Skip to content

Commit 6ce9c49

Browse files
authored
Add uniqueKeys for Sid in IAM policies (#3982)
1 parent 0e49015 commit 6ce9c49

File tree

3 files changed

+36
-0
lines changed

3 files changed

+36
-0
lines changed

src/cfnlint/data/schemas/other/iam/policy_identity.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,9 @@
6161
"type": [
6262
"object",
6363
"array"
64+
],
65+
"uniqueKeys": [
66+
"Sid"
6467
]
6568
},
6669
"Version": {

src/cfnlint/data/schemas/other/iam/policy_resource.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,9 @@
7373
"type": [
7474
"object",
7575
"array"
76+
],
77+
"uniqueKeys": [
78+
"Sid"
7679
]
7780
},
7881
"Version": {

test/unit/rules/resources/iam/test_identity_policy.py

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,3 +208,33 @@ def test_string_statements_with_condition(self):
208208
self.assertListEqual(
209209
list(errs[0].path), ["Statement", 0, "Condition", "iam:PassedToService"]
210210
)
211+
212+
def test_duplicate_sid(self):
213+
validator = CfnTemplateValidator()
214+
215+
policy = {
216+
"Version": "2012-10-17",
217+
"Statement": [
218+
{
219+
"Sid": "All",
220+
"Effect": "Allow",
221+
"Action": "*",
222+
"Resource": "*",
223+
},
224+
{
225+
"Sid": "All",
226+
"Effect": "Allow",
227+
"Action": "*",
228+
"Resource": "*",
229+
},
230+
],
231+
}
232+
233+
errs = list(
234+
self.rule.validate(
235+
validator=validator, policy=policy, schema={}, policy_type=None
236+
)
237+
)
238+
self.assertEqual(len(errs), 1, errs)
239+
self.assertEqual(errs[0].message, "array items are not unique for keys ['Sid']")
240+
self.assertListEqual(list(errs[0].path), ["Statement"])

0 commit comments

Comments
 (0)