Skip to content

Commit f81f65c

Browse files
authored
chore: do not load managed policies if already ARN (#2964)
1 parent c391bfb commit f81f65c

File tree

2 files changed

+61
-0
lines changed

2 files changed

+61
-0
lines changed

samtranslator/model/role_utils/role_constructor.py

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,12 @@ def _get_managed_policy_arn(
4343
if arn:
4444
return arn
4545

46+
# If it's already an ARN, we're done
47+
# https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
48+
is_arn = name.startswith("arn:")
49+
if is_arn:
50+
return name
51+
4652
# Caller-provided function to get managed policy map (fallback)
4753
if get_managed_policy_map:
4854
fallback_managed_policy_map = get_managed_policy_map()

tests/translator/test_translator.py

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -736,6 +736,61 @@ def get_managed_policy_map():
736736
self.assertEqual(function_arn, expected_arn)
737737
self.assertEqual(sfn_arn, expected_arn)
738738

739+
# test to make sure with arn it doesnt load, with non-arn it does
740+
@parameterized.expand(
741+
[
742+
([""], 1),
743+
(["SomeNonArnThing"], 1),
744+
(["SomeNonArnThing", "AnotherNonArnThing"], 1),
745+
(["aws:looks:like:an:ARN:but-not-really"], 1),
746+
(["arn:looks:like:an:ARN:foo", "Mixing_things_v2"], 1),
747+
(["arn:looks:like:an:ARN:foo"], 0),
748+
([{"Ref": "Foo"}], 0),
749+
([{"SQSPollerPolicy": {"QueueName": "Bar"}}], 0),
750+
(["arn:looks:like:an:ARN", "arn:aws:ec2:us-east-1:123456789012:vpc/vpc-0e9801d129EXAMPLE"], 0),
751+
]
752+
)
753+
@patch("boto3.session.Session.region_name", "ap-southeast-1")
754+
@patch("botocore.client.ClientEndpointBridge._check_default_region", mock_get_region)
755+
def test_managed_policies_arn_not_loaded(self, policies, load_policy_count):
756+
class ManagedPolicyLoader:
757+
def __init__(self):
758+
self.call_count = 0
759+
760+
def load(self):
761+
self.call_count += 1
762+
return {}
763+
764+
managed_policy_loader = ManagedPolicyLoader()
765+
766+
with patch("samtranslator.internal.managed_policies._BUNDLED_MANAGED_POLICIES", {}):
767+
transform(
768+
{
769+
"Resources": {
770+
"MyFunction": {
771+
"Type": "AWS::Serverless::Function",
772+
"Properties": {
773+
"Handler": "foo",
774+
"InlineCode": "bar",
775+
"Runtime": "nodejs14.x",
776+
"Policies": policies,
777+
},
778+
},
779+
"MyStateMachine": {
780+
"Type": "AWS::Serverless::StateMachine",
781+
"Properties": {
782+
"DefinitionUri": "s3://egg/baz",
783+
"Policies": policies,
784+
},
785+
},
786+
}
787+
},
788+
{},
789+
managed_policy_loader,
790+
)
791+
792+
self.assertEqual(load_policy_count, managed_policy_loader.call_count)
793+
739794
@parameterized.expand(
740795
[
741796
# All combinations, bundled map takes precedence

0 commit comments

Comments
 (0)