noqdev / iambic

IAMbic is Version-Control for IAM. It centralizes and simplifies cloud access and permissions. It maintains an eventually consistent, human-readable, bi-directional representation of IAM in Git.

Home Page:https://iambic.org

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Assertion against new exclude_account during import.

smoy opened this issue · comments

Is your feature request related to a problem? Please describe.
Import phase can at best generate an exact enumeration of include_accounts with account literals. It would beyond imagination if import generates statements like "exclude_accounts". Exclude Accounts is a disallow list evaluate against future complete set.

If this bug ever occurs, it's incredible difficult to self heal. We like to have an assertion to check against such invariant.

Invariant:

During an import cycle, the output template should not add new exclude_accounts.

For template that already have exclude_accounts and yet its in the account, the behavior is undefined.

Describe the solution you'd like
A clear and concise description of what you want to happen.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Community Engagement
Help us prioritize this request and express your support by adding a 👍 reaction to the original issue. This will assist both the community and the maintainers in addressing this request.

Please avoid leaving "+1" or "me too" comments as they create extra noise for issue followers and do not assist in prioritizing the request. If you are considering working on this issue or have already submitted a pull request, kindly leave a comment.