Add aws_iam_group_policy too long rule (#159)

* Add aws_iam_group_policy too long rule

* fixed PR comments

* Wrapped checks in EnsureNoError

Author: Rihoj

docs/rules/aws_iam_group_policy_too_long.md

@@ -0,0 +1,34 @@
+# aws_iam_group_policy_too_long
+
+This makes sure that an IAM group policy is not longer than the 5120 AWS character limit.
+## Example
+
+```hcl
+resource "aws_iam_group_policy" "policy" {
+	name        = "test_policy"
+	group       = "test_group"
+	description = "My test policy"
+	policy = <<EOF
+	{
+		STRING LONGER THAN 5120
+	}
+EOF
+}
+```
+
+```
+$ tflint
+1 issue(s) found:
+Error: The policy length is %d characters and is limited to 5120 characters. (aws_iam_policy_too_long_policy)
+  on template.tf line 6:
+   6:   policy = "{POLICY}" // Policy is too long,!
+
+```
+
+## Why
+
+Terraform does not check against this rule, but it will error if an apply is attempted. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-quotas-entity-length
+
+## How To Fix
+
+Update policy to reduce characters. Some methods are splitting into multiple policies, or switching to using a combination of deny and allow statements to optimize the policy.

docs/rules/aws_iam_policy_too_long_policy.md

@@ -1,6 +1,6 @@
 # aws_iam_policy_too_long_policy
 
-This makes sure that a IAM policy is not longer than the 6144 AWS character limit.
+This makes sure that an IAM policy is not longer than the 6144 AWS character limit.
 
 ## Example
 

rules/aws_iam_group_policy_too_long.go

@@ -0,0 +1,64 @@
+package rules
+
+import (
+	"fmt"
+	hcl "github.com/hashicorp/hcl/v2"
+	"github.com/terraform-linters/tflint-plugin-sdk/tflint"
+	"github.com/terraform-linters/tflint-ruleset-aws/project"
+	"regexp"
+)
+
+// AwsIAMGroupPolicyTooLongRule checks that the policy length is less than 5,120 characters
+type AwsIAMGroupPolicyTooLongRule struct {
+	resourceType  string
+	attributeName string
+	whitespaceRegex *regexp.Regexp
+}
+
+// NewAwsIAMGroupPolicyTooLongRule returns new rule with default attributes
+func NewAwsIAMGroupPolicyTooLongRule() *AwsIAMGroupPolicyTooLongRule {
+	return &AwsIAMGroupPolicyTooLongRule{
+		resourceType:  "aws_iam_group_policy",
+		attributeName: "policy",
+		whitespaceRegex: regexp.MustCompile(`\s+`),
+	}
+}
+
+// Name returns the rule name
+func (r *AwsIAMGroupPolicyTooLongRule) Name() string {
+	return "aws_iam_group_policy_too_long"
+}
+
+// Enabled returns whether the rule is enabled by default
+func (r *AwsIAMGroupPolicyTooLongRule) Enabled() bool {
+	return true
+}
+
+// Severity returns the rule severity
+func (r *AwsIAMGroupPolicyTooLongRule) Severity() string {
+	return tflint.ERROR
+}
+
+// Link returns the rule reference link
+func (r *AwsIAMGroupPolicyTooLongRule) Link() string {
+	return project.ReferenceLink(r.Name())
+}
+
+// Check checks the length of the policy
+func (r *AwsIAMGroupPolicyTooLongRule) Check(runner tflint.Runner) error {
+	return runner.WalkResourceAttributes(r.resourceType, r.attributeName, func(attribute *hcl.Attribute) error {
+		var policy string
+		err := runner.EvaluateExpr(attribute.Expr, &policy, nil)
+		return runner.EnsureNoError(err, func() error {
+			policy = r.whitespaceRegex.ReplaceAllString(policy, "")
+			if len(policy) > 5120 {
+				runner.EmitIssueOnExpr(
+					r,
+					fmt.Sprintf("The policy length is %d characters and is limited to 5120 characters.", len(policy)),
+					attribute.Expr,
+				)
+			}
+			return nil
+		})
+	})
+}

rules/aws_iam_group_policy_too_long_test.go

@@ -0,0 +1,75 @@
+package rules
+
+import (
+	"math/rand"
+	"testing"
+	"time"
+
+	hcl "github.com/hashicorp/hcl/v2"
+	"github.com/terraform-linters/tflint-plugin-sdk/helper"
+)
+
+func AwsIAMGroupPolicyTooLongRandSeq(n int) string {
+	var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
+	b := make([]rune, n)
+	for i := range b {
+		b[i] = letters[rand.Intn(len(letters))]
+	}
+	return string(b)
+}
+
+func Test_AwsIAMGroupPolicyTooLong(t *testing.T) {
+	rand.Seed(time.Now().UnixNano())
+	cases := []struct {
+		Name     string
+		Content  string
+		Expected helper.Issues
+	}{
+		{
+			Name: "policy is too long",
+			Content: `
+resource "aws_iam_group_policy" "policy" {
+	name        = "test_policy"
+	group = "test_group"
+	policy = <<EOF
+	{
+		"Version": "2012-10-17",
+		"Statement": [
+		{
+			"Action": [
+				` + AwsIAMGroupPolicyTooLongRandSeq(5120) + `
+			],
+			"Effect": "Allow",
+			"Resource": "arn:aws:s3:::<bucketname>/*""
+		}
+		]
+	}
+EOF
+}
+`,
+			Expected: helper.Issues{
+				{
+					Rule:    NewAwsIAMGroupPolicyTooLongRule(),
+					Message: "The policy length is 5231 characters and is limited to 5120 characters.",
+					Range: hcl.Range{
+						Filename: "resource.tf",
+						Start:    hcl.Pos{Line: 5, Column: 11},
+						End:      hcl.Pos{Line: 18, Column: 4},
+					},
+				},
+			},
+		},
+	}
+
+	rule := NewAwsIAMGroupPolicyTooLongRule()
+
+	for _, tc := range cases {
+		runner := helper.TestRunner(t, map[string]string{"resource.tf": tc.Content})
+
+		if err := rule.Check(runner); err != nil {
+			t.Fatalf("Unexpected error occurred: %s", err)
+		}
+
+		helper.AssertIssues(t, tc.Expected, runner.Issues)
+	}
+}

rules/aws_iam_policy_too_long_policy_test.go

@@ -9,9 +9,8 @@ import (
 	"github.com/terraform-linters/tflint-plugin-sdk/helper"
 )
 
-var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
-
-func randSeq(n int) string {
+func AwsIAMPolicyTooLongPolicyRandSeq(n int) string {
+	var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
 	b := make([]rune, n)
 	for i := range b {
 		b[i] = letters[rand.Intn(len(letters))]
@@ -39,7 +38,7 @@ resource "aws_iam_policy" "policy" {
 		"Statement": [
 		{
 			"Action": [
-				` + randSeq(6034) + `
+				` + AwsIAMPolicyTooLongPolicyRandSeq(6034) + `
 			],
 			"Effect": "Allow",
 			"Resource": "arn:aws:s3:::<bucketname>/*""

rules/provider.go

@@ -35,4 +35,5 @@ var Rules = append([]tflint.Rule{
 	NewAwsIAMPolicySidInvalidCharactersRule(),
 	NewAwsIAMPolicyTooLongPolicyRule(),
 	NewAwsLambdaFunctionDeprecatedRuntimeRule(),
+	NewAwsIAMGroupPolicyTooLongRule(),
 }, models.Rules...)