func ValidateIAMPolicyResource(ctx context.Context, pDoc v1alpha1.PolicyDocument) *field.Error {
	log := log.Logger(ctx, "pkg.validation", "ValidateIAMPolicyResource")
	for _, statement := range pDoc.Statement {
		if statement.Effect == "Deny" {
			continue
		}
		for _, resource := range statement.Resource {
			isAllowed := true
			for _, res := range config.Props.RestrictedPolicyResources() {
				if strings.Contains(resource, res) {
					isAllowed = false
					break
				}
			}
			if !isAllowed {
				err := fmt.Sprintf("restricted resource %s included in the request", resource)
				log.Error(errors.New(err), err)
				return field.Forbidden(field.NewPath("spec").Child("PolicyDocument").Child("Resource"), fmt.Sprintf("restricted resource %s included in the request", resource))
			}
		}
	}
	return nil
}
ValidateIAMPolicyResource validates policy resource
package validation
import (
	"context"
	"encoding/json"
	"fmt"
	"github.com/aws/aws-sdk-go/service/iam"
	"github.com/keikoproj/iam-manager/api/v1alpha1"
	"github.com/keikoproj/iam-manager/internal/config"
	"github.com/keikoproj/iam-manager/pkg/awsapi"
	"github.com/keikoproj/iam-manager/pkg/log"
	"github.com/pkg/errors"
	"k8s.io/apimachinery/pkg/util/validation/field"
	"net/url"
	"reflect"
	"strings"
)
func ValidateIAMPolicyAction(ctx context.Context, pDoc v1alpha1.PolicyDocument) *field.Error {
	log := log.Logger(ctx, "pkg.validation", "ValidateIAMPolicyAction")
	for _, statement := range pDoc.Statement {
		if statement.Effect == "Deny" {
			continue
		}
		for _, action := range statement.Action {
			isAllowed := false
			for _, prefix := range config.Props.AllowedPolicyAction() {
				if strings.HasPrefix(action, prefix) {
					isAllowed = true
					break
				}
			}
			if !isAllowed {
				err := fmt.Sprintf("restricted action %s included in the request", action)
				log.Error(errors.New(err), err)
				return field.Forbidden(field.NewPath("spec").Child("PolicyDocument").Child("Action"), fmt.Sprintf("restricted action %s included in the request", action))
			}
			if strings.HasPrefix(action, "s3:") {
				for _, resource := range statement.Resource {
					for _, res := range config.Props.RestrictedS3Resources() {
						isAllowed := false
						if resource != res {
							isAllowed = true
							break
						}
						if !isAllowed {
							err := fmt.Sprintf("restricted resource %s included in the request", resource)
							log.Error(errors.New(err), err)
							return field.Forbidden(field.NewPath("spec").Child("PolicyDocument").Child("Resource"), fmt.Sprintf("restricted resource %s included in the request", resource))
						}
					}
				}
			}
		}
	}
	return nil
}