Add trust policy severity caching to avoid repeated list scans

Streamlined the trust policy aggregation to eliminate repeated loops over statements and cache the severity filter before building
findings to improve performance.

Author: bhendo

cloudsplaining/scan/assume_role_policy_document.py

@@ -54,38 +54,42 @@ def __init__(
     @property
     def role_assumable_by_compute_services(self) -> list[str]:
         """Determines whether or not the role is assumed from a compute service, and if so which ones."""
-        assumable_by_compute_services = []
-        for statement in self.statements:
-            if statement.role_assumable_by_compute_services:
-                assumable_by_compute_services.extend(statement.role_assumable_by_compute_services)
-        return assumable_by_compute_services
+        return [
+            principal
+            for statement in self.statements
+            if statement.role_assumable_by_compute_services
+            for principal in statement.role_assumable_by_compute_services
+        ]
 
     @property
     def role_assumable_by_cross_account_principals(self) -> list[str]:
         """Determines whether or not the role can be assumed from principals in other accounts, and if so which ones."""
-        assumable_from_other_accounts = []
-        for statement in self.statements:
-            if statement.role_assumable_by_cross_account_principals:
-                assumable_from_other_accounts.extend(statement.role_assumable_by_cross_account_principals)
-        return assumable_from_other_accounts
+        return [
+            principal
+            for statement in self.statements
+            if statement.role_assumable_by_cross_account_principals
+            for principal in statement.role_assumable_by_cross_account_principals
+        ]
 
     @property
     def role_assumable_by_any_principal(self) -> list[str]:
         """Determines whether or not the role can be assumed by any principal (*) or any AWS account root."""
-        any_principals = []
-        for statement in self.statements:
-            if statement.role_assumable_by_any_principal:
-                any_principals.extend(statement.role_assumable_by_any_principal)
-        return any_principals
+        return [
+            principal
+            for statement in self.statements
+            if statement.role_assumable_by_any_principal
+            for principal in statement.role_assumable_by_any_principal
+        ]
 
     @property
     def role_assumable_by_any_principal_with_conditions(self) -> list[str]:
         """Determines whether or not the role can be assumed by any principal (*) or any AWS account root with conditions."""
-        any_principals_with_conditions = []
-        for statement in self.statements:
-            if statement.role_assumable_by_any_principal_with_conditions:
-                any_principals_with_conditions.extend(statement.role_assumable_by_any_principal_with_conditions)
-        return any_principals_with_conditions
+        return [
+            principal
+            for statement in self.statements
+            if statement.role_assumable_by_any_principal_with_conditions
+            for principal in statement.role_assumable_by_any_principal_with_conditions
+        ]
 
 
 class AssumeRoleStatement(ResourceStatement):

cloudsplaining/scan/role_details.py

@@ -352,6 +352,7 @@ def json(self) -> dict[str, Any]:
         )
 
         if self.flag_trust_policies:
+            severities = {x.lower() for x in self.severity}
             this_role_detail.update(
                 {
                     "AssumableByComputeServices": {
@@ -360,10 +361,7 @@ def json(self) -> dict[str, Any]:
                         "findings": (
                             self.assume_role_policy_document.role_assumable_by_compute_services
                             if self.assume_role_policy_document
-                            and (
-                                ISSUE_SEVERITY["AssumableByComputeService"] in [x.lower() for x in self.severity]
-                                or not self.severity
-                            )
+                            and (ISSUE_SEVERITY["AssumableByComputeService"] in severities or not self.severity)
                             else []
                         ),
                     },
@@ -373,10 +371,7 @@ def json(self) -> dict[str, Any]:
                         "findings": (
                             self.assume_role_policy_document.role_assumable_by_cross_account_principals
                             if self.assume_role_policy_document
-                            and (
-                                ISSUE_SEVERITY["AssumableByCrossAccountPrincipal"] in [x.lower() for x in self.severity]
-                                or not self.severity
-                            )
+                            and (ISSUE_SEVERITY["AssumableByCrossAccountPrincipal"] in severities or not self.severity)
                             else []
                         ),
                     },
@@ -386,10 +381,7 @@ def json(self) -> dict[str, Any]:
                         "findings": (
                             self.assume_role_policy_document.role_assumable_by_any_principal
                             if self.assume_role_policy_document
-                            and (
-                                ISSUE_SEVERITY["AssumableByAnyPrincipal"] in [x.lower() for x in self.severity]
-                                or not self.severity
-                            )
+                            and (ISSUE_SEVERITY["AssumableByAnyPrincipal"] in severities or not self.severity)
                             else []
                         ),
                     },
@@ -400,8 +392,7 @@ def json(self) -> dict[str, Any]:
                             self.assume_role_policy_document.role_assumable_by_any_principal_with_conditions
                             if self.assume_role_policy_document
                             and (
-                                ISSUE_SEVERITY["AssumableByAnyPrincipalWithConditions"]
-                                in [x.lower() for x in self.severity]
+                                ISSUE_SEVERITY["AssumableByAnyPrincipalWithConditions"] in severities
                                 or not self.severity
                             )
                             else []