#NEWLINE# def check_star_assume_role_policy( self , iamrole_item ) : #NEWLINE# #INDENT# '\n        alert when an IAM Role has an assume_role_policy_document but using a star\n        instead of limiting the assume to a specific IAM Role.\n        ' #NEWLINE# tag = '{0} allows assume-role from anyone' . format ( self . i_am_singular ) #NEWLINE# def check_statement( statement ) : #NEWLINE# #INDENT# action = statement . get ( 'Action' , None ) #NEWLINE# if ( action and ( action == 'sts:AssumeRole' ) ) : #NEWLINE# #INDENT# effect = statement . get ( 'Effect' , None ) #NEWLINE# if ( effect and ( effect == 'Allow' ) ) : #NEWLINE# #INDENT# principal = statement . get ( 'Principal' , None ) #NEWLINE# if ( not principal ) : #NEWLINE# #INDENT# return #NEWLINE# #UNINDENT# if ( type ( principal ) is dict ) : #NEWLINE# #INDENT# aws = principal . get ( 'AWS' , None ) #NEWLINE# if ( aws and ( aws == '*' ) ) : #NEWLINE# #INDENT# self . add_issue ( 10 , tag , iamrole_item , notes = json . dumps ( statement ) ) #NEWLINE# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# if ( aws and ( type ( aws ) is list ) ) : #NEWLINE# #INDENT# for entry in aws : #NEWLINE# #INDENT# if ( entry == '*' ) : #NEWLINE# #INDENT# self . add_issue ( 10 , tag , iamrole_item , notes = json . dumps ( statement ) ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# assume_role_policy = iamrole_item . config . get ( 'assume_role_policy_document' , { #NEWLINE# #INDENT# #NEWLINE# #UNINDENT# } ) #NEWLINE# statement = assume_role_policy . get ( 'Statement' , [ ] ) #NEWLINE# if ( type ( statement ) is list ) : #NEWLINE# #INDENT# for single_statement in statement : #NEWLINE# #INDENT# check_statement ( single_statement ) #NEWLINE# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# if ( type ( statement ) is dict ) : #NEWLINE# #INDENT# check_statement ( statement )