fix(restriction_policies): drop stale principals instead of skipping the whole policy (2/4)#630
Open
michael-richey wants to merge 1 commit into
Conversation
michael-richey
force-pushed
the
drop-unresolvable-principals-scaffolding
branch
from
7db6366 to
a7514ad
Compare
michael-richey
force-pushed
the
drop-unresolvable-principals-restriction-policies
branch
3 times, most recently
from
d71030b to
8a645fa
Compare
There was a problem hiding this comment.
Pull request overview
Adds drop-aware resource-connection behavior for restriction policies so that, when --drop-unresolvable-principals is enabled, principals missing from both source and destination are removed from bindings (instead of skipping the entire restriction policy), while still preserving the existing hard-fail behavior for “pending” (source-present, destination-missing) principals and for non-principal ID connections.
Changes:
- Override
RestrictionPolicies.connect_resources()to special-caseattributes.bindings.principalsand delegate principal filtering to the shared drop-aware binding helper. - Preserve the existing
id-based connection behavior (dashboards/SLOs/notebooks) via the genericfind_attr/connect_idpath. - Add a comprehensive unit test suite covering flag-off behavior, drop-and-continue behavior, hard-fail conditions, empty-binding risk/escalation behavior, and regression cases.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
datadog_sync/model/restriction_policies.py |
Overrides connect_resources() to drop stale principals per-binding while keeping generic ID connection logic unchanged. |
tests/unit/test_restriction_policies.py |
Adds unit tests validating drop/keep/hard-fail semantics, empty-binding escalation behavior, and key regressions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…the whole policy Overrides `connect_resources` so that, under `--drop-unresolvable-principals`, a principal absent from both destination and source state (permanently gone — e.g. a role deleted before the org's first-ever import) is dropped from its binding and the policy still syncs, instead of the entire restriction policy being skipped on a single dead reference. - Principals present in source but not destination keep today's hard-fail/retry behavior. - If dropping empties a binding whose source list was non-empty, the resource is still skipped and flagged as an access-elevation risk (ERROR + metric), governed by `--skip-failed-resource-connections` like any other connection failure. - The "id" (dashboard/slo/notebook) connections keep the generic path unchanged. - `extract_source_ids` is intentionally left unaffected (documented) so minimize-reads lazy-loading can still resolve which principals to check. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
michael-richey
force-pushed
the
drop-unresolvable-principals-restriction-policies
branch
from
8a645fa to
6213034
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Stacked PR 2 of 4. Base:
drop-unresolvable-principals-scaffolding(PR #629).This PR
Overrides
connect_resourcesonRestrictionPoliciesso that, under--drop-unresolvable-principals, a principal absent from both destination and source is dropped from its binding and the policy still syncs, instead of the whole restriction policy being skipped on a single dead reference.--skip-failed-resource-connections, the resource is skipped. With that flag enabled, the failure is intentionally suppressed and sync continues; an immediate ERROR explicitly saysDESTINATION RESOURCE MAY BE UNRESTRICTED, and the successful action receives the dedicated risk metric and end-of-run ERROR summary.extract_source_idsintentionally remains unaffected so--minimize-readslazy-loading can still resolve which principals to check.Testing
TestRestrictionPoliciesConnectResourcescovers flag off, drop-and-continue, source-present hard-fail, both empty-binding connection modes, metric/log propagation, multi-binding partial-empty, middle-element index-shift regression,extract_source_ids, org/non-composite pass-through, and dangling IDs. Focused tests green;ruffclean.