Demonstrate lack of enforcement of conditions in resource policy with…

… a test case.

Permission summary:
* no policies attached to Identity via allow-testing-s3.json GAAD
* bucket policy allows GetObject, but only if aws:PrincipalArn matches (a different arn)

Can I?
Expect: False (Denied)
Actual: True

tests/files/resource-s3-implicit-deny-via-condition.json

@@ -0,0 +1,29 @@
+[
+  {
+    "Resource": "arn:aws:s3:::bucket",
+    "Policy": {
+      "Version": "2012-10-17",
+      "Id": "ImplicitDenyAlmostAll",
+      "Statement": [
+        {
+          "Sid": "AllowNonExistentPrincipal",
+          "Effect": "Allow",
+          "Principal": "*",
+          "Action": "s3:GetObject",
+          "Resource": [
+            "arn:aws:s3:::bucket",
+            "arn:aws:s3:::bucket/*"
+          ],
+          "Condition": {
+            "ArnEquals": {
+              "aws:PrincipalArn": [
+                "arn:aws:iam::111111111111:user/some-other-user"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "Account": "111111111111"
+  }
+]

tests/test_integration.py

@@ -166,6 +166,18 @@
             ),
             True,
         ),
+        (
+            {"gaads": ["allow-testing-s3.json"], "resources": ["resource-s3-implicit-deny-via-condition.json"]},
+            (
+                "arn:aws:iam::111111111111:role/testing",
+                "s3:GetObject",
+                "arn:aws:s3:::bucket",
+                ["aws:PrincipalArn=arn:aws:iam::111111111111:role/testing"],
+                None,
+                True,
+            ),
+            False,
+        ),
     ],
 )
 def test_can_i(files, inp, out):