RefWithPath.py

"""
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
SPDX-License-Identifier: MIT-0
"""
from cfnlint.rules import CloudFormationLintRule
from cfnlint.rules import RuleMatch


class RefWithPath(CloudFormationLintRule):
    """Check if IAM Policy Version is correct"""
    id = 'E3050'
    shortdesc = 'Check if REFing to a IAM resource with path set'
    description = 'Some resources don\'t support looking up the IAM resource by name. ' \
                  'This check validates when a REF is being used and the Path is not \'/\''
    source_url = 'https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html'
    tags = ['properties', 'iam']

    def __init__(self):
        """Init"""
        super(RefWithPath, self).__init__()
        self.resources_and_keys = {
            'AWS::CodeBuild::Project': 'ServiceRole',
        }

        for resource_type in self.resources_and_keys:
            self.resource_property_types.append(resource_type)

    def check_ref(self, value, parameters, resources, path):  # pylint: disable=W0613
        """ Check Ref """
        matches = []

        iam_path = resources.get(value, {}).get('Properties', {}).get('Path')
        if not iam_path:
            return matches

        if iam_path != '/':
            message = 'When using a Ref to IAM resource the Path must be \'/\'.  Switch to GetAtt if the Path has to be \'{}\'.'
            matches.append(
                RuleMatch(path, message.format(iam_path)))

        return matches

    def match_resource_properties(self, properties, resourcetype, path, cfn):
        """Check CloudFormation Properties"""
        matches = []

        key = None
        if resourcetype in self.resources_and_keys:
            key = self.resources_and_keys.get(resourcetype)

        matches.extend(
            cfn.check_value(
                properties, key, path,
                check_ref=self.check_ref
            )
        )

        return matches