Repository: duo-labs/parliament

Issue:
Validate Statement Id values
If set, the `Sid` field in IAM policies may only contain characters from `(A-Z,a-z,0-9)`. `parliament` should declare a finding if `Sid` has spaces or other invalid characters. 

Discussion:

Patch:
diff --git a/parliament/statement.py b/parliament/statement.py
index bf663c9..cd9ab34 100644
--- a/parliament/statement.py
+++ b/parliament/statement.py
@@ -632,6 +632,15 @@ class Statement:
         else:
             self.effect_allow = False
 
+        # Check Sid
+        if "Sid" in self.stmt and not re.fullmatch("[0-9A-Za-z]*", self.stmt["Sid"]):
+            self.add_finding(
+                "Statement Sid does match regex [0-9A-Za-z]*",
+                severity.MALFORMED,
+                location={"string": self.stmt},
+            )
+            return False
+
         # Check Action
         if "Action" in self.stmt and "NotAction" in self.stmt:
             self.add_finding(


Test patch:
diff --git a/tests/unit/test_formatting.py b/tests/unit/test_formatting.py
index 98233d9..9a395e1 100644
--- a/tests/unit/test_formatting.py
+++ b/tests/unit/test_formatting.py
@@ -41,6 +41,18 @@ class TestFormatting(unittest.TestCase):
         )
         assert_false(len(policy.findings) == 0, "Policy has no Statement")
 
+    def test_analyze_policy_string_invalid_sid(self):
+        policy = analyze_policy_string(
+            """{
+    "Version": "2012-10-17",
+    "Statement": {
+        "Sid": "Statement With Spaces And Special Chars!?",
+        "Effect": "Allow",
+        "Action": "s3:listallmybuckets",
+        "Resource": "*"}}"""
+        )
+        assert_false(len(policy.findings) == 0, "Policy statement has invalid Sid")
+
     def test_analyze_policy_string_correct_simple(self):
         policy = analyze_policy_string(
             """{