feat: Provide a decoded policy document field inside aws_iam_policies.policy_version_list (#2020)

disq · web-flow · commit e7c51e170d60 · 2022-09-23T08:54:11.000Z
~This PR adds a `DecodedDocument *string` field inside the `policy_version_list []types.PolicyVersion` field.~ [PolicyVersion type](https://docs.aws.amazon.com/IAM/latest/APIReference/API_PolicyVersion.html) includes an URL-encoded policy document, which is no use to run policies with. The alternative is [this](c071944) which is extra slow.
diff --git a/plugins/source/aws/codegen/recipes/iam.go b/plugins/source/aws/codegen/recipes/iam.go
@@ -187,7 +187,7 @@ func IAMResources() []*Resource {
 		{
 			SubService: "policies",
 			Struct:     &types.ManagedPolicyDetail{},
-			SkipFields: []string{"PolicyId", "Tags"},
+			SkipFields: []string{"PolicyId", "Tags", "PolicyVersionList"},
 			ExtraColumns: []codegen.ColumnDefinition{
 				{
 					Name:     "account_id",
@@ -206,6 +206,11 @@ func IAMResources() []*Resource {
 					Type:     schema.TypeJSON,
 					Resolver: `resolveIamPolicyTags`,
 				},
+				{
+					Name:     "policy_version_list",
+					Type:     schema.TypeJSON,
+					Resolver: `resolveIamPolicyVersionList`,
+				},
 			},
 		},
 		{
diff --git a/plugins/source/aws/resources/services/iam/policies.go b/plugins/source/aws/resources/services/iam/policies.go
diff --git a/plugins/source/aws/resources/services/iam/policies_fetch.go b/plugins/source/aws/resources/services/iam/policies_fetch.go
@@ -2,6 +2,7 @@ package iam
 
 import (
 	"context"
+	"net/url"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
@@ -41,3 +42,15 @@ func resolveIamPolicyTags(ctx context.Context, meta schema.ClientMeta, resource
 	}
 	return resource.Set("tags", client.TagsToMap(response.Tags))
 }
+
+func resolveIamPolicyVersionList(ctx context.Context, meta schema.ClientMeta, resource *schema.Resource, c schema.Column) error {
+	r := resource.Item.(types.ManagedPolicyDetail)
+	for i := range r.PolicyVersionList {
+		if v, err := url.PathUnescape(aws.ToString(r.PolicyVersionList[i].Document)); err == nil {
+			r.PolicyVersionList[i].Document = &v
+		} else {
+			meta.Logger().Warn().Err(err).Str("policy_id", aws.ToString(r.PolicyId)).Msg("Failed to unescape policy document, leaving as-is")
+		}
+	}
+	return resource.Set(c.Name, r.PolicyVersionList)
+}
