role.go

package iam

import (
	"fmt"

	"github.com/aquasecurity/trivy/pkg/iac/providers/aws/iam"
	"github.com/aquasecurity/trivy/pkg/iac/state"
	"github.com/aquasecurity/trivy/pkg/iac/types"
	"github.com/aquasecurity/trivy/pkg/log"
	iamapi "github.com/aws/aws-sdk-go-v2/service/iam"
	iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"

	"github.com/aquasecurity/trivy-aws/pkg/concurrency"
)

func (a *adapter) adaptRoles(state *state.State) error {

	a.Tracker().SetServiceLabel("Discovering roles...")

	var nativeRoles []iamtypes.Role

	input := &iamapi.ListRolesInput{}
	for {
		rolesOutput, err := a.api.ListRoles(a.Context(), input)
		if err != nil {
			return err
		}
		nativeRoles = append(nativeRoles, rolesOutput.Roles...)
		a.Tracker().SetTotalResources(len(nativeRoles))
		if !rolesOutput.IsTruncated {
			break
		}
		input.Marker = rolesOutput.Marker
	}

	a.Tracker().SetServiceLabel("Adapting roles...")
	state.AWS.IAM.Roles = concurrency.Adapt(nativeRoles, a.RootAdapter, a.adaptRole)

	return nil
}

func (a *adapter) adaptRole(apiRole iamtypes.Role) (*iam.Role, error) {

	if apiRole.Arn == nil {
		return nil, fmt.Errorf("role arn not specified")
	}
	if apiRole.RoleName == nil {
		return nil, fmt.Errorf("role name not specified")
	}

	var policies []iam.Policy

	input := &iamapi.ListAttachedRolePoliciesInput{
		RoleName: apiRole.RoleName,
	}
	for {
		policiesOutput, err := a.api.ListAttachedRolePolicies(a.Context(), input)
		if err != nil {
			a.Logger().Error("Failed to locate policies attached to role",
				log.String("name", *apiRole.RoleName), log.Err(err))
			break
		}

		for _, apiPolicy := range policiesOutput.AttachedPolicies {
			policy, err := a.adaptAttachedPolicy(apiPolicy)
			if err != nil {
				a.Logger().Error("Failed to adapt policy attached to role",
					log.String("name", *apiRole.RoleName), log.Err(err))
				continue
			}
			policies = append(policies, *policy)
		}

		if !policiesOutput.IsTruncated {
			break
		}
		input.Marker = policiesOutput.Marker
	}

	metadata := a.CreateMetadataFromARN(*apiRole.Arn)

	return &iam.Role{
		Metadata: metadata,
		Name:     types.String(*apiRole.RoleName, metadata),
		Policies: policies,
	}, nil
}