func buildResourceList(stmt statement) []*string {
	resourceList := []*string{}
	for _, resource := range stmt.Resource {
		resourceList = append(resourceList, aws.String(resource))
	}
	return resourceList
}
builds the list of resources for an action
package federatedaccesstesting
import (
	"encoding/base64"
	"fmt"
	"io/ioutil"
	"os"
	"os/exec"
	"testing"
	"gopkg.in/yaml.v2"
	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/credentials"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/iam"
)
type crStruct struct {
	Spec struct {
		Policy struct {
			Statements []statement `yaml:"awsStatements"`
		} `yaml:"awsCustomPolicy"`
	} `yaml:"spec"`
}
type statement struct {
	Effect    string                       `yaml:"effect"`
	Action    []string                     `yaml:"action"`
	Resource  []string                     `yaml:"resource"`
	Condition map[string]map[string]string `yaml:"condition"`
}
type federatedAccountAccess struct {
	Metadata struct {
		Labels struct {
			AccountID string `yaml:"awsAccountID"`
			UID       string `yaml:"uid"`
		} `yaml:"labels"`
	} `yaml:"metadata"`
	Spec struct {
		Role struct {
			Name string `yaml:"name"`
		} `yaml:"awsFederatedRole"`
	} `yaml:"spec"`
}
type awsUserSecret struct {
	Data struct {
		AccessKeyID     string `yaml:"aws_access_key_id"`
		SecretAccessKey string `yaml:"aws_secret_access_key"`
	} `yaml:"data"`
}
func TestFederatedAccessRolePermissions(t *testing.T) {
	cr := os.Getenv("TEST_CR")
	if cr == "" {
		t.Skip("TEST_CR is not set, skipping.")
	}
	crFile := os.Getenv("TEST_ROLE_FILE")
	if crFile == "" {
		t.Skip("TEST_ROLE_FILE is not set, skipping.")
	}
	crToTest := crStruct{}
	unmarshalFromFile(t, crFile, &crToTest)
	accountAccessCR := federatedAccountAccess{}
	getFederatedAccountAccessCR(t, cr, &accountAccessCR)
	awsSecret := awsUserSecret{}
	getSecretCredentials(t, &awsSecret)
	iamClient, err := getAWSIAMClient(t, awsSecret)
	if err != nil {
		t.Fatal("Unable to get AWS Client", err)
	}
	roleARN := fmt.Sprintf("arn:aws:iam::%s:role/%s-%s", accountAccessCR.Metadata.Labels.AccountID, accountAccessCR.Spec.Role.Name, accountAccessCR.Metadata.Labels.UID)
	statements := crToTest.Spec.Policy.Statements
	for _, stmt := range statements {
		testAction(t, iamClient, roleARN, stmt)
	}
}
func buildActionList(stmt statement) []*string {
	actionList := []*string{}
	for _, action := range stmt.Action {
		actionList = append(actionList, aws.String(action))
	}
	return actionList
}
func buildContextList(stmt statement) []*iam.ContextEntry {
	contextList := []*iam.ContextEntry{}
	for key, condition := range stmt.Condition {
		if key == "StringEquals" || key == "StringLike" {
			for contextKey, contextValue := range condition {
				contextList = append(contextList, &iam.ContextEntry{
					ContextKeyName:   aws.String(contextKey),
					ContextKeyType:   aws.String("string"),
					ContextKeyValues: []*string{aws.String(contextValue)},
				})
			}
		}
	}
	return contextList
}