diff --git a/lib/policy/resourcePolicySchema.json b/lib/policy/resourcePolicySchema.json index 37f0369da..8f486ac36 100644 --- a/lib/policy/resourcePolicySchema.json +++ b/lib/policy/resourcePolicySchema.json @@ -38,7 +38,7 @@ }, "principalAWSUserArn": { "type": "string", - "pattern": "^arn:aws:iam::[0-9]{12}:user/(?!\\*)[\\w+=,.@ -/]{1,64}$" + "pattern": "^arn:aws:iam::[0-9]{12}:user/(?!\\*)[\\w+=,.@ -/]{1,2017}$" }, "principalAWSRoleArn": { "type": "string", diff --git a/lib/policy/userPolicySchema.json b/lib/policy/userPolicySchema.json index 5024b8127..b96beb462 100644 --- a/lib/policy/userPolicySchema.json +++ b/lib/policy/userPolicySchema.json @@ -28,7 +28,7 @@ }, "principalAWSUserArn": { "type": "string", - "pattern": "^arn:aws:iam::[0-9]{12}:user/(?!\\*)[\\w+=,.@ -/]{1,64}$" + "pattern": "^arn:aws:iam::[0-9]{12}:user/(?!\\*)[\\w+=,.@ -/]{1,2017}$" }, "principalAWSRoleArn": { "type": "string", diff --git a/tests/unit/policy/test_policyValidator.spec.js b/tests/unit/policy/test_policyValidator.spec.js index 819aadbc7..06d192f10 100644 --- a/tests/unit/policy/test_policyValidator.spec.js +++ b/tests/unit/policy/test_policyValidator.spec.js @@ -188,6 +188,11 @@ describe('Policies validation - Principal', () => { value: { AWS: 'arn:aws:iam::111111111111:user/path/in/org/leaf' }, policyType: [user, resource], }, + { + name: 'user arn with vault made path', + value: { AWS: 'arn:aws:iam::767707094035:user/user2/TENANT_USER/null/5417be27-8709-48bd-adfb-865ebc58b9f0/1a464be02ea631bdaf2a9ee884434233374a457460e925bf10d9e4665f8fa796/c1d83067-a3f3-41a4-bd45-d6bf47270bd0' }, // eslint-disable-line max-len + policyType: [user, resource], + }, { name: 'multiple user arns', value: {