diff --git a/iamspy/parse.py b/iamspy/parse.py index 0e831ab..e8809e5 100644 --- a/iamspy/parse.py +++ b/iamspy/parse.py @@ -519,7 +519,7 @@ def generate_evaluation_logic_checks(model_vars, source: Optional[str], resource ) constraints.append( z3.Or( - z3.And(z3.String("s_account") != z3.String("r_account"), resource_check), + z3.And(z3.String("s_account") != z3.String("r_account"), identity_check, resource_check), z3.String("s_account") == z3.String("r_account"), ) ) diff --git a/tests/test_integration.py b/tests/test_integration.py index b4246da..ebaf141 100644 --- a/tests/test_integration.py +++ b/tests/test_integration.py @@ -96,6 +96,15 @@ ), True, ), + ( + {"gaads": ["basic-allow.json"], "resources": ["cross-account-rp.json"]}, + ( + "arn:aws:iam::123456789012:role/name2", + "lambda:InvokeFunction", + "arn:aws:lambda:eu-west-1:111111111111:function:helloworld", + ), + False, + ), ( {"gaads": ["allow-with-conditions.json"]}, (