awspolicy

README

AWS Policy Equivalence Package

This package checks for structural equivalence of two AWS policy documents. See Godoc for more information on usage.

Post v1.5 Validation vs. Equivalence

In versions 1.5 and earlier, this package has had a validation role. For example, {} is a valid JSON but an invalid AWS policy. But, AWS emits this empty JSON in some cases. Should this package determine {} is equivalent to itself or throw an error and say it's not equivalent to itself? Since the purpose of this package is primarily equivalence and not validation, we are removing some of the validation role.

In other words, for v1.5 and earlier, {} is not equivalent to itself and returns an error. Post v1.5, {} is equivalent to itself and does not return an error. This may impact you if you have relied on this package for validation!

CI

Documentation

Overview

Package awspolicy contains functions to compare structural equivalence of AWS IAM policies.

Index

• func PoliciesAreEquivalent(policy1, policy2 string) (bool, error)

Functions

func PoliciesAreEquivalent

func PoliciesAreEquivalent(policy1, policy2 string) (bool, error)

PoliciesAreEquivalent tests for the structural equivalence of two AWS policies. It does not read into the semantics, other than treating single element string arrays as equivalent to a string without an array, as the AWS endpoints do.

It will, however, detect reordering and ignore whitespace.

Returns true if the policies are structurally equivalent, false otherwise. If either of the input strings are not valid JSON, false is returned along with an error.