From 4d78b9b1a48d847d503dbd83eaf00cca0d58afa6 Mon Sep 17 00:00:00 2001
From: Michael McClelland <mccmcc@amazon.com>
Date: Fri, 6 Oct 2023 11:49:52 -0400
Subject: [PATCH] add test for lengthy key policy

---
 .../KmsKeyWildcardPrincipal/expected.yaml     |   3 +-
 .../resources/KmsKeyWildcardPrincipal/main.tf | 368 ++++++++++++++++++
 2 files changed, 370 insertions(+), 1 deletion(-)

diff --git a/tests/terraform/graph/checks/resources/KmsKeyWildcardPrincipal/expected.yaml b/tests/terraform/graph/checks/resources/KmsKeyWildcardPrincipal/expected.yaml
index ca9680402db..e366db390d1 100644
--- a/tests/terraform/graph/checks/resources/KmsKeyWildcardPrincipal/expected.yaml
+++ b/tests/terraform/graph/checks/resources/KmsKeyWildcardPrincipal/expected.yaml
@@ -8,4 +8,5 @@ fail:
   - "aws_kms_key.fail_1"
   - "aws_kms_key.fail_2"
   - "aws_kms_key.fail_3"
-  - "aws_kms_key.fail_4"
\ No newline at end of file
+  - "aws_kms_key.fail_4"
+  - "aws_kms_key.fail_5"
\ No newline at end of file
diff --git a/tests/terraform/graph/checks/resources/KmsKeyWildcardPrincipal/main.tf b/tests/terraform/graph/checks/resources/KmsKeyWildcardPrincipal/main.tf
index a608872b3cc..2e7a8238e89 100644
--- a/tests/terraform/graph/checks/resources/KmsKeyWildcardPrincipal/main.tf
+++ b/tests/terraform/graph/checks/resources/KmsKeyWildcardPrincipal/main.tf
@@ -106,6 +106,374 @@ resource "aws_kms_key" "fail_4" {
 POLICY  
 }
 
+resource "aws_kms_key" "fail_5" {
+  description = "description"
+  policy      = <<POLICY
+{
+    "Version": "2012-10-17",
+    "Statement": [        
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "*"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+            }
+        },
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },      
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },    
+            {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },      
+          {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },    
+            {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },    
+            {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },      
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },      
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:*"
+            ],
+            "Resource": "*"
+        },        
+        {
+            "Sid": "AccessAnalyzerAndConfigPermissions",
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": [
+                    "arn:aws:iam::111122223333:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer",
+                    "arn:aws:iam::111122223333:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
+                    "arn:aws:iam::111122223333:role/aws-service-role/macie.amazonaws.com/AWSServiceRoleForAmazonMacie"
+                ]
+            },
+            "Action": [
+                "kms:Describe*",
+                "kms:GetKeyPolicy",
+                "kms:GetKeyRotationStatus",
+                "kms:List*"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": [
+                    "arn:aws:iam::111122223333:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer",
+                    "arn:aws:iam::111122223333:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
+                    "arn:aws:iam::111122223333:role/aws-service-role/macie.amazonaws.com/AWSServiceRoleForAmazonMacie"
+                ]
+            },
+            "Action": [
+                "kms:Describe*",
+                "kms:GetKeyPolicy",
+                "kms:GetKeyRotationStatus",
+                "kms:List*"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": [
+                    "arn:aws:iam::111122223333:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer",
+                    "arn:aws:iam::111122223333:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
+                    "arn:aws:iam::111122223333:role/aws-service-role/macie.amazonaws.com/AWSServiceRoleForAmazonMacie"
+                ]
+            },
+            "Action": [
+                "kms:Describe*",
+                "kms:GetKeyPolicy",
+                "kms:GetKeyRotationStatus",
+                "kms:List*"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": [
+                    "arn:aws:iam::111122223333:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer",
+                    "arn:aws:iam::111122223333:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
+                    "arn:aws:iam::111122223333:role/aws-service-role/macie.amazonaws.com/AWSServiceRoleForAmazonMacie"
+                ]
+            },
+            "Action": [
+                "kms:Describe*",
+                "kms:GetKeyPolicy",
+                "kms:GetKeyRotationStatus",
+                "kms:List*"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": [
+                    "arn:aws:iam::111122223333:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer",
+                    "arn:aws:iam::111122223333:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
+                    "arn:aws:iam::111122223333:role/aws-service-role/macie.amazonaws.com/AWSServiceRoleForAmazonMacie"
+                ]
+            },
+            "Action": [
+                "kms:Describe*",
+                "kms:GetKeyPolicy",
+                "kms:GetKeyRotationStatus",
+                "kms:List*"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111122223333:root"
+            },
+            "Action": [
+                "kms:Describe*",
+                "kms:GetKeyPolicy",
+                "kms:GetKeyRotationStatus",
+                "kms:List*"
+            ],
+            "Resource": "*",
+            "Condition": {
+                "StringEquals": {
+                    "awws:PrincipalAccount": "111122223333",
+                    "kms:CallerAccount": "111122223333",
+                    "aws:PrincipalOrgID": "o-abcdefg"
+                }
+            }
+        },
+        {
+            "Sid": "DisableSafetyBypass",
+            "Effect": "Deny",
+            "Principal": {
+                "AWS": "*"
+            },
+            "Action": "kms:PutKeyPolicy",
+            "Resource": "*",
+            "Condition": {
+                "Bool": {
+                    "kms:BypassPolicyLockoutSafetyCheck": "true"
+                }
+            }
+        }
+    ]
+}
+POLICY
+}
+
+
 resource "aws_kms_key" "pass_0" {
   description = "description"
   policy      = <<POLICY