Repository: Netflix/consoleme
File: consoleme/lib/aws.py (Python)

Code before:
    ```

    :param
        arn: The AWS role arn
        role_tags: A dictionary of role tags

    :return: boolean specifying whether ConsoleMe is allowed to sync / access the role
    """
    allowed_tags = config.get("roles.allowed_tags", {})
    allowed_arns = config.get("roles.allowed_arns", [])
    allowed_tag_keys = config.get("roles.allowed_tag_keys", [])
    if not allowed_tags and not allowed_arns and not allowed_tag_keys:
        return True

    if role_arn in allowed_arns:
        return True

    # Convert list of role tag dicts to an array of tag keys
    # ex:
    # role_tags = [{'Key': 'consoleme-authorized', 'Value': 'consoleme_admins'},
    # {'Key': 'Description', 'Value': 'ConsoleMe OSS Demo Role'}]
    # so: actual_tag_keys = ['consoleme-authorized', 'Description']
    actual_tag_keys = [d['Key'] for d in role_tags]

    # If any allowed tag key exists in the role's actual_tags this condition will pass
    if allowed_tag_keys and any(x in allowed_tag_keys for x in actual_tag_keys):
        return True

    # Convert list of role tag dicts to a single key/value dict of tags
    # ex:
    # role_tags = [{'Key': 'consoleme-authorized', 'Value': 'consoleme_admins'},
    # {'Key': 'Description', 'Value': 'ConsoleMe OSS Demo Role'}]
    # so: actual_tags = {'consoleme-authorized': 'consoleme_admins', 'Description': 'ConsoleMe OSS Demo Role'}
    actual_tags = {
        d["Key"]: d["Value"] for d in role_tags
    }  # Convert List[Dicts] to 1 Dict

    # All configured allowed_tags must exist in the role's actual_tags for this condition to pass
    if allowed_tags and allowed_tags.items() <= actual_tags.items():
        return True
    return False


def remove_temp_policies(role, iam_client) -> bool:
    """
    If this feature is enabled, it will look at inline role policies and remove expired policies if they have been
    designated as temporary. Policies can be designated as temporary through a certain prefix in the policy name.
    In the future, we may allow specifying temporary policies by `Sid` or other means.

    :param role: A single AWS IAM role entry in dictionary format as returned by the `get_account_authorization_details`
        call

Review comment (suggestion):
We can eliminate the list comprehension above by changing this to:

```python
if allowed_tag_keys and any(x in role_tags for x in allowed_tag_keys):
```

That way, each iteration through `allowed_tag_keys` is a hash lookup in the `role_tags` dict.

Code after:
    ```

    :param
        arn: The AWS role arn
        role_tags: A dictionary of role tags

    :return: boolean specifying whether ConsoleMe is allowed to sync / access the role
    """
    allowed_tags = config.get("roles.allowed_tags", {})
    allowed_arns = config.get("roles.allowed_arns", [])
    allowed_tag_keys = config.get("roles.allowed_tag_keys", [])
    if not allowed_tags and not allowed_arns and not allowed_tag_keys:
        return True

    if role_arn in allowed_arns:
        return True

    # Convert list of role tag dicts to an array of tag keys
    # ex:
    # role_tags = [{'Key': 'consoleme-authorized', 'Value': 'consoleme_admins'},
    # {'Key': 'Description', 'Value': 'ConsoleMe OSS Demo Role'}]
    # so: actual_tag_keys = ['consoleme-authorized', 'Description']
    actual_tag_keys = [d["Key"] for d in role_tags]

    # If any allowed tag key exists in the role's actual_tags this condition will pass
    if allowed_tag_keys and any(x in allowed_tag_keys for x in actual_tag_keys):
        return True

    # Convert list of role tag dicts to a single key/value dict of tags
    # ex:
    # role_tags = [{'Key': 'consoleme-authorized', 'Value': 'consoleme_admins'},
    # {'Key': 'Description', 'Value': 'ConsoleMe OSS Demo Role'}]
    # so: actual_tags = {'consoleme-authorized': 'consoleme_admins', 'Description': 'ConsoleMe OSS Demo Role'}
    actual_tags = {
        d["Key"]: d["Value"] for d in role_tags
    }  # Convert List[Dicts] to 1 Dict

    # All configured allowed_tags must exist in the role's actual_tags for this condition to pass
    if allowed_tags and allowed_tags.items() <= actual_tags.items():
        return True
    return False


def remove_temp_policies(role, iam_client) -> bool:
    """
    If this feature is enabled, it will look at inline role policies and remove expired policies if they have been
    designated as temporary. Policies can be designated as temporary through a certain prefix in the policy name.
    In the future, we may allow specifying temporary policies by `Sid` or other means.

    :param role: A single AWS IAM role entry in dictionary format as returned by the `get_account_authorization_details`
        call