cmd_failing_validations = ['iascan -p tests/py/awsec2instances.py',
                            'iamscan asdf -p tests/py/awsec2instances.py',
                            'iamscan -p tests/py/awsec2instances.go']


cmd_passing_validations = ['iamscan -p tests/py/awsec2instances.py',
                            'iamscan --path iamscan -p tests/py/',
                            'iamscan --path iamscan -p tests/py/awsec2instances.py --output-format yaml',

                            'iamscan --help']



javascript_validations = [('athena.js', ['athena:GetQueryExecution', 'athena:GetQueryResults', 'athena:StartQueryExecution']),
    ('admin-disable-user.js', []),
    ('cwe_putrule.js', []),
    ('cw_enablealarmactions.js', ['cloudwatch:EnableAlarmActions', 'cloudwatch:PutMetricAlarm']),
    ('ddb_batchwriteitem.js', ['dynamodb:BatchWriteItem']),
    ('cwl_putsubscriptionfilter.js', []),
    ('ec2_createsecuritygroup.js', ['ec2:AuthorizeSecurityGroupIngress', 'ec2:CreateSecurityGroup', 'ec2:DescribeVpcs']),
    ('eb_putrule.js', []),
    ('getRealtimeMetrics.js', []),
    ('emc_getendpoint.js', []),
    ('kinesis-example.js', ['kinesis:PutRecords']),
    ('iam_createaccountalias.js', ['iam:CreateAccountAlias']),
    ('nodegetstarted.js', ['s3api:CreateBucket', 's3api:PutObject']),
    ('lambda-trigger-custom-message-admin-create-user.js', []),
    ('pinpoint_send_email_message_email_api.js', []),
    ('pinpoint_send_email_message_api.js', []),
    ('s3_deletebucketpolicy.js', ['s3api:DeleteBucketPolicy']),
    ('pinpoint_send_voice_message_sms_voice_api.js', []),
    ('s3_setbucketwebsite.js', ['s3api:PutBucketWebsite']),
    ('s3_getcors.js', ['s3api:GetBucketCors']),
    ('ses_createreceiptrule.js', []),
    ('secrets_getsecretvalue.js', ['secretsmanager:GetSecretValue']),
    ('sqs_changingvisibility.js', ['sqs:ChangeMessageVisibility', 'sqs:ReceiveMessage']),
    ('sns_settopicattributes.js', ['sns:SetTopicAttributes']),
    ('uploadArchive.js', ['glacier:UploadArchive']),
    ('sts_assumerole.js', ['sts:AssumeRole', 'sts:GetCallerIdentity']),
    ('writeLambdaFunction.js', ['dynamodb:GetItem']),
    ('widgets.js', ['s3api:DeleteObject', 's3api:GetObject', 's3api:ListObjectsV2', 's3api:PutObject']),
    ]



python_validations = [('awsec2instances.py', ['ec2:DescribeInstances', 'ec2:RebootInstances', 'ec2:RunInstances', 'ec2:StartInstances', 'ec2:StopInstances', 'ec2:TerminateInstances']),
    ('awslambdas3copy.py', []),
    ('awslambdas3move.py', ['s3api:DeleteObject']),
    ('lambdacreate.py', ['lambda:CreateFunction']),
    ('lambdadelete.py', ['lambda:DeleteFunction']),
    ('lambdalist.py', ['lambda:GetFunctionConfiguration']),
    ('lambdaupdate.py', ['lambda:UpdateFunctionCode', 'lambda:UpdateFunctionConfiguration']),
    ('s3copy.py', []),
    ('s3create.py', ['s3api:CreateBucket']),
    ('s3delete.py', ['s3api:DeleteBucket']),
    ('s3deleteobject.py', ['s3api:DeleteObject']),
    ('s3download.py', []),
    ('s3list.py', ['s3api:ListObjectsV2']),
    ('s3listall.py', ['s3api:ListBuckets', 's3api:ListObjectsV2']),
    ('s3move.py', ['s3api:DeleteObject']),
    ('s3upload.py', []),]


shell_validations = [('cloudfront-inprogress-status.sh', ['cloudfront:GetDistribution', 'cloudfront:ListDistributions']),
    ('cloudfront-invalidation-status.sh', ['cloudfront:GetInvalidation', 'cloudfront:ListDistributions', 'cloudfront:ListInvalidations']),
    ('cloudwatch-create-alarms-statuscheckfailed.sh', ['cloudwatch:DescribeAlarms', 'cloudwatch:PutMetricAlarm', 'ec2:DescribeInstances', 'ec2:DescribeRegions', 'ec2:DescribeTags']),
    ('cloudwatch-create-alarms-unhealthyhost.sh', ['cloudwatch:DescribeAlarms', 'cloudwatch:PutMetricAlarm', 'ec2:DescribeRegions', 'elb:DescribeLoadBalancers', 'elbv2:DescribeLoadBalancers', 'sns:ListTopics']),
    ('cloudwatch-create-alarms.sh', ['cloudwatch:PutMetricAlarm']),
    ('cloudwatch-logs-cleanup.sh', ['ec2:DescribeRegions', 'logs:DeleteLogGroup', 'logs:DescribeLogGroups', 'logs:DescribeLogStreams']),
    ('cloudwatch-logs-delete-groups.sh', ['ec2:DescribeRegions', 'logs:DeleteLogGroup', 'logs:DescribeLogGroups']),
    ('cloudwatch-logs-retention-policy.sh', ['ec2:DescribeRegions', 'logs:DescribeLogGroups', 'logs:PutRetentionPolicy']),
    ('cloudwatch-logs-search.sh', ['ec2:DescribeRegions', 'logs:DescribeLogGroups']),
    ('convert-iplist-cidr-json-array.sh', []),
    ('ec2-ami-encrypted-ebs-boot-volume.sh', ['ec2:CopyImage', 'ec2:CreateTags', 'ec2:DescribeImages', 'ec2:DescribeSnapshots', 'ssm:GetParameters', 'sts:GetCallerIdentity']),
    ('ec2-associate-elastic-ip.sh', ['ec2:AssociateAddress']),
    ('ec2-classic-import-network-acl.sh', ['ec2:CreateNetworkAclEntry']),
    ('ec2-ebs-create-snapshots.sh', ['ec2:CreateSnapshot', 'ec2:CreateTags', 'ec2:DescribeVolumes']),
    ('ec2-ebs-delete-snapshots.sh', ['ec2:DeleteSnapshot', 'ec2:DescribeSnapshots']),
    ('ec2-elb-export-template.sh', ['elb:ConfigureHealthCheck', 'elb:CreateLoadBalancer', 'elb:DescribeLoadBalancerAttributes', 'elb:DescribeLoadBalancers', 'elb:ModifyLoadBalancerAttributes', 'elb:RegisterInstancesWithLoadBalancer']),
    ('ec2-elb-upload-ssl-cert.sh', ['iam:UploadServerCertificate']),
    ('elastic-beanstalk-set-hostname-within-instance.sh', []),
    ('elastic-beanstalk-update-hostnames.sh', ['ec2:DescribeInstances', 'elasticbeanstalk:DescribeEnvironmentResources', 'elasticbeanstalk:DescribeEnvironments']),
    ('equality_test.sh', []),
    ('iam-create-s3-users.sh', ['iam:AddUserToGroup', 'iam:CreateAccessKey', 'iam:CreateUser', 'iam:PutUserPolicy']),
    ('install-awscli.sh', []),
    ('install-s3cmd.sh', []),
    ('route53-export-zones.sh', ['route53:ListHostedZones']),
    ('route53-record-set.sh', ['route53:ChangeResourceRecordSets']),
    ('s3-buckets-file-size-s3cmd.sh', []),
    ('s3-buckets-local-backup.sh', ['s3:GetObject', 's3:ListBucket', 's3:PutObject', 's3api:GetBucketLocation']),
    ('s3-buckets-security-audit.sh', ['s3:ListBucket', 's3api:GetBucketAcl', 's3api:GetBucketCors', 's3api:GetBucketLocation', 's3api:GetBucketPolicy', 's3api:GetBucketWebsite']),
    ('s3-buckets-total-file-size.sh', ['s3:ListBucket', 's3api:GetBucketLocation', 's3api:ListObjects']),
    ('s3-fix-content-type-metadata.sh', ['s3:GetObject', 's3:PutObject', 's3api:GetBucketLocation']),
    ('s3-open-bucket-policy.sh', ['s3api:GetBucketPolicy', 's3api:PutBucketPolicy']),
    ('s3-remove-glacier-objects.sh', ['s3:DeleteObject', 's3api:GetBucketLocation', 's3api:ListObjectsV2']),
    ('s3-restrict-bucket-policy.sh', ['s3api:GetBucketPolicy', 's3api:PutBucketPolicy']),
    ('s3-set-cache-control-max-age.sh', ['s3:GetObject', 's3:PutObject', 's3api:GetBucketLocation']),
    ('s3-setup-buckets.sh', ['s3api:CreateBucket', 's3api:PutBucketCors', 's3api:PutBucketTagging']),
    ('terraform-redact-iam-secrets.sh', []),
    ('vpc-eni-monitor.sh', ['ec2:DescribeNetworkInterfaces', 'ec2:DescribeVpcs', 's3:GetObject', 's3:PutObject']),
    ('vpc-sg-import-rules-cloudflare.sh', ['ec2:AuthorizeSecurityGroupIngress', 'ec2:CreateSecurityGroup', 'ec2:CreateTags', 'ec2:DeleteSecurityGroup', 'ec2:DescribeSecurityGroups']),
    ('vpc-sg-import-rules-cloudfront.sh', ['ec2:AuthorizeSecurityGroupIngress', 'ec2:CreateSecurityGroup', 'ec2:CreateTags', 'ec2:DeleteSecurityGroup', 'ec2:DescribeSecurityGroups', 'ec2:DescribeTags', 'ec2:DescribeVpcs']),
    ('vpc-sg-import-rules-pingdom.sh', ['ec2:AuthorizeSecurityGroupIngress', 'ec2:CreateSecurityGroup', 'ec2:CreateTags', 'ec2:DescribeSecurityGroups', 'ec2:DescribeTags', 'ec2:DescribeVpcs', 'ec2:RevokeSecurityGroupIngress']),
    ('vpc-sg-import-rules.sh', ['ec2:AuthorizeSecurityGroupIngress', 'ec2:CreateSecurityGroup', 'ec2:CreateTags', 'ec2:DescribeTags', 'ec2:DescribeVpcs'])      ,
    ('vpc-sg-merge-groups.sh', ['ec2:AuthorizeSecurityGroupEgress', 'ec2:AuthorizeSecurityGroupIngress', 'ec2:CreateSecurityGroup', 'ec2:CreateTags', 'ec2:DescribeSecurityGroups', 'ec2:DescribeTags', 'ec2:DescribeVpcs']),
    ('vpc-sg-rename-group.sh', ['ec2:AuthorizeSecurityGroupEgress', 'ec2:AuthorizeSecurityGroupIngress', 'ec2:CreateSecurityGroup', 'ec2:CreateTags', 'ec2:DescribeSecurityGroups', 'ec2:DescribeTags', 'ec2:DescribeVpcs', 'ec2:RevokeSecurityGroupEgress']),
    ('waf-export-ip-sets.sh', []),
    ('waf-import-ip-set-facebook.sh', ['ec2:CreateSecurityGroup', 'ec2:CreateTags', 'ec2:DescribeSecurityGroups', 'waf:UpdateIpSet']),
    ('waf-web-acl-pingdom.sh', ['ec2:CreateSecurityGroup', 'ec2:CreateTags', 'ec2:DescribeSecurityGroups', 'waf:UpdateIpSet', 'waf:UpdateRule', 'waf:UpdateWebAcl']),
    ]