class AWS::Core::Policy::Statement

Represents a statement in a policy.

@see AWS::Core::Policy#allow @see AWS::Core::Policy#deny

Attributes

actions[RW]

@return [Array] Returns an array of statement actions included

by this policy statement.
conditions[RW]

@return [Array] Returns an array of conditions for this policy.

effect[RW]

@return [String] Returns the statement effect, either “Allow” or

"Deny"
excluded_actions[RW]

@return [Array] Returns an array of actions excluded by this

policy statement.
excluded_resources[RW]
principals[RW]

@return [Array] Returns an array of principals.

resources[RW]

@return [Array] Returns an array of resources affected by this

policy statement.
sid[RW]

@return [String] Returns the statement id

Public Class Methods

new(opts = {}) { |self| ... } click to toggle source

Constructs a new statement.

@option opts [String] :sid The statement ID. This is optional; if

omitted, a UUID will be generated for the statement.

@option opts [String] :effect The statement effect, which must be either

"Allow" or "Deny".
@see Policy#allow
@see Policy#deny

@option opts [String or array of strings] :principals The account(s)

affected by the statement.  These should be AWS account IDs.

@option opts :actions The action or actions affected by

the statement.  These can be symbols or strings.  If
they are strings, you can use wildcard character "*"
to match zero or more characters in the action name.
Symbols are expected to match methods of S3::Client.

@option opts :excluded_actions Action or actions which are

explicitly not affected by this statement.  As with
`:actions`, these may be symbols or strings.

@option opts [String or array of strings] :resources The

resource(s) affected by the statement.  These can be
expressed as ARNs (e.g. `arn:aws:s3:::mybucket/mykey`)
or you may omit the `arn:aws:s3:::` prefix and just give
the path as `bucket_name/key`.  You may use the wildcard
character "*" to match zero or more characters in the
resource name.

@option opts [ConditionBlock or Hash] :conditions

Additional conditions that narrow the effect of the
statement.  It's typically more convenient to use the
ConditionBuilder instance returned from Policy#allow or
Policy#deny to add conditions to a statement.

@see S3::Client

# File lib/aws/core/policy.rb, line 749
def initialize(opts = {})
  self.sid = SecureRandom.uuid.tr('-','')
  self.conditions = ConditionBlock.new

  parse_options(opts)

  yield(self) if block_given?
end

Public Instance Methods

exclude_action(*actions)
Alias for: exclude_actions
exclude_actions(*actions) click to toggle source

Convenience method to add to the list of actions explicitly not affected by this statement.

# File lib/aws/core/policy.rb, line 768
def exclude_actions(*actions)
  self.excluded_actions ||= []
  self.excluded_actions.push(*actions)
end
Also aliased as: exclude_action
include_action(*actions)
Alias for: include_actions
include_actions(*actions) click to toggle source

Convenience method to add to the list of actions affected by this statement.

# File lib/aws/core/policy.rb, line 760
def include_actions(*actions)
  self.actions ||= []
  self.actions.push(*actions)
end
Also aliased as: include_action
to_h() click to toggle source

@api private

# File lib/aws/core/policy.rb, line 775
def to_h
  stmt = {
    "Sid" => sid,
    "Effect" => Inflection.class_name(effect.to_s),
    "Principal" => principals_hash,
    "Resource" => (resource_arns if resource_arns),
    "NotResource" => (excluded_resource_arns if excluded_resource_arns),
    "Condition" => (conditions.to_h if conditions)
  }
  stmt.delete("Condition") if !conditions || conditions.to_h.empty?
  stmt.delete("Principal") unless principals_hash
  stmt.delete("Resource") unless resource_arns
  stmt.delete("NotResource") unless excluded_resource_arns
  if !translated_actions || translated_actions.empty?
    stmt["NotAction"] = translated_excluded_actions
  else
    stmt["Action"] = translated_actions
  end
  stmt
end

Protected Instance Methods

coerce_array_option(attr, value) click to toggle source
# File lib/aws/core/policy.rb, line 852
def coerce_array_option(attr, value)
  if value.kind_of?(Array)
    send("#{attr}=", value)
  else
    send("#{attr}=", [value])
  end
end
excluded_resource_arn(excluded_resource) click to toggle source
# File lib/aws/core/policy.rb, line 933
def excluded_resource_arn excluded_resource
  excluded_resource.to_s
end
excluded_resource_arns() click to toggle source
# File lib/aws/core/policy.rb, line 922
def excluded_resource_arns
  return nil unless excluded_resources
  excluded_resources.map do |excluded_resource|
    case excluded_resource
    when :any    then "*"
    else excluded_resource_arn(excluded_resource)
    end
  end
end
parse_action_option(value) click to toggle source
# File lib/aws/core/policy.rb, line 817
def parse_action_option(value)
  coerce_array_option(:actions, value)
end
parse_condition_option(value) click to toggle source
# File lib/aws/core/policy.rb, line 847
def parse_condition_option(value)
  self.conditions = ConditionBlock.new(value)
end
parse_effect_option(value) click to toggle source
# File lib/aws/core/policy.rb, line 807
def parse_effect_option(value)
  self.effect = value
end
parse_excluded_action_option(value)
parse_excluded_resource_option(value)
parse_not_action_option(value) click to toggle source
# File lib/aws/core/policy.rb, line 822
def parse_not_action_option(value)
  coerce_array_option(:excluded_actions, value)
end
Also aliased as: parse_excluded_action_option
parse_not_resource_option(value) click to toggle source
# File lib/aws/core/policy.rb, line 841
def parse_not_resource_option(value)
  coerce_array_option(:excluded_resources, value)
end
parse_options(options) click to toggle source
# File lib/aws/core/policy.rb, line 797
def parse_options(options)
  options.each do |name, value|
    name = Inflection.ruby_name(name.to_s)
    name.sub!(/s$/,'')
    send("parse_#{name}_option", value) if
      respond_to?("parse_#{name}_option", true)
  end
end
parse_principal_option(value) click to toggle source
# File lib/aws/core/policy.rb, line 828
def parse_principal_option(value)
  if value and value.kind_of?(Hash)
    value = value["AWS"] || []
  end

  coerce_array_option(:principals, value)
end
parse_resource_option(value) click to toggle source
# File lib/aws/core/policy.rb, line 837
def parse_resource_option(value)
  coerce_array_option(:resources, value)
end
parse_sid_option(value) click to toggle source
# File lib/aws/core/policy.rb, line 812
def parse_sid_option(value)
  self.sid = value
end
principals_hash() click to toggle source
# File lib/aws/core/policy.rb, line 861
def principals_hash
  return nil unless principals
  { "AWS" =>
    principals.map do |principal|
      principal == :any ? "*" : principal
    end }
end
resource_arn(resource) click to toggle source
# File lib/aws/core/policy.rb, line 917
def resource_arn resource
  resource.to_s
end
resource_arns() click to toggle source
# File lib/aws/core/policy.rb, line 906
def resource_arns
  return nil unless resources
  resources.map do |resource|
    case resource
    when :any    then "*"
    else resource_arn(resource)
    end
  end
end
translate_action(action) click to toggle source
# File lib/aws/core/policy.rb, line 870
def translate_action(action)
  case action
  when String then action
  when :any   then '*'
  when Symbol

    if self.class == Core::Policy::Statement
      msg = 'symbolized action names are only accepted by service ' +
      'specific policies (e.g. AWS::S3::Policy)'
      raise ArgumentError, msg
    end

    unless self.class::ACTION_MAPPING.has_key?(action)
      raise ArgumentError, "unrecognized action: #{action}"
    end

    self.class::ACTION_MAPPING[action]

  end
end
translated_actions() click to toggle source
# File lib/aws/core/policy.rb, line 892
def translated_actions
  return nil unless actions
  actions.map do |action|
    translate_action(action)
  end
end
translated_excluded_actions() click to toggle source
# File lib/aws/core/policy.rb, line 900
def translated_excluded_actions
  return nil unless excluded_actions
  excluded_actions.map { |a| translate_action(a) }
end