Releases: salesforce/policy_sentry
Releases · salesforce/policy_sentry
0.7.0.2: Ignore unfilled access level sections in CRUD template
This leads to less user errors - and helps me out with the improved terraform module.
0.7.0.1: Quick fixes for write-policy
0.7.0: Template format updates; deprecated analyze/download subcommands; template type autodetection.
User-facing changes
- The
initialize
command is now completely optional. - Removed: The
analyze
command is deprecated and removed. We moved this functionality over to Parliament here - Removed: The
download-policies
command is deprecated and removed. - Breaking change: Template format is vastly different. You will have to either pin to an old version or update your templates.
- Removed: The
--crud
flag forwrite-policy
command. Now users do not have to specify the--crud
flag. Policy Sentry will automatically detect the format. - Removed:
analyze
anddownload-policies
commands.
Developer library changes
- A lot. Removed a lot of the old functions.
- Replaced
ArnActionGroup
withSidGroup
. This will allow us to do conditions, etc. It is also easier to read. - The old
write-policy
logic usingArnActionGroup
is nuked. Now usingSidGroup
, since that will help us take advantage of condition keys. And it's clean(er). write-policy
is easier to call as a method.- Unit tests are in a nested folder structure that resembles the rest of the python package.
- Moved to Python Black instead of autopep8
- Replaced a lot of print statements with logging.
0.6.11: Initialize command finishes instantly rather than requiring users to build post-install.
Now you can skip the long wait under the initialize
command - the initialize
command finishes instantly. To rebuild the database, run initialize --build
, or to build it with the latest AWS docs, use initialize --fetch
.
0.6.10: Quick fix for Tagging in write-policy CRUD mode
In the last version, if you specified "tagging" in your YML file, the write-policy command was ignoring it. This fixes that.
0.6.9: Improvements to Database queries which help with writing policies. Helpful error messages to users.
- database: Fixes #51 - Give the user an error when the database file does not exist (in connect_db function). Except for the case of the initialize function.
- query: The query command now supports querying for wildcard only actions at an access level per service. For example, the only wildcard-only action under S3 at the Permissions management access level is s3:PutAccountPublicAccessBlock
- query: The query command now supports yaml output. This Fixes #95 (output in the Query command) but does not fix #11 (since #11 is asking for the write-policy command to support YAML, and was before the query functionality came out).
- query: the get_actions_matching_condition_key_crud_and_arn is available. This provides some scaffolding for #21
- travis: Auto-deployment of Python package with TravisCI
0.6.8: get_actions_with_access_level now supports 'all' to query all IAM actions under a specific access level regardless of service
get_actions_with_access_level
now supports 'all' so you can query literally all IAM actions that have Permissions management or other access levels
0.6.7: write-policy can now be used easily as a library. Adjusted policy template names
- Template:
arn
is nowrole_arn
to avoid confusion when writing templatestag
is nowtagging
to avoid inconsistency when writing templates
write_policy_with_actions
write_policy_with_access_levels
can be called directly.get_crud_template_dict
andget_actions_template_dict
are available so developers can create the templates by calling the library. They can pass that into write_policy_with_actions and write_policy_with_access_levels- Added examples for the above in the docs
0.6.6: Fix bundled database oversized issue
Previous one was oversized and had some stale actions.
0.6.5: Docker support
- Docker support
- Write-policy allows template via STDIN
- Better JSON Schema validation
- Fixed an issue with the pre-bundled DB path from 0.6.4.