Skip to content

Commit 067534d

Browse files
bbernayspull[bot]
bbernays
authored and
pull[bot]
committed
feat(aws)!: Support all policy types in Identity Center (#10985)
 #### Summary closes #10870 <!--
1 parent b53f63e commit 067534d

18 files changed

+468
-68
lines changed

‎plugins/source/aws/docs/tables/README.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -574,7 +574,11 @@
574574
- [aws_ssm_sessions](../../../../../website/tables/aws/aws_ssm_sessions.md)
575575
- [aws_ssoadmin_instances](../../../../../website/tables/aws/aws_ssoadmin_instances.md)
576576
- [aws_ssoadmin_permission_sets](../../../../../website/tables/aws/aws_ssoadmin_permission_sets.md)
577-
- [aws_ssoadmin_account_assignments](../../../../../website/tables/aws/aws_ssoadmin_account_assignments.md)
577+
- [aws_ssoadmin_permission_set_account_assignments](../../../../../website/tables/aws/aws_ssoadmin_permission_set_account_assignments.md)
578+
- [aws_ssoadmin_permission_set_customer_managed_policies](../../../../../website/tables/aws/aws_ssoadmin_permission_set_customer_managed_policies.md)
579+
- [aws_ssoadmin_permission_set_inline_policies](../../../../../website/tables/aws/aws_ssoadmin_permission_set_inline_policies.md)
580+
- [aws_ssoadmin_permission_set_managed_policies](../../../../../website/tables/aws/aws_ssoadmin_permission_set_managed_policies.md)
581+
- [aws_ssoadmin_permission_set_permissions_boundaries](../../../../../website/tables/aws/aws_ssoadmin_permission_set_permissions_boundaries.md)
578582
- [aws_stepfunctions_activities](../../../../../website/tables/aws/aws_stepfunctions_activities.md)
579583
- [aws_stepfunctions_state_machines](../../../../../website/tables/aws/aws_stepfunctions_state_machines.md)
580584
- [aws_stepfunctions_executions](../../../../../website/tables/aws/aws_stepfunctions_executions.md)

‎plugins/source/aws/resources/services/ssoadmin/account_assignments.go‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package ssoadmin
33
import (
44
"context"
55

6+
"github.com/apache/arrow/go/v13/arrow"
67
"github.com/aws/aws-sdk-go-v2/aws"
78
"github.com/aws/aws-sdk-go-v2/service/ssoadmin"
89
"github.com/aws/aws-sdk-go-v2/service/ssoadmin/types"
@@ -12,13 +13,31 @@ import (
1213
)
1314

1415
func accountAssignments() *schema.Table {
15-
tableName := "aws_ssoadmin_account_assignments"
16+
tableName := "aws_ssoadmin_permission_set_account_assignments"
1617
return &schema.Table{
17-
Name: tableName,
18-
Description: `https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AccountAssignment.html`,
19-
Resolver: fetchSsoadminAccountAssignments,
20-
Transform: transformers.TransformWithStruct(&types.AccountAssignment{}),
21-
Multiplex: client.ServiceAccountRegionMultiplexer(tableName, "identitystore"),
18+
Name: tableName,
19+
Description: `https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AccountAssignment.html
20+
The 'request_account_id' and 'request_region' columns are added to show the account_id and region of where the request was made from.`,
21+
Resolver: fetchSsoadminAccountAssignments,
22+
Transform: transformers.TransformWithStruct(&types.AccountAssignment{}, transformers.WithPrimaryKeys("PermissionSetArn", "PrincipalId", "PrincipalType", "AccountId")),
23+
Columns: schema.ColumnList{
24+
{
25+
Name: "request_account_id",
26+
Type: arrow.BinaryTypes.String,
27+
Resolver: client.ResolveAWSAccount,
28+
},
29+
{
30+
Name: "request_region",
31+
Type: arrow.BinaryTypes.String,
32+
Resolver: client.ResolveAWSRegion,
33+
},
34+
{
35+
Name: "instance_arn",
36+
Type: arrow.BinaryTypes.String,
37+
Resolver: schema.ParentColumnResolver("instance_arn"),
38+
PrimaryKey: true,
39+
},
40+
},
2241
}
2342
}
2443

‎plugins/source/aws/resources/services/ssoadmin/customer_managed_policies.go‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
package ssoadmin
2+
3+
import (
4+
"context"
5+
6+
"github.com/apache/arrow/go/v13/arrow"
7+
"github.com/aws/aws-sdk-go-v2/service/ssoadmin"
8+
"github.com/aws/aws-sdk-go-v2/service/ssoadmin/types"
9+
"github.com/cloudquery/cloudquery/plugins/source/aws/client"
10+
"github.com/cloudquery/plugin-sdk/v3/schema"
11+
"github.com/cloudquery/plugin-sdk/v3/transformers"
12+
)
13+
14+
func customerManagedPolicies() *schema.Table {
15+
tableName := "aws_ssoadmin_permission_set_customer_managed_policies"
16+
return &schema.Table{
17+
Name: tableName,
18+
Description: `https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListManagedPoliciesInPermissionSet.html`,
19+
Resolver: fetchCustomerManagedPolicies,
20+
Transform: transformers.TransformWithStruct(&types.CustomerManagedPolicyReference{}, transformers.WithPrimaryKeys("Name", "Path")),
21+
Columns: []schema.Column{
22+
{
23+
Name: "permission_set_arn",
24+
Type: arrow.BinaryTypes.String,
25+
Resolver: schema.ParentColumnResolver("permission_set_arn"),
26+
PrimaryKey: true,
27+
},
28+
{
29+
Name: "instance_arn",
30+
Type: arrow.BinaryTypes.String,
31+
Resolver: schema.ParentColumnResolver("instance_arn"),
32+
PrimaryKey: true,
33+
},
34+
},
35+
}
36+
}
37+
38+
func fetchCustomerManagedPolicies(ctx context.Context, meta schema.ClientMeta, parent *schema.Resource, res chan<- any) error {
39+
cl := meta.(*client.Client)
40+
svc := cl.Services().Ssoadmin
41+
42+
permissionSetARN := parent.Item.(*types.PermissionSet).PermissionSetArn
43+
instanceARN := parent.Parent.Item.(types.InstanceMetadata).InstanceArn
44+
config := ssoadmin.ListCustomerManagedPolicyReferencesInPermissionSetInput{
45+
InstanceArn: instanceARN,
46+
PermissionSetArn: permissionSetARN,
47+
}
48+
paginator := ssoadmin.NewListCustomerManagedPolicyReferencesInPermissionSetPaginator(svc, &config)
49+
for paginator.HasMorePages() {
50+
page, err := paginator.NextPage(ctx, func(o *ssoadmin.Options) {
51+
o.Region = cl.Region
52+
})
53+
if err != nil {
54+
return err
55+
}
56+
res <- page.CustomerManagedPolicyReferences
57+
}
58+
return nil
59+
}

‎plugins/source/aws/resources/services/ssoadmin/inline_policies.go‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
package ssoadmin
2+
3+
import (
4+
"context"
5+
"encoding/json"
6+
"net/url"
7+
8+
"github.com/apache/arrow/go/v13/arrow"
9+
"github.com/aws/aws-sdk-go-v2/service/ssoadmin"
10+
"github.com/aws/aws-sdk-go-v2/service/ssoadmin/types"
11+
"github.com/cloudquery/cloudquery/plugins/source/aws/client"
12+
"github.com/cloudquery/plugin-sdk/v3/schema"
13+
"github.com/cloudquery/plugin-sdk/v3/transformers"
14+
sdkTypes "github.com/cloudquery/plugin-sdk/v3/types"
15+
)
16+
17+
func inlinePolicies() *schema.Table {
18+
tableName := "aws_ssoadmin_permission_set_inline_policies"
19+
return &schema.Table{
20+
Name: tableName,
21+
Description: `https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetInlinePolicyForPermissionSet.html`,
22+
Resolver: fetchInlinePolicies,
23+
Transform: transformers.TransformWithStruct(&ssoadmin.GetInlinePolicyForPermissionSetOutput{}, transformers.WithSkipFields("ResultMetadata")),
24+
Columns: []schema.Column{
25+
{
26+
Name: "permission_set_arn",
27+
Type: arrow.BinaryTypes.String,
28+
Resolver: schema.ParentColumnResolver("permission_set_arn"),
29+
PrimaryKey: true,
30+
},
31+
{
32+
Name: "instance_arn",
33+
Type: arrow.BinaryTypes.String,
34+
Resolver: schema.ParentColumnResolver("instance_arn"),
35+
PrimaryKey: true,
36+
},
37+
{
38+
Name: "inline_policy_json",
39+
Type: sdkTypes.ExtensionTypes.JSON,
40+
Resolver: resolveInlinePolicyJSON,
41+
},
42+
},
43+
}
44+
}
45+
46+
func fetchInlinePolicies(ctx context.Context, meta schema.ClientMeta, parent *schema.Resource, res chan<- any) error {
47+
cl := meta.(*client.Client)
48+
svc := cl.Services().Ssoadmin
49+
50+
permissionSetARN := parent.Item.(*types.PermissionSet).PermissionSetArn
51+
instanceARN := parent.Parent.Item.(types.InstanceMetadata).InstanceArn
52+
config := ssoadmin.GetInlinePolicyForPermissionSetInput{
53+
InstanceArn: instanceARN,
54+
PermissionSetArn: permissionSetARN,
55+
}
56+
57+
response, err := svc.GetInlinePolicyForPermissionSet(ctx, &config, func(o *ssoadmin.Options) {
58+
o.Region = cl.Region
59+
})
60+
if err != nil {
61+
return err
62+
}
63+
64+
res <- response
65+
return nil
66+
}
67+
68+
func resolveInlinePolicyJSON(ctx context.Context, meta schema.ClientMeta, resource *schema.Resource, c schema.Column) error {
69+
r := resource.Item.(*ssoadmin.GetInlinePolicyForPermissionSetOutput)
70+
71+
decodedDocument, err := url.QueryUnescape(*r.InlinePolicy)
72+
if err != nil {
73+
return err
74+
}
75+
76+
var document map[string]any
77+
err = json.Unmarshal([]byte(decodedDocument), &document)
78+
if err != nil {
79+
return err
80+
}
81+
return resource.Set(c.Name, document)
82+
}

‎plugins/source/aws/resources/services/ssoadmin/instances.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ func Instances() *schema.Table {
1616
Name: tableName,
1717
Description: `https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_InstanceMetadata.html`,
1818
Resolver: fetchSsoadminInstances,
19-
Transform: transformers.TransformWithStruct(&types.InstanceMetadata{}),
19+
Transform: transformers.TransformWithStruct(&types.InstanceMetadata{}, transformers.WithPrimaryKeys("InstanceArn")),
2020
Multiplex: client.ServiceAccountRegionMultiplexer(tableName, "identitystore"),
2121

2222
Relations: []*schema.Table{

‎plugins/source/aws/resources/services/ssoadmin/instances_mock_test.go‎

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ func buildInstances(t *testing.T, ctrl *gomock.Controller) client.Services {
1616
im := types.InstanceMetadata{}
1717
ps := types.PermissionSet{}
1818
as := types.AccountAssignment{}
19+
pb := types.PermissionsBoundary{}
20+
cmpr := types.CustomerManagedPolicyReference{}
21+
amp := types.AttachedManagedPolicy{}
1922
ip := `{"key": "value"}`
2023
err := faker.FakeObject(&ps)
2124
if err != nil {
@@ -29,7 +32,18 @@ func buildInstances(t *testing.T, ctrl *gomock.Controller) client.Services {
2932
if err != nil {
3033
t.Fatal(err)
3134
}
32-
35+
err = faker.FakeObject(&pb)
36+
if err != nil {
37+
t.Fatal(err)
38+
}
39+
err = faker.FakeObject(&cmpr)
40+
if err != nil {
41+
t.Fatal(err)
42+
}
43+
err = faker.FakeObject(&amp)
44+
if err != nil {
45+
t.Fatal(err)
46+
}
3347
mSSOAdmin.EXPECT().ListInstances(gomock.Any(), gomock.Any(), gomock.Any()).Return(
3448
&ssoadmin.ListInstancesOutput{
3549
Instances: []types.InstanceMetadata{im},
@@ -58,6 +72,20 @@ func buildInstances(t *testing.T, ctrl *gomock.Controller) client.Services {
5872
InlinePolicy: &ip,
5973
}, nil)
6074

75+
mSSOAdmin.EXPECT().GetPermissionsBoundaryForPermissionSet(gomock.Any(), gomock.Any(), gomock.Any()).Return(
76+
&ssoadmin.GetPermissionsBoundaryForPermissionSetOutput{
77+
PermissionsBoundary: &pb,
78+
}, nil)
79+
80+
mSSOAdmin.EXPECT().ListCustomerManagedPolicyReferencesInPermissionSet(gomock.Any(), gomock.Any(), gomock.Any()).Return(
81+
&ssoadmin.ListCustomerManagedPolicyReferencesInPermissionSetOutput{
82+
CustomerManagedPolicyReferences: []types.CustomerManagedPolicyReference{cmpr},
83+
}, nil)
84+
mSSOAdmin.EXPECT().ListManagedPoliciesInPermissionSet(gomock.Any(), gomock.Any(), gomock.Any()).Return(
85+
&ssoadmin.ListManagedPoliciesInPermissionSetOutput{
86+
AttachedManagedPolicies: []types.AttachedManagedPolicy{amp},
87+
}, nil)
88+
6189
return client.Services{
6290
Ssoadmin: mSSOAdmin,
6391
}

‎plugins/source/aws/resources/services/ssoadmin/managed_policies.go‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
package ssoadmin
2+
3+
import (
4+
"context"
5+
6+
"github.com/apache/arrow/go/v13/arrow"
7+
"github.com/aws/aws-sdk-go-v2/service/ssoadmin"
8+
"github.com/aws/aws-sdk-go-v2/service/ssoadmin/types"
9+
"github.com/cloudquery/cloudquery/plugins/source/aws/client"
10+
"github.com/cloudquery/plugin-sdk/v3/schema"
11+
"github.com/cloudquery/plugin-sdk/v3/transformers"
12+
)
13+
14+
func managedPolicies() *schema.Table {
15+
tableName := "aws_ssoadmin_permission_set_managed_policies"
16+
return &schema.Table{
17+
Name: tableName,
18+
Description: `https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListManagedPoliciesInPermissionSet.html`,
19+
Resolver: fetchManagedPolicies,
20+
Transform: transformers.TransformWithStruct(&types.AttachedManagedPolicy{}, transformers.WithPrimaryKeys("Arn")),
21+
Columns: []schema.Column{
22+
{
23+
Name: "permission_set_arn",
24+
Type: arrow.BinaryTypes.String,
25+
Resolver: schema.ParentColumnResolver("permission_set_arn"),
26+
PrimaryKey: true,
27+
},
28+
{
29+
Name: "instance_arn",
30+
Type: arrow.BinaryTypes.String,
31+
Resolver: schema.ParentColumnResolver("instance_arn"),
32+
PrimaryKey: true,
33+
},
34+
},
35+
}
36+
}
37+
38+
func fetchManagedPolicies(ctx context.Context, meta schema.ClientMeta, parent *schema.Resource, res chan<- any) error {
39+
cl := meta.(*client.Client)
40+
svc := cl.Services().Ssoadmin
41+
42+
permissionSetARN := parent.Item.(*types.PermissionSet).PermissionSetArn
43+
instanceARN := parent.Parent.Item.(types.InstanceMetadata).InstanceArn
44+
config := ssoadmin.ListManagedPoliciesInPermissionSetInput{
45+
InstanceArn: instanceARN,
46+
PermissionSetArn: permissionSetARN,
47+
}
48+
paginator := ssoadmin.NewListManagedPoliciesInPermissionSetPaginator(svc, &config)
49+
for paginator.HasMorePages() {
50+
page, err := paginator.NextPage(ctx, func(o *ssoadmin.Options) {
51+
o.Region = cl.Region
52+
})
53+
if err != nil {
54+
return err
55+
}
56+
res <- page.AttachedManagedPolicies
57+
}
58+
return nil
59+
}

‎plugins/source/aws/resources/services/ssoadmin/permission_boundaries.go‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
package ssoadmin
2+
3+
import (
4+
"context"
5+
6+
"github.com/apache/arrow/go/v13/arrow"
7+
"github.com/aws/aws-sdk-go-v2/service/ssoadmin"
8+
"github.com/aws/aws-sdk-go-v2/service/ssoadmin/types"
9+
"github.com/cloudquery/cloudquery/plugins/source/aws/client"
10+
"github.com/cloudquery/plugin-sdk/v3/schema"
11+
"github.com/cloudquery/plugin-sdk/v3/transformers"
12+
)
13+
14+
func permissionsBoundaries() *schema.Table {
15+
tableName := "aws_ssoadmin_permission_set_permissions_boundaries"
16+
return &schema.Table{
17+
Name: tableName,
18+
Description: `https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetPermissionsBoundaryForPermissionSet.html`,
19+
Resolver: fetchPermissionBoundaries,
20+
Transform: transformers.TransformWithStruct(&types.PermissionsBoundary{}, transformers.WithSkipFields("ResultMetadata")),
21+
Columns: []schema.Column{
22+
{
23+
Name: "permission_set_arn",
24+
Type: arrow.BinaryTypes.String,
25+
Resolver: schema.ParentColumnResolver("permission_set_arn"),
26+
PrimaryKey: true,
27+
},
28+
{
29+
Name: "instance_arn",
30+
Type: arrow.BinaryTypes.String,
31+
Resolver: schema.ParentColumnResolver("instance_arn"),
32+
PrimaryKey: true,
33+
},
34+
},
35+
}
36+
}
37+
38+
func fetchPermissionBoundaries(ctx context.Context, meta schema.ClientMeta, parent *schema.Resource, res chan<- any) error {
39+
cl := meta.(*client.Client)
40+
svc := cl.Services().Ssoadmin
41+
42+
permissionSetARN := parent.Item.(*types.PermissionSet).PermissionSetArn
43+
instanceARN := parent.Parent.Item.(types.InstanceMetadata).InstanceArn
44+
config := ssoadmin.GetPermissionsBoundaryForPermissionSetInput{
45+
InstanceArn: instanceARN,
46+
PermissionSetArn: permissionSetARN,
47+
}
48+
49+
response, err := svc.GetPermissionsBoundaryForPermissionSet(ctx, &config, func(o *ssoadmin.Options) {
50+
o.Region = cl.Region
51+
})
52+
if err != nil {
53+
return err
54+
}
55+
56+
res <- response.PermissionsBoundary
57+
return nil
58+
}

0 commit comments

Comments
 (0)