@actsecurity/iam-collect 0.1.215

package/README.md

@@ -0,0 +1,188 @@
+# iam-collect
+
+[![NPM Version](https://img.shields.io/npm/v/@cloud-copilot/iam-collect.svg?logo=nodedotjs)](https://www.npmjs.com/package/@cloud-copilot/iam-collect) [![License: AGPL v3](https://img.shields.io/github/license/cloud-copilot/iam-collect)](LICENSE.txt) [![GuardDog](https://github.com/cloud-copilot/iam-collect/actions/workflows/guarddog.yml/badge.svg)](https://github.com/cloud-copilot/iam-collect/actions/workflows/guarddog.yml) [![Known Vulnerabilities](https://snyk.io/test/github/cloud-copilot/iam-collect/badge.svg?targetFile=package.json&style=flat-square)](https://snyk.io/test/github/cloud-copilot/iam-collect?targetFile=package.json)
+
+Get every possible policy in any set of AWS accounts. This is built to run out of the box in simple use cases, and also work in terribly oppressive environments with a little more configuration. If you want to analyze IAM data at scale this is what you've been looking for.
+
+## Table of Contents
+
+1. [Tenets](#iam-collect-tenets)
+2. [Introduction](#introduction)
+3. [Getting Started](#getting-started)
+4. [Using Your Data](#using-your-data)
+5. [Configuration](docs/Configuration.md)
+6. [Authentication](docs/Authentication.md)
+7. [Storage](docs/Storage.md)
+8. [Filtering](docs/Filtering.md)
+9. [Indexing](docs/Indexing.md)
+10. [CLI](docs/CLI.md)
+11. [History](docs/History.md)
+12. [Supported Services and Data](#supported-services-and-data)
+13. [Using AWS Config as a Data Source](docs/AwsConfig.md)
+14. [Deploying iam-collect at Scale with Terraform](infrastructure_as_code/terraform/README.md)
+
+## iam-collect Tenets
+
+1. _Centralized_ Store [all your data](#supported-services-and-data) across all partitions, organizations, accounts, and regions in one place. This is a single source of truth for all your IAM data.
+2. _Easy_ A few commands and you can get started and everything should just work. If resources no longer exist, data is cleaned up automatically.
+3. _Configurable_ Store your data on [disk or in S3](docs/Storage.md). You can configure exactly what [accounts, regions, and services](docs/Filtering.md) you want to collect data for; and [customize auth](docs/Authentication.md) for each.
+
+## Introduction
+
+### What is iam-collect?
+
+iam-collect is a command-line tool that aggregates every IAM-related resource and policy across any number of AWS accounts, regions, and partitions into a single, consistent dataset. It requires minimal setup for simple use cases and allows flexible configuration to operate in even the most restrictive (compliance oriented) environments to give you a single source of truth for your IAM data.
+
+### Why use it?
+
+- **Centralized store:** Consolidate IAM data from multiple partitions, organizations, and accounts into one structured store.
+- **Get everything:** Collect all the polices from all the resources in all your accounts. Terraform will show you what was intended, iam-collect will show you what is actually there.
+- **Audit and compliance:** Generate comprehensive snapshots of your IAM landscape to support security reviews, audits, and forensics. The structured approach to storage makes it easy to build automation and tooling around the data.
+
+### How it works at a glance
+
+Every time you run `iam-collect download` it will:
+
+1. **Scan:** Connect to AWS account(s) using your configured credentials or roles and retrieve IAM resources (users, roles, policies, etc.) from each target account.
+2. **Store:** Persist the data to your chosen storage (local filesystem or S3), organizing it by partition, account, service, and resource.
+3. **Index:** Build search-friendly JSON indexes that map resources to accounts and other relationships for fast lookups.
+
+Then you use the data to analyze your IAM landscape, build reports, or integrate with other tools.
+
+## Getting Started
+
+By default, iam-collect will use the credentials configured in your environment using the [default credential chain](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-credential-providers/#fromnodeproviderchain). If you have the permissions in the SID `CollectIAMData` in the [example policy](src/aws/collect-policy.json) everything will work for the current account you have credentials for.
+
+You don't need the AWS CLI, but a good way to make sure your credentials are configured is to ensure you can run `aws sts get-caller-identity` and a command that requires a region be set such as `aws ec2 describe-instances`.
+
+```bash
+npm install -g @cloud-copilot/iam-collect
+# Create a default configuration file
+iam-collect init
+# Download iam data from the current account to `./iam-data`
+iam-collect download
+```
+
+### Install
+
+You need Node.js >= 20.
+
+```bash
+npm install -g @cloud-copilot/iam-collect
+```
+
+### Initialize
+
+```bash
+iam-collect init
+```
+
+This will create a file called `iam-collect.jsonc` in the current directory with a simple default configuration and many comments on how to customize the configuration.
+
+### Download
+
+```bash
+iam-collect download
+```
+
+This will download the IAM data from the current account to the `./iam-data` directory. You can change the output directory by modifying the `storage.path` property in the configuration. See the [storage docs](docs/Storage.md) for more details.
+
+### Enjoy
+
+```bash
+ls -R ./iam-data
+```
+
+This will show you your data that was downloaded. See the [storage docs](docs/Storage.md#storage-layout-explained) for more details on the layout of the data.
+
+## Additional Docs
+
+- [Configuration](docs/Configuration.md) - Set the configuration files to use.
+- [Authentication](docs/Authentication.md) - Configure authentication for different accounts, services, and regions.
+- [Storage](docs/Storage.md) - Configure where your data is stored.
+- [Filtering](docs/Filtering.md) - Configure what accounts, services, and regions are downloaded.
+- [Indexing](docs/Indexing.md) - Disable or manually run indexing.
+- [CLI](docs/CLI.md) - Details on the CLI commands and options.
+- [History](docs/History.md) - How to track history of changes.
+
+## Using Your Data
+
+### iam-lens
+
+To explore effective access in your environment check out [iam-lens](https://github.com/cloud-copilot/iam-lens). iam-lens reads your iam-collect data to answer questions like: "Who can access this resource?", "Who can assume this role?", and "Does this principal have access to this bucket?"
+
+### Leveraging Your AI
+
+Use [AgentInstructions.md](docs/AgentInstructions.md) to help your AI understand the data and how to interrogate it.
+
+```bash
+curl -O https://raw.githubusercontent.com/cloud-copilot/iam-collect/main/docs/AgentInstructions.md
+```
+
+Then you can start asking questions like "Using AgentInstructions.md as context...":
+
+- Do I have any roles that have "\*" in the trust policy?
+- Which users have the "AdministratorAccess" managed policy attached?
+- What RAM shares are sharing resources outside of my organization?
+- Are there any S3 buckets without block public access enabled?
+
+You can also ask your AI to generate scripts to predictably and scalably answer these same questions for you.
+
+## Additional Data Sources
+
+By default, iam-collect collects data directly from AWS service APIs.
+
+If you prefer, you can configure iam-collect to pull data from AWS Config instead. See the [AWS Config data source documentation](docs/AwsConfig.md) for details.
+
+## Supported Services and Data
+
+| Service           | Resource Type                     | Data Downloaded                                                                                                                     |
+| ----------------- | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| iam               | Users                             | name, path, id, groups, tags, inline policies, managed policies, permission boundary                                                |
+| iam               | Groups                            | name, path, id, inline policies, managed policies                                                                                   |
+| iam               | Roles                             | name, path, id, trust policy, inline policies, managed policies, instance profiles, tags (excluded by default), permission boundary |
+| iam               | Customer and AWS Managed Policies | name, path, id, default version, default version doc, tags                                                                          |
+| iam               | OIDC Providers                    | audiences, thumbprints, url, tags                                                                                                   |
+| iam               | SAML Providers                    | metadata document, uuid, private keys, valid until, tags                                                                            |
+| iam               | Instance Profiles                 | name, roles, id, path, tags                                                                                                         |
+| apigateway        | Rest APIs                         | id, name, policy, tags                                                                                                              |
+| backup            | Backup Vaults                     | name, key, tags, policy                                                                                                             |
+| dynamodb          | Streams                           | name, region, resource policy                                                                                                       |
+| dynamodb          | Tables                            | name, region, tags, resource policy                                                                                                 |
+| ecr               | Repositories                      | name, region, tags, resource policy, key id                                                                                         |
+| ecr               | Registries                        | policy                                                                                                                              |
+| ec2               | VPC Endpoints                     | id, name, type, vpc, policy                                                                                                         |
+| eks               | Clusters                          | name, authentication mode, tags                                                                                                     |
+| eks               | Access Entries                    | cluster, principal, username, type, kubernetes groups, associated access policies, tags                                             |
+| elasticfilesystem | File Systems                      | name, id, key, encryption, tags, policy                                                                                             |
+| es                | OpenSearch Domains                | name, policy, tags, KMS key id                                                                                                      |
+| events            | Event Buses                       | name, key id, policy, tags                                                                                                          |
+| glacier           | Vaults                            | name, region, tags, policy                                                                                                          |
+| glue              | Root Catalogs                     | policy                                                                                                                              |
+| kafka             | MSK Clusters                      | name, policy, kms key, tags                                                                                                         |
+| kinesis           | Data Streams                      | name, encryption type, key id, policy, tags                                                                                         |
+| kms               | Keys                              | id, policy, tags                                                                                                                    |
+| lambda            | Functions                         | name, role, tags, policy                                                                                                            |
+| lambda            | Function Aliases                  | name, role, alias, version, policy                                                                                                  |
+| lambda            | Layer Versions                    | name, version, policy                                                                                                               |
+| ram               | Shared Resources                  | resource shares, resource policy                                                                                                    |
+| s3                | Access Points                     | name, bucket, bucket account, policy, block public access configuration, network origin, vpc, alias, endpoints                      |
+| s3                | Buckets                           | name, region, tags, policy, block public access configuration, default encryption                                                   |
+| s3                | Multi Region Access Points        | name, alias, regions, policy, block public access configuration                                                                     |
+| s3-object-lambda  | Object Lambda Access Points       | name, alias, policy, block public access configuration                                                                              |
+| s3express         | Directory Buckets                 | name, encryption settings, policy                                                                                                   |
+| s3express         | Directory Bucket Access Points    | name, bucket, bucket account, policy, block public access configuration, network origin, vpc, alias, endpoints                      |
+| s3outposts        | Outpost Buckets                   | name, region, tags, policy                                                                                                          |
+| s3outposts        | Outpost Access Points             | name, bucket, bucket account, policy, network origin, vpc                                                                           |
+| s3tables          | Table Buckets                     | name, region, bucket policy, encryption                                                                                             |
+| organizations     | Organizations                     | id, root account id, enabled policy types, org structure, delegated administrators                                                  |
+| organizations     | Organizational Units              | id, parent ou, enabled SCPs, enabled RCPs, tags                                                                                     |
+| organizations     | Accounts                          | id, parent ou, enabled SCPs, enabled RCPs, tags                                                                                     |
+| organizations     | SCPs, RCPs, S3 Policies           | id, name, description, tags, policy                                                                                                 |
+| sns               | Topics                            | name, tags, kms key id, policy                                                                                                      |
+| sqs               | Queues                            | name, tags, kms key id, policy                                                                                                      |
+| secretsmanager    | Secrets                           | name, tags, kms key id, policy                                                                                                      |
+| sso               | Instances                         | id, name, owner account id, status, tags                                                                                            |
+| sso               | Permission Sets                   | name, description, AWS managed policies, customer managed policies, inline policy, permission boundary, accounts, tags              |
+
+If you don't see the data you are looking for, please check the [open resource issues](https://github.com/cloud-copilot/iam-collect/issues?q=is%3Aissue%20state%3Aopen%20label%3Aresource) and comment on the issue or create a new one.

package/dist/cjs/analysis/analyze.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Analyze the provided log file for job execution times and incomplete jobs.
+ *
+ * @param logFilePath the path to the log file to analyze
+ * @returns true if all jobs completed successfully, false if there are incomplete jobs
+ */
+export declare function conductLogAnalysis(logFilePath: string): Promise<boolean>;
+//# sourceMappingURL=analyze.d.ts.map

package/dist/cjs/analysis/analyze.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze.d.ts","sourceRoot":"","sources":["../../../src/analysis/analyze.ts"],"names":[],"mappings":"AAsFA;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAoB9E"}

package/dist/cjs/analysis/analyze.js

@@ -0,0 +1,116 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.conductLogAnalysis = conductLogAnalysis;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+function keyToString(k) {
+    return [k.service, k.accountId, k.region, k.sync].join('|');
+}
+function stringToKey(s) {
+    const [service, accountId, region, sync] = s.split('|');
+    return { service, accountId, region, sync };
+}
+function parseLogs(filePath) {
+    const raw = fs.readFileSync(filePath, 'utf8');
+    return raw
+        .split('\n')
+        .filter((line) => line.trim().length > 0)
+        .map((line) => JSON.parse(line));
+}
+function analyzeJobs(entries) {
+    const startTimes = new Map();
+    const finishTimes = new Map();
+    const fmt = (ts) => new Date(ts);
+    for (const e of entries) {
+        const keyProps = {
+            service: e.service,
+            accountId: e.accountId,
+            region: e.region ?? '', // global jobs will have empty region
+            sync: e.sync
+        };
+        // only consider entries with a full set of job identifiers
+        if (!keyProps.service || !keyProps.accountId || !keyProps.sync) {
+            continue;
+        }
+        const keyStr = keyToString(keyProps);
+        const when = fmt(e.timestamp);
+        if (e.message.includes('Executing') && e.message.includes('sync')) {
+            // first start time wins
+            if (!startTimes.has(keyStr)) {
+                startTimes.set(keyStr, when);
+            }
+        }
+        else if (e.message.includes('Finished') && e.message.includes('sync')) {
+            finishTimes.set(keyStr, when);
+        }
+    }
+    // 1) Jobs that started but didn't finish
+    const incomplete = Array.from(startTimes.keys())
+        .filter((k) => !finishTimes.has(k))
+        .map(stringToKey);
+    // 2) Compute durations for completed jobs
+    const durations = Array.from(startTimes.entries())
+        .filter(([k]) => finishTimes.has(k))
+        .map(([k, start]) => {
+        const finish = finishTimes.get(k);
+        const deltaSec = (finish.getTime() - start.getTime()) / 1000;
+        return { ...stringToKey(k), durationSec: deltaSec };
+    });
+    return { incomplete, durations };
+}
+/**
+ * Analyze the provided log file for job execution times and incomplete jobs.
+ *
+ * @param logFilePath the path to the log file to analyze
+ * @returns true if all jobs completed successfully, false if there are incomplete jobs
+ */
+async function conductLogAnalysis(logFilePath) {
+    const logFile = path.resolve(logFilePath);
+    const entries = parseLogs(logFile);
+    const { incomplete, durations } = analyzeJobs(entries);
+    if (incomplete.length > 0) {
+        console.log('\n🔴 Incomplete Jobs:');
+        incomplete.forEach((j) => {
+            console.log(`  • ${j.service} | ${j.accountId} | ${j.region} | ${j.sync}`);
+        });
+    }
+    console.log('\n⏱️  Job Durations (seconds):');
+    durations.forEach((d) => {
+        console.log(`  • ${d.service} | ${d.accountId} | ${d.region} | ${d.sync}: ${d.durationSec.toFixed(3)}s`);
+    });
+    return incomplete.length === 0;
+}
+//# sourceMappingURL=analyze.js.map

package/dist/cjs/analysis/analyze.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../../../src/analysis/analyze.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,gDAoBC;AAhHD,uCAAwB;AACxB,2CAA4B;AAsB5B,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,CAAY;IAC/B,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7C,OAAO,GAAG;SACP,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,OAAmB;IACtC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmB,CAAA;IAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmB,CAAA;IAC9C,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;IAExC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAoB;YAChC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,qCAAqC;YAC7D,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAA;QACD,2DAA2D;QAC3D,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/D,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,QAAkB,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAE7B,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClE,wBAAwB;YACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAClC,GAAG,CAAC,WAAW,CAAC,CAAA;IAEnB,0CAA0C;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAE,CAAA;QAClC,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAA;QAC5D,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAA;IACrD,CAAC,CAAC,CAAA;IAEJ,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;AAClC,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IAEtD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;QACpC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;IAC7C,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC5F,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAA;AAChC,CAAC"}

package/dist/cjs/aws/ClientPool.d.ts

@@ -0,0 +1,49 @@
+import type { Client } from '@smithy/smithy-client';
+import { type AwsService } from '../services.js';
+import { type AwsCredentialProviderWithMetaData } from './coreAuth.js';
+export type ClientConstructor<T> = new (args: any) => T;
+export type AnyClient = Client<any, any, any, any>;
+export declare class AwsClientPool {
+    static defaultInstance: AwsClientPool;
+    private clientCache;
+    private defaultRetryStrategy;
+    constructor();
+    /**
+     * Returns a client of the specified type with the specified credentials and region.
+     * Will create a new client if one does not already exist in the cache.
+     *
+     * @param ClientType The client constructor to create an instance of.
+     * @param credentials The credentials to use for the client.
+     * @param region The region to use for the client.
+     * @returns A client of the specified type with the specified credentials and region.
+     */
+    client<T extends AnyClient>(ClientType: ClientConstructor<T>, credentials: AwsCredentialProviderWithMetaData, region: string | undefined, endpoint: string | undefined): T;
+    private getCacheKey;
+    /**
+     * Destroys all clients in the pool and empties the cache.
+     *
+     * NOT THREAD SAFE, this should only be called when all other operations are complete.
+     */
+    clear(): void;
+    /**
+     * Do any async initialization required for the client pool. Should be called
+     * before the first use of the pool.
+     */
+    init(): Promise<void>;
+    /**
+     * Whether this client pool requires valid AWS credentials for each instance.
+     */
+    requiresAwsCredentials(): boolean;
+    /**
+     * Determine if a given sync is supported by this client pool for the given service and region.
+     *
+     * @param service the AWS service
+     * @param syncName the name of the sync operation
+     * @param region the AWS region
+     * @returns true if the sync is supported, false otherwise
+     */
+    isSyncSupported(service: AwsService, syncName: string, region: string): boolean;
+    private retryStrategyForClient;
+    private makeRetryStrategy;
+}
+//# sourceMappingURL=ClientPool.d.ts.map

package/dist/cjs/aws/ClientPool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientPool.d.ts","sourceRoot":"","sources":["../../../src/aws/ClientPool.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAMnD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,KAAK,iCAAiC,EAAE,MAAM,eAAe,CAAA;AAEtE,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,GAAG,KAAK,CAAC,CAAA;AACvD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAWlD,qBAAa,aAAa;IACxB,OAAc,eAAe,gBAAsB;IAEnD,OAAO,CAAC,WAAW,CAA+B;IAClD,OAAO,CAAC,oBAAoB,CAAiB;;IAU7C;;;;;;;;OAQG;IACI,MAAM,CAAC,CAAC,SAAS,SAAS,EAC/B,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAChC,WAAW,EAAE,iCAAiC,EAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,CAAC;IAoBJ,OAAO,CAAC,WAAW;IASnB;;;;OAIG;IACI,KAAK,IAAI,IAAI;IASpB;;;OAGG;IACU,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAElC;;OAEG;IACI,sBAAsB,IAAI,OAAO;IAIxC;;;;;;;OAOG;IACI,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAItF,OAAO,CAAC,sBAAsB;IAQ9B,OAAO,CAAC,iBAAiB;CAK1B"}

package/dist/cjs/aws/ClientPool.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsClientPool = void 0;
+const client_lambda_1 = require("@aws-sdk/client-lambda");
+const node_http_handler_1 = require("@smithy/node-http-handler");
+const util_retry_1 = require("@smithy/util-retry");
+const retrySettings = {
+    [client_lambda_1.LambdaClient.name]: {
+        beta: 0.4, // cut harder on throttle (default 0.7)
+        minFillRate: 0.2, // lower baseline QPS (default 0.5)
+        scaleConstant: 0.1, // slower cubic ramp (default 0.4)
+        smooth: 0.5 // dampen measured rate (default 0.8)
+    }
+};
+class AwsClientPool {
+    static defaultInstance = new AwsClientPool();
+    clientCache = new Map();
+    defaultRetryStrategy;
+    constructor() {
+        this.defaultRetryStrategy = this.makeRetryStrategy({
+            beta: 0.5, // cut harder on throttle (default 0.7)
+            minFillRate: 0.25, // lower baseline QPS (default 0.5)
+            scaleConstant: 0.2, // slower cubic ramp (default 0.4)
+            smooth: 0.6 // dampen measured rate (default 0.8)
+        });
+    }
+    /**
+     * Returns a client of the specified type with the specified credentials and region.
+     * Will create a new client if one does not already exist in the cache.
+     *
+     * @param ClientType The client constructor to create an instance of.
+     * @param credentials The credentials to use for the client.
+     * @param region The region to use for the client.
+     * @returns A client of the specified type with the specified credentials and region.
+     */
+    client(ClientType, credentials, region, endpoint) {
+        const cacheKey = this.getCacheKey(ClientType, credentials, region, endpoint);
+        if (!this.clientCache.has(cacheKey)) {
+            const client = new ClientType({
+                credentials: credentials.provider,
+                region,
+                maxAttempts: 10,
+                requestHandler: new node_http_handler_1.NodeHttpHandler({
+                    connectionTimeout: 5_000,
+                    socketTimeout: 15_000
+                }),
+                retryStrategy: this.retryStrategyForClient(ClientType)
+            });
+            this.clientCache.set(cacheKey, client);
+        }
+        return this.clientCache.get(cacheKey);
+    }
+    getCacheKey(ClientType, credentials, region, endpoint) {
+        return `${ClientType.name}:${credentials.accountId}:${credentials.cacheKey}:${region}:${endpoint}`;
+    }
+    /**
+     * Destroys all clients in the pool and empties the cache.
+     *
+     * NOT THREAD SAFE, this should only be called when all other operations are complete.
+     */
+    clear() {
+        this.clientCache.forEach((client) => {
+            if (typeof client.destroy === 'function') {
+                client.destroy();
+            }
+        });
+        this.clientCache.clear();
+    }
+    /**
+     * Do any async initialization required for the client pool. Should be called
+     * before the first use of the pool.
+     */
+    async init() { }
+    /**
+     * Whether this client pool requires valid AWS credentials for each instance.
+     */
+    requiresAwsCredentials() {
+        return true;
+    }
+    /**
+     * Determine if a given sync is supported by this client pool for the given service and region.
+     *
+     * @param service the AWS service
+     * @param syncName the name of the sync operation
+     * @param region the AWS region
+     * @returns true if the sync is supported, false otherwise
+     */
+    isSyncSupported(service, syncName, region) {
+        return true;
+    }
+    retryStrategyForClient(client) {
+        const settings = retrySettings[client.name];
+        if (settings) {
+            return this.makeRetryStrategy(settings);
+        }
+        return this.defaultRetryStrategy;
+    }
+    makeRetryStrategy(rateLimiterOptions) {
+        return new util_retry_1.AdaptiveRetryStrategy(async () => 20, {
+            rateLimiter: new util_retry_1.DefaultRateLimiter(rateLimiterOptions)
+        });
+    }
+}
+exports.AwsClientPool = AwsClientPool;
+//# sourceMappingURL=ClientPool.js.map

package/dist/cjs/aws/ClientPool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientPool.js","sourceRoot":"","sources":["../../../src/aws/ClientPool.ts"],"names":[],"mappings":";;;AAAA,0DAAqD;AAErD,iEAA2D;AAE3D,mDAI2B;AAO3B,MAAM,aAAa,GAA8C;IAC/D,CAAC,4BAAY,CAAC,IAAI,CAAC,EAAE;QACnB,IAAI,EAAE,GAAG,EAAE,uCAAuC;QAClD,WAAW,EAAE,GAAG,EAAE,mCAAmC;QACrD,aAAa,EAAE,GAAG,EAAE,kCAAkC;QACtD,MAAM,EAAE,GAAG,CAAC,qCAAqC;KAClD;CACF,CAAA;AAED,MAAa,aAAa;IACjB,MAAM,CAAC,eAAe,GAAG,IAAI,aAAa,EAAE,CAAA;IAE3C,WAAW,GAAG,IAAI,GAAG,EAAqB,CAAA;IAC1C,oBAAoB,CAAiB;IAC7C;QACE,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACjD,IAAI,EAAE,GAAG,EAAE,uCAAuC;YAClD,WAAW,EAAE,IAAI,EAAE,mCAAmC;YACtD,aAAa,EAAE,GAAG,EAAE,kCAAkC;YACtD,MAAM,EAAE,GAAG,CAAC,qCAAqC;SAClD,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CACX,UAAgC,EAChC,WAA8C,EAC9C,MAA0B,EAC1B,QAA4B;QAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAE5E,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;gBAC5B,WAAW,EAAE,WAAW,CAAC,QAAQ;gBACjC,MAAM;gBACN,WAAW,EAAE,EAAE;gBACf,cAAc,EAAE,IAAI,mCAAe,CAAC;oBAClC,iBAAiB,EAAE,KAAK;oBACxB,aAAa,EAAE,MAAM;iBACtB,CAAC;gBACF,aAAa,EAAE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC;aACvD,CAAC,CAAA;YACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAM,CAAA;IAC5C,CAAC;IAEO,WAAW,CACjB,UAAgC,EAChC,WAA8C,EAC9C,MAA0B,EAC1B,QAA4B;QAE5B,OAAO,GAAG,UAAU,CAAC,IAAI,IAAI,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAA;IACpG,CAAC;IAED;;;;OAIG;IACI,KAAK;QACV,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAClC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBACzC,MAAM,CAAC,OAAO,EAAE,CAAA;YAClB,CAAC;QACH,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAA;IAC1B,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,IAAI,KAAmB,CAAC;IAErC;;OAEG;IACI,sBAAsB;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;OAOG;IACI,eAAe,CAAC,OAAmB,EAAE,QAAgB,EAAE,MAAc;QAC1E,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,sBAAsB,CAAC,MAA8B;QAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,oBAAoB,CAAA;IAClC,CAAC;IAEO,iBAAiB,CAAC,kBAA6C;QACrE,OAAO,IAAI,kCAAqB,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE;YAC/C,WAAW,EAAE,IAAI,+BAAkB,CAAC,kBAAkB,CAAC;SACxD,CAAC,CAAA;IACJ,CAAC;;AA5GH,sCA6GC"}

package/dist/cjs/aws/auth.d.ts

@@ -0,0 +1,11 @@
+import { type AuthConfig } from '../config/config.js';
+import { type AwsCredentialProviderWithMetaData } from './coreAuth.js';
+/**
+ * Get credentials for the given account ID and auth configuration.
+ *
+ * @param accountId the AWS account ID for which to get credentials
+ * @param authConfig the authentication configuration to use for the account
+ * @returns new or cached credentials based on the provided account ID and auth configuration
+ */
+export declare function getCredentials(accountId: string, authConfig: AuthConfig | undefined): Promise<AwsCredentialProviderWithMetaData>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/cjs/aws/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/aws/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD,OAAO,EAAE,KAAK,iCAAiC,EAA0B,MAAM,eAAe,CAAA;AA6D9F;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,UAAU,GAAG,SAAS,GACjC,OAAO,CAAC,iCAAiC,CAAC,CAuB5C"}

package/dist/cjs/aws/auth.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCredentials = getCredentials;
+const log_1 = require("@cloud-copilot/log");
+const coreAuth_js_1 = require("./coreAuth.js");
+/**
+ * We cache credentials with a timeout
+ */
+const credentialsCache = new Map();
+// Currently using a static timeout
+const CREDENTIAL_CACHE_TIMEOUT = 300 * 1000;
+/**
+ * We cache requests for credentials to avoid multiple requests for the same accountId and authConfig.
+ */
+const credentialRequestCache = {};
+/**
+ * Generate a cache key for the given account ID and auth configuration.
+ *
+ * @param accountId the AWS account ID
+ * @param authConfig the authentication configuration, if any
+ * @returns a unique cache key for the credentials
+ */
+function credentialsCacheKey(accountId, authConfig) {
+    return authConfig ? `${accountId}:${JSON.stringify(authConfig)}` : accountId;
+}
+/**
+ * Get cached credentials for the given cache key, if they exist and are not expired.
+ *
+ * @param cacheKey the cache key to get credentials for
+ * @returns the cached credentials if they exist and are not expired, otherwise undefined
+ */
+function getCachedCredentials(cacheKey) {
+    const cached = credentialsCache.get(cacheKey);
+    if (cached && cached.expiration > Date.now()) {
+        return cached.credentials;
+    }
+    credentialsCache.delete(cacheKey);
+    return undefined;
+}
+/**
+ * Cache a set of credentials
+ *
+ * @param cacheKey the cache key to use for the credentials
+ * @param credentials the credentials to cache
+ */
+function setCachedCredentials(cacheKey, credentials) {
+    const expiration = (0, coreAuth_js_1.now)() + CREDENTIAL_CACHE_TIMEOUT;
+    credentialsCache.set(cacheKey, { expiration, credentials });
+}
+/**
+ * Get credentials for the given account ID and auth configuration.
+ *
+ * @param accountId the AWS account ID for which to get credentials
+ * @param authConfig the authentication configuration to use for the account
+ * @returns new or cached credentials based on the provided account ID and auth configuration
+ */
+async function getCredentials(accountId, authConfig) {
+    const cacheKey = credentialsCacheKey(accountId, authConfig);
+    const cachedCredentials = getCachedCredentials(cacheKey);
+    if (cachedCredentials) {
+        log_1.log.trace({ accountId }, 'Using cached credentials');
+        return cachedCredentials;
+    }
+    if (credentialRequestCache[cacheKey] !== undefined) {
+        return credentialRequestCache[cacheKey];
+    }
+    //Create a new promise and store it in case another request comes in while this one is being processed.
+    return (credentialRequestCache[cacheKey] = (async () => {
+        try {
+            log_1.log.trace({ accountId }, 'Creating new credentials');
+            const newCredentials = await (0, coreAuth_js_1.getNewCredentials)(accountId, authConfig);
+            setCachedCredentials(cacheKey, newCredentials);
+            return newCredentials;
+        }
+        finally {
+            delete credentialRequestCache[cacheKey]; // Clean up the queue regardless of success or failure.
+        }
+    })());
+}
+//# sourceMappingURL=auth.js.map

package/dist/cjs/aws/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/aws/auth.ts"],"names":[],"mappings":";;AAsEA,wCA0BC;AA/FD,4CAAwC;AACxC,+CAA8F;AAE9F;;GAEG;AACH,MAAM,gBAAgB,GAMlB,IAAI,GAAG,EAAE,CAAA;AAEb,mCAAmC;AACnC,MAAM,wBAAwB,GAAG,GAAG,GAAG,IAAI,CAAA;AAE3C;;GAEG;AACH,MAAM,sBAAsB,GAA+D,EAAE,CAAA;AAE7F;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,SAAiB,EAAE,UAAkC;IAChF,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9E,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,WAAW,CAAA;IAC3B,CAAC;IACD,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACjC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,QAAgB,EAChB,WAA8C;IAE9C,MAAM,UAAU,GAAG,IAAA,iBAAG,GAAE,GAAG,wBAAwB,CAAA;IACnD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,UAAkC;IAElC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC3D,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACxD,IAAI,iBAAiB,EAAE,CAAC;QACtB,SAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,0BAA0B,CAAC,CAAA;QACpD,OAAO,iBAAiB,CAAA;IAC1B,CAAC;IAED,IAAI,sBAAsB,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;QACnD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IACzC,CAAC;IAED,uGAAuG;IACvG,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;QACrD,IAAI,CAAC;YACH,SAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,0BAA0B,CAAC,CAAA;YACpD,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAiB,EAAC,SAAS,EAAE,UAAU,CAAC,CAAA;YACrE,oBAAoB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YAC9C,OAAO,cAAc,CAAA;QACvB,CAAC;gBAAS,CAAC;YACT,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAA,CAAC,uDAAuD;QACjG,CAAC;IACH,CAAC,CAAC,EAAE,CAAC,CAAA;AACP,CAAC"}