correctly propagate condition keys to resource types

.github/workflows/ci.yml

@@ -14,6 +14,7 @@ permissions:
 
 env:
   MIN_PYTHON_VERSION: "3.9"
+  TERRAFORM_VERSION: "1.10"
 
 jobs:
   pre-commit:
@@ -23,6 +24,9 @@ jobs:
       - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: ${{ env.MIN_PYTHON_VERSION }}
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
+        with:
+          terraform_version: ${{ env.TERRAFORM_VERSION }}
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1
 
   sanity:

policy_sentry/querying/actions.py

@@ -109,11 +109,17 @@ def create_action_data_entries(
     """
 
     results = []
-    condition_keys = []
     dependent_actions = []
+
+    # check for condition keys, which can be used with any allowed resource type
+    wildcard_condition_keys = []
+    if wildcard_resource_type := action_data["resource_types"].get(""):
+        wildcard_condition_keys = wildcard_resource_type["condition_keys"]
+
     for resource_type, resource_type_entry in action_data["resource_types"].items():
         # Set default value for if no other matches are found
         resource_arn_format = "*"
+        condition_keys = []
         # Get the dependent actions
         resource_dependent_actions = resource_type_entry["dependent_actions"]
         if resource_dependent_actions:
@@ -123,7 +129,11 @@ def create_action_data_entries(
             service_resource_data = service_prefix_data["resources"].get(resource_type)
             if service_resource_data:
                 resource_arn_format = service_resource_data.get("arn", "*")
-                condition_keys = service_resource_data.get("condition_keys")
+                if resource_condition_keys := service_resource_data.get("condition_keys"):
+                    condition_keys.extend(resource_condition_keys)
+
+        if wildcard_condition_keys:
+            condition_keys.extend(wildcard_condition_keys)
 
         temp_dict = {
             "action": f"{service_prefix_data['prefix']}:{action_name}",

test/querying/test_query_actions.py

@@ -145,6 +145,8 @@ def test_get_action_data(self):
                         "aws:ResourceTag/${TagKey}",
                         "ram:PermissionArn",
                         "ram:PermissionResourceType",
+                        "aws:RequestTag/${TagKey}",
+                        "aws:TagKeys",
                     ],
                     "dependent_actions": [],
                 },
@@ -158,6 +160,8 @@ def test_get_action_data(self):
                         "aws:ResourceTag/${TagKey}",
                         "ram:AllowsExternalPrincipals",
                         "ram:ResourceShareName",
+                        "aws:RequestTag/${TagKey}",
+                        "aws:TagKeys",
                     ],
                     "dependent_actions": [],
                 },
@@ -168,9 +172,8 @@ def test_get_action_data(self):
                     "api_documentation_link": "https://docs.aws.amazon.com/ram/latest/APIReference/API_TagResource.html",
                     "resource_arn_format": "*",
                     "condition_keys": [
-                        "aws:ResourceTag/${TagKey}",
-                        "ram:AllowsExternalPrincipals",
-                        "ram:ResourceShareName",
+                        "aws:RequestTag/${TagKey}",
+                        "aws:TagKeys",
                     ],
                     "dependent_actions": [],
                 },