Rename after discussions

Author: aug24

src/constructs/iam/policies/index.ts

@@ -6,7 +6,7 @@ export * from "./describe-ec2";
 export * from "./dynamodb";
 export * from "./kcl";
 export * from "./log-shipping";
-export * from "./developer-policy";
+export * from "./workload-policy";
 export * from "./parameter-store-read";
 export * from "./s3-get-object";
 export * from "./s3-put-object";

…ts/iam/policies/developer-policy.test.ts …cts/iam/policies/workload-policy.test.tssrc/constructs/iam/policies/developer-policy.test.ts renamed to src/constructs/iam/policies/workload-policy.test.ts src/constructs/iam/policies/developer-policy.test.ts renamed to src/constructs/iam/policies/workload-policy.test.ts

@@ -1,11 +1,11 @@
 import { Template } from "aws-cdk-lib/assertions";
 import { simpleGuStackForTesting } from "../../../utils/test";
-import { GuDeveloperPolicy } from "./developer-policy";
+import { GuWorkloadPolicy } from "./workload-policy";
 
 describe("GuDeveloperPolicy", () => {
   test("if a single action is provided, the resulting Developer Policy resource's statement will have a single item", () => {
     const stack = simpleGuStackForTesting();
-    new GuDeveloperPolicy(stack, "AllowS3GetObject", {
+    new GuWorkloadPolicy(stack, "AllowS3GetObject", {
       allow: [
         {
           actions: ["s3:GetObject"],
@@ -16,7 +16,7 @@ describe("GuDeveloperPolicy", () => {
     });
 
     Template.fromStack(stack).hasResourceProperties("AWS::IAM::ManagedPolicy", {
-      Path: "/developer-policy/test123/",
+      Path: "/workload-policy/test123/",
       PolicyDocument: {
         Version: "2012-10-17",
         Statement: [
@@ -31,7 +31,7 @@ describe("GuDeveloperPolicy", () => {
   });
   test("if multiple actions are provided, the resulting Managed Policy resource's action will container all items", () => {
     const stack = simpleGuStackForTesting();
-    new GuDeveloperPolicy(stack, "AllowS3GetObject", {
+    new GuWorkloadPolicy(stack, "AllowS3GetObject", {
       allow: [
         {
           actions: ["s3:GetObject"],
@@ -54,7 +54,7 @@ describe("GuDeveloperPolicy", () => {
 
     Template.fromStack(stack).hasResourceProperties("AWS::IAM::ManagedPolicy", {
       Description: "testtesttest",
-      Path: "/developer-policy/test321/",
+      Path: "/workload-policy/test321/",
       PolicyDocument: {
         Version: "2012-10-17",
         Statement: [

…structs/iam/policies/developer-policy.ts …nstructs/iam/policies/workload-policy.tssrc/constructs/iam/policies/developer-policy.ts renamed to src/constructs/iam/policies/workload-policy.ts src/constructs/iam/policies/developer-policy.ts renamed to src/constructs/iam/policies/workload-policy.ts

@@ -1,8 +1,9 @@
+import { Annotations } from "aws-cdk-lib";
 import { Effect, ManagedPolicy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import type { GuStack } from "../../core";
 import type { GuAllowPolicyProps, GuDenyPolicyProps } from "./base-policy";
 
-export type GuDeveloperPolicyProps = {
+export type GuWorkloadPolicyProps = {
   /**
    * List of explicitly allowed permissions given by this policy.
    */
@@ -52,14 +53,33 @@ export type GuDeveloperPolicyProps = {
  *       aws:cdk:path: janus-resources-for-testing-managed-policy-tagging/justin-testing/Resource* ```
  * ```
  */
-export class GuDeveloperPolicy extends ManagedPolicy {
-  constructor(scope: GuStack, id: string, props: GuDeveloperPolicyProps) {
+export class GuWorkloadPolicy extends ManagedPolicy {
+  constructor(scope: GuStack, id: string, props: GuWorkloadPolicyProps) {
     super(scope, id, {
       description: `${props.permission} developer policy`,
       ...props,
-      path: `/developer-policy/${props.permission}/`,
+      path: `/workload-policy/${props.permission}/`,
     });
+
+    let valid = true;
+
     for (const allowed of props.allow) {
+
+      // validity checks
+      const name = allowed.policyName ?? allowed.actions.join(",") + ' on ' + allowed.resources.join(",");
+      for (const resource of allowed.resources) {
+        if (resource === "*") {
+          Annotations.of(this).addError(`Resource of '*' found in ${name} ALLOW permission`);
+          valid = false;
+        }
+      }
+      for (const action of allowed.actions) {
+        if (action === "*") {
+          const name = allowed.policyName ?? allowed.actions.join(",");
+          Annotations.of(this).addError(`Action of '*' found in ${name} ALLOW permission`);
+          valid = false;
+        }
+      }
       this.addStatements(
         new PolicyStatement({
           effect: Effect.ALLOW,
@@ -68,6 +88,11 @@ export class GuDeveloperPolicy extends ManagedPolicy {
         }),
       );
     }
+
+    if (!valid) {
+      throw new Error("Overly broad permission present, see annotations for details");
+    }
+
     const { deny = [] } = props;
     for (const denied of deny) {
       this.addStatements(