Fix policy reader to properly consume object principles and populate the principles collection

Author: danielmarbach

generator/.DevConfigs/afe0bbf9-4ecb-4fc0-af7f-ffff0c56190a.json

@@ -0,0 +1,9 @@
+{
+    "core": {
+        "updateMinimum": true,
+        "type": "Patch",
+        "changeLogMessages": [
+            "Fix regression where `Amazon.Auth.AccessControlPolicy.Policy.FromJson` was not correctly handling objects in the `Principal` property (https://github.com/aws/aws-sdk-net/issues/3791)"
+        ]
+    }
+}

sdk/src/Core/Amazon.Auth/AccessControlPolicy/Internal/JsonPolicyReader.cs

@@ -97,24 +97,19 @@ private static void convertPrincipals(Statement statement, JsonElement jStatemen
                 {
                     if (jPrincipal.Value.ValueKind == JsonValueKind.String)
                     {
-                        if (jPrincipal.Value.GetString().Equals("*"))
-                        {
-                            statement.Principals.Add(Principal.Anonymous);
-                        }
-                        else
-                        {
-                            // Don't strip '-' and assume the policy being deserialized is already valid.
-                            Principal principal = new Principal(jPrincipal.Name, jPrincipal.Value.GetString());
-                        }
+                        // Don't strip '-' and assume the policy being deserialized is already valid.
+                        Principal principal = new Principal(jPrincipal.Name, jPrincipal.Value.GetString());
+                        statement.Principals.Add(principal);
                     }
                     else if (jPrincipal.Value.ValueKind == JsonValueKind.Array)
                     {
-                        foreach (JsonElement arrayElement in jPrincipals.EnumerateArray())
+                        foreach (JsonElement arrayElement in jPrincipal.Value.EnumerateArray())
                         {
                             if (arrayElement.ValueKind == JsonValueKind.String)
                             {
                                 // Don't strip '-' and assume the policy being deserialized is already valid.
                                 Principal principal = new Principal(jPrincipal.Name, arrayElement.GetString(), false);
+                                statement.Principals.Add(principal);
                             }
                         }
                     }

sdk/test/UnitTests/Custom/PolicyTests.cs

@@ -1,21 +1,17 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Text;
-using System.Threading.Tasks;
-using Microsoft.VisualStudio.TestTools.UnitTesting;
-
-using Amazon.Auth.AccessControlPolicy;
+using Amazon.Auth.AccessControlPolicy;
 using AWSSDK_DotNet.IntegrationTests.Utils;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using System;
+using System.Linq;
 using static Amazon.Auth.AccessControlPolicy.ConditionFactory;
 
 namespace AWSSDK_DotNet.UnitTests
 {
     [TestClass]
+    [TestCategory("Runtime")]
     public class PolicyTests
     {
         [TestMethod]
-        [TestCategory("Runtime")]
         public void TestIfStatementAlreadyExists()
         {
             var policy = new Policy();
@@ -154,5 +150,104 @@ public void LookForStringComparisonTypeChanges()
                 expectedHash,
                 "The Amazon.Auth.AccessControlPolicy.ConditionFactory.ToString(DateComparisonType) method implementation may need to be updated.");
         }
+
+        [TestMethod]
+        public void HandleObjectsWhenConvertingPrincipals()
+        {
+            string testPolicy = @"{
+              ""Version"": ""2012-10-17"",
+              ""Statement"": [
+                {
+                  ""Effect"": ""Deny"",
+                  ""Action"": ""s3:*"",
+                  ""Principal"": {
+                    ""AWS"": [
+                        ""arn:aws:iam::123456789012:root"",
+                        ""999999999999""
+                    ],
+                    ""CanonicalUser"": ""79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be""
+                  },
+                  ""Resource"": [
+                    ""arn:aws:s3:::amzn-s3-demo-bucket/*"",
+                    ""arn:aws:s3:::amzn-s3-demo-bucket""
+                  ],
+                  ""Condition"": {
+                    ""ArnNotEquals"": {
+                      ""aws:PrincipalArn"": ""arn:aws:iam::444455556666:user/user-name""
+                    }
+                  }
+                }
+              ]
+            }";
+
+            var policy = Policy.FromJson(testPolicy);
+            Assert.IsNotNull(policy);
+            Assert.AreEqual(1, policy.Statements.Count);
+
+            var statement = policy.Statements.First();
+            Assert.AreEqual(statement.Actions.Count, 1);
+            Assert.AreEqual(statement.Principals.Count, 3);
+            Assert.AreEqual(statement.Conditions.Count, 1);
+        }
+
+        [TestMethod]
+        public void HandleSingleValueWhenConvertingPrincipals()
+        {
+            string testPolicy = @"{
+              ""Version"": ""2012-10-17"",
+              ""Statement"": [
+                {
+                  ""Effect"": ""Allow"",
+                  ""Action"": ""s3:ListBucket"",
+                  ""Principal"": {
+                    ""AWS"": ""123456789012""
+                  }
+                }
+              ]
+            }";
+
+            var policy = Policy.FromJson(testPolicy);
+            Assert.IsNotNull(policy);
+            Assert.AreEqual(1, policy.Statements.Count);
+
+            var statement = policy.Statements.First();
+            Assert.AreEqual(1, statement.Principals.Count);
+
+            var principal = statement.Principals.First();
+            Assert.AreEqual(Principal.AWS_PROVIDER, principal.Provider);
+            Assert.AreEqual("123456789012", principal.Id);
+        }
+
+        [TestMethod]
+        public void HandleAnonymousWhenConvertingPrincipals()
+        {
+            string testPolicy = @"{
+              ""Version"": ""2012-10-17"",
+              ""Statement"": [
+                {
+                  ""Effect"": ""Deny"",
+                  ""Action"": ""s3:*"",
+                  ""Principal"": ""*"",
+                  ""Resource"": [
+                    ""arn:aws:s3:::amzn-s3-demo-bucket/*"",
+                    ""arn:aws:s3:::amzn-s3-demo-bucket""
+                  ],
+                  ""Condition"": {
+                    ""ArnNotEquals"": {
+                      ""aws:PrincipalArn"": ""arn:aws:iam::444455556666:user/user-name""
+                    }
+                  }
+                }
+              ]
+            }";
+
+            var policy = Policy.FromJson(testPolicy);
+            Assert.IsNotNull(policy);
+            Assert.AreEqual(1, policy.Statements.Count);
+
+            var statement = policy.Statements.First();
+            Assert.AreEqual(1, statement.Principals.Count);
+            Assert.AreEqual(Principal.Anonymous, statement.Principals.First());
+        }
     }
 }