Merge pull request #346 from kmcquade/update-access-level-overrides

Update access levels, add Makefile, update IAM definition, update dependencies

Author: kmcquade

Makefile

@@ -0,0 +1,81 @@
+SHELL:=/bin/bash
+
+PROJECT := policy-sentry
+PROJECT_UNDERSCORE := policy_sentry
+
+.PHONY: setup-env
+setup-env:
+	python3 -m venv ./venv && source venv/bin/activate
+	python3 -m pip install -r requirements.txt
+
+.PHONY: setup-dev
+setup-dev: setup-env
+	python3 -m pip install -r requirements-dev.txt
+
+.PHONY: build-docs
+build-docs: setup-dev
+	mkdocs build
+
+.PHONY: serve-docs
+serve-docs: setup-dev
+	mkdocs serve --dev-addr "127.0.0.1:8001"
+
+.PHONY: build
+build: setup-env clean
+	python3 -m pip install --upgrade setuptools wheel
+	python3 -m setup -q sdist bdist_wheel
+
+.PHONY: install
+install: build
+	python3 -m pip install -q ./dist/${PROJECT}*.tar.gz
+	${PROJECT} --help
+
+.PHONY: uninstall
+uninstall:
+	python3 -m pip uninstall ${PROJECT} -y
+	python3 -m pip uninstall -r requirements.txt -y
+	python3 -m pip uninstall -r requirements-dev.txt -y
+	python3 -m pip freeze | xargs python3 -m pip uninstall -y
+
+.PHONY: clean
+clean:
+	rm -rf dist/
+	rm -rf build/
+	rm -rf *.egg-info
+	find . -name '*.pyc' -delete
+	find . -name '*.pyo' -delete
+	find . -name '*.egg-link' -delete
+	find . -name '*.pyc' -exec rm --force {} +
+	find . -name '*.pyo' -exec rm --force {} +
+
+.PHONY: test
+test: setup-dev
+	python3 -m coverage run -m pytest -v
+
+.PHONY: security-test
+security-test: setup-dev
+	bandit -r ./${PROJECT_UNDERSCORE}/
+
+.PHONY: fmt
+fmt: setup-dev
+	black ${PROJECT_UNDERSCORE}/
+
+.PHONY: lint
+lint: setup-dev
+	pylint ${PROJECT_UNDERSCORE}/
+
+.PHONY: publish
+publish: build
+	python3 -m pip install --upgrade twine
+	python3 -m twine upload dist/*
+	python3 -m pip install ${PROJECT}
+
+.PHONY: count-loc
+count-loc:
+	echo "If you don't have tokei installed, you can install it with 'brew install tokei'"
+	echo "Website: https://github.com/XAMPPRocky/tokei#installation'"
+	tokei ./* --exclude --exclude '**/*.html' --exclude '**/*.json' --exclude "docs/*" --exclude "examples/*" --exclude "test/*"
+
+.PHONY: update-iam-data
+update-iam-data:
+	python3 ./utils/download_docs.py

docs/requirements.txt

@@ -3,73 +3,10 @@ atomicwrites==1.4.0
 distlib==0.3.1
 filelock==3.0.12
 mkdocs==1.1.2
-mkdocs-material==6.2.3
+mkdocs-material==7.0.6
 mkdocs-material-extensions==1.0.1
-mkdocstrings==0.13.6
-Pygments==2.7.4
-pymdown-extensions==8.1
-pytkdocs==0.9.0
-virtualenv==20.2.2
-virtualenv-clone==0.5.4
-# From the rest of requirements-dev.txt... not sure what is required in order for RTD to auto-include the Python Classes in the library reference section
-appdirs==1.4.4
-astroid==2.4.2
-attrs==20.3.0
-bandit==1.7.0
-beautifulsoup4==4.9.3
-black==20.8b1
-boto3==1.16.43
-botocore==1.19.43
-certifi==2020.12.5
-chardet==4.0.0
-click==7.1.2
-contextlib2==0.6.0.post1
-coverage==5.4
-docutils==0.16
-dparse==0.5.1
-future==0.18.2
-gitdb==4.0.5
-GitPython==3.1.11
-idna==2.10
-importlib-metadata==3.3.0
-invoke==1.4.1
-isort==5.7.0
-Jinja2==2.11.3
-jmespath==0.10.0
-joblib==1.0.0
-lazy-object-proxy==1.4.*
-livereload==2.6.3
-lunr==0.5.8
-markdown==3.3.3
-MarkupSafe==1.1.1
-mccabe==0.6.1
-more-itertools==8.6.0
-nltk==3.5
-nose==1.3.7
-packaging==20.8
-pathspec==0.8.1
-pbr==5.5.1
-pluggy==0.13.1
-py==1.10.0
-pylint==2.6.1
-pyparsing==2.4.7
-pytest==6.2.2
-python-dateutil==2.8.1
-PyYAML==5.4.1
-regex==2020.11.13
-requests==2.25.1
-s3transfer==0.3.3
-safety==1.10.0
-schema==0.7.3
-six==1.15.0
-smmap==3.0.4
-soupsieve==2.1
-stevedore==3.3.0
-toml==0.10.2
-tornado==6.1
-tqdm==4.56.0
-typed-ast==1.4.1
-urllib3==1.26.4
-wcwidth==0.2.5
-wrapt==1.12.1
-zipp==3.4.0
+mkdocstrings==0.15.0
+Pygments==2.8.1
+pymdown-extensions==8.1.1
+pytkdocs==0.11.0
+

policy_sentry/bin/version.py

@@ -1,2 +1,2 @@
 # pylint: disable=missing-module-docstring
-__version__ = "0.11.5"
+__version__ = "0.11.6"

policy_sentry/shared/awsdocs.py

@@ -248,7 +248,7 @@ def create_database(destination_directory, access_level_overrides_file):
                             continue
                         else:
                             api_documentation_link = link.attrs.get('href')
-                            print(api_documentation_link)
+                            logger.debug(api_documentation_link)
                         priv = chomp(link.text)
                     if priv == "":
                         priv = chomp(cells[0].text)

policy_sentry/shared/data/access-level-overrides.yml

@@ -109,6 +109,8 @@ ecr:
     # AWS documentation lists this as Write
     Permissions management:
         - deleterepositorypolicy
+        - putregistrypolicy
+        - deleteregistrypolicy
 es:
     Permissions management:
         - createelasticsearchdomain
@@ -357,7 +359,9 @@ rds:
         - createdbsubnetgroup
         - createeventsubscription
         - createoptiongroup
-        # AWS documentation lists this as "Permissions management"
+    Permissions management:
+        - modifydbsnapshotattribute
+        - modifydbclustersnapshotattribute
 redshift:
     # AWS documentation lists this as "Permissions management"
     Write:
@@ -383,6 +387,10 @@ securityhub:
     Tagging:
         - untagresource
         - tagresource
+ses:
+    Permissions management:
+        - putidentitypolicy
+        - deleteidentitypolicy
 sns:
     Permissions management:
         - settopicattributes