remove duplications from check
@@ -4,6 +4,7 @@ import re
from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
from checkov.common.models.enums import CheckResult, CheckCategories
+ACCOUNT_ACCESS = re.compile(r'\d{12}|arn:aws:iam::\d{12}:root')
class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):
def __init__(self):
@@ -15,36 +16,21 @@ class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):
def scan_resource_conf(self, conf):
if 'AssumeRolePolicyDocument' in conf['Properties']:
- if isinstance(conf['Properties']['AssumeRolePolicyDocument'], dict) and 'Fn::Sub' in conf['Properties']['AssumeRolePolicyDocument'].keys():
- assume_role_block = json.loads(conf['Properties']['AssumeRolePolicyDocument']['Fn::Sub'])
- if 'Statement' in assume_role_block.keys():
- if isinstance(assume_role_block['Statement'], list) and 'Principal' in \
- assume_role_block['Statement'][0]:
- if 'AWS' in assume_role_block['Statement'][0]['Principal']:
- account_access = re.compile(r'\d{12}|arn:aws:iam::\d{12}:root')
- if 'AWS' in assume_role_block['Statement'][0]['Principal']:
- if isinstance(assume_role_block['Statement'][0]['Principal']['AWS'],
- list) and isinstance(
- assume_role_block['Statement'][0]['Principal']['AWS'][0], str):
- if re.match(account_access,
- assume_role_block['Statement'][0]['Principal']['AWS'][0]):
- return CheckResult.FAILED
- else:
- if isinstance(conf['Properties']['AssumeRolePolicyDocument'], str):
- assume_role_block = json.loads(conf['Properties']['AssumeRolePolicyDocument'])
+ assume_role_policy_doc = conf['Properties']['AssumeRolePolicyDocument']
+ if isinstance(assume_role_policy_doc, dict) and 'Fn::Sub' in assume_role_policy_doc.keys():
+ assume_role_block = json.loads(assume_role_policy_doc['Fn::Sub'])
+ elif isinstance(assume_role_policy_doc, str):
+ assume_role_block = json.loads(assume_role_policy_doc)
else:
- assume_role_block = conf['Properties']['AssumeRolePolicyDocument']
+ assume_role_block = assume_role_policy_doc
+
if 'Statement' in assume_role_block.keys():
if isinstance(assume_role_block['Statement'], list) and 'Principal' in \
assume_role_block['Statement'][0]:
if 'AWS' in assume_role_block['Statement'][0]['Principal']:
- account_access = re.compile(r'\d{12}|arn:aws:iam::\d{12}:root')
- if 'AWS' in assume_role_block['Statement'][0]['Principal']:
- if isinstance(assume_role_block['Statement'][0]['Principal']['AWS'],
- list) and isinstance(
- assume_role_block['Statement'][0]['Principal']['AWS'][0], str):
- if re.match(account_access,
- assume_role_block['Statement'][0]['Principal']['AWS'][0]):
+ if isinstance(assume_role_block['Statement'][0]['Principal']['AWS'],list) \
+ and isinstance(assume_role_block['Statement'][0]['Principal']['AWS'][0], str):
+ if re.match(ACCOUNT_ACCESS, assume_role_block['Statement'][0]['Principal']['AWS'][0]):
return CheckResult.FAILED
return CheckResult.PASSED
