feat: added updated iam policy and role validations

.projenrc.ts

@@ -56,10 +56,10 @@ project.eslint?.addPlugins("jsdoc");
 project.eslint?.addExtends("plugin:jsdoc/recommended");
 project.eslint?.addRules({
   "jsdoc/require-param-type": "off",
-  "jsdoc/require-description": "error",
+  "jsdoc/require-description": "warn",
   "jsdoc/require-returns-type": "off",
   "jsdoc/require-jsdoc": [
-    "error",
+    "warn",
     {
       require: {
         ArrowFunctionExpression: true,

src/aws/iam-policy.ts

@@ -19,7 +19,20 @@ export class IamPolicy extends Construct implements FusionConstruct {
    */
   constructor(scope: Construct, id: string, options: IamPolicyProps) {
     super(scope, id);
-
     this.construct = new iam.IamPolicy(this, "iam-policy", options);
+    this.node.addValidation({
+      /**
+       *
+       */
+      validate: () => {
+        let errors = [];
+        if (this.construct.path === "*") {
+          errors.push(
+            `IAM Policy path "${this.construct.path}" for ${this.construct.friendlyUniqueId} may be overly permissive.`
+          );
+        }
+        return errors;
+      },
+    });
   }
 }

src/aws/role.ts → src/aws/iam-role.ts

@@ -1,9 +1,10 @@
 import * as iam from "@cdktf/provider-aws/lib/iam";
 import { Construct } from "constructs";
+import { FusionConstruct } from "../@types";
 
 export interface IamRoleProps extends iam.IamRoleConfig {}
 
-export class IamRole extends Construct {
+export class IamRole extends Construct implements FusionConstruct {
   readonly construct: iam.IamRole;
 
   /**

src/aws/index.ts

@@ -1,3 +1,4 @@
 export * from "./security-group";
-export * from "./role";
+export * from "./iam-role";
+export * from "./iam-policy";
 export * from "./s3-bucket";

src/integ.default.ts

@@ -18,4 +18,9 @@ new fusionaws.S3Bucket(stack, "bucket", {
   encryptionKey: security.NOT_SECURE,
 });
 
+new fusionaws.IamPolicy(stack, "iam-policy", {
+  path: "*",
+  policy: "",
+});
+
 app.synth();

test/aws.test.ts

@@ -0,0 +1,96 @@
+import { AwsProvider } from "@cdktf/provider-aws";
+import { TerraformStack, Testing } from "cdktf";
+import "cdktf/lib/testing/adapters/jest";
+import { fusionaws } from "../src";
+import { NOT_SECURE } from "../src/@types/security";
+
+Testing.setupJest();
+
+describe("AWS", () => {
+  describe("Security group", () => {
+    const app = Testing.app();
+    const stack = new TerraformStack(app, "test");
+    new AwsProvider(stack, "provider");
+
+    it("should produce valid terraform", () => {
+      const properties: fusionaws.SecurityGroupProps = {
+        name: "my-security-group",
+      };
+
+      new fusionaws.SecurityGroup(stack, "test-security-group", properties);
+      expect(Testing.fullSynth(stack)).toBeValidTerraform();
+    });
+  });
+
+  describe("s3 bucket", () => {
+    const app = Testing.app();
+    const stack = new TerraformStack(app, "test");
+
+    new AwsProvider(stack, "provider");
+
+    it("should produce valid terraform", () => {
+      const properties: fusionaws.S3BucketProps = {
+        bucket: "my-bucket",
+        encryptionKey: NOT_SECURE,
+      };
+
+      new fusionaws.S3Bucket(stack, "test-s3-bucket", properties);
+      expect(Testing.fullSynth(stack)).toBeValidTerraform();
+    });
+  });
+
+  describe("IAM role", () => {
+    const app = Testing.app();
+    const stack = new TerraformStack(app, "test");
+    new AwsProvider(stack, "provider");
+
+    it("should produce valid terraform", () => {
+      const properties: fusionaws.IamRoleProps = {
+        name: "my-iam-role",
+        assumeRolePolicy: JSON.stringify({
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Principal: {
+                Service: "ec2.amazonaws.com",
+              },
+              Effect: "Allow",
+            },
+          ],
+        }),
+      };
+
+      new fusionaws.IamRole(stack, "test-iam-role", properties);
+      expect(Testing.fullSynth(stack)).toBeValidTerraform();
+    });
+  });
+
+  describe("IAM policy", () => {
+    const app = Testing.app();
+    const stack = new TerraformStack(app, "test");
+    new AwsProvider(stack, "provider");
+
+    it("should produce valid terraform", () => {
+      const properties: fusionaws.IamPolicyProps = {
+        name: "my-iam-policy",
+        path: "*",
+        policy: JSON.stringify({
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Principal: {
+                Service: "ec2.amazonaws.com",
+              },
+              Effect: "Allow",
+            },
+          ],
+        }),
+      };
+
+      new fusionaws.IamPolicy(stack, "test-iam-policy", properties);
+      expect(Testing.fullSynth(stack)).toBeValidTerraform();
+    });
+  });
+});