[BUG] Resource Policy Condition Keys - Handling it as non-case sensitive about cloudformation-guard HOT 1 OPEN

Hi Fabio,

Thank you for taking a closer look at the Guard rule example we have provided with the repository. We think that the Guard rule has clauses that will make the keys sensitive. Here's how:

From the same AWS documentation you linked, it also states:

Case-sensitivity of condition key values depends on the condition operator that you use. For example, the following condition includes the StringEquals operator to ensure that only requests made by johndoe match. Users named JohnDoe are denied access.

The guard rule in question applies to the keys StringEquals, StringLike, ArnEquals and ArnLike, the following snippet will ensure that:

rule check_via_aws_service(statement) {
    when %statement.Principal.Service exists {
        %statement.Condition[ keys == /String(Equals|Like)|Arn(Equals|Like)/ ] not empty {
            let source_accounts = this[ keys == /(aws|AWS):[sS]ource(Account|Owner|Arn|ARN)/ ]
            %source_accounts in %allowed
        }
    }
}

Now, for the templates where this rule is skipped meaning the four keys that we are checking are actually not used, where as IgnoreCase equivalent is used I agree there is a possibility of bypassing the rule.

We may need to either tweak the rule or add another clause applicable to ignore case condition operators as well. We will make the necessary changes and raise a PR for this change.

HTH,
Akshay

from cloudformation-guard.