aws.rest-api
Filters
cross-account
Check a resource’s embedded iam policy for cross account access.
Supports a whitelist_patterns option to skip principals whose identifier
matches any of the provided fnmatch patterns. This is
useful for ignoring unique identifiers left behind by deleted IAM principals
(e.g. AIDA* for deleted IAM users, AROA* for deleted IAM roles)
which AWS substitutes into resource policies when the original principal is
removed. See IAM unique identifiers
for the full list of prefixes.
- type: cross-account
whitelist_patterns:
- "AIDA*"
- "AROA*"
Supports a whitelist_org_units option for trusting principals via
aws:PrincipalOrgPaths conditions. Each entry must be a full OU path
starting with the org ID and ending with the OU ID to trust:
- type: cross-account
whitelist_org_units:
- "o-abc1234567/r-ab12/ou-ab12-prod"
Wildcards (*, ?) are not permitted in whitelist entries. The org
ID prefix is required because OU IDs are only unique within an
organization. A whitelist matches a policy path when the path’s leading
segment equals the whitelist’s org ID and the whitelist’s leaf OU ID
appears as a literal segment in the path; this means a parent-OU whitelist
will not implicitly cover policies that only name a descendant OU. List
each OU level you actually want to trust. aws:PrincipalOrgPaths matching
also respects whitelist_orgids. Any policy path whose leading segment
matches a whitelisted org ID is accepted regardless of the OU whitelist.
properties:
actions:
items:
type: string
type: array
everyone_only:
type: boolean
return_allowed:
type: boolean
type:
enum:
- cross-account
whitelist:
items:
type: string
type: array
whitelist_conditions:
items:
type: string
type: array
whitelist_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
whitelist_org_units:
items:
type: string
type: array
whitelist_org_units_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
whitelist_orgids:
items:
type: string
type: array
whitelist_orgids_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
whitelist_patterns:
items:
type: string
type: array
whitelist_patterns_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
whitelist_vpc:
items:
type: string
type: array
whitelist_vpc_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
whitelist_vpce:
items:
type: string
type: array
whitelist_vpce_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
headers:
patternProperties:
? ''
: type: string
type: object
query:
type: string
url:
type: string
required:
- url
type: object
required:
- type
Permissions - apigateway:GET
has-statement
Find resources with matching access policy statements.
If you want to return resource statements that include the listed key, e.g. Action, you can use PartialMatch instead of an exact match.
- example:
policies:
- name: sns-check-statement-id
resource: sns
filters:
- type: has-statement
statement_ids:
- BlockNonSSL
policies:
- name: sns-check-block-non-ssl
resource: sns
filters:
- type: has-statement
statements:
- Effect: Deny
Action: 'SNS:Publish'
Principal: '*'
Condition:
Bool:
"aws:SecureTransport": "false"
PartialMatch: 'Action'
properties:
statement_ids:
items:
type: string
type: array
statements:
items:
properties:
Action:
anyOf:
- type: string
- type: array
Condition:
type: object
Effect:
enum:
- Allow
- Deny
type: string
NotAction:
anyOf:
- type: string
- type: array
NotPrincipal:
anyOf:
- type: object
- type: array
NotResource:
anyOf:
- type: string
- type: array
PartialMatch:
anyOf:
- enum:
- Action
- NotAction
- Principal
- NotPrincipal
- Resource
- NotResource
- Condition
type: string
- items:
- enum:
- Action
- NotAction
- Principal
- NotPrincipal
- Resource
- NotResource
- Condition
type: string
type: array
Principal:
anyOf:
- type: string
- type: object
- type: array
Resource:
anyOf:
- type: string
- type: array
Sid:
type: string
required:
- Effect
type: object
type: array
type:
enum:
- has-statement
required:
- type
Permissions - apigateway:GET
json-diff
Compute the diff from the current resource to a previous version.
A resource matches the filter if a diff exists between the current resource and the selected revision.
Utilizes config as a resource revision database.
Revisions can be selected by date, against the previous version, and against a locked version (requires use of is-locked filter).
properties:
selector:
enum:
- previous
- date
- locked
selector_value:
type: string
type:
enum:
- json-diff
required:
- type
Permissions - config:GetResourceConfigHistory
Actions
delete
Delete a REST API.
- example:
contrived example to delete rest api
policies:
- name: apigw-delete
resource: rest-api
filters:
- description: empty
actions:
- type: delete
properties:
type:
enum:
- delete
required:
- type
Permissions - apigateway:DELETE
rename-tag
Rename an existing tag key to a new value.
- example:
rename Application, and Bap to App, if a resource has both of the old keys then we’ll use the value specified by Application, which is based on the order of values of old_keys.
policies: - name: rename-tags-example resource: aws.log-group filters: - or: - "tag:Bap": present - "tag:Application": present actions: - type: rename-tag old_keys: [Application, Bap] new_key: App
properties:
new_key:
type: string
old_key:
type: string
old_keys:
items:
type: string
type: array
type:
enum:
- rename-tag
required:
- type
Permissions - tag:TagResources, tag:UntagResources
update
Update configuration of a REST API.
Non-exhaustive list of updateable attributes. https://docs.aws.amazon.com/apigateway/api-reference/link-relation/restapi-update/#remarks
- example:
contrived example to update description on api gateways
policies:
- name: apigw-description
resource: rest-api
filters:
- description: empty
actions:
- type: update
patch:
- op: replace
path: /description
value: "not empty :-)"
properties:
patch:
items:
additonalProperties: false
properties:
from:
type: string
op:
enum:
- add
- remove
- update
- copy
- replace
- test
path:
type: string
value:
type: string
required:
- op
- path
type: object
type: array
type:
enum:
- update
required:
- patch
- type
Permissions - apigateway:PATCH