chore: add support for IAM Identity Center in security diff

[bergjaak]

For issue aws/aws-cdk#29835

This is the first of 2 PRs. The other PR will be to the main aws-cdk repository.

Notice that AWS::SSO::PermissionSet has a property called ManagedPolicies. That's why I add that property check. And judging by the db.json that we create in this package (the service spec), AWS::SSO::PermissionSet is the only resource with that property name:

(18:36:39) bergjak@bcd074b101ed ~/workplace/CDK/awscdk-service-spec AwsSsoFix ✔
 ➜ cat ~/db.json4 | jq '.schema.resource.entities.[]' | jq '.properties' | grep ManagedPolicies
    "scrutinizable": "ManagedPolicies"
    "scrutinizable": "ManagedPolicies"
    "scrutinizable": "ManagedPolicies"
    "scrutinizable": "ManagedPolicies"
    "scrutinizable": "CustomerManagedPolicies"
  "ManagedPolicies": {
    "scrutinizable": "ManagedPolicies"

AWS::SSO is the IAM Identity Center, and therefore changes to AWS SSO resources are security sensitive. Hence the issue.

Testing

As you'll see in the next pull request, I have integration tests for this change

• Here is the PR with all the testing feat: support for IAM Identity Center in security diff aws/aws-cdk#30009

[TheRealAmazonKendra]

Are there any tests that can be added here?

[bergjaak]

@TheRealAmazonKendra

Are there any tests that can be added here?

I believe there are no tests for scrutinies in this package because they're tested in the aws-cdk repo. But I can make new tests if we think that would be beneficial. Though I don't have a problem with the tests being in aws-cdk. (Unless I am just not able to find the tests that are in this package... but it does make sense to me to test them where they're used, namely in aws-cdk repo.)

(19:19:56) bergjak@bcd074b101ed ~/workplace/CDK/awscdk-service-spec/packages/@aws-cdk AwsSsoFix ✔
 ➜ grep -rin scrut | grep -i test

(19:20:01) bergjak@bcd074b101ed ~/workplace/CDK/awscdk-service-spec/packages/@aws-cdk AwsSsoFix ✔
 ➜ find . | grep test.ts
./service-spec-types/test/resource.test.ts
./service-spec-importers/test/sam-spec.test.ts
./service-spec-importers/test/stateful-resources.test.ts
./service-spec-importers/test/property-conversion.test.ts
./service-spec-importers/test/loading/format-patch-report.test.ts
./service-spec-importers/test/sam-resources.test.ts
./service-spec-importers/test/loading-docs.test.ts
./service-spec-importers/test/db-diff.test.ts
./service-spec-importers/test/cloudformation-registry.test.ts
./service-spec-importers/test/patches/registry-patches.test.ts
./service-spec-importers/test/patches/json-schema-patches.test.ts
./service-spec-importers/test/printable-tree.test.ts
./service-spec-importers/test/double-import.test.ts
./service-spec-importers/test/canned-metrics.test.ts
./service-spec-importers/test/resource-spec.test.ts
./service-spec-importers/test/patching/fp.test.ts

[github-actions]

@aws-cdk/aws-service-spec: Model database diff detected

└[~] service aws-sso
  └ resources
     ├[~] resource AWS::SSO::Assignment
     │ └  - scrutinizable: undefined
     │    + scrutinizable: SsoAssignmentResource
     ├[~] resource AWS::SSO::InstanceAccessControlAttributeConfiguration
     │ └  - scrutinizable: undefined
     │    + scrutinizable: SsoInstanceACAConfigResource
     └[~] resource AWS::SSO::PermissionSet
       └  - scrutinizable: undefined
          + scrutinizable: SsoPermissionSet