@@ -2,6 +2,7 @@ package iamlivecore
22
33import (
44 _ "embed"
5+ b64 "encoding/base64"
56 "encoding/json"
67 "fmt"
78 "log"
@@ -15,8 +16,9 @@ import (
1516
1617 "github.com/buger/goterm"
1718 "github.com/kenshaw/baseconv"
18- "github.com/ucarion/urlpath"
1919 "github.com/oliveagle/jsonpath"
20+ "github.com/ucarion/urlpath"
21+ "google.golang.org/protobuf/proto"
2022)
2123
2224//go:embed map.json
@@ -36,10 +38,10 @@ var gcpCallLog []string
3638var azureCallLog []AzureEntry
3739
3840type AzureEntry struct {
39- HTTPMethod string
40- Path string
41- Parameters map [string ][]string
42- Body []byte
41+ HTTPMethod string
42+ Path string
43+ Parameters map [string ][]string
44+ Body []byte
4345}
4446
4547// JSON maps
@@ -58,6 +60,7 @@ type Entry struct {
5860 URIParameters map [string ]string
5961 FinalHTTPStatusCode int `json:"FinalHttpStatusCode"`
6062 AccessKey string `json:"AccessKey"`
63+ SessionToken string `json:"SessionToken"`
6164}
6265
6366// Statement is a single statement within an IAM policy
@@ -74,12 +77,12 @@ type IAMPolicy struct {
7477}
7578
7679type AzureIAMPolicy struct {
77- Name string `json:"Name"`
78- IsCustom bool `json:"IsCustom"`
79- Description string `json:"Description"`
80- Actions []string `json:"Actions"`
81- DataActions []string `json:"DataActions"`
82- NotDataActions []string `json:"NotDataActions"`
80+ Name string `json:"Name"`
81+ IsCustom bool `json:"IsCustom"`
82+ Description string `json:"Description"`
83+ Actions []string `json:"Actions"`
84+ DataActions []string `json:"DataActions"`
85+ NotDataActions []string `json:"NotDataActions"`
8386 AssignableScopes []string `json:"AssignableScopes"`
8487}
8588
@@ -234,11 +237,11 @@ func GetPolicyDocument() []byte {
234237 sort .Strings (dataActionsList )
235238
236239 returnPolicy := AzureIAMPolicy {
237- Actions : actionsList ,
238- DataActions : dataActionsList ,
239- NotDataActions : make ([]string , 0 ),
240+ Actions : actionsList ,
241+ DataActions : dataActionsList ,
242+ NotDataActions : make ([]string , 0 ),
240243 AssignableScopes : make ([]string , 0 ),
241- IsCustom : true ,
244+ IsCustom : true ,
242245 }
243246
244247 doc , err := json .MarshalIndent (returnPolicy , "" , " " )
@@ -375,14 +378,14 @@ type AzurePath map[string]AzurePermission
375378type AzurePermission map [string ]AzurePermissionDetail
376379
377380type AzurePermissionDetail struct {
378- Automated bool `json:"automated"`
379- IsDataAction bool `json:"isDataAction"`
380- Condition AzureCondition `json:"condition"`
381+ Automated bool `json:"automated"`
382+ IsDataAction bool `json:"isDataAction"`
383+ Condition AzureCondition `json:"condition"`
381384}
382385
383386type AzureCondition struct {
384- PathEquals map [string ]string `json:"pathEquals"`
385- BodyPathExists string `json:"bodyPathExists"`
387+ PathEquals map [string ]string `json:"pathEquals"`
388+ BodyPathExists string `json:"bodyPathExists"`
386389}
387390
388391type gcpIamMapBase struct {
@@ -790,6 +793,31 @@ func getStatementsForProxyCall(call Entry) (statements []Statement) {
790793 return statements
791794}
792795
796+ func getAccountAndRegionFromSessionToken (sessionToken string ) (string , string , error ) {
797+ in , err := b64 .StdEncoding .DecodeString (sessionToken )
798+ if err != nil {
799+ return "" , "" , err
800+ }
801+
802+ msgType := in [0 ]
803+ in = in [1 :]
804+
805+ if msgType == 33 || msgType == 2 {
806+ var t33Msg SessionType33Message
807+ if err := proto .Unmarshal (in , & t33Msg ); err != nil {
808+ return "" , "" , err
809+ }
810+
811+ return t33Msg .GetUser ().GetAccountId (), t33Msg .GetRegion (), nil
812+ } else if msgType == 23 {
813+ return "" , "" , nil
814+ } else if msgType == 21 {
815+ return "" , "" , nil
816+ }
817+
818+ return "" , "" , fmt .Errorf ("unknown session token type" )
819+ }
820+
793821func getAccountFromAccessKey (accessKeyId string ) (string , error ) {
794822 base10 := "0123456789"
795823 base32AwsFlavour := "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"
@@ -887,19 +915,33 @@ func subARNParameters(arn string, call Entry, specialsOnly bool) (bool, []string
887915 }
888916 }
889917
918+ region := call .Region
919+
920+ if call .SessionToken != "" {
921+ newAccount , newRegion , err := getAccountAndRegionFromSessionToken (call .SessionToken )
922+ if err == nil {
923+ if newAccount != "" {
924+ account = newAccount
925+ }
926+ if newRegion != "" {
927+ region = newRegion
928+ }
929+ }
930+ }
931+
890932 partition := "aws"
891- if strings .HasPrefix (call . Region , "cn" ) {
933+ if strings .HasPrefix (region , "cn" ) {
892934 partition = "aws-cn"
893935 }
894- if strings .HasPrefix (call . Region , "us-gov" ) {
936+ if strings .HasPrefix (region , "us-gov" ) {
895937 partition = "aws-us-gov"
896938 }
897939
898940 anyUnresolved := false
899941 result := []string {}
900942 for _ , arn := range arns {
901943 arn = regexp .MustCompile (`\$\{Partition\}` ).ReplaceAllString (arn , partition )
902- arn = regexp .MustCompile (`\$\{Region\}` ).ReplaceAllString (arn , call . Region )
944+ arn = regexp .MustCompile (`\$\{Region\}` ).ReplaceAllString (arn , region )
903945 arn = regexp .MustCompile (`\$\{Account\}` ).ReplaceAllString (arn , account )
904946 unresolvedArn := arn
905947 arn = regexp .MustCompile (`\$\{.+?\}` ).ReplaceAllString (arn , "*" ) // TODO: preserve ${aws:*} variables
0 commit comments