policyJsonSchema.json

{
  "$schema": "http://json-schema.org/draft-06/schema#",
  "type": "object",
  "title": "AWS User Policy schema.",
  "description": "This schema describes a user policy per AWS policy grammar rules",
  "definitions": {
    "principalService": {
      "type": "object",
      "properties": {
        "Service": {
          "type": "string",
          "const": "backbeat"
        }
      },
      "additionalProperties": false
    },
    "principalAnonymous": {
      "type": "string",
      "pattern": "^\\*$"
    },
    "principalAWSAccountID": {
      "type": "string",
      "pattern": "^[0-9]{12}$"
    },
    "principalAWSAccountArn": {
      "type": "string",
      "pattern": "^arn:aws:iam::[0-9]{12}:root$"
    },
    "principalAWSUserArn": {
      "type": "string",
      "pattern": "^arn:aws:iam::[0-9]{12}:user/(?!\\*)[\\w+=,.@ -/]{1,64}$"
    },
    "principalAWSRoleArn": {
      "type": "string",
      "pattern": "^arn:aws:iam::[0-9]{12}:role/[\\w+=,.@ -]{1,64}$"
    },
    "principalFederatedSamlIdp": {
      "type": "string",
      "pattern": "^arn:aws:iam::[0-9]{12}:saml-provider/[\\w._-]{1,128}$"
    },
    "principalFederatedOidcIdp": {
      "type": "string",
      "pattern": "^(?:http(s)?://)?[\\w.-]+(?:\\.[\\w\\.-]+)+[\\w\\-\\._~:/?#[\\]@!\\$&'\\(\\)\\*\\+,;=.]+$"
    },
    "principalAWSItem": {
      "type": "object",
      "properties": {
        "AWS": {
          "oneOf": [
            {
              "$ref": "#/definitions/principalAWSAccountID"
            },
            {
              "$ref": "#/definitions/principalAnonymous"
            },
            {
              "$ref": "#/definitions/principalAWSAccountArn"
            },
            {
              "$ref": "#/definitions/principalAWSUserArn"
            },
            {
              "$ref": "#/definitions/principalAWSRoleArn"
            },
            {
              "type": "array",
              "minItems": 1,
              "items": {
                "$ref": "#/definitions/principalAWSAccountID"
              }
            },
            {
              "type": "array",
              "minItems": 1,
              "items": {
                "$ref": "#/definitions/principalAWSAccountArn"
              }
            },
            {
              "type": "array",
              "minItems": 1,
              "items": {
                "$ref": "#/definitions/principalAWSRoleArn"
              }
            },
            {
              "type": "array",
              "minItems": 1,
              "items": {
                "$ref": "#/definitions/principalAWSUserArn"
              }
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "principalFederatedItem": {
      "type": "object",
      "properties": {
        "Federated": {
          "oneOf": [
            {
              "$ref": "#/definitions/principalFederatedSamlIdp"
            },
            {
              "$ref": "#/definitions/principalFederatedOidcIdp"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "principalItem": {
      "oneOf": [
        {
          "$ref": "#/definitions/principalAWSItem"
        },
        {
          "$ref": "#/definitions/principalAnonymous"
        },
        {
          "$ref": "#/definitions/principalFederatedItem"
        },
        {
          "$ref": "#/definitions/principalService"
        }
      ]
    },
    "actionItem": {
      "enum": [
        "s3:*",
        "s3:DeleteBucket",
        "s3:PutEncryptionConfiguration",
        "s3:DeleteBucketPolicy",
        "s3:DeleteBucketWebsite",
        "s3:DeleteBucketTagging",
        "s3:ListBucket",
        "s3:GetBucketAcl",
        "s3:GetBucketCORS",
        "s3:GetEncryptionConfiguration",
        "s3:GetLifecycleConfiguration",
        "s3:GetBucketLocation",
        "s3:GetBucketNotificationConfiguration",
        "s3:GetBucketObjectLockConfiguration",
        "s3:GetBucketPolicy",
        "s3:GetReplicationConfiguration",
        "s3:GetBucketVersioning",
        "s3:GetBucketWebsite",
        "s3:GetBucketTagging",
        "s3:PutBucketAcl",
        "s3:PutBucketCORS",
        "s3:PutLifecycleConfiguration",
        "s3:PutBucketNotificationConfiguration",
        "s3:PutBucketObjectLockConfiguration",
        "s3:PutBucketPolicy",
        "s3:PutReplicationConfiguration",
        "s3:PutBucketVersioning",
        "s3:PutBucketWebsite",
        "s3:PutBucketTagging",
        "s3:BypassGovernanceRetention",
        "s3:ListBucketMultipartUploads",
        "s3:ListMultipartUploadParts",
        "s3:MetadataSearch",
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:DeleteObjectTagging",
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:GetObjectLegalHold",
        "s3:GetObjectRetention",
        "s3:GetObjectTagging",
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:PutObjectLegalHold",
        "s3:PutObjectRetention",
        "s3:PutObjectTagging",
        "s3:RestoreObject",
        "s3:PutObjectVersion",
        "s3:CreateBucket",
        "s3:DeleteReplicationConfiguration",
        "s3:DeleteLifecycleConfiguration",
        "s3:DeleteObjectVersion",
        "s3:DeleteObjectVersionTagging",
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersionTagging",
        "s3:PutObjectVersionAcl",
        "s3:PutObjectVersionTagging",
        "s3:ListAllMyBuckets",
        "s3:ListBucketVersions",
        "s3:ReplicateObject",
        "s3:GetObjectVersionRetention",
        "s3:PutObjectVersionRetention",
        "s3:GetObjectVersionLegalHold",
        "s3:PutObjectVersionLegalHold",
        "s3:GetBucketNotification",
        "s3:PutBucketNotification",
        "iam:*",
        "iam:AttachGroupPolicy",
        "iam:AttachUserPolicy",
        "iam:CreateAccessKey",
        "iam:CreateGroup",
        "iam:CreatePolicy",
        "iam:CreatePolicyVersion",
        "iam:CreateUser",
        "iam:DeleteAccessKey",
        "iam:DeleteGroup",
        "iam:DeleteGroupPolicy",
        "iam:DeletePolicy",
        "iam:DeletePolicyVersion",
        "iam:DeleteUser",
        "iam:DetachGroupPolicy",
        "iam:DetachUserPolicy",
        "iam:GetGroup",
        "iam:GetGroupPolicy",
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:GetUser",
        "iam:ListAccessKeys",
        "iam:ListEntitiesForPolicy",
        "iam:ListGroupPolicies",
        "iam:ListGroups",
        "iam:ListGroupsForUser",
        "iam:ListPolicies",
        "iam:ListPolicyVersions",
        "iam:ListUsers",
        "iam:PutGroupPolicy",
        "iam:RemoveUserFromGroup",
        "iam:UpdateAccessKey",
        "iam:UpdateGroup",
        "iam:UpdateUser",
        "iam:GetAccessKeyLastUsed",
        "iam:GenerateCredentialReport",
        "iam:GetCredentialReport",
        "iam:TagUser",
        "iam:UntagUser",
        "iam:ListUserTags",
        "sso:*",
        "sso:Authorize",
        "sts:*",
        "sts:AssumeRole",
        "metadata:*",
        "metadata:admin",
        "metadata:bucketd"
      ]
    },
    "resourceItem": {
      "type": "string",
      "pattern": "^\\*|arn:(aws|scality)(:(\\*{1}|[a-z0-9\\*\\-]{2,})*?){3}:((?!\\$\\{\\}).)*?$"
    },
    "conditions": {
      "type": "object",
      "properties": {
        "StringEquals": {
          "type": "object"
        },
        "StringNotEquals": {
          "type": "object"
        },
        "StringEqualsIgnoreCase": {
          "type": "object"
        },
        "StringNotEqualsIgnoreCase": {
          "type": "object"
        },
        "StringLike": {
          "type": "object"
        },
        "StringNotLike": {
          "type": "object"
        },
        "NumericEquals": {
          "type": "object"
        },
        "NumericNotEquals": {
          "type": "object"
        },
        "NumericLessThan": {
          "type": "object"
        },
        "NumericLessThanEquals": {
          "type": "object"
        },
        "NumericGreaterThan": {
          "type": "object"
        },
        "NumericGreaterThanEquals": {
          "type": "object"
        },
        "DateEquals": {
          "type": "object"
        },
        "DateNotEquals": {
          "type": "object"
        },
        "DateLessThan": {
          "type": "object"
        },
        "DateLessThanEquals": {
          "type": "object"
        },
        "DateGreaterThan": {
          "type": "object"
        },
        "DateGreaterThanEquals": {
          "type": "object"
        },
        "Bool": {
          "type": "object"
        },
        "BinaryEquals": {
          "type": "object"
        },
        "BinaryNotEquals": {
          "type": "object"
        },
        "IpAddress": {
          "type": "object"
        },
        "NotIpAddress": {
          "type": "object"
        },
        "ArnEquals": {
          "type": "object"
        },
        "ArnNotEquals": {
          "type": "object"
        },
        "ArnLike": {
          "type": "object"
        },
        "ArnNotLike": {
          "type": "object"
        },
        "Null": {
          "type": "object"
        },
        "StringEqualsIfExists": {
          "type": "object"
        },
        "StringNotEqualsIfExists": {
          "type": "object"
        },
        "StringEqualsIgnoreCaseIfExists": {
          "type": "object"
        },
        "StringNotEqualsIgnoreCaseIfExists": {
          "type": "object"
        },
        "StringLikeIfExists": {
          "type": "object"
        },
        "StringNotLikeIfExists": {
          "type": "object"
        },
        "NumericEqualsIfExists": {
          "type": "object"
        },
        "NumericNotEqualsIfExists": {
          "type": "object"
        },
        "NumericLessThanIfExists": {
          "type": "object"
        },
        "NumericLessThanEqualsIfExists": {
          "type": "object"
        },
        "NumericGreaterThanIfExists": {
          "type": "object"
        },
        "NumericGreaterThanEqualsIfExists": {
          "type": "object"
        },
        "DateEqualsIfExists": {
          "type": "object"
        },
        "DateNotEqualsIfExists": {
          "type": "object"
        },
        "DateLessThanIfExists": {
          "type": "object"
        },
        "DateLessThanEqualsIfExists": {
          "type": "object"
        },
        "DateGreaterThanIfExists": {
          "type": "object"
        },
        "DateGreaterThanEqualsIfExists": {
          "type": "object"
        },
        "BoolIfExists": {
          "type": "object"
        },
        "BinaryEqualsIfExists": {
          "type": "object"
        },
        "BinaryNotEqualsIfExists": {
          "type": "object"
        },
        "IpAddressIfExists": {
          "type": "object"
        },
        "NotIpAddressIfExists": {
          "type": "object"
        },
        "ArnEqualsIfExists": {
          "type": "object"
        },
        "ArnNotEqualsIfExists": {
          "type": "object"
        },
        "ArnLikeIfExists": {
          "type": "object"
        },
        "ArnNotLikeIfExists": {
          "type": "object"
        }
      },
      "additionalProperties": false
    }
  },
  "properties": {
    "Version": {
      "type": "string",
      "const": "2012-10-17"
    },
    "Statement": {
      "oneOf": [
        {
          "type": ["array"],
          "minItems": 1,
          "items": {
            "type": "object",
            "properties": {
              "Sid": {
                "type": "string",
                "pattern": "^[a-zA-Z0-9]+$"
              },
              "Effect": {
                "type": "string",
                "enum": ["Allow", "Deny"]
              },
              "Principal": {
                "$ref": "#/definitions/principalItem"
              },
              "NotPrincipal": {
                "$ref": "#/definitions/principalItem"
              },
              "Action": {
                "oneOf": [
                  {
                    "$ref": "#/definitions/actionItem"
                  },
                  {
                    "type": "array",
                    "items": {
                      "$ref": "#/definitions/actionItem"
                    }
                  }
                ]
              },
              "NotAction": {
                "oneOf": [
                  {
                    "$ref": "#/definitions/actionItem"
                  },
                  {
                    "type": "array",
                    "items": {
                      "$ref": "#/definitions/actionItem"
                    }
                  }
                ]
              },
              "Resource": {
                "oneOf": [
                  {
                    "$ref": "#/definitions/resourceItem"
                  },
                  {
                    "type": "array",
                    "items": {
                      "$ref": "#/definitions/resourceItem"
                    },
                    "minItems": 1
                  }
                ]
              },
              "NotResource": {
                "oneOf": [
                  {
                    "$ref": "#/definitions/resourceItem"
                  },
                  {
                    "type": "array",
                    "items": {
                      "$ref": "#/definitions/resourceItem"
                    },
                    "minItems": 1
                  }
                ]
              },
              "Condition": {
                "$ref": "#/definitions/conditions"
              }
            },
            "oneOf": [
              {
                "required": ["Effect", "Action", "Resource"]
              },
              {
                "required": ["Effect", "Action", "NotResource"]
              },
              {
                "required": ["Effect", "NotAction", "Resource"]
              },
              {
                "required": ["Effect", "NotAction", "NotResource"]
              },
              {
                "required": ["Effect", "Action", "Principal"]
              },
              {
                "required": ["Effect", "Action", "NotPrincipal"]
              }
            ]
          }
        },
        {
          "type": ["object"],
          "properties": {
            "Sid": {
              "type": "string",
              "pattern": "^[a-zA-Z0-9]+$"
            },
            "Effect": {
              "type": "string",
              "enum": ["Allow", "Deny"]
            },
            "Principal": {
              "$ref": "#/definitions/principalItem"
            },
            "Action": {
              "oneOf": [
                {
                  "$ref": "#/definitions/actionItem"
                },
                {
                  "type": "array",
                  "items": {
                    "$ref": "#/definitions/actionItem"
                  }
                }
              ]
            },
            "NotAction": {
              "oneOf": [
                {
                  "$ref": "#/definitions/actionItem"
                },
                {
                  "type": "array",
                  "items": {
                    "$ref": "#/definitions/actionItem"
                  }
                }
              ]
            },
            "Resource": {
              "oneOf": [
                {
                  "$ref": "#/definitions/resourceItem"
                },
                {
                  "type": "array",
                  "items": {
                    "$ref": "#/definitions/resourceItem"
                  },
                  "minItems": 1
                }
              ]
            },
            "NotResource": {
              "oneOf": [
                {
                  "$ref": "#/definitions/resourceItem"
                },
                {
                  "type": "array",
                  "items": {
                    "$ref": "#/definitions/resourceItem"
                  },
                  "minItems": 1
                }
              ]
            },
            "Condition": {
              "$ref": "#/definitions/conditions"
            }
          },
          "oneOf": [
            {
              "required": ["Action", "Effect", "Resource"]
            },
            {
              "required": ["Action", "Effect", "NotResource"]
            },
            {
              "required": ["Effect", "NotAction", "Resource"]
            },
            {
              "required": ["Effect", "NotAction", "NotResource"]
            },
            {
              "required": ["Effect", "Action", "Principal"]
            },
            {
              "required": ["Effect", "Action", "NotPrincipal"]
            }
          ]
        }
      ]
    }
  },
  "required": ["Version", "Statement"],
  "additionalProperties": false
}