33import re
44from six import string_types
55
6- from samtranslator .model .intrinsics import ref , is_intrinsic_no_value
7- from samtranslator .model .intrinsics import make_conditional , fnSub , is_intrinsic_if
6+ from samtranslator .model .intrinsics import ref
7+ from samtranslator .model .intrinsics import make_conditional , fnSub
88from samtranslator .model .exceptions import InvalidDocumentException , InvalidTemplateException
99
1010
@@ -853,6 +853,10 @@ def add_resource_policy(self, resource_policy, path, api_id, stage):
853853 ip_range_blacklist = resource_policy .get ("IpRangeBlacklist" )
854854 source_vpc_whitelist = resource_policy .get ("SourceVpcWhitelist" )
855855 source_vpc_blacklist = resource_policy .get ("SourceVpcBlacklist" )
856+ source_vpc_intrinsic_whitelist = resource_policy .get ("IntrinsicVpcWhitelist" )
857+ source_vpce_intrinsic_whitelist = resource_policy .get ("IntrinsicVpceWhitelist" )
858+ source_vpc_intrinsic_blacklist = resource_policy .get ("IntrinsicVpcBlacklist" )
859+ source_vpce_intrinsic_blacklist = resource_policy .get ("IntrinsicVpceBlacklist" )
856860
857861 if aws_account_whitelist is not None :
858862 resource_list = self ._get_method_path_uri_list (path , api_id , stage )
@@ -870,13 +874,31 @@ def add_resource_policy(self, resource_policy, path, api_id, stage):
870874 resource_list = self ._get_method_path_uri_list (path , api_id , stage )
871875 self ._add_ip_resource_policy_for_method (ip_range_blacklist , "IpAddress" , resource_list )
872876
873- if source_vpc_whitelist is not None :
877+ if (
878+ (source_vpc_blacklist is not None )
879+ or (source_vpc_intrinsic_blacklist is not None )
880+ or (source_vpce_intrinsic_blacklist is not None )
881+ ):
882+ blacklist_dict = {
883+ "StringEndpointList" : source_vpc_blacklist ,
884+ "IntrinsicVpcList" : source_vpc_intrinsic_blacklist ,
885+ "IntrinsicVpceList" : source_vpce_intrinsic_blacklist ,
886+ }
874887 resource_list = self ._get_method_path_uri_list (path , api_id , stage )
875- self ._add_vpc_resource_policy_for_method (source_vpc_whitelist , "StringNotEquals " , resource_list )
888+ self ._add_vpc_resource_policy_for_method (blacklist_dict , "StringEquals " , resource_list )
876889
877- if source_vpc_blacklist is not None :
890+ if (
891+ (source_vpc_whitelist is not None )
892+ or (source_vpc_intrinsic_whitelist is not None )
893+ or (source_vpce_intrinsic_whitelist is not None )
894+ ):
895+ whitelist_dict = {
896+ "StringEndpointList" : source_vpc_whitelist ,
897+ "IntrinsicVpcList" : source_vpc_intrinsic_whitelist ,
898+ "IntrinsicVpceList" : source_vpce_intrinsic_whitelist ,
899+ }
878900 resource_list = self ._get_method_path_uri_list (path , api_id , stage )
879- self ._add_vpc_resource_policy_for_method (source_vpc_blacklist , "StringEquals " , resource_list )
901+ self ._add_vpc_resource_policy_for_method (whitelist_dict , "StringNotEquals " , resource_list )
880902
881903 self ._doc [self ._X_APIGW_POLICY ] = self .resource_policy
882904
@@ -980,33 +1002,44 @@ def _add_ip_resource_policy_for_method(self, ip_list, conditional, resource_list
9801002 statement .extend ([deny_statement ])
9811003 self .resource_policy ["Statement" ] = statement
9821004
983- def _add_vpc_resource_policy_for_method (self , endpoint_list , conditional , resource_list ):
1005+ def _add_vpc_resource_policy_for_method (self , endpoint_dict , conditional , resource_list ):
9841006 """
9851007 This method generates a policy statement to grant/deny specific VPC/VPCE access to the API method and
9861008 appends it to the swagger under `x-amazon-apigateway-policy`
9871009 :raises ValueError: If the conditional passed in does not match the allowed values.
9881010 """
989- if not endpoint_list :
990- return
9911011
9921012 if conditional not in "StringNotEquals" , "StringEquals" ]:
9931013 raise ValueError ("Conditional must be one of {}" .format (["StringNotEquals" , "StringEquals" ]))
9941014
995- vpce_regex = r"^vpce-"
996- vpc_regex = r"^vpc-"
997- vpc_list = []
998- vpce_list = []
999- for endpoint in endpoint_list :
1000- if re .match (vpce_regex , endpoint ):
1001- vpce_list .append (endpoint )
1002- if re .match (vpc_regex , endpoint ):
1003- vpc_list .append (endpoint )
1004-
10051015 condition = {}
1006- if vpc_list :
1007- condition ["aws:SourceVpc" ] = vpc_list
1008- if vpce_list :
1009- condition ["aws:SourceVpce" ] = vpce_list
1016+ string_endpoint_list = endpoint_dict .get ("StringEndpointList" )
1017+ intrinsic_vpc_endpoint_list = endpoint_dict .get ("IntrinsicVpcList" )
1018+ intrinsic_vpce_endpoint_list = endpoint_dict .get ("IntrinsicVpceList" )
1019+
1020+ if string_endpoint_list is not None :
1021+ vpce_regex = r"^vpce-"
1022+ vpc_regex = r"^vpc-"
1023+ vpc_list = []
1024+ vpce_list = []
1025+ for endpoint in string_endpoint_list :
1026+ if re .match (vpce_regex , endpoint ):
1027+ vpce_list .append (endpoint )
1028+ if re .match (vpc_regex , endpoint ):
1029+ vpc_list .append (endpoint )
1030+ if vpc_list :
1031+ condition .setdefault ("aws:SourceVpc" , []).extend (vpc_list )
1032+ if vpce_list :
1033+ condition .setdefault ("aws:SourceVpce" , []).extend (vpce_list )
1034+ if intrinsic_vpc_endpoint_list is not None :
1035+ condition .setdefault ("aws:SourceVpc" , []).extend (intrinsic_vpc_endpoint_list )
1036+ if intrinsic_vpce_endpoint_list is not None :
1037+ condition .setdefault ("aws:SourceVpce" , []).extend (intrinsic_vpce_endpoint_list )
1038+
1039+ # Skip writing to transformed template if both vpc and vpce endpoint lists are empty
1040+ if (not condition .get ("aws:SourceVpc" , [])) and (not condition .get ("aws:SourceVpce" , [])):
1041+ return
1042+
10101043 self .resource_policy ["Version" ] = "2012-10-17"
10111044 allow_statement = {}
10121045 allow_statement ["Effect" ] = "Allow"
0 commit comments