fix incorrect actions when querying for catalog resources

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ permissions:
 
 env:
   JUST_VERSION: '1'
-  PREK_VERSION: '0.2.12'
+  PREK_VERSION: '0.2.13'
   TERRAFORM_VERSION: '1.13'
 
 jobs:

policy_sentry/querying/actions.py

@@ -239,6 +239,8 @@ def get_actions_with_arn_type_and_access_level(
                 results.extend(actions)
     else:
         service_prefix_data = get_service_prefix_data(service_prefix)
+        # mainly needed for the use case of `catalog` -> `servicecatalog` mapping
+        service_prefix = service_prefix_data["prefix"]
         for action_name, action_data in service_prefix_data["privileges"].items():
             if (
                 action_data["access_level"] == access_level

pyproject.toml

@@ -46,7 +46,7 @@ Twitter = "https://twitter.com/kmcquade3"
 dev = [
     "coverage>=7.11.0,<8.0.0",
     "mypy>=1.18.0,<2.0.0",
-    "prek>=0.2.10,<0.3.0",
+    "prek>=0.2.13,<0.3.0",
     "pytest>=8.4.0,<9.0.0",
     "rust-just>=1.43.0,<2.0.0",
     "types-beautifulsoup4>=4.12.0,<5.0.0",

test/querying/test_query_actions.py

@@ -346,6 +346,13 @@ def test_get_actions_with_arn_type_and_access_level_case_5(self):
         output = get_actions_with_arn_type_and_access_level("s3", "object", "List")
         self.assertTrue("s3:ListMultipartUploadParts" in output)
 
+    def test_get_actions_with_arn_type_and_access_level_servicecatalog(self):
+        # querying with `catalog` as a service prefix should yield `servicecatalog` as an action prefix
+        # https://github.com/salesforce/policy_sentry/issues/563
+
+        output = get_actions_with_arn_type_and_access_level("catalog", "Portfolio", "List")
+        self.assertIn("servicecatalog:ListPortfolioAccess", output)
+
     def test_get_actions_matching_arn_type_case_1(self):
         """querying.actions.get_actions_matching_arn_type"""
         expected_results = [