Filtering AWS S3 Policy JSON: Select Statements with ARNs Only

Learn how to filter AWS S3 policies in JSON format using `jq` to exclude specific entries with string values.
---
This video is based on the question https://stackoverflow.com/q/68833834/ asked by the user 'Fransurbo' ( https://stackoverflow.com/u/2434397/ ) and on the answer https://stackoverflow.com/a/68834055/ provided by the user 'Weeble' ( https://stackoverflow.com/u/2283/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Inner select on json when key is either string or array?

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/licensing
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/by-sa/4.0/ ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/by-sa/4.0/ ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Filtering AWS S3 Policy JSON: Select Statements with ARNs Only

Working with AWS S3 policies can often lead to complexities, especially when dealing with JSON outputs. If you’ve found yourself trying to manage conditions where a key can be both a string and an array, you're not alone! In this guide, we'll tackle a common challenge: filtering out specific entries from a JSON document where the key you are interested in might be one of two different types.

The Challenge

You have an AWS S3 policy formatted in JSON, which includes multiple statements under "Statement." Each statement can either have the "Principal" key as a list of ARNs (Amazon Resource Names) or just a single string. Your goal is to extract only those statements where the "Principal" is a non-singleton array of ARNs.

For example, you have a JSON structure as follows:

[[See Video to Reveal this Text or Code Snippet]]

In the above example, your target is to keep only the first statement since it contains an array of ARNs and discard the statement that holds a string "KEY1".

The Solution

Using jq for JSON Filtering

To achieve the desired filtering, you can utilize the powerful jq tool, which is designed for processing JSON data. Below is a step-by-step breakdown of the command needed to filter out the unwanted statements.

The Command

You can run the following jq command:

[[See Video to Reveal this Text or Code Snippet]]

Breakdown of the Command

.Statement: This specifies that you want to manipulate the "Statement" part of the JSON.

|= map(...): This is a jq operator that updates the content of "Statement" with new values based on the mapping function provided.

select(...): This function is used to filter the elements.

[.Principal.AWS] | flatten:

The [.Principal.AWS] part creates an array from the "AWS" values of the "Principal" elements.

The flatten function converts nested arrays into a single list.

all(. != "KEY1"): This checks that none of the values in the flattened list is equal to "KEY1". Statements that meet this condition are kept.

Result

After running the command, you will receive a polished JSON output that excludes unwanted statements. Your filtered JSON will look like this:

[[See Video to Reveal this Text or Code Snippet]]

Conclusion

Filtering JSON in complex scenarios may seem daunting at first, but with jq, it becomes a manageable task. By breaking down the filtering process into comprehensible parts, you can effectively manipulate JSON according to your needs. Now that you have the tools and the knowledge, you can confidently refine your AWS S3 policy configurations! If you have any questions or need further assistance, feel free to reach out.

Видео Filtering AWS S3 Policy JSON: Select Statements with ARNs Only канала vlogize