Handle `NotAction` in IAM policy

I’m seeing an unhandled exception in https://github.com/lyft/cartography/blob/master/cartography/intel/aws/iam.py#L278 if the IAM statement includes a NotAction and no Action.

I can provide more information if necessary but as far as I know there’s no difference in how an Action and NotAction should be parsed.

[achantavy]

Thanks for pointing this out! I’ll be pushing out a quick and ugly patch today to fix the crash.

However, modeling NotActions is going to be tricky and we’ll have to think on it.

Currently we represent IAM permissions in the graph between groups and roles in the “positive form” like this: (AWSGroup)-[:STS_ASSUMEROLE_ALLOW]->(AWSRole). That is, for consistency we only show in the graph what permissions an identity has, as opposed to showing what permissions an identity does-not-have.

There could be ways to take the NotAction and convert them to an equivalent Actions list, but that sounds unwieldy.

[stale[bot]]

This issue has been automatically closed for inactivity. If you still wish to make these changes, please open a new change or reopen this one.