I have a single role policy

"rolePolicy": {
        "role": "ug_132e420282a146868644925b2c591034",
        "parentRoles": [
          "inventory_sessions_read",
          "monitoring_dashboard_read"
        ],
        "scope": "bcaa9a67-5600-47a8-8bef-006a7105f974.data",
        "rules": [
          {
            "resource": "*",
            "allowActions": [
              "*"
            ],
            "condition": {
              "match": {
                "all": {
                  "of": [
                    {
                      "expr": "request.resource.attr.region in [\"west\"]"
                    }
                  ]
                }
              }
            }
          }
        ]
      }

Now I send a plan resources call and the response is

"filterDebug": "(eq request.resource.attr.region \"west\")"

Now if I have a second policy

"rolePolicy": {
        "role": "ug_132e420282a146868644925b2c591666",
        "parentRoles": [
          "inventory_sessions_read",
          "monitoring_dashboard_read"
        ],
        "scope": "bcaa9a67-5600-47a8-8bef-006a7105f974.data",
        "rules": [
          {
            "resource": "*",
            "allowActions": [
              "*"
            ],
            "condition": {
              "match": {
                "all": {
                  "of": [
                    {
                      "expr": "request.resource.attr.region in [\"east\"]"
                    }
                  ]
                }
              }
            }
          }
        ]
      }

If I send a planresources request with both roles as input, I get a weird double negative response:

"filterDebug": "(not (or (not (eq request.resource.attr.region \"east\")) (not (eq request.resource.attr.region \"west\"))))"

Is that a bug? My expectation was

"filterDebug": "(or (eq request.resource.attr.region \"east\") (eq request.resource.attr.region \"west\"))"

Thanks for this. There is a fix pending review. The double negative is actually expected. Role policy rules behave differently to resource policies; when you define a role policy rule, it's effectively saying: • The allowable actions defined for this resource are the only allowable actions for this resource (they act like an allow-list, implicitly denying anything else). • There must be a matching rule in a resource policy (in this scope or a parent scope) that also issues an allow. In order to evaluate both of these rule types together, a role policy rule is effectively "negated" (hence the

not (not (eq FOO))

), but I was incorrectly combining those specific rules with all other "normal" ones, hence the

or (not (eq FOO)) (not (eq BAR))

(the

or

being the culprit). I've made a change to separate this handling. The produced output will now be:

"filterDebug": "(not (and (not (eq request.resource.attr.region \"east\")) (not (eq request.resource.attr.region \"west\"))))"

Note the

and

rather than the

or

. This seems a bit convoluted, but is logically equivalent to your expected result of:

"filterDebug": "(or (eq request.resource.attr.region \"east\") (eq request.resource.attr.region \"west\"))"

Not the first time in my life I've been De Morgan'd 🙃. Thanks again.

Hi folks, Following up with this: do you know when we might be able to expect the release for this fix?