Registry / aws / policyuniverse

policyuniverse

library1.5.1.20231109pypypi✓ verified 87d ago

PolicyUniverse, currently at version 1.5.1.20231109, is a Python library for parsing and processing AWS IAM Policies, Statements, ARNs, and wildcards. It provides classes to parse AWS IAM and Resource Policies, expand wildcards using AWS permission data, and minify policies to help users stay under AWS policy size limits. The project, open-sourced by Netflix-Skunkworks, sees releases as needed, with its latest update in November 2023.

aws

pip install policyuniverse

github ↗package ↗

INSTALL

IMPORT

SIG · POLICYUNIVERSE

policyuniverse

awspythonv1.5.1.20231109

Install

1.6s avg

Import

248ms

Disk

24MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v1.5.1.20231109 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.920 runs

installs and imports cleanly · install 0.0s · import 0.262s · 25.7MB

glibc

py 3.10–3.920 runs

installs and imports cleanly · install 1.6s · import 0.234s · 26MB

24MB installed

● package 24MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

ARN

✓ from policyuniverse.arn import ARN

Policy

✓ from policyuniverse.policy import Policy

Statement

✓ from policyuniverse.statement import Statement

Often used implicitly by Policy objects, but can be imported for direct use.

This example demonstrates how to parse an AWS IAM policy document using the `Policy` class, retrieve its principals, check for internet accessibility, and get a summary of actions.

from policyuniverse.policy import Policy policy_document = { 'Version': '2012-10-17', 'Statement': [ { 'Effect': 'Allow', 'Principal': 'arn:aws:iam::012345678910:root', 'Action': ['s3:*'], 'Resource': '*', 'Condition': { 'IpAddress': { 'AWS:SourceIP': ['0.0.0.0/0'] } } }, { 'Effect': 'Allow', 'Principal': 'arn:aws:iam::*:role/Hello', 'Action': ['ec2:*'], 'Resource': '*', 'Condition': { 'StringLike': { 'AWS:SourceOwner': '012345678910' } } } ] } policy = Policy(policy_document) print(f"Policy principals: {policy.principals}") print(f"Is internet accessible: {policy.is_internet_accessible()}") print(f"Actions summary: {policy.action_summary()}")

Debug

Known issues

gotchaMinification of policies does not currently work on 'Deny' statements. Attempting to minify a policy with 'Deny' effects will raise an exception.

fix

Ensure that policies intended for minification only contain 'Allow' effects, or handle 'Deny' statements separately.

affects: All versions

gotchaWhile PolicyUniverse can minify policies to meet size limits, the resulting minified policies can be significantly less readable. It is recommended to avoid minification if possible, prioritizing human readability and maintainability.

fix

Only use policy minification when strictly necessary to comply with AWS policy size constraints. Otherwise, manage policies in their more human-readable expanded form.

affects: All versions

Errors

Common errors & fixes

Exception: Minification does not currently work on Deny statements.

The `policyuniverse` library's policy minification function is explicitly designed only for 'Allow' statements and raises an exception if it encounters a 'Deny' effect within the policy.

fix

Ensure that policies intended for minification using `policyuniverse` only contain 'Allow' effects, or handle 'Deny' statements separately by not applying the minification function to them.

ModuleNotFoundError: No module named 'policyuniverse'

The `policyuniverse` library has not been installed in the current Python environment, or the environment where the code is being executed does not have access to the installed library.

fix

Install the `policyuniverse` library using pip: `pip install policyuniverse`.

AttributeError: 'Policy' object has no attribute 'non_existent_attribute'

You are attempting to access an attribute or call a method on a `Policy` object that does not exist or is misspelled.

fix

Consult the `policyuniverse` documentation or source code to verify the correct attribute or method names available for the `Policy` object (e.g., `.principals`, `.actions_expanded`, `.is_internet_accessible()`). For example, to get principals, use `policy_object.principals` instead of a hypothetical `policy_object.get_principals()`.

ValueError: Invalid policy document

The input provided to the `Policy` class constructor is not a valid AWS IAM policy JSON structure, possibly due to incorrect keys, missing required fields, or malformed JSON.

fix

Review the policy document to ensure it strictly adheres to the AWS IAM policy JSON specification, including the presence of 'Version' and 'Statement' keys, and valid values for 'Effect', 'Action', 'Resource', and other policy elements.

Upgrade

Version history

1.5.1.20231109latest on PyPI · released Nov 30, 2023

Audit

Dependencies

No dependency data recorded yet.

Agent activity

12 hits · last 30 days

node

Resources

githubhttps://github.com/Netflix-Skunkworks/policyuniverse ↗

packagehttps://pypi.org/project/policyuniverse/ ↗