From ec647cab8243ea4ce4bfd4a60a55b39dba4bcb99 Mon Sep 17 00:00:00 2001 From: Pratik kumar Date: Wed, 14 Jan 2026 14:01:31 +0100 Subject: [PATCH] fix: improve guardhooks-no-root-principals-except-kms-secrets.guard rule to ignore non string elements --- ...o-root-principals-except-kms-secrets.guard | 28 ++++++++++++++----- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/tools/@aws-cdk/security-guardian/rules/guard-hooks/guardhooks-no-root-principals-except-kms-secrets.guard b/tools/@aws-cdk/security-guardian/rules/guard-hooks/guardhooks-no-root-principals-except-kms-secrets.guard index 053952aa5d1c3..3308488449a90 100644 --- a/tools/@aws-cdk/security-guardian/rules/guard-hooks/guardhooks-no-root-principals-except-kms-secrets.guard +++ b/tools/@aws-cdk/security-guardian/rules/guard-hooks/guardhooks-no-root-principals-except-kms-secrets.guard @@ -25,10 +25,12 @@ rule NO_ROOT_PRINCIPALS_EXCEPT_KMS_SECRETS when %resources_no_root_principals !e when Principal.AWS is_string { Principal.AWS != /(?i):root$/ } - # Check if AWS is an array - only check string items + # Check if AWS is an array - only check string items, skip intrinsic functions when Principal.AWS is_list { - when Principal.AWS[*] is_string { - Principal.AWS[*] != /(?i):root$/ + Principal.AWS[*] { + when this is_string { + this != /(?i):root$/ + } } } } @@ -45,7 +47,11 @@ rule NO_ROOT_PRINCIPALS_EXCEPT_KMS_SECRETS when %resources_no_root_principals !e Principal.AWS != /(?i):root$/ } when Principal.AWS is_list { - Principal.AWS[*] != /(?i):root$/ + Principal.AWS[*] { + when this is_string { + this != /(?i):root$/ + } + } } } } @@ -61,7 +67,11 @@ rule NO_ROOT_PRINCIPALS_EXCEPT_KMS_SECRETS when %resources_no_root_principals !e Principal.AWS != /(?i):root$/ } when Principal.AWS is_list { - Principal.AWS[*] != /(?i):root$/ + Principal.AWS[*] { + when this is_string { + this != /(?i):root$/ + } + } } } } @@ -77,11 +87,15 @@ rule NO_ROOT_PRINCIPALS_EXCEPT_KMS_SECRETS when %resources_no_root_principals !e Principal.AWS != /(?i):root$/ } when Principal.AWS is_list { - Principal.AWS[*] != /(?i):root$/ + Principal.AWS[*] { + when this is_string { + this != /(?i):root$/ + } + } } } } } } } -} \ No newline at end of file +}