@actsecurity/iam-collect 0.1.215

package/dist/esm/awsConfigClients/clients/AwsConfigEC2Client.js

@@ -0,0 +1,58 @@
+import { DescribeVpcEndpointsCommand, EC2Client } from '@aws-sdk/client-ec2';
+import {} from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { awsConfigCommand } from '../AwsConfigClientContext.js';
+import { executeConfigQuery, parseConfigItem, resourceStatusWhereClause } from '../awsConfigUtils.js';
+/**
+ * AWS Config-based EC2 client implementation
+ */
+export class AwsConfigEC2Client extends AbstractClient {
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    /**
+     * Register all EC2 command implementations
+     */
+    registerCommands() {
+        this.registerCommand(AwsConfigDescribeVpcEndpointsCommand);
+    }
+}
+AwsConfigEC2Client.clientName = EC2Client.name;
+/**
+ * Config-based implementation of EC2 DescribeVpcEndpointsCommand
+ * Retrieves VPC endpoint information including endpoint policies from AWS Config
+ */
+const AwsConfigDescribeVpcEndpointsCommand = awsConfigCommand({
+    command: DescribeVpcEndpointsCommand,
+    execute: async (input, context) => {
+        let query = `
+      SELECT
+        configuration.vpcEndpointId,
+        configuration.vpcEndpointType,
+        configuration.serviceName,
+        configuration.policyDocument
+      WHERE
+        resourceType = 'AWS::EC2::VPCEndpoint'
+        AND awsRegion = '${context.region}'
+        AND accountId = '${context.accountId}'
+        AND ${resourceStatusWhereClause}
+    `;
+        const results = await executeConfigQuery(query, context);
+        // Transform Config results to match AWS SDK format with only essential fields
+        const vpcEndpoints = results.map((resultString) => {
+            const { configItem } = parseConfigItem(resultString);
+            const config = configItem.configuration || {};
+            return {
+                VpcEndpointId: config.vpcEndpointId,
+                VpcEndpointType: config.vpcEndpointType,
+                ServiceName: config.serviceName,
+                PolicyDocument: config.policyDocument // The endpoint policy as a string
+            };
+        });
+        return {
+            VpcEndpoints: vpcEndpoints,
+            NextToken: undefined // Config doesn't support pagination in this context
+        };
+    }
+});
+//# sourceMappingURL=AwsConfigEC2Client.js.map

package/dist/esm/awsConfigClients/clients/AwsConfigEC2Client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigEC2Client.js","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigEC2Client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAA0C,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAA+B,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAC5F,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAE7B;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,cAAsC;IAG5E,YACE,OAGC,EACD,aAAqC;QAErC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACO,gBAAgB;QACxB,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,CAAA;IAC5D,CAAC;;AAjBe,6BAAU,GAAG,SAAS,CAAC,IAAI,CAAA;AAoB7C;;;GAGG;AACH,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IAC5D,OAAO,EAAE,2BAA2B;IACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,IAAI,KAAK,GAAG;;;;;;;;2BAQW,OAAO,CAAC,MAAM;2BACd,OAAO,CAAC,SAAS;cAC9B,yBAAyB;KAClC,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAExD,8EAA8E;QAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,YAAoB,EAAE,EAAE;YACxD,MAAM,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;YACpD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAA;YAE7C,OAAO;gBACL,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,kCAAkC;aACzE,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,SAAS,CAAC,oDAAoD;SAC1E,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/esm/awsConfigClients/clients/AwsConfigEcrClient.d.ts

@@ -0,0 +1,18 @@
+import { type AwsCredentialProviderWithMetaData } from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { type AwsConfigClientContext } from '../AwsConfigClientContext.js';
+/**
+ * Config-based ECR client implementation
+ */
+export declare class AwsConfigEcrClient extends AbstractClient<AwsConfigClientContext> {
+    static readonly clientName: string;
+    constructor(options: {
+        credentials: AwsCredentialProviderWithMetaData;
+        region: string | undefined;
+    }, customContext: AwsConfigClientContext);
+    /**
+     * Register all ECR command implementations
+     */
+    protected registerCommands(): void;
+}
+//# sourceMappingURL=AwsConfigEcrClient.d.ts.map

package/dist/esm/awsConfigClients/clients/AwsConfigEcrClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigEcrClient.d.ts","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigEcrClient.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAEtE,OAAO,EAAE,KAAK,sBAAsB,EAAoB,MAAM,8BAA8B,CAAA;AAO5F;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,sBAAsB,CAAC;IAC5E,MAAM,CAAC,QAAQ,CAAC,UAAU,SAAiB;gBAGzC,OAAO,EAAE;QACP,WAAW,EAAE,iCAAiC,CAAA;QAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,EACD,aAAa,EAAE,sBAAsB;IAKvC;;OAEG;IACH,SAAS,CAAC,gBAAgB,IAAI,IAAI;CAMnC"}

package/dist/esm/awsConfigClients/clients/AwsConfigEcrClient.js

@@ -0,0 +1,119 @@
+import { DescribeRepositoriesCommand, ECRClient, GetRegistryPolicyCommand, GetRepositoryPolicyCommand, ListTagsForResourceCommand } from '@aws-sdk/client-ecr';
+import {} from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { stringifyIfPresent } from '../../utils/json.js';
+import { awsConfigCommand } from '../AwsConfigClientContext.js';
+import { executeConfigQuery, parseConfigItem, resourceStatusWhereClause } from '../awsConfigUtils.js';
+/**
+ * Config-based ECR client implementation
+ */
+export class AwsConfigEcrClient extends AbstractClient {
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    /**
+     * Register all ECR command implementations
+     */
+    registerCommands() {
+        this.registerCommand(AwsConfigDescribeRepositoriesCommand);
+        this.registerCommand(AwsConfigGetRepositoryPolicyCommand);
+        this.registerCommand(AwsConfigListTagsForResourceCommand);
+        this.registerCommand(AwsConfigGetRegistryPolicyCommand);
+    }
+}
+AwsConfigEcrClient.clientName = ECRClient.name;
+/**
+ * Config-based implementation of ECR GetRegistryPolicyCommand
+ * Uses AWS::ECR::RegistryPolicy resource type from Config
+ */
+const AwsConfigGetRegistryPolicyCommand = awsConfigCommand({
+    command: GetRegistryPolicyCommand,
+    execute: async (input, context) => {
+        const query = `
+      SELECT
+        configuration.PolicyText
+      WHERE
+        resourceType = 'AWS::ECR::RegistryPolicy'
+        AND accountId = '${context.accountId}'
+        AND awsRegion = '${context.region}'
+        AND ${resourceStatusWhereClause}
+    `;
+        const results = await executeConfigQuery(query, context);
+        if (results.length === 0) {
+            // Return undefined when no registry policy is configured
+            return {
+                policyText: undefined
+            };
+        }
+        const { configuration } = parseConfigItem(results[0]);
+        return {
+            policyText: configuration?.PolicyText ? JSON.stringify(configuration.PolicyText) : undefined
+        };
+    }
+});
+/**
+ * Config-based implementation of ECR DescribeRepositoriesCommand
+ *
+ * Note: Without repository policies, repository listing provides no meaningful IAM analysis value.
+ * ECR is primarily used for policy analysis, but policies are not available in Config.
+ * Returning empty result to indicate no actionable data available.
+ */
+const AwsConfigDescribeRepositoriesCommand = awsConfigCommand({
+    command: DescribeRepositoriesCommand,
+    execute: async (input, context) => {
+        const sql = `
+    SELECT
+      resourceId,
+      arn,
+      configuration.RepositoryName,
+      configuration.RepositoryPolicyText,
+      tags
+    WHERE
+      resourceType = 'AWS::ECR::Repository'
+      AND awsRegion = '${context.region}'
+      AND accountId = '${context.accountId}'
+      AND ${resourceStatusWhereClause}
+    `;
+        const results = await executeConfigQuery(sql, context);
+        const repositories = results.map((resultString) => {
+            const { configItem, configuration } = parseConfigItem(resultString);
+            // Cache data that will be needed by other commands
+            context.putCache(configItem.resourceId, 'configuration', configuration);
+            // Also cache by ARN for ListTagsForResourceCommand
+            context.putCache(configItem.arn, 'configuration', configuration);
+            return {
+                repositoryName: configuration.RepositoryName
+            };
+        });
+        return {
+            repositories
+        };
+    }
+});
+/**
+ * Config-based implementation of ECR GetRepositoryPolicyCommand
+ *
+ */
+const AwsConfigGetRepositoryPolicyCommand = awsConfigCommand({
+    command: GetRepositoryPolicyCommand,
+    execute: async (input, context) => {
+        const configuration = context.getCache(input.repositoryName, 'configuration');
+        return {
+            policyText: stringifyIfPresent(configuration?.RepositoryPolicyText)
+        };
+    }
+});
+/**
+ * Config-based implementation of ECR ListTagsForResourceCommand
+ *
+ */
+const AwsConfigListTagsForResourceCommand = awsConfigCommand({
+    command: ListTagsForResourceCommand,
+    execute: async (input, context) => {
+        const tags = context.getCache(input.resourceArn, 'tags');
+        return {
+            tags: tags
+        };
+    }
+});
+//# sourceMappingURL=AwsConfigEcrClient.js.map

package/dist/esm/awsConfigClients/clients/AwsConfigEcrClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigEcrClient.js","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigEcrClient.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,SAAS,EACT,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAA0C,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAA+B,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAC5F,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAE7B;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,cAAsC;IAG5E,YACE,OAGC,EACD,aAAqC;QAErC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACO,gBAAgB;QACxB,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,CAAA;QAC1D,IAAI,CAAC,eAAe,CAAC,mCAAmC,CAAC,CAAA;QACzD,IAAI,CAAC,eAAe,CAAC,mCAAmC,CAAC,CAAA;QACzD,IAAI,CAAC,eAAe,CAAC,iCAAiC,CAAC,CAAA;IACzD,CAAC;;AApBe,6BAAU,GAAG,SAAS,CAAC,IAAI,CAAA;AAuB7C;;;GAGG;AACH,MAAM,iCAAiC,GAAG,gBAAgB,CAAC;IACzD,OAAO,EAAE,wBAAwB;IACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG;;;;;2BAKS,OAAO,CAAC,SAAS;2BACjB,OAAO,CAAC,MAAM;cAC3B,yBAAyB;KAClC,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAExD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,yDAAyD;YACzD,OAAO;gBACL,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;QAErD,OAAO;YACL,UAAU,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;SAC7F,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IAC5D,OAAO,EAAE,2BAA2B;IACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG;;;;;;;;;yBASS,OAAO,CAAC,MAAM;yBACd,OAAO,CAAC,SAAS;YAC9B,yBAAyB;KAChC,CAAA;QACD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAEtD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,YAAoB,EAAE,EAAE;YACxD,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;YAEnE,mDAAmD;YACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;YACvE,mDAAmD;YACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;YAEhE,OAAO;gBACL,cAAc,EAAE,aAAa,CAAC,cAAc;aAC7C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,YAAY;SACb,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAC3D,OAAO,EAAE,0BAA0B;IACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAe,EAAE,eAAe,CAAC,CAAA;QAE9E,OAAO;YACL,UAAU,EAAE,kBAAkB,CAAC,aAAa,EAAE,oBAAoB,CAAC;SACpE,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAC3D,OAAO,EAAE,0BAA0B;IACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAY,EAAE,MAAM,CAAC,CAAA;QAEzD,OAAO;YACL,IAAI,EAAE,IAAI;SACX,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/esm/awsConfigClients/clients/AwsConfigEfsClient.d.ts

@@ -0,0 +1,18 @@
+import { type AwsCredentialProviderWithMetaData } from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { type AwsConfigClientContext } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config-based EFS client implementation
+ */
+export declare class AwsConfigEfsClient extends AbstractClient<AwsConfigClientContext> {
+    static readonly clientName: string;
+    constructor(options: {
+        credentials: AwsCredentialProviderWithMetaData;
+        region: string | undefined;
+    }, customContext: AwsConfigClientContext);
+    /**
+     * Register all EFS command implementations
+     */
+    protected registerCommands(): void;
+}
+//# sourceMappingURL=AwsConfigEfsClient.d.ts.map

package/dist/esm/awsConfigClients/clients/AwsConfigEfsClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigEfsClient.d.ts","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigEfsClient.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAEtE,OAAO,EAAE,KAAK,sBAAsB,EAAoB,MAAM,8BAA8B,CAAA;AAO5F;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,sBAAsB,CAAC;IAC5E,MAAM,CAAC,QAAQ,CAAC,UAAU,SAAiB;gBAGzC,OAAO,EAAE;QACP,WAAW,EAAE,iCAAiC,CAAA;QAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,EACD,aAAa,EAAE,sBAAsB;IAKvC;;OAEG;IACH,SAAS,CAAC,gBAAgB,IAAI,IAAI;CAInC"}

package/dist/esm/awsConfigClients/clients/AwsConfigEfsClient.js

@@ -0,0 +1,86 @@
+import { DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, EFSClient } from '@aws-sdk/client-efs';
+import {} from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { stringifyIfPresent } from '../../utils/json.js';
+import { awsConfigCommand } from '../AwsConfigClientContext.js';
+import { executeConfigQuery, parseConfigItem, resourceStatusWhereClause } from '../awsConfigUtils.js';
+/**
+ * AWS Config-based EFS client implementation
+ */
+export class AwsConfigEfsClient extends AbstractClient {
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    /**
+     * Register all EFS command implementations
+     */
+    registerCommands() {
+        this.registerCommand(AwsConfigDescribeFileSystemsCommand);
+        this.registerCommand(AwsConfigDescribeFileSystemPolicyCommand);
+    }
+}
+AwsConfigEfsClient.clientName = EFSClient.name;
+/**
+ * Config-based implementation of EFS DescribeFileSystemPolicyCommand
+ * Uses configuration.FileSystemPolicy from AWS Config
+ */
+const AwsConfigDescribeFileSystemPolicyCommand = awsConfigCommand({
+    command: DescribeFileSystemPolicyCommand,
+    execute: async (input, context) => {
+        const configuration = context.getCache(input.FileSystemId, 'configuration');
+        return {
+            FileSystemId: input.FileSystemId,
+            Policy: stringifyIfPresent(configuration?.FileSystemPolicy)
+        };
+    }
+});
+/**
+ * Config-based implementation of EFS DescribeFileSystemsCommand
+ * Retrieves file system information from AWS Config with minimal required fields
+ */
+const AwsConfigDescribeFileSystemsCommand = awsConfigCommand({
+    command: DescribeFileSystemsCommand,
+    execute: async (input, context) => {
+        let query = `
+      SELECT
+        resourceId,
+        arn,
+        configuration.Name,
+        configuration.AvailabilityZoneId,
+        configuration.KmsKeyId,
+        configuration.Encrypted,
+        configuration.CreationTime,
+        configuration.FileSystemPolicy,
+        tags
+      WHERE
+        resourceType = 'AWS::EFS::FileSystem'
+        AND awsRegion = '${context.region}'
+        AND accountId = '${context.accountId}'
+        AND ${resourceStatusWhereClause}
+    `;
+        // Add specific file system ID filter if provided
+        if (input.FileSystemId) {
+            query += ` AND resourceId = '${input.FileSystemId}'`;
+        }
+        const results = await executeConfigQuery(query, context);
+        // Transform Config results to match AWS SDK format with minimal required fields
+        const fileSystems = results.map((resultString) => {
+            const { configItem, configuration, tags } = parseConfigItem(resultString);
+            // Cache data that will be needed by other commands
+            context.putCache(configItem.resourceId, 'configuration', configuration);
+            return {
+                FileSystemId: configItem.resourceId,
+                FileSystemArn: configItem.arn,
+                Name: configuration.Name,
+                Encrypted: configuration.Encrypted || false,
+                KmsKeyId: configuration.KmsKeyId,
+                AvailabilityZoneId: configuration.AvailabilityZoneId,
+                Tags: tags
+            };
+        });
+        return {
+            FileSystems: fileSystems
+        };
+    }
+});
+//# sourceMappingURL=AwsConfigEfsClient.js.map

package/dist/esm/awsConfigClients/clients/AwsConfigEfsClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigEfsClient.js","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigEfsClient.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,SAAS,EAEV,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAA0C,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAA+B,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAC5F,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAE7B;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,cAAsC;IAG5E,YACE,OAGC,EACD,aAAqC;QAErC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACO,gBAAgB;QACxB,IAAI,CAAC,eAAe,CAAC,mCAAmC,CAAC,CAAA;QACzD,IAAI,CAAC,eAAe,CAAC,wCAAwC,CAAC,CAAA;IAChE,CAAC;;AAlBe,6BAAU,GAAG,SAAS,CAAC,IAAI,CAAA;AAqB7C;;;GAGG;AACH,MAAM,wCAAwC,GAAG,gBAAgB,CAAC;IAChE,OAAO,EAAE,+BAA+B;IACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAa,EAAE,eAAe,CAAC,CAAA;QAE5E,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,kBAAkB,CAAC,aAAa,EAAE,gBAAgB,CAAC;SAC5D,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAC3D,OAAO,EAAE,0BAA0B;IACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,IAAI,KAAK,GAAG;;;;;;;;;;;;;2BAaW,OAAO,CAAC,MAAM;2BACd,OAAO,CAAC,SAAS;cAC9B,yBAAyB;KAClC,CAAA;QAED,iDAAiD;QACjD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,KAAK,IAAI,sBAAsB,KAAK,CAAC,YAAY,GAAG,CAAA;QACtD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAExD,gFAAgF;QAChF,MAAM,WAAW,GAA4B,OAAO,CAAC,GAAG,CAAC,CAAC,YAAoB,EAAE,EAAE;YAChF,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;YAEzE,mDAAmD;YACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;YAEvE,OAAO;gBACL,YAAY,EAAE,UAAU,CAAC,UAAU;gBACnC,aAAa,EAAE,UAAU,CAAC,GAAG;gBAC7B,IAAI,EAAE,aAAa,CAAC,IAAI;gBACxB,SAAS,EAAE,aAAa,CAAC,SAAS,IAAI,KAAK;gBAC3C,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,IAAI,EAAE,IAAI;aACc,CAAA;QAC5B,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,WAAW,EAAE,WAAW;SACzB,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/esm/awsConfigClients/clients/AwsConfigEventBridgeClient.d.ts

@@ -0,0 +1,19 @@
+import { type AwsCredentialProviderWithMetaData } from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { type AwsConfigClientContext } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config-based EventBridge client implementation
+ *
+ */
+export declare class AwsConfigEventBridgeClient extends AbstractClient<AwsConfigClientContext> {
+    static readonly clientName: string;
+    constructor(options: {
+        credentials: AwsCredentialProviderWithMetaData;
+        region: string | undefined;
+    }, customContext: AwsConfigClientContext);
+    /**
+     * Register all EventBridge command implementations
+     */
+    protected registerCommands(): void;
+}
+//# sourceMappingURL=AwsConfigEventBridgeClient.d.ts.map

package/dist/esm/awsConfigClients/clients/AwsConfigEventBridgeClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigEventBridgeClient.d.ts","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigEventBridgeClient.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAAE,KAAK,sBAAsB,EAAoB,MAAM,8BAA8B,CAAA;AAO5F;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,cAAc,CAAC,sBAAsB,CAAC;IACpF,MAAM,CAAC,QAAQ,CAAC,UAAU,SAAyB;gBAGjD,OAAO,EAAE;QACP,WAAW,EAAE,iCAAiC,CAAA;QAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,EACD,aAAa,EAAE,sBAAsB;IAKvC;;OAEG;IACH,SAAS,CAAC,gBAAgB,IAAI,IAAI;CAKnC"}

package/dist/esm/awsConfigClients/clients/AwsConfigEventBridgeClient.js

@@ -0,0 +1,104 @@
+import { DescribeEventBusCommand, EventBridgeClient, ListEventBusesCommand, ListTagsForResourceCommand } from '@aws-sdk/client-eventbridge';
+import {} from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { awsConfigCommand } from '../AwsConfigClientContext.js';
+import { executeConfigQuery, parseConfigItem, resourceStatusWhereClause } from '../awsConfigUtils.js';
+/**
+ * AWS Config-based EventBridge client implementation
+ *
+ */
+export class AwsConfigEventBridgeClient extends AbstractClient {
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    /**
+     * Register all EventBridge command implementations
+     */
+    registerCommands() {
+        this.registerCommand(AwsConfigDescribeEventBusCommand);
+        this.registerCommand(AwsConfigListEventBusesCommand);
+        this.registerCommand(AwsConfigListTagsForResourceCommand);
+    }
+}
+AwsConfigEventBridgeClient.clientName = EventBridgeClient.name;
+/**
+ * Config-based implementation of EventBridge DescribeEventBusCommand
+ *
+ * Maps Events::EventBus Config data to EventBridge DescribeEventBusCommand output format.
+ * Returns event bus policy from configuration.Policy field for IAM analysis.
+ */
+const AwsConfigDescribeEventBusCommand = awsConfigCommand({
+    command: DescribeEventBusCommand,
+    execute: async (input, context) => {
+        const eventBusName = input.Name || 'default';
+        const configuration = context.getCache(eventBusName, 'configuration');
+        return {
+            Name: configuration.Name || eventBusName,
+            Arn: configuration.Arn,
+            Policy: configuration.Policy,
+            // Note: KmsKeyIdentifier is not available in Config schema
+            KmsKeyIdentifier: undefined
+        };
+    }
+});
+/**
+ * Config-based implementation of EventBridge ListEventBusesCommand
+ *
+ * Maps Events::EventBus Config data to EventBridge ListEventBusesCommand output format.
+ * Returns event bus listing for IAM analysis and resource discovery.
+ */
+const AwsConfigListEventBusesCommand = awsConfigCommand({
+    command: ListEventBusesCommand,
+    execute: async (input, context) => {
+        const query = `
+      SELECT
+        arn,
+        resourceId,
+        resourceName,
+        configuration.Name,
+        configuration.Arn,
+        configuration.EventSourceName,
+        configuration.Policy,
+        tags
+      WHERE
+        resourceType = 'AWS::Events::EventBus'
+        AND awsRegion = '${context.region}'
+        AND accountId = '${context.accountId}'
+        AND ${resourceStatusWhereClause}
+    `;
+        const results = await executeConfigQuery(query, context);
+        const eventBuses = results.map((result) => {
+            const { configItem, configuration, tags } = parseConfigItem(result);
+            // Cache data that will be needed by other commands
+            const eventBusName = configuration.Name || configItem.resourceName;
+            context.putCache(eventBusName, 'configuration', configuration);
+            context.putCache(configItem.arn, 'tags', tags);
+            return {
+                Name: configuration.Name,
+                Arn: configuration.Arn,
+                EventSourceName: configuration.EventSourceName
+            };
+        });
+        return {
+            EventBuses: eventBuses
+        };
+    }
+});
+/**
+ * Config-based implementation of EventBridge ListTagsForResourceCommand
+ *
+ * Maps Events::EventBus Config tag data to EventBridge ListTagsForResourceCommand output format.
+ * Returns event bus tags for resource identification and compliance analysis.
+ */
+const AwsConfigListTagsForResourceCommand = awsConfigCommand({
+    command: ListTagsForResourceCommand,
+    execute: async (input, context) => {
+        // Extract event bus name from ARN or use the ARN directly for resourceName lookup
+        const resourceArn = input.ResourceARN;
+        const tags = context.getCache(resourceArn, 'tags');
+        return {
+            Tags: tags
+        };
+    }
+});
+//# sourceMappingURL=AwsConfigEventBridgeClient.js.map

package/dist/esm/awsConfigClients/clients/AwsConfigEventBridgeClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigEventBridgeClient.js","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigEventBridgeClient.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,0BAA0B,EAC3B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAA0C,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAA+B,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAC5F,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAE7B;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,cAAsC;IAGpF,YACE,OAGC,EACD,aAAqC;QAErC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACO,gBAAgB;QACxB,IAAI,CAAC,eAAe,CAAC,gCAAgC,CAAC,CAAA;QACtD,IAAI,CAAC,eAAe,CAAC,8BAA8B,CAAC,CAAA;QACpD,IAAI,CAAC,eAAe,CAAC,mCAAmC,CAAC,CAAA;IAC3D,CAAC;;AAnBe,qCAAU,GAAG,iBAAiB,CAAC,IAAI,CAAA;AAsBrD;;;;;GAKG;AACH,MAAM,gCAAgC,GAAG,gBAAgB,CAAC;IACxD,OAAO,EAAE,uBAAuB;IAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,IAAI,SAAS,CAAA;QAE5C,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;QAErE,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,IAAI,IAAI,YAAY;YACxC,GAAG,EAAE,aAAa,CAAC,GAAG;YACtB,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,2DAA2D;YAC3D,gBAAgB,EAAE,SAAS;SAC5B,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;IACtD,OAAO,EAAE,qBAAqB;IAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG;;;;;;;;;;;;2BAYS,OAAO,CAAC,MAAM;2BACd,OAAO,CAAC,SAAS;cAC9B,yBAAyB;KAClC,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAExD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACxC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;YAEnE,mDAAmD;YACnD,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,IAAI,UAAU,CAAC,YAAY,CAAA;YAClE,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;YAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;YAE9C,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,IAAI;gBACxB,GAAG,EAAE,aAAa,CAAC,GAAG;gBACtB,eAAe,EAAE,aAAa,CAAC,eAAe;aAC/C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,UAAU,EAAE,UAAU;SACvB,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAC3D,OAAO,EAAE,0BAA0B;IACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,kFAAkF;QAClF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAA;QAEtC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAElD,OAAO;YACL,IAAI,EAAE,IAAI;SACX,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/esm/awsConfigClients/clients/AwsConfigGlueClient.d.ts

@@ -0,0 +1,21 @@
+import { type AwsCredentialProviderWithMetaData } from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { type AwsConfigClientContext } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config-based Glue client implementation
+ *
+ * Since policies are not available in AWS Config, this client provides limited functionality
+ * and returns empty results for all operations.
+ */
+export declare class AwsConfigGlueClient extends AbstractClient<AwsConfigClientContext> {
+    static readonly clientName: string;
+    constructor(options: {
+        credentials: AwsCredentialProviderWithMetaData;
+        region: string | undefined;
+    }, customContext: AwsConfigClientContext);
+    /**
+     * Register all Glue command implementations
+     */
+    protected registerCommands(): void;
+}
+//# sourceMappingURL=AwsConfigGlueClient.d.ts.map

package/dist/esm/awsConfigClients/clients/AwsConfigGlueClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigGlueClient.d.ts","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigGlueClient.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAAE,KAAK,sBAAsB,EAAoB,MAAM,8BAA8B,CAAA;AAE5F;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,cAAc,CAAC,sBAAsB,CAAC;IAC7E,MAAM,CAAC,QAAQ,CAAC,UAAU,SAAkB;gBAG1C,OAAO,EAAE;QACP,WAAW,EAAE,iCAAiC,CAAA;QAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,EACD,aAAa,EAAE,sBAAsB;IAKvC;;OAEG;IACH,SAAS,CAAC,gBAAgB,IAAI,IAAI;CAGnC"}

package/dist/esm/awsConfigClients/clients/AwsConfigGlueClient.js

@@ -0,0 +1,41 @@
+import { GetResourcePolicyCommand, GlueClient } from '@aws-sdk/client-glue';
+import {} from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { awsConfigCommand } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config-based Glue client implementation
+ *
+ * Since policies are not available in AWS Config, this client provides limited functionality
+ * and returns empty results for all operations.
+ */
+export class AwsConfigGlueClient extends AbstractClient {
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    /**
+     * Register all Glue command implementations
+     */
+    registerCommands() {
+        this.registerCommand(AwsConfigGetResourcePolicyCommand);
+    }
+}
+AwsConfigGlueClient.clientName = GlueClient.name;
+/**
+ * Config-based implementation of Glue GetResourcePolicyCommand
+ *
+ * Note: The Glue data catalog resource and its policies are not tracked by AWS Config.
+ * AWS Config only tracks individual Glue jobs, transforms, and classifiers - not the catalog itself.
+ * Therefore, no catalog policy analysis is possible from Config data.
+ */
+const AwsConfigGetResourcePolicyCommand = awsConfigCommand({
+    command: GetResourcePolicyCommand,
+    execute: async (input, context) => {
+        // Note: The Glue data catalog resource and its policies are not tracked by AWS Config.
+        // AWS Config only tracks individual Glue jobs, transforms, and classifiers - not the catalog itself.
+        // Therefore, no catalog policy analysis is possible from Config data.
+        return {
+            PolicyInJson: undefined // Empty - no catalog policy data available in Config
+        };
+    }
+});
+//# sourceMappingURL=AwsConfigGlueClient.js.map

package/dist/esm/awsConfigClients/clients/AwsConfigGlueClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigGlueClient.js","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigGlueClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAA0C,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAA+B,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAE5F;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,cAAsC;IAG7E,YACE,OAGC,EACD,aAAqC;QAErC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACO,gBAAgB;QACxB,IAAI,CAAC,eAAe,CAAC,iCAAiC,CAAC,CAAA;IACzD,CAAC;;AAjBe,8BAAU,GAAG,UAAU,CAAC,IAAI,CAAA;AAoB9C;;;;;;GAMG;AACH,MAAM,iCAAiC,GAAG,gBAAgB,CAAC;IACzD,OAAO,EAAE,wBAAwB;IACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,uFAAuF;QACvF,qGAAqG;QACrG,sEAAsE;QACtE,OAAO;YACL,YAAY,EAAE,SAAS,CAAC,qDAAqD;SAC9E,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/esm/awsConfigClients/clients/AwsConfigIamClient.d.ts

@@ -0,0 +1,18 @@
+import { type AwsCredentialProviderWithMetaData } from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { type AwsConfigClientContext } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config-based IAM client implementation
+ */
+export declare class AwsConfigIamClient extends AbstractClient<AwsConfigClientContext> {
+    static readonly clientName: string;
+    constructor(options: {
+        credentials: AwsCredentialProviderWithMetaData;
+        region: string | undefined;
+    }, customContext: AwsConfigClientContext);
+    /**
+     * Register all IAM command implementations
+     */
+    protected registerCommands(): void;
+}
+//# sourceMappingURL=AwsConfigIamClient.d.ts.map

package/dist/esm/awsConfigClients/clients/AwsConfigIamClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigIamClient.d.ts","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigIamClient.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAAE,KAAK,sBAAsB,EAAoB,MAAM,8BAA8B,CAAA;AAO5F;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,sBAAsB,CAAC;IAC5E,MAAM,CAAC,QAAQ,CAAC,UAAU,SAAiB;gBAGzC,OAAO,EAAE;QACP,WAAW,EAAE,iCAAiC,CAAA;QAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,EACD,aAAa,EAAE,sBAAsB;IAKvC;;OAEG;IACH,SAAS,CAAC,gBAAgB,IAAI,IAAI;CASnC"}