# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json --- principals: ddex_ingester_find_or_create_account: id: ff8b855a-b316-4f31-87db-415da0e02079 roles: - user attr: type: machine tenants: {} lambda_sme_ext_meta_generate_ddex: id: e02be40c-dfcf-4168-ac65-dbdae5b7d577 roles: - user attr: type: machine tenants: {} resources: new_subaccount_under_sme_account_is_distributor_omitted: id: new_subaccount_under_sme_account_is_distributor_omitted kind: subaccount attr: tenant: tenant_uuid: new_subaccount_under_sme_account_is_distributor_omitted tenant_type: account tenant_hierarchy: ["parent_company_1", "9b36a627-4be9-4762-b790-5628676f5f90"] new_subaccount_under_sme_account_is_distributor_Y: id: new_subaccount_under_sme_account_is_distributor_Y kind: subaccount attr: is_distributor: true tenant: tenant_uuid: new_subaccount_under_sme_account_is_distributor_Y tenant_type: account tenant_hierarchy: ["parent_company_1", "9b36a627-4be9-4762-b790-5628676f5f90"] new_subaccount_under_sme_account_is_distributor_N: id: new_subaccount_under_sme_account_is_distributor_N kind: subaccount attr: is_distributor: false tenant: tenant_uuid: new_subaccount_under_sme_account_is_distributor_N tenant_type: account tenant_hierarchy: ["parent_company_1", "9b36a627-4be9-4762-b790-5628676f5f90"] new_subaccount_under_orchard_account_is_distributor_Y: id: new_subaccount_under_orchard_account_is_distributor_Y kind: subaccount attr: is_distributor: true tenant: tenant_uuid: new_subaccount_under_orchard_account_is_distributor_Y tenant_type: account tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"] new_subaccount_under_orchard_account_is_distributor_N: id: new_subaccount_under_orchard_account_is_distributor_N kind: subaccount attr: is_distributor: false tenant: tenant_uuid: new_subaccount_under_orchard_account_is_distributor_N tenant_type: account tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"] new_subaccount_under_some_distributor: id: new_subaccount_under_some_distributor kind: subaccount attr: is_distributor: true tenant: tenant_uuid: new_subaccount_under_some_distributor tenant_type: account tenant_hierarchy: ["parent_company_1"] new_subaccount_under_sme_distributor_that_is_not_an_account_tenant_type: id: new_subaccount_under_sme_distributor_that_is_not_an_account_tenant_type kind: subaccount attr: is_distributor: true tenant: tenant_uuid: new_subaccount_under_sme_distributor_that_is_not_an_account_tenant_type tenant_type: subaccount tenant_hierarchy: ["parent_company_1", "9b36a627-4be9-4762-b790-5628676f5f90"] new_subaccount_under_distributor_without_tenant_hierarchy: id: new_subaccount_under_distributor_without_tenant_hierarchy kind: subaccount attr: is_distributor: true tenant: tenant_uuid: d6455851-3f86-48d8-b102-8d996eb92645 tenant_type: account name: SubaccountTestSuite description: Tests for verifying the Subaccount resource policy tests: - name: Machine usage input: principals: - ddex_ingester_find_or_create_account - lambda_sme_ext_meta_generate_ddex resources: - new_subaccount_under_sme_account_is_distributor_omitted - new_subaccount_under_sme_account_is_distributor_Y - new_subaccount_under_sme_account_is_distributor_N - new_subaccount_under_some_distributor - new_subaccount_under_sme_distributor_that_is_not_an_account_tenant_type - new_subaccount_under_distributor_without_tenant_hierarchy actions: - create - view_sony_financial_metadata - delete expected: - principal: ddex_ingester_find_or_create_account resources: - new_subaccount_under_sme_account_is_distributor_omitted - new_subaccount_under_sme_account_is_distributor_N - new_subaccount_under_some_distributor - new_subaccount_under_sme_distributor_that_is_not_an_account_tenant_type actions: create: EFFECT_DENY view_sony_financial_metadata: EFFECT_DENY delete: EFFECT_DENY - principal: ddex_ingester_find_or_create_account resources: - new_subaccount_under_sme_account_is_distributor_Y actions: create: EFFECT_ALLOW view_sony_financial_metadata: EFFECT_DENY delete: EFFECT_DENY - principal: lambda_sme_ext_meta_generate_ddex resources: - new_subaccount_under_sme_account_is_distributor_omitted - new_subaccount_under_sme_account_is_distributor_N - new_subaccount_under_some_distributor - new_subaccount_under_sme_distributor_that_is_not_an_account_tenant_type - new_subaccount_under_sme_account_is_distributor_Y - new_subaccount_under_distributor_without_tenant_hierarchy actions: create: EFFECT_DENY view_sony_financial_metadata: EFFECT_ALLOW delete: EFFECT_DENY - name: a360 input: principals: - raed - jess - melissa - abacus_readonly_user resources: - new_subaccount_under_sme_account_is_distributor_Y - new_subaccount_under_sme_account_is_distributor_N - new_subaccount_under_orchard_account_is_distributor_Y - new_subaccount_under_orchard_account_is_distributor_N - new_subaccount_under_sme_account_is_distributor_omitted - new_subaccount_under_distributor_without_tenant_hierarchy actions: - create - view_sony_financial_metadata - delete expected: - principal: raed resources: - new_subaccount_under_sme_account_is_distributor_Y - new_subaccount_under_sme_account_is_distributor_N - new_subaccount_under_sme_account_is_distributor_omitted actions: create: EFFECT_DENY view_sony_financial_metadata: EFFECT_DENY delete: EFFECT_DENY - principal: raed resource: new_subaccount_under_orchard_account_is_distributor_N actions: create: EFFECT_DENY view_sony_financial_metadata: EFFECT_DENY delete: EFFECT_ALLOW - principal: raed resource: new_subaccount_under_orchard_account_is_distributor_Y actions: create: EFFECT_ALLOW view_sony_financial_metadata: EFFECT_DENY delete: EFFECT_ALLOW - principal: jess resources: - new_subaccount_under_sme_account_is_distributor_Y - new_subaccount_under_sme_account_is_distributor_N - new_subaccount_under_orchard_account_is_distributor_Y - new_subaccount_under_orchard_account_is_distributor_N - new_subaccount_under_sme_account_is_distributor_omitted - new_subaccount_under_distributor_without_tenant_hierarchy actions: create: EFFECT_DENY view_sony_financial_metadata: EFFECT_DENY delete: EFFECT_DENY - principal: melissa resources: - new_subaccount_under_sme_account_is_distributor_Y - new_subaccount_under_sme_account_is_distributor_N - new_subaccount_under_orchard_account_is_distributor_Y - new_subaccount_under_orchard_account_is_distributor_N - new_subaccount_under_sme_account_is_distributor_omitted actions: create: EFFECT_DENY view_sony_financial_metadata: EFFECT_DENY delete: EFFECT_DENY - principal: melissa resource: new_subaccount_under_distributor_without_tenant_hierarchy actions: create: EFFECT_ALLOW view_sony_financial_metadata: EFFECT_DENY delete: EFFECT_ALLOW - principal: abacus_readonly_user resources: - new_subaccount_under_sme_account_is_distributor_Y - new_subaccount_under_sme_account_is_distributor_N - new_subaccount_under_orchard_account_is_distributor_Y - new_subaccount_under_orchard_account_is_distributor_N - new_subaccount_under_sme_account_is_distributor_omitted - new_subaccount_under_distributor_without_tenant_hierarchy actions: create: EFFECT_DENY view_sony_financial_metadata: EFFECT_DENY delete: EFFECT_DENY