@actsecurity/iam-collect 0.1.215

package/dist/cjs/syncs/ecr/ecrSyncs.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EcrSyncs = void 0;
+const client_ecr_1 = require("@aws-sdk/client-ecr");
+const client_tools_js_1 = require("../../utils/client-tools.js");
+const json_js_1 = require("../../utils/json.js");
+const typedSync_js_1 = require("../typedSync.js");
+exports.EcrSyncs = [
+    (0, typedSync_js_1.createTypedSyncOperation)('ecr', 'repositories', (0, typedSync_js_1.createResourceSyncType)({
+        client: client_ecr_1.ECRClient,
+        command: client_ecr_1.DescribeRepositoriesCommand,
+        key: 'repositories',
+        paginationConfig: {
+            inputKey: 'nextToken',
+            outputKey: 'nextToken'
+        },
+        arn: (repository, region, account, partition) => repositoryArn(repository, region, account, partition),
+        tags: (repository) => repository.extraFields.tags,
+        resourceTypeParts: (account, region) => ({
+            account,
+            service: 'ecr',
+            region,
+            resourceType: 'repository'
+        }),
+        extraFields: {
+            tags: async (client, repository, account, region, partition) => {
+                const result = await client.send(new client_ecr_1.ListTagsForResourceCommand({
+                    resourceArn: repositoryArn(repository, region, account, partition)
+                }));
+                return result.tags;
+            },
+            policy: async (client, repository, account, region, partition) => {
+                const policy = await (0, client_tools_js_1.runAndCatchError)('RepositoryPolicyNotFoundException', async () => {
+                    const result = await client.send(new client_ecr_1.GetRepositoryPolicyCommand({
+                        repositoryName: repository.repositoryName
+                    }));
+                    return (0, json_js_1.parseIfPresent)(result.policyText);
+                });
+                return policy;
+            }
+        },
+        results: (repository) => ({
+            metadata: {
+                repositoryName: repository.repositoryName,
+                key: repository.encryptionConfiguration?.kmsKey
+            },
+            policy: repository.extraFields.policy
+        })
+    })),
+    {
+        awsService: 'ecr',
+        name: 'registry',
+        execute: async (accountId, region, credentials, storage, endpoint, syncOptions) => {
+            const client = syncOptions.clientPool.client(client_ecr_1.ECRClient, credentials, region, endpoint);
+            const policyText = await (0, client_tools_js_1.runAndCatchError)('RegistryPolicyNotFoundException', async () => {
+                const result = await client.send(new client_ecr_1.GetRegistryPolicyCommand({}));
+                return result.policyText;
+            });
+            const policy = policyText ? JSON.parse(policyText) : undefined;
+            await storage.saveAccountMetadata(accountId, `ecr-registry-policy.${region}`, policy);
+        }
+    }
+];
+/**
+ * Make an ECR Repository ARN
+ *
+ * @param repository the ECR Repository object
+ * @param region the AWS region
+ * @param account the AWS account ID
+ * @param partition the AWS partition (e.g., 'aws', 'aws-cn', 'aws-us-gov')
+ * @returns the ARN of the ECR Repository
+ */
+function repositoryArn(repository, region, account, partition) {
+    return `arn:${partition}:ecr:${region}:${account}:repository/${repository.repositoryName}`;
+}
+//# sourceMappingURL=ecrSyncs.js.map

package/dist/cjs/syncs/ecr/ecrSyncs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecrSyncs.js","sourceRoot":"","sources":["../../../../src/syncs/ecr/ecrSyncs.ts"],"names":[],"mappings":";;;AAAA,oDAO4B;AAC5B,iEAA8D;AAC9D,iDAAoD;AAEpD,kDAAkF;AAErE,QAAA,QAAQ,GAAW;IAC9B,IAAA,uCAAwB,EACtB,KAAK,EACL,cAAc,EACd,IAAA,qCAAsB,EAAC;QACrB,MAAM,EAAE,sBAAS;QACjB,OAAO,EAAE,wCAA2B;QACpC,GAAG,EAAE,cAAc;QACnB,gBAAgB,EAAE;YAChB,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,WAAW;SACvB;QACD,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAC9C,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;QACvD,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI;QACjD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO;YACP,OAAO,EAAE,KAAK;YACd,MAAM;YACN,YAAY,EAAE,YAAY;SAC3B,CAAC;QACF,WAAW,EAAE;YACX,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;gBAC7D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,uCAA0B,CAAC;oBAC7B,WAAW,EAAE,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;iBACnE,CAAC,CACH,CAAA;gBACD,OAAO,MAAM,CAAC,IAAI,CAAA;YACpB,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;gBAC/D,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAgB,EAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;oBACpF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,uCAA0B,CAAC;wBAC7B,cAAc,EAAE,UAAU,CAAC,cAAc;qBAC1C,CAAC,CACH,CAAA;oBACD,OAAO,IAAA,wBAAc,EAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC,CAAC,CAAA;gBAEF,OAAO,MAAM,CAAA;YACf,CAAC;SACF;QACD,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACxB,QAAQ,EAAE;gBACR,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,GAAG,EAAE,UAAU,CAAC,uBAAuB,EAAE,MAAM;aAChD;YACD,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM;SACtC,CAAC;KACH,CAAC,CACH;IACD;QACE,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YAChF,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,sBAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;YACtF,MAAM,UAAU,GAAG,MAAM,IAAA,kCAAgB,EAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;gBACtF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,CAAC,CAAC,CAAA;gBAClE,OAAO,MAAM,CAAC,UAAU,CAAA;YAC1B,CAAC,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC9D,MAAM,OAAO,CAAC,mBAAmB,CAAC,SAAS,EAAE,uBAAuB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;QACvF,CAAC;KACF;CACF,CAAA;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,UAAsB,EACtB,MAAc,EACd,OAAe,EACf,SAAiB;IAEjB,OAAO,OAAO,SAAS,QAAQ,MAAM,IAAI,OAAO,eAAe,UAAU,CAAC,cAAc,EAAE,CAAA;AAC5F,CAAC"}

package/dist/cjs/syncs/efs/fileSystems.d.ts

@@ -0,0 +1,2 @@
+export declare const ElasticFileSystemsSync: import("../sync.js").Sync;
+//# sourceMappingURL=fileSystems.d.ts.map

package/dist/cjs/syncs/efs/fileSystems.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileSystems.d.ts","sourceRoot":"","sources":["../../../../src/syncs/efs/fileSystems.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,sBAAsB,2BAwClC,CAAA"}

package/dist/cjs/syncs/efs/fileSystems.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ElasticFileSystemsSync = void 0;
+const client_efs_1 = require("@aws-sdk/client-efs");
+const client_tools_js_1 = require("../../utils/client-tools.js");
+const json_js_1 = require("../../utils/json.js");
+const typedSync_js_1 = require("../typedSync.js");
+exports.ElasticFileSystemsSync = (0, typedSync_js_1.createTypedSyncOperation)('elasticfilesystem', 'fileSystems', (0, typedSync_js_1.createResourceSyncType)({
+    client: client_efs_1.EFSClient,
+    command: client_efs_1.DescribeFileSystemsCommand,
+    key: 'FileSystems',
+    paginationConfig: {
+        inputKey: 'Marker',
+        outputKey: 'NextMarker'
+    },
+    resourceTypeParts: (accountId, region) => ({
+        service: 'elasticfilesystem',
+        resourceType: 'file-system',
+        account: accountId,
+        region: region
+    }),
+    extraFields: {
+        policy: async (client, fileSystem) => {
+            return (0, client_tools_js_1.runAndCatch404)(async () => {
+                const policyResult = await client.send(new client_efs_1.DescribeFileSystemPolicyCommand({ FileSystemId: fileSystem.FileSystemId }));
+                return (0, json_js_1.parseIfPresent)(policyResult.Policy);
+            });
+        }
+    },
+    tags: (fileSystem) => fileSystem.Tags,
+    arn: (fileSystem) => fileSystem.FileSystemArn,
+    results: (fileSystem) => ({
+        metadata: {
+            name: fileSystem.Name,
+            id: fileSystem.FileSystemId,
+            az: fileSystem.AvailabilityZoneId,
+            key: fileSystem.KmsKeyId,
+            encrypted: fileSystem.Encrypted
+        },
+        policy: fileSystem.extraFields.policy
+    })
+}));
+//# sourceMappingURL=fileSystems.js.map

package/dist/cjs/syncs/efs/fileSystems.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileSystems.js","sourceRoot":"","sources":["../../../../src/syncs/efs/fileSystems.ts"],"names":[],"mappings":";;;AAAA,oDAI4B;AAC5B,iEAA4D;AAC5D,iDAAoD;AACpD,kDAAkF;AAErE,QAAA,sBAAsB,GAAG,IAAA,uCAAwB,EAC5D,mBAAmB,EACnB,aAAa,EACb,IAAA,qCAAsB,EAAC;IACrB,MAAM,EAAE,sBAAS;IACjB,OAAO,EAAE,uCAA0B;IACnC,GAAG,EAAE,aAAa;IAClB,gBAAgB,EAAE;QAChB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,YAAY;KACxB;IACD,iBAAiB,EAAE,CAAC,SAAiB,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,mBAAmB;QAC5B,YAAY,EAAE,aAAa;QAC3B,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,MAAM;KACf,CAAC;IACF,WAAW,EAAE;QACX,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE;YACnC,OAAO,IAAA,gCAAc,EAAC,KAAK,IAAI,EAAE;gBAC/B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CACpC,IAAI,4CAA+B,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAC/E,CAAA;gBACD,OAAO,IAAA,wBAAc,EAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;QACJ,CAAC;KACF;IACD,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI;IACrC,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,aAAc;IAC9C,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACxB,QAAQ,EAAE;YACR,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,EAAE,EAAE,UAAU,CAAC,kBAAkB;YACjC,GAAG,EAAE,UAAU,CAAC,QAAQ;YACxB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC;QACD,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM;KACtC,CAAC;CACH,CAAC,CACH,CAAA"}

package/dist/cjs/syncs/eks/accessEntries.d.ts

@@ -0,0 +1,8 @@
+import { type Sync } from '../sync.js';
+/**
+ * Syncs EKS clusters and their access entries. Access entries map IAM principals to
+ * Kubernetes permissions and only exist on clusters with the API or API_AND_CONFIG_MAP
+ * authentication mode.
+ */
+export declare const EksAccessEntriesSync: Sync;
+//# sourceMappingURL=accessEntries.d.ts.map

package/dist/cjs/syncs/eks/accessEntries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessEntries.d.ts","sourceRoot":"","sources":["../../../../src/syncs/eks/accessEntries.ts"],"names":[],"mappings":"AASA,OAAO,EAAmB,KAAK,IAAI,EAAY,MAAM,YAAY,CAAA;AAQjE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAsHlC,CAAA"}

package/dist/cjs/syncs/eks/accessEntries.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EksAccessEntriesSync = void 0;
+const client_eks_1 = require("@aws-sdk/client-eks");
+const client_tools_js_1 = require("../../utils/client-tools.js");
+const sync_js_1 = require("../sync.js");
+const typedSync_js_1 = require("../typedSync.js");
+const paginationConfig = {
+    inputKey: 'nextToken',
+    outputKey: 'nextToken'
+};
+/**
+ * Syncs EKS clusters and their access entries. Access entries map IAM principals to
+ * Kubernetes permissions and only exist on clusters with the API or API_AND_CONFIG_MAP
+ * authentication mode.
+ */
+exports.EksAccessEntriesSync = {
+    awsService: 'eks',
+    name: 'accessEntries',
+    execute: async (accountId, region, credentials, storage, endpoint, syncOptions) => {
+        const eksClient = syncOptions.clientPool.client(client_eks_1.EKSClient, credentials, region, endpoint);
+        const clusterNames = await (0, typedSync_js_1.paginateResource)(eksClient, client_eks_1.ListClustersCommand, 'clusters', paginationConfig);
+        const clusterRecords = [];
+        const accessEntryRecords = [];
+        for (const clusterName of clusterNames) {
+            const describeResult = await (0, client_tools_js_1.runAndCatch404)(async () => {
+                return eksClient.send(new client_eks_1.DescribeClusterCommand({ name: clusterName }));
+            });
+            const cluster = describeResult?.cluster;
+            if (!cluster?.arn) {
+                continue;
+            }
+            const authenticationMode = cluster.accessConfig?.authenticationMode;
+            clusterRecords.push({
+                arn: cluster.arn,
+                metadata: {
+                    name: cluster.name,
+                    arn: cluster.arn,
+                    authenticationMode
+                },
+                tags: cluster.tags
+            });
+            // Access entries can only be listed when API authentication is enabled.
+            if (authenticationMode !== 'API' && authenticationMode !== 'API_AND_CONFIG_MAP') {
+                continue;
+            }
+            const principalArns = await (0, typedSync_js_1.paginateResource)(eksClient, client_eks_1.ListAccessEntriesCommand, 'accessEntries', paginationConfig, { clusterName });
+            for (const principalArn of principalArns) {
+                const describeEntryResult = await (0, client_tools_js_1.runAndCatch404)(async () => {
+                    return eksClient.send(new client_eks_1.DescribeAccessEntryCommand({ clusterName, principalArn }));
+                });
+                const accessEntry = describeEntryResult?.accessEntry;
+                if (!accessEntry?.accessEntryArn) {
+                    continue;
+                }
+                const associatedAccessPolicies = await (0, client_tools_js_1.runAndCatchAccessDeniedWithLog)(accessEntry.accessEntryArn, 'eks', 'accessEntry', 'accessPolicies', async () => {
+                    return (0, typedSync_js_1.paginateResource)(eksClient, client_eks_1.ListAssociatedAccessPoliciesCommand, 'associatedAccessPolicies', paginationConfig, { clusterName, principalArn });
+                });
+                accessEntryRecords.push({
+                    arn: accessEntry.accessEntryArn,
+                    metadata: {
+                        arn: accessEntry.accessEntryArn,
+                        clusterName: accessEntry.clusterName,
+                        principalArn: accessEntry.principalArn,
+                        username: accessEntry.username,
+                        type: accessEntry.type,
+                        kubernetesGroups: accessEntry.kubernetesGroups
+                    },
+                    accessPolicies: associatedAccessPolicies?.map((policy) => ({
+                        policyArn: policy.policyArn,
+                        accessScope: policy.accessScope
+                    })),
+                    tags: accessEntry.tags
+                });
+            }
+        }
+        await (0, sync_js_1.syncData)(clusterRecords, storage, accountId, {
+            service: 'eks',
+            resourceType: 'cluster',
+            account: accountId,
+            region: region
+        }, syncOptions.writeOnly);
+        await (0, sync_js_1.syncData)(accessEntryRecords, storage, accountId, {
+            service: 'eks',
+            resourceType: 'access-entry',
+            account: accountId,
+            region: region
+        }, syncOptions.writeOnly);
+    }
+};
+//# sourceMappingURL=accessEntries.js.map

package/dist/cjs/syncs/eks/accessEntries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessEntries.js","sourceRoot":"","sources":["../../../../src/syncs/eks/accessEntries.ts"],"names":[],"mappings":";;;AAAA,oDAO4B;AAC5B,iEAA4F;AAC5F,wCAAiE;AACjE,kDAAkD;AAElD,MAAM,gBAAgB,GAAG;IACvB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,WAAW;CACd,CAAA;AAEV;;;;GAIG;AACU,QAAA,oBAAoB,GAAS;IACxC,UAAU,EAAE,KAAK;IACjB,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;QAChF,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,sBAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzF,MAAM,YAAY,GAAG,MAAM,IAAA,+BAAgB,EACzC,SAAS,EACT,gCAAmB,EACnB,UAAU,EACV,gBAAgB,CACjB,CAAA;QAED,MAAM,cAAc,GAAiB,EAAE,CAAA;QACvC,MAAM,kBAAkB,GAAiB,EAAE,CAAA;QAE3C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,cAAc,GAAG,MAAM,IAAA,gCAAc,EAAC,KAAK,IAAI,EAAE;gBACrD,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,mCAAsB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;YAC1E,CAAC,CAAC,CAAA;YACF,MAAM,OAAO,GAAG,cAAc,EAAE,OAAO,CAAA;YACvC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;gBAClB,SAAQ;YACV,CAAC;YAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,kBAAkB,CAAA;YACnE,cAAc,CAAC,IAAI,CAAC;gBAClB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,kBAAkB;iBACnB;gBACD,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAA;YAEF,wEAAwE;YACxE,IAAI,kBAAkB,KAAK,KAAK,IAAI,kBAAkB,KAAK,oBAAoB,EAAE,CAAC;gBAChF,SAAQ;YACV,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAA,+BAAgB,EAC1C,SAAS,EACT,qCAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,EAAE,WAAW,EAAE,CAChB,CAAA;YAED,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,MAAM,mBAAmB,GAAG,MAAM,IAAA,gCAAc,EAAC,KAAK,IAAI,EAAE;oBAC1D,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,uCAA0B,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;gBACtF,CAAC,CAAC,CAAA;gBACF,MAAM,WAAW,GAAG,mBAAmB,EAAE,WAAW,CAAA;gBACpD,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC;oBACjC,SAAQ;gBACV,CAAC;gBAED,MAAM,wBAAwB,GAAG,MAAM,IAAA,gDAA8B,EACnE,WAAW,CAAC,cAAc,EAC1B,KAAK,EACL,aAAa,EACb,gBAAgB,EAChB,KAAK,IAAI,EAAE;oBACT,OAAO,IAAA,+BAAgB,EACrB,SAAS,EACT,gDAAmC,EACnC,0BAA0B,EAC1B,gBAAgB,EAChB,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAA;gBACH,CAAC,CACF,CAAA;gBAED,kBAAkB,CAAC,IAAI,CAAC;oBACtB,GAAG,EAAE,WAAW,CAAC,cAAc;oBAC/B,QAAQ,EAAE;wBACR,GAAG,EAAE,WAAW,CAAC,cAAc;wBAC/B,WAAW,EAAE,WAAW,CAAC,WAAW;wBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;wBACtC,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;wBACtB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;qBAC/C;oBACD,cAAc,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;wBACzD,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;qBAChC,CAAC,CAAC;oBACH,IAAI,EAAE,WAAW,CAAC,IAAI;iBACvB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAA,kBAAQ,EACZ,cAAc,EACd,OAAO,EACP,SAAS,EACT;YACE,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,SAAS;YACvB,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,MAAM;SACf,EACD,WAAW,CAAC,SAAS,CACtB,CAAA;QAED,MAAM,IAAA,kBAAQ,EACZ,kBAAkB,EAClB,OAAO,EACP,SAAS,EACT;YACE,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,cAAc;YAC5B,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,MAAM;SACf,EACD,WAAW,CAAC,SAAS,CACtB,CAAA;IACH,CAAC;CACF,CAAA"}

package/dist/cjs/syncs/events/eventBuses.d.ts

@@ -0,0 +1,2 @@
+export declare const EventBridgeEventBusesSync: import("../sync.js").Sync;
+//# sourceMappingURL=eventBuses.d.ts.map

package/dist/cjs/syncs/events/eventBuses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eventBuses.d.ts","sourceRoot":"","sources":["../../../../src/syncs/events/eventBuses.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,yBAAyB,2BAiDrC,CAAA"}

package/dist/cjs/syncs/events/eventBuses.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EventBridgeEventBusesSync = void 0;
+const client_eventbridge_1 = require("@aws-sdk/client-eventbridge");
+const client_tools_js_1 = require("../../utils/client-tools.js");
+const json_js_1 = require("../../utils/json.js");
+const typedSync_js_1 = require("../typedSync.js");
+exports.EventBridgeEventBusesSync = (0, typedSync_js_1.createTypedSyncOperation)('events', 'eventBuses', (0, typedSync_js_1.createResourceSyncType)({
+    client: client_eventbridge_1.EventBridgeClient,
+    command: client_eventbridge_1.ListEventBusesCommand,
+    key: 'EventBuses',
+    paginationConfig: {
+        inputKey: 'NextToken',
+        outputKey: 'NextToken'
+    },
+    arn: (eventBus) => eventBus.Arn,
+    resourceTypeParts: (accountId, region) => ({
+        service: 'events',
+        resourceType: 'event-bus',
+        account: accountId,
+        region: region
+    }),
+    extraFields: {
+        details: async (client, eventBus) => {
+            return (0, client_tools_js_1.runAndCatch404)(async () => {
+                const result = await client.send(new client_eventbridge_1.DescribeEventBusCommand({
+                    Name: eventBus.Name
+                }));
+                return result;
+            });
+        },
+        tags: async (client, eventBus, accountId, region, partition) => {
+            return (0, client_tools_js_1.runAndCatch404)(async () => {
+                const result = await client.send(new client_eventbridge_1.ListTagsForResourceCommand({
+                    ResourceARN: eventBus.Arn
+                }));
+                return result.Tags;
+            });
+        }
+    },
+    tags: (eventBus) => eventBus.extraFields.tags,
+    results: (eventBus) => ({
+        metadata: {
+            name: eventBus.Name,
+            kmsKey: eventBus.extraFields.details?.KmsKeyIdentifier
+        },
+        policy: (0, json_js_1.parseIfPresent)(eventBus.extraFields.details?.Policy)
+    })
+}));
+//# sourceMappingURL=eventBuses.js.map

package/dist/cjs/syncs/events/eventBuses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eventBuses.js","sourceRoot":"","sources":["../../../../src/syncs/events/eventBuses.ts"],"names":[],"mappings":";;;AAAA,oEAKoC;AACpC,iEAA4D;AAC5D,iDAAoD;AACpD,kDAAkF;AAErE,QAAA,yBAAyB,GAAG,IAAA,uCAAwB,EAC/D,QAAQ,EACR,YAAY,EACZ,IAAA,qCAAsB,EAAC;IACrB,MAAM,EAAE,sCAAiB;IACzB,OAAO,EAAE,0CAAqB;IAC9B,GAAG,EAAE,YAAY;IACjB,gBAAgB,EAAE;QAChB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,WAAW;KACvB;IACD,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAI;IAChC,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,QAAQ;QACjB,YAAY,EAAE,WAAW;QACzB,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,MAAM;KACf,CAAC;IACF,WAAW,EAAE;QACX,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YAClC,OAAO,IAAA,gCAAc,EAAC,KAAK,IAAI,EAAE;gBAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,4CAAuB,CAAC;oBAC1B,IAAI,EAAE,QAAQ,CAAC,IAAI;iBACpB,CAAC,CACH,CAAA;gBACD,OAAO,MAAM,CAAA;YACf,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;YAC7D,OAAO,IAAA,gCAAc,EAAC,KAAK,IAAI,EAAE;gBAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,+CAA0B,CAAC;oBAC7B,WAAW,EAAE,QAAQ,CAAC,GAAI;iBAC3B,CAAC,CACH,CAAA;gBACD,OAAO,MAAM,CAAC,IAAI,CAAA;YACpB,CAAC,CAAC,CAAA;QACJ,CAAC;KACF;IACD,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI;IAC7C,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,gBAAgB;SACvD;QACD,MAAM,EAAE,IAAA,wBAAc,EAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC;KAC7D,CAAC;CACH,CAAC,CACH,CAAA"}

package/dist/cjs/syncs/glue/catalogs.d.ts

@@ -0,0 +1,3 @@
+import { type Sync } from '../sync.js';
+export declare const GlueCatalogSync: Sync;
+//# sourceMappingURL=catalogs.d.ts.map

package/dist/cjs/syncs/glue/catalogs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogs.d.ts","sourceRoot":"","sources":["../../../../src/syncs/glue/catalogs.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,eAAO,MAAM,eAAe,EAAE,IAqB7B,CAAA"}

package/dist/cjs/syncs/glue/catalogs.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GlueCatalogSync = void 0;
+const client_glue_1 = require("@aws-sdk/client-glue");
+const client_tools_js_1 = require("../../utils/client-tools.js");
+const json_js_1 = require("../../utils/json.js");
+exports.GlueCatalogSync = {
+    name: 'GlueCatalogSync',
+    awsService: 'glue',
+    execute: async (accountId, region, credentials, storage, endpoint, syncOptions) => {
+        const glueClient = syncOptions.clientPool.client(client_glue_1.GlueClient, credentials, region, endpoint);
+        const policy = await (0, client_tools_js_1.runAndCatchError)('EntityNotFoundException', async () => {
+            const result = await glueClient.send(new client_glue_1.GetResourcePolicyCommand());
+            return (0, json_js_1.parseIfPresent)(result.PolicyInJson);
+        });
+        const arn = rootCatalogArn(credentials.partition, accountId, region);
+        if (policy) {
+            await storage.saveResourceMetadata(accountId, arn, 'policy', policy);
+            await storage.saveResourceMetadata(accountId, arn, 'metadata', {
+                arn
+            });
+        }
+        else {
+            await storage.deleteResource(accountId, arn);
+        }
+    }
+};
+/**
+ * Get the ARN for a root Glue catalog
+ *
+ * @param partition the partition (aws, aws-cn, aws-us-gov)
+ * @param accountId the account id
+ * @param region the region
+ * @returns the ARN for the root Glue catalog
+ */
+function rootCatalogArn(partition, accountId, region) {
+    return `arn:${partition}:glue:${region}:${accountId}:catalog`;
+}
+//# sourceMappingURL=catalogs.js.map

package/dist/cjs/syncs/glue/catalogs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogs.js","sourceRoot":"","sources":["../../../../src/syncs/glue/catalogs.ts"],"names":[],"mappings":";;;AAAA,sDAA2E;AAC3E,iEAA8D;AAC9D,iDAAoD;AAGvC,QAAA,eAAe,GAAS;IACnC,IAAI,EAAE,iBAAiB;IACvB,UAAU,EAAE,MAAM;IAClB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;QAChF,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,wBAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAE3F,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAgB,EAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,sCAAwB,EAAE,CAAC,CAAA;YACpE,OAAO,IAAA,wBAAc,EAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QACpE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YACpE,MAAM,OAAO,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE;gBAC7D,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;CACF,CAAA;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,SAAiB,EAAE,SAAiB,EAAE,MAAc;IAC1E,OAAO,OAAO,SAAS,SAAS,MAAM,IAAI,SAAS,UAAU,CAAA;AAC/D,CAAC"}

package/dist/cjs/syncs/iam/authorizationDetails.d.ts

@@ -0,0 +1,23 @@
+import { type GroupDetail, IAMClient, type ManagedPolicyDetail, type RoleDetail, type Tag, type UserDetail } from '@aws-sdk/client-iam';
+import { ConcurrentWorkerPool } from '@actsecurity/job';
+import { type Sync } from '../sync.js';
+export declare const AuthorizationDetailsSync: Sync;
+interface ManagedPolicyDetailWithExtraData extends ManagedPolicyDetail {
+    Tags?: Tag[];
+}
+/**
+ * Return the results of the Authorization Details call for this account.
+ * Excludes users and AWS managed policies.
+ *
+ * @param credentials The credentials to use for the API call
+ * @returns Returns the results of the Authorization Details call for this account
+ */
+export declare function getAuthorizationDetails(client: IAMClient, concurrentWorkerPool: ConcurrentWorkerPool<any, any>, customConfig?: Record<string, any>): Promise<{
+    groups: GroupDetail[];
+    roles: RoleDetail[];
+    policies: ManagedPolicyDetailWithExtraData[];
+    awsManagedPolicies: ManagedPolicyDetail[];
+    users: UserDetail[];
+}>;
+export {};
+//# sourceMappingURL=authorizationDetails.d.ts.map

package/dist/cjs/syncs/iam/authorizationDetails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizationDetails.d.ts","sourceRoot":"","sources":["../../../../src/syncs/iam/authorizationDetails.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,WAAW,EAChB,SAAS,EAET,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,GAAG,EACR,KAAK,UAAU,EAChB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,oBAAoB,EAAY,MAAM,kBAAkB,CAAA;AAMjE,OAAO,EAAE,KAAK,IAAI,EAA8B,MAAM,YAAY,CAAA;AAElE,eAAO,MAAM,wBAAwB,EAAE,IAoLtC,CAAA;AAED,UAAU,gCAAiC,SAAQ,mBAAmB;IACpE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;CACb;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,SAAS,EACjB,oBAAoB,EAAE,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,EACpD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,OAAO,CAAC;IACT,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB,QAAQ,EAAE,gCAAgC,EAAE,CAAA;IAC5C,kBAAkB,EAAE,mBAAmB,EAAE,CAAA;IACzC,KAAK,EAAE,UAAU,EAAE,CAAA;CACpB,CAAC,CAiDD"}