Privileges::determine_allowed should consider resources

[danielpops]

I think there's a bug here:

    def determine_allowed(self):
        [...]
        # Look at denied
        for stmt in self.stmts:
            if stmt['Effect'] == 'Deny':
                stmt_actions = self.get_actions_from_statement(stmt)
                for action in stmt_actions:
                    if action in actions:
                        del actions[action]

Consider the following policy statements, which gives:

• Full access (except for CreateBucket) to most buckets
• No access to one particular bucket

"Statement": [
                {
                    "Action": "s3:*",
                    "Effect": "Allow",
                    "Resource": "*"
                },
                {
                    "Action": "s3:CreateBucket",
                    "Effect": "Deny",
                    "Resource": "*"
                },
                {
                    "Action": "s3:*",
                    "Effect": "Deny",
                    "Resource": [
                        "arn:aws:s3:::super-sensitive-bucket",
                        "arn:aws:s3:::super-sensitive-bucket/*"
                    ]
                }

Expected:
The list of allowed actions should contain everything except s3:CreateBucket.
Actual:
The list of allowed actions is empty.

A naive solution could be to only delete the action key if the resource is * (or maybe something like it... like s3://*).

[0xdabbad00]

Looks like this is a motivator for me to implement #2 to use policyuniverse, which should solve this and similar issues for me.

[0xdabbad00]

Resolved in 20d5473