Add missing elements to Policy Statement (#24792)

* Add: NotAction, NotResource, Principal, NotPrincipal
* Implement some of the conditional logic
  - e.g., Action or NotAction is required
  - however, mutual exclusivity is not implemented (hard to do in Typescript)
* Allow >1 statement per PolicyDocument
This commit is contained in:
Aneil Mallavarapu 2018-04-12 12:11:30 -07:00 committed by Mohamed Hegazy
parent 01a9dfd2f5
commit a5db46d192
2 changed files with 55 additions and 7 deletions

View File

@ -260,9 +260,27 @@ statement = {
};
statement = {
Sid: str,
Action: [str, str],
Effect: str,
Resource: [str, str]
Resource: [str, str],
Condition: {
condition1: { key: "value" },
condition2: [{
key1: "value",
key2: "value"
}, {
key3: "value"
}]
},
Principal: [str, str],
NotPrincipal: [str, str]
};
statement = {
Effect: str,
NotAction: str,
NotResource: str
};
policyDocument = {
@ -270,6 +288,11 @@ policyDocument = {
Statement: [statement]
};
policyDocument = {
Version: str,
Statement: [statement, statement]
};
authResponse = {
principalId: str,
policyDocument,

View File

@ -17,6 +17,7 @@
// Simon Buchan <https://github.com/simonbuchan>
// David Hayden <https://github.com/Haydabase>
// Chris Redekop <https://github.com/repl-chris>
// Aneil Mallavarapu <https://github.com/aneilbaboo>
// Definitions: https://github.com/DefinitelyTyped/DefinitelyTyped
// TypeScript Version: 2.3
@ -438,28 +439,52 @@ export interface CustomAuthorizerResult {
principalId: string;
policyDocument: PolicyDocument;
context?: AuthResponseContext;
usageIdentifierKey?: string;
}
export type AuthResponse = CustomAuthorizerResult;
/**
* API Gateway CustomAuthorizer AuthResponse.PolicyDocument.
* http://docs.aws.amazon.com/apigateway/latest/developerguide/use-custom-authorizer.html#api-gateway-custom-authorizer-output
* https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-lambda-authorizer-output.html
* https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Condition
*/
export interface PolicyDocument {
Version: string;
Statement: [Statement];
Id?: string;
Statement: Statement[];
}
/**
* API Gateway CustomAuthorizer AuthResponse.PolicyDocument.Condition.
* https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-policy-language-overview.html
* https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html
*/
export interface ConditionBlock {
[condition: string]: Condition | Condition[];
}
export interface Condition {
[key: string]: string | string[];
}
/**
* API Gateway CustomAuthorizer AuthResponse.PolicyDocument.Statement.
* http://docs.aws.amazon.com/apigateway/latest/developerguide/use-custom-authorizer.html#api-gateway-custom-authorizer-output
* https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-policy-language-overview.html
* https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html
*/
export interface Statement {
Action: string | string[];
export type Statement = BaseStatement & StatementAction & StatementResource;
export interface BaseStatement {
Effect: string;
Resource: string | string[];
Sid?: string;
Condition?: ConditionBlock;
Principal?: string | string[];
NotPrincipal?: string | string[];
}
export type StatementAction = { Action: string | string[] } | { NotAction: string | string[] };
export type StatementResource = { Resource: string | string[] } | { NotResource: string | string[] };
/**
* API Gateway CustomAuthorizer AuthResponse.PolicyDocument.Statement.
* http://docs.aws.amazon.com/apigateway/latest/developerguide/use-custom-authorizer.html#api-gateway-custom-authorizer-output