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.stream.Collectors;
import software.amazon.smithy.model.Model;
import software.amazon.smithy.model.knowledge.TopDownIndex;
import software.amazon.smithy.model.shapes.ResourceShape;
import software.amazon.smithy.model.shapes.ServiceShape;
import software.amazon.smithy.model.validation.AbstractValidator;
import software.amazon.smithy.model.validation.ValidationEvent;
import software.amazon.smithy.utils.SmithyInternalApi;

/**
* Ensures that there is no resource name conflict in a service closure
* in IAM space after processing {@link IamResourceTrait}.
*/
@SmithyInternalApi
public class IamResourceTraitConflictingNameValidator extends AbstractValidator {
@Override
public List<ValidationEvent> validate(Model model) {
TopDownIndex topDownIndex = TopDownIndex.of(model);
return model.shapes(ServiceShape.class)
.flatMap(shape -> validateService(topDownIndex, shape).stream())
.collect(Collectors.toList());
}

private List<ValidationEvent> validateService(TopDownIndex topDownIndex, ServiceShape service) {
List<ValidationEvent> events = new ArrayList<>();
Map<String, ResourceShape> container = new HashMap<>();
for (ResourceShape resource : topDownIndex.getContainedResources(service)) {
String resourceName = resource.getId().getName();
IamResourceTrait iamResourceTrait;
if (resource.hasTrait(IamResourceTrait.class)
&& resource.expectTrait(IamResourceTrait.class).getName().isPresent()) {
resourceName = resource.getTrait(IamResourceTrait.class).get().getName().get();
}
Copy link
Contributor

@syall syall May 21, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the method you want to use is IamResourceTrait::resolveResourceName().

To get the resource name in the IAM space, something like this could work:

String resourceName = IamResourceTrait.resolveResourceName(resource);

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that this means the .getName check in the if must also be removed, as resolveResourceName checks other sources.

if (container.containsKey(resourceName)) {
events.add(error(resource, String.format(
"Conflicting IAM resource names in an entire service closure is not allowed. "
+ "This IAM resource name `%s` conflicts with other resource `%s` in the service `%s`.",
resourceName, container.get(resourceName), service.getId())));

}
container.put(resourceName, resource);
}
return events;
}
}
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
software.amazon.smithy.aws.iam.traits.ConditionKeysValidator
software.amazon.smithy.aws.iam.traits.IamActionValidator
software.amazon.smithy.aws.iam.traits.IamResourceTraitValidator
software.amazon.smithy.aws.iam.traits.IamResourceTraitConflictingNameValidator
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
[ERROR] smithy.example#Beer: Conflicting IAM resource names in an entire service closure is not allowed. This IAM resource name `Beer` conflicts with other resource `(resource: `smithy.example#BadIamResourceName`)` in the service `smithy.example#MyService`. | IamResourceTraitConflictingName
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
$version: "2"
namespace smithy.example

use aws.api#arn

@aws.api#service(sdkId: "My")
@aws.iam#defineConditionKeys("foo:baz": {type: "String", documentation: "Foo baz"})
service MyService {
version: "2019-02-20",
resources: [
BadIamResourceName,
Beer,
ShouldNotThrowAnErrorFirst,
ShouldNotThrowAnErrorSecond
]
}

@aws.iam#iamResource(name: "Beer")
resource BadIamResourceName {
identifiers: {
id: String
}
}

resource Beer {
identifiers: {
beerId: String
}
}

@aws.iam#iamResource(name: "shouldNotThrowErrorSecond")
resource ShouldNotThrowAnErrorFirst {
identifiers: {
beerId: String
}
}

@aws.iam#iamResource(name: "shouldNotThrowErrorFirst")
resource ShouldNotThrowAnErrorSecond {
identifiers: {
arn: String
}
}
Loading