refactor: preliminary changes for managed policy improvements

.cfnlintrc.yaml

@@ -117,6 +117,7 @@ ignore_templates:
   - tests/translator/output/**/state_machine_with_schedule_dlq_retry_policy.json
   - tests/translator/output/**/globals_for_function.json  # RuntimeManagementConfig
   - tests/translator/output/**/function_with_runtime_config.json  # RuntimeManagementConfig
+  - tests/translator/output/**/managed_policies_minimal.json  # Intentionally has non-existent managed policy name
 ignore_checks:
   - E2531 # Deprecated runtime; not relevant for transform tests
   - W2531 # EOL runtime; not relevant for transform tests

samtranslator/model/sam_resources.py

@@ -281,7 +281,10 @@ def to_cloudformation(self, **kwargs):  # type: ignore[no-untyped-def]
 
         execution_role = None
         if lambda_function.Role is None:
-            execution_role = self._construct_role(managed_policy_map, event_invoke_policies)
+            execution_role = self._construct_role(
+                managed_policy_map,
+                event_invoke_policies,
+            )
             lambda_function.Role = execution_role.get_runtime_attr("arn")
             resources.append(execution_role)
 
@@ -559,7 +562,9 @@ def _add_event_invoke_managed_policy(
         return {}
 
     def _construct_role(
-        self, managed_policy_map: Dict[str, Any], event_invoke_policies: List[Dict[str, Any]]
+        self,
+        managed_policy_map: Dict[str, Any],
+        event_invoke_policies: List[Dict[str, Any]],
     ) -> IAMRole:
         """Constructs a Lambda execution role based on this SAM function's Policies property.
 

samtranslator/translator/managed_policy_translator.py

@@ -1,4 +1,5 @@
 import logging
+from typing import Dict, cast
 
 from samtranslator.metrics.method_decorator import cw_timer
 
@@ -30,7 +31,8 @@ def _load_policies_from_iam(self):  # type: ignore[no-untyped-def]
         LOG.info("Finished loading policies from IAM.")
         self._policy_map = name_to_arn_map
 
-    def load(self):  # type: ignore[no-untyped-def]
+    def load(self) -> Dict[str, str]:
         if self._policy_map is None:
             self._load_policies_from_iam()
-        return self._policy_map
+        # mypy doesn't realize that function above assigns non-None value
+        return cast(Dict[str, str], self._policy_map)

samtranslator/translator/transform.py

@@ -14,7 +14,10 @@ def transform(input_fragment, parameter_values, managed_policy_loader, feature_t
 
     sam_parser = Parser()
     to_py27_compatible_template(input_fragment, parameter_values)
-    translator = Translator(managed_policy_loader.load(), sam_parser)  # type: ignore[no-untyped-call]
+    translator = Translator(  # type: ignore[no-untyped-call]
+        managed_policy_loader.load(),
+        sam_parser,
+    )
     transformed = translator.translate(
         input_fragment,
         parameter_values=parameter_values,

samtranslator/translator/translator.py

@@ -38,7 +38,14 @@
 class Translator:
     """Translates SAM templates into CloudFormation templates"""
 
-    def __init__(self, managed_policy_map, sam_parser, plugins=None, boto_session=None, metrics=None):  # type: ignore[no-untyped-def]
+    def __init__(  # type: ignore[no-untyped-def]
+        self,
+        managed_policy_map,
+        sam_parser,
+        plugins=None,
+        boto_session=None,
+        metrics=None,
+    ):
         """
         :param dict managed_policy_map: Map of managed policy names to the ARNs
         :param sam_parser: Instance of a SAM Parser

tests/translator/input/managed_policies_minimal.yaml

@@ -0,0 +1,18 @@
+Resources:
+  MyFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      Runtime: python3.8
+      Handler: foo
+      InlineCode: bar
+      Policies:
+      - AnyNonOfficialManagedPolicy
+      - AmazonS3FullAccess
+
+  MyStateMachine:
+    Type: AWS::Serverless::StateMachine
+    Properties:
+      DefinitionUri: s3://foo/bar
+      Policies:
+      - AnyNonOfficialManagedPolicy
+      - AmazonS3FullAccess

tests/translator/output/aws-cn/managed_policies_minimal.json

@@ -0,0 +1,110 @@
+{
+  "Resources": {
+    "MyFunction": {
+      "Properties": {
+        "Code": {
+          "ZipFile": "bar"
+        },
+        "Handler": "foo",
+        "Role": {
+          "Fn::GetAtt": [
+            "MyFunctionRole",
+            "Arn"
+          ]
+        },
+        "Runtime": "python3.8",
+        "Tags": [
+          {
+            "Key": "lambda:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::Lambda::Function"
+    },
+    "MyFunctionRole": {
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "sts:AssumeRole"
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "Service": [
+                  "lambda.amazonaws.com"
+                ]
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+          "AnyNonOfficialManagedPolicy",
+          "AmazonS3FullAccess"
+        ],
+        "Tags": [
+          {
+            "Key": "lambda:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::IAM::Role"
+    },
+    "MyStateMachine": {
+      "Properties": {
+        "DefinitionS3Location": {
+          "Bucket": "foo",
+          "Key": "bar"
+        },
+        "RoleArn": {
+          "Fn::GetAtt": [
+            "MyStateMachineRole",
+            "Arn"
+          ]
+        },
+        "Tags": [
+          {
+            "Key": "stateMachine:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::StepFunctions::StateMachine"
+    },
+    "MyStateMachineRole": {
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "sts:AssumeRole"
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "Service": [
+                  "states.amazonaws.com"
+                ]
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          "AnyNonOfficialManagedPolicy",
+          "AmazonS3FullAccess"
+        ],
+        "Tags": [
+          {
+            "Key": "stateMachine:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::IAM::Role"
+    }
+  }
+}

tests/translator/output/aws-us-gov/managed_policies_minimal.json

@@ -0,0 +1,110 @@
+{
+  "Resources": {
+    "MyFunction": {
+      "Properties": {
+        "Code": {
+          "ZipFile": "bar"
+        },
+        "Handler": "foo",
+        "Role": {
+          "Fn::GetAtt": [
+            "MyFunctionRole",
+            "Arn"
+          ]
+        },
+        "Runtime": "python3.8",
+        "Tags": [
+          {
+            "Key": "lambda:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::Lambda::Function"
+    },
+    "MyFunctionRole": {
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "sts:AssumeRole"
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "Service": [
+                  "lambda.amazonaws.com"
+                ]
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+          "AnyNonOfficialManagedPolicy",
+          "AmazonS3FullAccess"
+        ],
+        "Tags": [
+          {
+            "Key": "lambda:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::IAM::Role"
+    },
+    "MyStateMachine": {
+      "Properties": {
+        "DefinitionS3Location": {
+          "Bucket": "foo",
+          "Key": "bar"
+        },
+        "RoleArn": {
+          "Fn::GetAtt": [
+            "MyStateMachineRole",
+            "Arn"
+          ]
+        },
+        "Tags": [
+          {
+            "Key": "stateMachine:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::StepFunctions::StateMachine"
+    },
+    "MyStateMachineRole": {
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "sts:AssumeRole"
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "Service": [
+                  "states.amazonaws.com"
+                ]
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          "AnyNonOfficialManagedPolicy",
+          "AmazonS3FullAccess"
+        ],
+        "Tags": [
+          {
+            "Key": "stateMachine:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::IAM::Role"
+    }
+  }
+}