From 7ea663a055c9b773b005b1cf420a07ddf5d6b6cd Mon Sep 17 00:00:00 2001
From: Johan Herland <johan@herland.net>
Date: Tue, 1 Jul 2025 11:25:12 +0000
Subject: [PATCH] terraform-iam-policy-validator: init at 0.0.9

---
 .../package.nix                               | 49 +++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 pkgs/by-name/te/terraform-iam-policy-validator/package.nix

diff --git a/pkgs/by-name/te/terraform-iam-policy-validator/package.nix b/pkgs/by-name/te/terraform-iam-policy-validator/package.nix
new file mode 100644
index 000000000000..cf46752aaba0
--- /dev/null
+++ b/pkgs/by-name/te/terraform-iam-policy-validator/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "terraform-iam-policy-validator";
+  version = "0.0.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "awslabs";
+    repo = "terraform-iam-policy-validator";
+    tag = "v${version}";
+    hash = "sha256-RGZqnt2t+aSNGt8Ubi2dzZE04n9Zfkw+T3Zmol/FO+I=";
+  };
+
+  build-system = with python3Packages; [ poetry-core ];
+
+  dependencies = with python3Packages; [
+    boto3
+    pyyaml
+  ];
+
+  nativeCheckInputs = with python3Packages; [ pytestCheckHook ];
+
+  # Some tests require network
+  disabledTestPaths = [ "test/test_accessAnalyzer.py" ];
+
+  # Tests need to be run relative to a subdir
+  preCheck = ''
+    pushd iam_check
+  '';
+  postCheck = ''
+    popd
+  '';
+
+  pythonImportsCheck = [ "iam_check" ];
+
+  meta = {
+    description = "CLI tool that validates AWS IAM Policies in a Terraform template against AWS IAM best practices";
+    homepage = "https://github.com/awslabs/terraform-iam-policy-validator";
+    changelog = "https://github.com/awslabs/terraform-iam-policy-validator/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+    mainProgram = "tf-policy-validator";
+  };
+}