|
| 1 | +## aws_policy_equal |
| 2 | + |
| 3 | +```text |
| 4 | +aws_policy_equal(POLICY1, POLICY2) |
| 5 | +``` |
| 6 | + |
| 7 | +Compares two AWS IAM policy JSON strings and returns 1 if they are semantically equivalent according to AWS IAM policy evaluation rules, 0 otherwise. This function handles the specific comparison rules for AWS policies, where certain elements (like Action, Resource, and Principal) are treated as unordered sets. |
| 8 | + |
| 9 | +```sql |
| 10 | +-- Compare identical policies |
| 11 | +SELECT aws_policy_equal( |
| 12 | + '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}', |
| 13 | + '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}' |
| 14 | +); -- Returns 1 (true) |
| 15 | + |
| 16 | +-- Compare policies with different Action ordering |
| 17 | +SELECT aws_policy_equal( |
| 18 | + '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:PutObject"],"Resource":"*"}]}', |
| 19 | + '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:PutObject","s3:GetObject"],"Resource":"*"}]}' |
| 20 | +); -- Returns 1 (true) |
| 21 | + |
| 22 | +-- Compare policies with different Principal formats |
| 23 | +SELECT aws_policy_equal( |
| 24 | + '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:role/role1"},"Action":"sts:AssumeRole"}]}', |
| 25 | + '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["arn:aws:iam::123456789012:role/role1"]},"Action":"sts:AssumeRole"}]}' |
| 26 | +); -- Returns 1 (true) |
| 27 | + |
| 28 | +-- Compare different policies |
| 29 | +SELECT aws_policy_equal( |
| 30 | + '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject"],"Resource":"*"}]}', |
| 31 | + '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["s3:GetObject"],"Resource":"*"}]}' |
| 32 | +); -- Returns 0 (false) |
| 33 | +``` |
| 34 | + |
| 35 | +### Key Features |
| 36 | + |
| 37 | +- **Semantic Policy Comparison:** Compares AWS IAM policies according to AWS evaluation rules. |
| 38 | +- **Unordered Arrays:** Treats arrays in fields like `Action`, `Resource`, and `Principal` as unordered sets. |
| 39 | +- **Principal Format Support:** Handles both string and array formats for principals and other elements. |
| 40 | +- **Condition Block Handling:** Correctly compares condition blocks regardless of key order. |
| 41 | +- **Case-Insensitive ARNs:** Performs case-insensitive comparison for service names in ARNs. |
| 42 | + |
| 43 | +### Supported Policy Types |
| 44 | + |
| 45 | +- **IAM Policies:** Identity-based policies attached to IAM roles, users, and groups. |
| 46 | +- **Trust Policies:** Resource-based policies that define which principals can assume an IAM role. |
| 47 | +- **S3 Bucket Policies:** Resource-based policies attached to S3 buckets. |
| 48 | + |
| 49 | +### Installation and Usage |
| 50 | + |
| 51 | +SQLite command-line interface: |
| 52 | + |
| 53 | +``` |
| 54 | +sqlite> .load ./aws_policy_equal.so |
| 55 | +sqlite> SELECT aws_policy_equal( |
| 56 | + '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}', |
| 57 | + '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}' |
| 58 | +); |
| 59 | +``` |
| 60 | + |
| 61 | +### Implementation Details |
| 62 | + |
| 63 | +The `aws_policy_equal` function is implemented using the [cJSON library](https://github.com/DaveGamble/cJSON) and includes specialized comparison logic for AWS policy elements. It is part of the StackQL extension suite for SQLite, providing enhanced cloud policy management capabilities. |
| 64 | + |
| 65 | +[⬇️ Download](https://github.com/stackql/stackql/releases/latest) • |
| 66 | +[✨ Explore](https://github.com/stackql/stackql) • |
| 67 | +[🚀 Follow](https://github.com/stackql) |
0 commit comments