Support "required" as an additional key for a privilege

[vkomarov-r7]

In the AWS Actions Table docs, resources that are marked as required within the tables are denoted as having a * at the end of the resource type. For better machine consumption of this data, would it be possible to include a new key, called required or the like on a given resource type block that denotes the required status of the resource, and remove the asterisk from the resource type?

# for: ec2-instance-connect:SendSSHPublicKey
{
    "resource_type": "instance",  # remove asterisk
    "required": true,  # add boolean flag denoting the required status
    "condition_keys": [],
    "dependent_actions": []
},

[kmcquade]

Yes, definitely possible to do this without ripple effects

Can I understand your use case a bit more? Curious as to what prompts this ask specifically

As a note for implementation if anyone takes this on (as I might not have time to do this for a bit)

• Currently, the iam_definition.json file just contains the wildcard on the resource instance* in the example above
• We store it as-is, so some resource types do have the * suffixed and some do not
• The * is removed later down the line in policy_sentry.querying.actions by some_resource_type["resource_type"].strip("*"). You can find all 3 matches by searching for strip("*"). Example:
  https://github.com/salesforce/policy_sentry/blob/master/policy_sentry/querying/actions.py#L205
• This is the location where you would discover whether or not the resource type is suffixed by a *, before you would feed it into the chomp function. https://github.com/salesforce/policy_sentry/blob/master/policy_sentry/shared/awsdocs.py#L278
• This would be added to the JSON at this location: https://github.com/salesforce/policy_sentry/blob/master/policy_sentry/shared/awsdocs.py#L293

[vkomarov-r7]

Hey, saw the PR, thanks for fixing this! To follow up, our use case is basically determining which ARN patterns are applicable for a given action. In our existing code, we use the json metadata file directly (without policy_sentry as a go-between), so we just do .rstrip('*') internally, but the thought occurred to me that breaking the asterisk out during parsing would be cleaner overall.

Your changes and speed are much appreciated!