Skip to content

Blatantly wrong implementation of iam::simulate_principal_policy #12427

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
amit-batra opened this issue Mar 24, 2025 · 3 comments
Closed

Blatantly wrong implementation of iam::simulate_principal_policy #12427

amit-batra opened this issue Mar 24, 2025 · 3 comments
Labels
aws:iam AWS Identity and Access Management status: backlog Triaged but not yet being worked on

Comments

@amit-batra
Copy link

The policy_source_arn parameter passed to simulate_principal_policy in the LocalStack IAM provider is being erroneously assumed to be a policy URN (refer to:

localstack/localstack-core/localstack/services/iam/provider.py

Line 171 in 0618277

policy = backend.get_policy(policy_source_arn)
)

This is blatantly incorrect and hasn't been fixed for many years. As per AWS, this parameter refers to a user, group, or role whose policies you want to include in the simulation. (refer to: AWS documentation https://docs.aws.amazon.com/cli/latest/reference/iam/simulate-principal-policy.html).

Because of this mistake, all correct calls to simulate_principal_policy (where this parameter is a user, group or role ARN) fail on LocalStack.

This is a big embarrassment to the entire LocalStack team and should be resolved ASAP.
@localstack-bot
Copy link
Collaborator

Welcome to LocalStack! Thanks for reporting your first issue and our team will be working towards fixing the issue for you or reach out for more background information. We recommend joining our Slack Community for real-time help and drop a message to LocalStack Pro Support if you are a Pro user! If you are willing to contribute towards fixing this issue, please have a look at our contributing guidelines and our contributing guide.

@ryan-berke ryan-berke added aws:iam AWS Identity and Access Management status: backlog Triaged but not yet being worked on labels Mar 26, 2025
@peter-smith-phd
Copy link
Contributor

Thanks for reporting this parity gap. We appreciate that you're making good use of LocalStack, and that you've been able to identify a gap in our implementation. Given that we support a large number of AWS services, and each service has numerous features, we find it very helpful when the community sends in these bug reports. It helps us know which fixes to treat as a high priority. Thanks 👍

@pinzon pinzon mentioned this issue Apr 21, 2025
Merged
@pinzon
Copy link
Member

pinzon commented May 7, 2025

The solution of this issue has been merged. Please download the latest version of the image.
Thank you for the report. 👍

@pinzon pinzon closed this as completed May 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
aws:iam AWS Identity and Access Management status: backlog Triaged but not yet being worked on
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@peter-smith-phd @amit-batra @pinzon @localstack-bot @ryan-berke