Repository: salesforce/policy_sentry (python)

Issue:
Actions table query reports Conditions incorrectly
I installed policy_sentry yesterday with pip.
```
$ policy_sentry --version
policy_sentry, version 0.13.1
```

When I query the Conditions table for Actions which support iam:PermissionsBoundary, iam:CreateRole comes up:
```
$ policy_sentry query action-table -s iam -c iam:PermissionsBoundary
IAM actions under iam service that support the iam:PermissionsBoundary condition only:
iam:AttachRolePolicy
iam:AttachUserPolicy
iam:CreateRole <=======
iam:CreateUser
iam:DeleteRolePermissionsBoundary
iam:DeleteRolePolicy
iam:DeleteUserPermissionsBoundary
iam:DeleteUserPolicy
iam:DetachRolePolicy
iam:DetachUserPolicy
iam:PutRolePermissionsBoundary
iam:PutRolePolicy
iam:PutUserPermissionsBoundary
iam:PutUserPolicy
```

But when I query the Action table for iam:CreateRole, the condition_keys element does NOT contain iam:PermissionsBoundary:
```
$ policy_sentry query action-table -s iam -n CreateRole
{
    "iam": [
        {
            "action": "iam:CreateRole",
            "description": "Grants permission to create a new role",
            "access_level": "Permissions management",
            "api_documentation_link": "https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html",
            "resource_arn_format": "arn:${Partition}:iam::${Account}:role/${RoleNameWithPath}",
            "condition_keys": [
                "aws:ResourceTag/${TagKey}",  <======
                "iam:ResourceTag/${TagKey}"
            ],
            "dependent_actions": []
        },
        {
            "action": "iam:CreateRole",
            "description": "Grants permission to create a new role",
            "access_level": "Permissions management",
            "api_documentation_link": "https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html",
            "resource_arn_format": "*",
            "condition_keys": [
                "aws:ResourceTag/${TagKey}",  <======
                "iam:ResourceTag/${TagKey}"
            ],
            "dependent_actions": []
        }
    ]
}
```

Maybe this is because the SAR has more than one entry in the resource_types[] array? TBH I'm not even sure how to interpret this phenomenon in the SAR, which shows up as split cells in the table, e.g. [iam:CreateRole](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentityandaccessmanagementiam.html#awsidentityandaccessmanagementiam-CreateRole)

Actually, trying other Actions it seems policy_sentry just doesn't report Condtion Keys at all? e.g.
```
$ policy_sentry query action-table -s lambda -n CreateEventSourceMapping
{
    "lambda": [
        {
            "action": "lambda:CreateEventSourceMapping",
            "description": "Grants permission to create a mapping between an event source and an AWS Lambda function",
            "access_level": "Write",
            "api_documentation_link": "https://docs.aws.amazon.com/lambda/latest/dg/API_CreateEventSourceMapping.html",
            "resource_arn_format": "*",
            "condition_keys": [],  <======
            "dependent_actions": []
        }
    ]
}
```
compare with https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslambda.html#awslambda-CreateEventSourceMapping

Pull request description:
correctly propagate condition keys to resource types
## What does this PR do?

Fixes #522 

## What gif best describes this PR or how it makes you feel?

![](https://media.giphy.com/media/9V5dlBnbjrPcruCVE6/giphy.gif?cid=790b7611858h9q3dmmx3nll0garcrhfto5cn67zprxkp2v7e&ep=v1_gifs_search&rid=giphy.gif&ct=g)

## Completion checklist

- [x] Additions and changes have unit tests
- [x] [Unit tests, Pylint, security testing, and Integration tests are passing.](https://github.com/salesforce/policy_sentry/actions). GitHub actions does this automatically
- [x] The pull request has been appropriately labeled using the provided PR labels


Patch:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd14bd18..6b5a2d08 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,7 @@ permissions:
 
 env:
   MIN_PYTHON_VERSION: "3.9"
+  TERRAFORM_VERSION: "1.10"
 
 jobs:
   pre-commit:
@@ -23,6 +24,9 @@ jobs:
       - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: ${{ env.MIN_PYTHON_VERSION }}
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
+        with:
+          terraform_version: ${{ env.TERRAFORM_VERSION }}
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1
 
   sanity:
diff --git a/policy_sentry/querying/actions.py b/policy_sentry/querying/actions.py
index 15dd5c20..5486a2f6 100644
--- a/policy_sentry/querying/actions.py
+++ b/policy_sentry/querying/actions.py
@@ -109,11 +109,17 @@ def create_action_data_entries(
     """
 
     results = []
-    condition_keys = []
     dependent_actions = []
+
+    # check for condition keys, which can be used with any allowed resource type
+    wildcard_condition_keys = []
+    if wildcard_resource_type := action_data["resource_types"].get(""):
+        wildcard_condition_keys = wildcard_resource_type["condition_keys"]
+
     for resource_type, resource_type_entry in action_data["resource_types"].items():
         # Set default value for if no other matches are found
         resource_arn_format = "*"
+        condition_keys = []
         # Get the dependent actions
         resource_dependent_actions = resource_type_entry["dependent_actions"]
         if resource_dependent_actions:
@@ -123,7 +129,11 @@ def create_action_data_entries(
             service_resource_data = service_prefix_data["resources"].get(resource_type)
             if service_resource_data:
                 resource_arn_format = service_resource_data.get("arn", "*")
-                condition_keys = service_resource_data.get("condition_keys")
+                if resource_condition_keys := service_resource_data.get("condition_keys"):
+                    condition_keys.extend(resource_condition_keys)
+
+        if wildcard_condition_keys:
+            condition_keys.extend(wildcard_condition_keys)
 
         temp_dict = {
             "action": f"{service_prefix_data['prefix']}:{action_name}",


Test patch:
diff --git a/test/querying/test_query_actions.py b/test/querying/test_query_actions.py
index f4ad7c64..2abe6fe5 100644
--- a/test/querying/test_query_actions.py
+++ b/test/querying/test_query_actions.py
@@ -145,6 +145,8 @@ class QueryActionsTestCase(unittest.TestCase):
                         "aws:ResourceTag/${TagKey}",
                         "ram:PermissionArn",
                         "ram:PermissionResourceType",
+                        "aws:RequestTag/${TagKey}",
+                        "aws:TagKeys",
                     ],
                     "dependent_actions": [],
                 },
@@ -158,6 +160,8 @@ class QueryActionsTestCase(unittest.TestCase):
                         "aws:ResourceTag/${TagKey}",
                         "ram:AllowsExternalPrincipals",
                         "ram:ResourceShareName",
+                        "aws:RequestTag/${TagKey}",
+                        "aws:TagKeys",
                     ],
                     "dependent_actions": [],
                 },
@@ -168,9 +172,8 @@ class QueryActionsTestCase(unittest.TestCase):
                     "api_documentation_link": "https://docs.aws.amazon.com/ram/latest/APIReference/API_TagResource.html",
                     "resource_arn_format": "*",
                     "condition_keys": [
-                        "aws:ResourceTag/${TagKey}",
-                        "ram:AllowsExternalPrincipals",
-                        "ram:ResourceShareName",
+                        "aws:RequestTag/${TagKey}",
+                        "aws:TagKeys",
                     ],
                     "dependent_actions": [],
                 },