Check for org ID restrictions in policies

[arielkr256]

Background

The policyuniverse library incorrectly considers policies with wildcard principals ("Principal": "*") as internet accessible, even when they have restrictive conditions like organization ID restrictions. The is_internet_accessible method in policyuniverse considers a policy statement internet accessible if ANY of its condition entries are internet accessible. ARN patterns with wildcards in the account number position (arn:aws:iam::*:role/...) are considered internet accessible by the _arn_internet_accessible method.

Changes

• Modified the policy_is_internet_accessible function in the aws_resource_made_public.py rule to add an additional check for policies with organization ID restrictions. If a statement has a wildcard principal but also has organization ID conditions, we consider it not internet accessible.
• Cleaned up the rule logic to be less complex and easier to understand.

Testing

• several new unit tests based on recent false positives

[arielkr256]

There is an open issue/PR in policyuniverse to address this issue, but seeing as it's been there for 2 years I don't know that it will be updated any time soon.

[LucySuddenly]

aws why are you like this

[LucySuddenly]

Limiting my approval to the following statement:

This appears to fix the incorrect trigger of this rule that I encountered a couple times recently