Querying Global Condition Context Keys

[jsmartin]

Based on Amazon docs there are 30 Global Condition Context Keys. It would be great if we had a direct way to query those.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html

aws:CalledVia aws:CalledViaFirst aws:CalledViaLast aws:CurrentTime aws:EpochTime aws:MultiFactorAuthAge aws:MultiFactorAuthPresent aws:PrincipalAccount aws:PrincipalArn aws:PrincipalOrgID aws:PrincipalOrgPaths aws:PrincipalTag aws:PrincipalType aws:referer aws:RequestedRegion aws:RequestTag/tag-key aws:ResourceTag/tag-key aws:SecureTransport aws:SourceAccount aws:SourceArn aws:SourceIp aws:SourceVpc aws:SourceVpce aws:TagKeys aws:TokenIssueTime aws:UserAgent aws:userid aws:username aws:ViaAWSService aws:VpcSourceIp

I attempted to generate that list by going through all the services and grepping context keys that started with "aws" but come up short by about 15 of them.

#! /usr/bin/env python
  
from policy_sentry.querying.all import get_all_service_prefixes
from policy_sentry.querying.arns import get_raw_arns_for_service
from policy_sentry.querying.all import get_all_actions
from policy_sentry.querying.arns import get_arn_types_for_service
from policy_sentry.querying.arns import get_arn_type_details
from policy_sentry.querying.conditions import  get_condition_keys_for_service
services = get_all_service_prefixes()

condition_keys = []
services_with_specific_keys = []

for s in services:

    arn_types = get_arn_types_for_service(s)
    keys = get_condition_keys_for_service(s)
    condition_keys += keys

condition_keys = (set(condition_keys))

for key in condition_keys:
  if key.startswith('aws:'):
    print(key)

[kmcquade]

@jsmartin - Policy Sentry only scrapes the Actions, Resources and Condition Keys pages right now. The scraping does not pull that Global condition keys page.

Given that the write-policy function doesn't rely on Condition Keys, we actually don't use the Condition table outside of the query function. So I can't personally dedicate any time to this.

But if you did want to take this on so that global keys can be queried, feel free to do so - happy to answer any questions in the process and review a PR.

[jsmartin]

Awesome, any tips you can provide before I get started would be great (methods to re-use, where to put the files, etc). Probably something I can work on in the next couple of weeks.