com.amazonaws.auth.policy.Principal Java Examples

@Test
public void testGetAssumeRolePolicyDocument() throws IOException {
    String assumeRolePolicyDocument = awsIamService.getResourceFileAsString(
            "json/aws-assume-role-policy-document.json");
    String encodedAssumeRolePolicyDocument = URLEncoder.encode(assumeRolePolicyDocument,
            StandardCharsets.UTF_8);


    Statement statement = new Statement(Effect.Allow).withId("1")
            .withPrincipals(new Principal("AWS", "arn:aws:iam::123456890:role/assume-role"))
            .withActions(SecurityTokenServiceActions.AssumeRole);
    Policy expectedAssumeRolePolicy = new Policy().withStatements(statement);

    Role role = mock(Role.class);
    when(role.getAssumeRolePolicyDocument()).thenReturn(encodedAssumeRolePolicyDocument);

    Policy assumeRolePolicy = awsIamService.getAssumeRolePolicy(role);
    assertThat(assumeRolePolicy).isNotNull();
    assertThat(assumeRolePolicy.toJson()).isEqualTo(expectedAssumeRolePolicy.toJson());
}
 

protected Policy allowSendMessagePolicy(String roleARN) {
    Policy policy = new Policy();
    Statement statement = new Statement(Statement.Effect.Allow);
    statement.setActions(Collections.singletonList(SQSActions.SendMessage));
    statement.setPrincipals(new Principal(roleARN));
    statement.setResources(Collections.singletonList(new Resource("arn:aws:sqs:*:*:*")));
    policy.setStatements(Collections.singletonList(statement));
    return policy;
}
 

private String getPolicy(List<String> accountIds) {
	Policy policy = new Policy("AuthorizedWorkerAccessPolicy");
	Statement stmt = new Statement(Effect.Allow);
	Action action = SQSActions.SendMessage;
	stmt.getActions().add(action);
	stmt.setResources(new LinkedList<>());
	for(String accountId : accountIds) {
		Principal principal = new Principal(accountId);
		stmt.getPrincipals().add(principal);
	}
	stmt.getResources().add(new Resource(getQueueARN()));
	policy.getStatements().add(stmt);
	return policy.toJson();
}
 

public static String getPublicReadPolicy(String bucket_name) {
    Policy bucket_policy = new Policy().withStatements(
            new Statement(Statement.Effect.Allow)
                    .withPrincipals(Principal.AllUsers)
                    .withActions(S3Actions.GetObject)
                    .withResources(new Resource(
                            "arn:aws:s3:::" + bucket_name + "/*")));
    return bucket_policy.toJson();
}
 

/**
 * For retrieving vault inventory. For initializing SQS for determining when
 * job completed. Does nothing if member snsTopicName is null. Sets members
 * sqsQueueURL, sqsQueueARN, and sqsClient.
 */
   private void setupSQS() {
	// If no sqsQueueName setup then simply return
	if (sqsQueueName == null)
		return;

	CreateQueueRequest request = new CreateQueueRequest()
			.withQueueName(sqsQueueName);
	CreateQueueResult result = sqsClient.createQueue(request);
	sqsQueueURL = result.getQueueUrl();

	GetQueueAttributesRequest qRequest = new GetQueueAttributesRequest()
			.withQueueUrl(sqsQueueURL).withAttributeNames("QueueArn");

	GetQueueAttributesResult qResult = sqsClient
			.getQueueAttributes(qRequest);
	sqsQueueARN = qResult.getAttributes().get("QueueArn");

	Policy sqsPolicy = new Policy().withStatements(new Statement(
			Effect.Allow).withPrincipals(Principal.AllUsers)
			.withActions(SQSActions.SendMessage)
			.withResources(new Resource(sqsQueueARN)));
	Map<String, String> queueAttributes = new HashMap<String, String>();
	queueAttributes.put("Policy", sqsPolicy.toJson());
	sqsClient.setQueueAttributes(new SetQueueAttributesRequest(sqsQueueURL,
			queueAttributes));
}
 

private TemporaryQueue createQueue(String snsTopicArn, String sqsQueueArn, String sqsQueueName) {
  String sqsQueueUrl =
      amazonSQS
          .createQueue(
              new CreateQueueRequest()
                  .withQueueName(sqsQueueName)
                  .withAttributes(
                      Collections.singletonMap(
                          "MessageRetentionPeriod", "60")) // 60s message retention
              )
          .getQueueUrl();
  log.info("Created Temporary S3 Notification Queue: {}", value("queue", sqsQueueUrl));

  String snsTopicSubscriptionArn =
      amazonSNS.subscribe(snsTopicArn, "sqs", sqsQueueArn).getSubscriptionArn();

  Statement snsStatement =
      new Statement(Statement.Effect.Allow).withActions(SQSActions.SendMessage);
  snsStatement.setPrincipals(Principal.All);
  snsStatement.setResources(Collections.singletonList(new Resource(sqsQueueArn)));
  snsStatement.setConditions(
      Collections.singletonList(
          new Condition()
              .withType("ArnEquals")
              .withConditionKey("aws:SourceArn")
              .withValues(snsTopicArn)));

  Policy allowSnsPolicy = new Policy("allow-sns", Collections.singletonList(snsStatement));

  HashMap<String, String> attributes = new HashMap<>();
  attributes.put("Policy", allowSnsPolicy.toJson());
  amazonSQS.setQueueAttributes(sqsQueueUrl, attributes);

  return new TemporaryQueue(snsTopicArn, sqsQueueArn, sqsQueueUrl, snsTopicSubscriptionArn);
}
 

@Test
public void ec2NotInPrincipals() {
    assertThat(awsInstanceProfileEC2TrustValidator.checkEC2InPrincipals(
            Collections.singletonList(Principal.All))).isFalse();
    assertThat(awsInstanceProfileEC2TrustValidator.checkEC2InPrincipals(
            Collections.singletonList(Principal.AllServices))).isFalse();
    assertThat(awsInstanceProfileEC2TrustValidator.checkEC2InPrincipals(
            Collections.singletonList(new Principal("Service", "invalid")))).isFalse();
    assertThat(awsInstanceProfileEC2TrustValidator.checkEC2InPrincipals(
            Arrays.asList(
                    Principal.All,
                    Principal.AllServices,
                    new Principal("Service", "invalid")
            ))).isFalse();
}
 

@Test
public void ec2InPrincipals() {
    assertThat(awsInstanceProfileEC2TrustValidator.checkEC2InPrincipals(Collections.singletonList(
            new Principal("Service", Services.AmazonEC2.getServiceId())))).isTrue();
    assertThat(awsInstanceProfileEC2TrustValidator.checkEC2InPrincipals(
            Arrays.asList(
                    Principal.AllServices,
                    new Principal("Service", Services.AmazonEC2.getServiceId())
            ))).isTrue();
}
 

private Policy getTrustedPolicy() {
    return new Policy().withStatements(
            new Statement(Effect.Allow)
                    .withActions(SecurityTokenServiceActions.AssumeRole)
                    .withPrincipals(new Principal("Service", Services.AmazonEC2.getServiceId()))
    );
}
 

@Test
public void
    test_that_filterKeysCreatedByKmsService_filters_out_keys_that_do_not_contain_expected_arn_prefix() {

  Policy policyThatShouldBeInSet =
      new Policy()
          .withStatements(
              new Statement(Statement.Effect.Allow)
                  .withId(CERBERUS_MANAGEMENT_SERVICE_SID)
                  .withPrincipals(
                      new Principal("arn:aws:iam:123456:role/" + ENV + "-cms-role-alk234khsdf")),
              new Statement(Statement.Effect.Allow),
              new Statement(Statement.Effect.Allow),
              new Statement(Statement.Effect.Allow));

  Policy policyThatShouldNotBeInSet =
      new Policy()
          .withStatements(
              new Statement(Statement.Effect.Allow)
                  .withId(CERBERUS_MANAGEMENT_SERVICE_SID)
                  .withPrincipals(
                      new Principal("arn:aws:iam:123456:role/prod-cms-role-alk234khsdf")),
              new Statement(Statement.Effect.Allow),
              new Statement(Statement.Effect.Allow),
              new Statement(Statement.Effect.Allow));

  Policy policyThatWasntCreatedByCms =
      new Policy()
          .withStatements(
              new Statement(Statement.Effect.Allow)
                  .withId("foo-bar")
                  .withPrincipals(
                      new Principal("arn:aws:iam:123456:role/" + ENV + "-cms-role-alk234khsdf")));

  KmsService kmsServiceSpy = spy(kmsService);

  Set<String> allKmsCmkIdsForRegion = ImmutableSet.of("key1", "key2", "key3", "key4", "key5");

  String region = "us-west-2";

  Set<String> expectedKeys = ImmutableSet.of("key3");

  doReturn(Optional.of(policyThatShouldNotBeInSet))
      .when(kmsServiceSpy)
      .downloadPolicy("key1", region, 0);
  doReturn(Optional.of(policyThatShouldNotBeInSet))
      .when(kmsServiceSpy)
      .downloadPolicy("key2", region, 0);
  doReturn(Optional.of(policyThatShouldBeInSet))
      .when(kmsServiceSpy)
      .downloadPolicy("key3", region, 0);
  doReturn(Optional.of(policyThatShouldNotBeInSet))
      .when(kmsServiceSpy)
      .downloadPolicy("key4", region, 0);
  doReturn(Optional.of(policyThatWasntCreatedByCms))
      .when(kmsServiceSpy)
      .downloadPolicy("key5", region, 0);

  Set<String> actual = kmsServiceSpy.filterKeysCreatedByKmsService(allKmsCmkIdsForRegion, region);

  assertEquals(expectedKeys, actual);
}
 

public void connectToTopic(boolean callerIsMaster, int maxAttempts, String userAccountPrincipalId, String userARN) throws Exception {
	
	
	// try up to max attempts to connect to pre-existing topic
	for (int i=0; i<maxAttempts; i++) {
		
		logger.debug("connectToTopic() attempt: " + (i+1));
		
		ListTopicsResult listResult = snsClient.listTopics();
		List<Topic> topics = listResult.getTopics();
		
		while(topics != null) {
			
			for (Topic topic : topics) {

				// note we do index of match....
				if (topic.getTopicArn().indexOf(snsControlTopicName) != -1) {
					snsTopicARN = topic.getTopicArn();
					logger.info("Found existing SNS topic by name: "+snsControlTopicName + " @ " + snsTopicARN);
					break;
				}
			}

			String nextToken = listResult.getNextToken();
			
			if (nextToken != null && snsTopicARN == null) {
				listResult = snsClient.listTopics(nextToken);
				topics = listResult.getTopics();
				
			} else {
				break;
			}
		}
		
		// if consumer, retry, otherwise is master, so just exit quick to create...
		if (snsTopicARN == null && !callerIsMaster) {
			Thread.currentThread().sleep(1000);
			continue;
		} else {
			break; // exit;
		}
	}
	
	
	
	// if master only he can create...
	if (snsTopicARN == null && callerIsMaster) {
		this.snsControlTopicName = this.snsControlTopicName.substring(0,(snsControlTopicName.length() > 80 ? 80 : this.snsControlTopicName.length()));
		
		logger.info("Attempting to create new SNS control channel topic by name: "+this.snsControlTopicName);
		
		CreateTopicResult createTopicResult = snsClient.createTopic(this.snsControlTopicName);
		snsTopicARN = createTopicResult.getTopicArn();
		snsClient.addPermission(snsTopicARN, "Permit_SNSAdd", 
								Arrays.asList(new String[]{userARN}), 
								Arrays.asList(new String[]{"Publish","Subscribe","Receive"}));
		logger.info("Created new SNS control channel topic by name: "+this.snsControlTopicName + " @ " + snsTopicARN);
		
	} else if (snsTopicARN == null) {
		throw new Exception("Worker() cannot start, snsControlTopicName has yet to be created by master?: " + this.snsControlTopicName);
	}
	
	// http://www.jorgjanke.com/2013/01/aws-sns-topic-subscriptions-with-sqs.html
	
	// create SQS queue to get SNS notifications (max 80 len)
	String prefix =  ("s3bktLoaderCC_" + mySourceIdentifier);
	String sqsQueueName = prefix.substring(0,(prefix.length() > 80 ? 80 : prefix.length()));
	
	CreateQueueResult createQueueResult = sqsClient.createQueue(sqsQueueName);
	this.sqsQueueUrl = createQueueResult.getQueueUrl();
	this.sqsQueueARN = sqsClient.getQueueAttributes(sqsQueueUrl, Arrays.asList(new String[]{"QueueArn"})).getAttributes().get("QueueArn");

	Statement statement = new Statement(Effect.Allow)
							.withActions(SQSActions.SendMessage)
							 .withPrincipals(new Principal("*"))
							 .withConditions(ConditionFactory.newSourceArnCondition(snsTopicARN))
							 .withResources(new Resource(sqsQueueARN));
	Policy policy = new Policy("SubscriptionPermission").withStatements(statement);

	HashMap<String, String> attributes = new HashMap<String, String>();
	attributes.put("Policy", policy.toJson());
	SetQueueAttributesRequest request = new SetQueueAttributesRequest(sqsQueueUrl, attributes);
	sqsClient.setQueueAttributes(request);

	logger.info("Created SQS queue: " + sqsQueueARN + " @ " + sqsQueueUrl);
	
	// subscribe our SQS queue to the SNS:s3MountTest topic
	SubscribeResult subscribeResult = snsClient.subscribe(snsTopicARN,"sqs",sqsQueueARN);
	snsSubscriptionARN = subscribeResult.getSubscriptionArn();
	logger.info("Subscribed for messages from SNS control channel:" + snsTopicARN + " ----> SQS: "+sqsQueueARN);
	logger.info("Subscription ARN: " + snsSubscriptionARN);
	
	this.consumerThread = new Thread(this,"ControlChannel msg consumer thread");
	this.consumerThread.start();

	logger.info("\n-------------------------------------------\n" +
				"CONTROL CHANNEL: ALL SNS/SQS resources hooked up OK\n" +
				"-------------------------------------------\n");
}
 

boolean checkEC2InPrincipals(List<Principal> principals) {
    return principals
            .stream()
            .anyMatch(principal -> "Service".equals(principal.getProvider())
                    && Services.AmazonEC2.getServiceId().equals(principal.getId()));
}