@actsecurity/iam-collect 0.1.215

package/dist/esm/syncs/ecr/ecrSyncs.js

@@ -0,0 +1,74 @@
+import { DescribeRepositoriesCommand, ECRClient, GetRegistryPolicyCommand, GetRepositoryPolicyCommand, ListTagsForResourceCommand } from '@aws-sdk/client-ecr';
+import { runAndCatchError } from '../../utils/client-tools.js';
+import { parseIfPresent } from '../../utils/json.js';
+import {} from '../sync.js';
+import { createResourceSyncType, createTypedSyncOperation } from '../typedSync.js';
+export const EcrSyncs = [
+    createTypedSyncOperation('ecr', 'repositories', createResourceSyncType({
+        client: ECRClient,
+        command: DescribeRepositoriesCommand,
+        key: 'repositories',
+        paginationConfig: {
+            inputKey: 'nextToken',
+            outputKey: 'nextToken'
+        },
+        arn: (repository, region, account, partition) => repositoryArn(repository, region, account, partition),
+        tags: (repository) => repository.extraFields.tags,
+        resourceTypeParts: (account, region) => ({
+            account,
+            service: 'ecr',
+            region,
+            resourceType: 'repository'
+        }),
+        extraFields: {
+            tags: async (client, repository, account, region, partition) => {
+                const result = await client.send(new ListTagsForResourceCommand({
+                    resourceArn: repositoryArn(repository, region, account, partition)
+                }));
+                return result.tags;
+            },
+            policy: async (client, repository, account, region, partition) => {
+                const policy = await runAndCatchError('RepositoryPolicyNotFoundException', async () => {
+                    const result = await client.send(new GetRepositoryPolicyCommand({
+                        repositoryName: repository.repositoryName
+                    }));
+                    return parseIfPresent(result.policyText);
+                });
+                return policy;
+            }
+        },
+        results: (repository) => ({
+            metadata: {
+                repositoryName: repository.repositoryName,
+                key: repository.encryptionConfiguration?.kmsKey
+            },
+            policy: repository.extraFields.policy
+        })
+    })),
+    {
+        awsService: 'ecr',
+        name: 'registry',
+        execute: async (accountId, region, credentials, storage, endpoint, syncOptions) => {
+            const client = syncOptions.clientPool.client(ECRClient, credentials, region, endpoint);
+            const policyText = await runAndCatchError('RegistryPolicyNotFoundException', async () => {
+                const result = await client.send(new GetRegistryPolicyCommand({}));
+                return result.policyText;
+            });
+            const policy = policyText ? JSON.parse(policyText) : undefined;
+            await storage.saveAccountMetadata(accountId, `ecr-registry-policy.${region}`, policy);
+        }
+    }
+];
+/**
+ * Make an ECR Repository ARN
+ *
+ * @param repository the ECR Repository object
+ * @param region the AWS region
+ * @param account the AWS account ID
+ * @param partition the AWS partition (e.g., 'aws', 'aws-cn', 'aws-us-gov')
+ * @returns the ARN of the ECR Repository
+ */
+function repositoryArn(repository, region, account, partition) {
+    return `arn:${partition}:ecr:${region}:${account}:repository/${repository.repositoryName}`;
+}
+//# sourceMappingURL=ecrSyncs.js.map

package/dist/esm/syncs/ecr/ecrSyncs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecrSyncs.js","sourceRoot":"","sources":["../../../../src/syncs/ecr/ecrSyncs.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,SAAS,EACT,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAE3B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAa,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAElF,MAAM,CAAC,MAAM,QAAQ,GAAW;IAC9B,wBAAwB,CACtB,KAAK,EACL,cAAc,EACd,sBAAsB,CAAC;QACrB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,2BAA2B;QACpC,GAAG,EAAE,cAAc;QACnB,gBAAgB,EAAE;YAChB,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,WAAW;SACvB;QACD,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAC9C,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;QACvD,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI;QACjD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO;YACP,OAAO,EAAE,KAAK;YACd,MAAM;YACN,YAAY,EAAE,YAAY;SAC3B,CAAC;QACF,WAAW,EAAE;YACX,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;gBAC7D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,0BAA0B,CAAC;oBAC7B,WAAW,EAAE,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;iBACnE,CAAC,CACH,CAAA;gBACD,OAAO,MAAM,CAAC,IAAI,CAAA;YACpB,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;gBAC/D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;oBACpF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,0BAA0B,CAAC;wBAC7B,cAAc,EAAE,UAAU,CAAC,cAAc;qBAC1C,CAAC,CACH,CAAA;oBACD,OAAO,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC,CAAC,CAAA;gBAEF,OAAO,MAAM,CAAA;YACf,CAAC;SACF;QACD,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACxB,QAAQ,EAAE;gBACR,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,GAAG,EAAE,UAAU,CAAC,uBAAuB,EAAE,MAAM;aAChD;YACD,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM;SACtC,CAAC;KACH,CAAC,CACH;IACD;QACE,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YAChF,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;YACtF,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;gBACtF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAA;gBAClE,OAAO,MAAM,CAAC,UAAU,CAAA;YAC1B,CAAC,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC9D,MAAM,OAAO,CAAC,mBAAmB,CAAC,SAAS,EAAE,uBAAuB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;QACvF,CAAC;KACF;CACF,CAAA;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,UAAsB,EACtB,MAAc,EACd,OAAe,EACf,SAAiB;IAEjB,OAAO,OAAO,SAAS,QAAQ,MAAM,IAAI,OAAO,eAAe,UAAU,CAAC,cAAc,EAAE,CAAA;AAC5F,CAAC"}

package/dist/esm/syncs/efs/fileSystems.d.ts

@@ -0,0 +1,2 @@
+export declare const ElasticFileSystemsSync: import("../sync.js").Sync;
+//# sourceMappingURL=fileSystems.d.ts.map

package/dist/esm/syncs/efs/fileSystems.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileSystems.d.ts","sourceRoot":"","sources":["../../../../src/syncs/efs/fileSystems.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,sBAAsB,2BAwClC,CAAA"}

package/dist/esm/syncs/efs/fileSystems.js

@@ -0,0 +1,40 @@
+import { DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, EFSClient } from '@aws-sdk/client-efs';
+import { runAndCatch404 } from '../../utils/client-tools.js';
+import { parseIfPresent } from '../../utils/json.js';
+import { createResourceSyncType, createTypedSyncOperation } from '../typedSync.js';
+export const ElasticFileSystemsSync = createTypedSyncOperation('elasticfilesystem', 'fileSystems', createResourceSyncType({
+    client: EFSClient,
+    command: DescribeFileSystemsCommand,
+    key: 'FileSystems',
+    paginationConfig: {
+        inputKey: 'Marker',
+        outputKey: 'NextMarker'
+    },
+    resourceTypeParts: (accountId, region) => ({
+        service: 'elasticfilesystem',
+        resourceType: 'file-system',
+        account: accountId,
+        region: region
+    }),
+    extraFields: {
+        policy: async (client, fileSystem) => {
+            return runAndCatch404(async () => {
+                const policyResult = await client.send(new DescribeFileSystemPolicyCommand({ FileSystemId: fileSystem.FileSystemId }));
+                return parseIfPresent(policyResult.Policy);
+            });
+        }
+    },
+    tags: (fileSystem) => fileSystem.Tags,
+    arn: (fileSystem) => fileSystem.FileSystemArn,
+    results: (fileSystem) => ({
+        metadata: {
+            name: fileSystem.Name,
+            id: fileSystem.FileSystemId,
+            az: fileSystem.AvailabilityZoneId,
+            key: fileSystem.KmsKeyId,
+            encrypted: fileSystem.Encrypted
+        },
+        policy: fileSystem.extraFields.policy
+    })
+}));
+//# sourceMappingURL=fileSystems.js.map

package/dist/esm/syncs/efs/fileSystems.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileSystems.js","sourceRoot":"","sources":["../../../../src/syncs/efs/fileSystems.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,SAAS,EACV,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAElF,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAC5D,mBAAmB,EACnB,aAAa,EACb,sBAAsB,CAAC;IACrB,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,0BAA0B;IACnC,GAAG,EAAE,aAAa;IAClB,gBAAgB,EAAE;QAChB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,YAAY;KACxB;IACD,iBAAiB,EAAE,CAAC,SAAiB,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,mBAAmB;QAC5B,YAAY,EAAE,aAAa;QAC3B,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,MAAM;KACf,CAAC;IACF,WAAW,EAAE;QACX,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE;YACnC,OAAO,cAAc,CAAC,KAAK,IAAI,EAAE;gBAC/B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CACpC,IAAI,+BAA+B,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAC/E,CAAA;gBACD,OAAO,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;QACJ,CAAC;KACF;IACD,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI;IACrC,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,aAAc;IAC9C,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACxB,QAAQ,EAAE;YACR,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,EAAE,EAAE,UAAU,CAAC,kBAAkB;YACjC,GAAG,EAAE,UAAU,CAAC,QAAQ;YACxB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC;QACD,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM;KACtC,CAAC;CACH,CAAC,CACH,CAAA"}

package/dist/esm/syncs/eks/accessEntries.d.ts

@@ -0,0 +1,8 @@
+import { type Sync } from '../sync.js';
+/**
+ * Syncs EKS clusters and their access entries. Access entries map IAM principals to
+ * Kubernetes permissions and only exist on clusters with the API or API_AND_CONFIG_MAP
+ * authentication mode.
+ */
+export declare const EksAccessEntriesSync: Sync;
+//# sourceMappingURL=accessEntries.d.ts.map

package/dist/esm/syncs/eks/accessEntries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessEntries.d.ts","sourceRoot":"","sources":["../../../../src/syncs/eks/accessEntries.ts"],"names":[],"mappings":"AASA,OAAO,EAAmB,KAAK,IAAI,EAAY,MAAM,YAAY,CAAA;AAQjE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAsHlC,CAAA"}

package/dist/esm/syncs/eks/accessEntries.js

@@ -0,0 +1,88 @@
+import { DescribeAccessEntryCommand, DescribeClusterCommand, EKSClient, ListAccessEntriesCommand, ListAssociatedAccessPoliciesCommand, ListClustersCommand } from '@aws-sdk/client-eks';
+import { runAndCatch404, runAndCatchAccessDeniedWithLog } from '../../utils/client-tools.js';
+import { syncData } from '../sync.js';
+import { paginateResource } from '../typedSync.js';
+const paginationConfig = {
+    inputKey: 'nextToken',
+    outputKey: 'nextToken'
+};
+/**
+ * Syncs EKS clusters and their access entries. Access entries map IAM principals to
+ * Kubernetes permissions and only exist on clusters with the API or API_AND_CONFIG_MAP
+ * authentication mode.
+ */
+export const EksAccessEntriesSync = {
+    awsService: 'eks',
+    name: 'accessEntries',
+    execute: async (accountId, region, credentials, storage, endpoint, syncOptions) => {
+        const eksClient = syncOptions.clientPool.client(EKSClient, credentials, region, endpoint);
+        const clusterNames = await paginateResource(eksClient, ListClustersCommand, 'clusters', paginationConfig);
+        const clusterRecords = [];
+        const accessEntryRecords = [];
+        for (const clusterName of clusterNames) {
+            const describeResult = await runAndCatch404(async () => {
+                return eksClient.send(new DescribeClusterCommand({ name: clusterName }));
+            });
+            const cluster = describeResult?.cluster;
+            if (!cluster?.arn) {
+                continue;
+            }
+            const authenticationMode = cluster.accessConfig?.authenticationMode;
+            clusterRecords.push({
+                arn: cluster.arn,
+                metadata: {
+                    name: cluster.name,
+                    arn: cluster.arn,
+                    authenticationMode
+                },
+                tags: cluster.tags
+            });
+            // Access entries can only be listed when API authentication is enabled.
+            if (authenticationMode !== 'API' && authenticationMode !== 'API_AND_CONFIG_MAP') {
+                continue;
+            }
+            const principalArns = await paginateResource(eksClient, ListAccessEntriesCommand, 'accessEntries', paginationConfig, { clusterName });
+            for (const principalArn of principalArns) {
+                const describeEntryResult = await runAndCatch404(async () => {
+                    return eksClient.send(new DescribeAccessEntryCommand({ clusterName, principalArn }));
+                });
+                const accessEntry = describeEntryResult?.accessEntry;
+                if (!accessEntry?.accessEntryArn) {
+                    continue;
+                }
+                const associatedAccessPolicies = await runAndCatchAccessDeniedWithLog(accessEntry.accessEntryArn, 'eks', 'accessEntry', 'accessPolicies', async () => {
+                    return paginateResource(eksClient, ListAssociatedAccessPoliciesCommand, 'associatedAccessPolicies', paginationConfig, { clusterName, principalArn });
+                });
+                accessEntryRecords.push({
+                    arn: accessEntry.accessEntryArn,
+                    metadata: {
+                        arn: accessEntry.accessEntryArn,
+                        clusterName: accessEntry.clusterName,
+                        principalArn: accessEntry.principalArn,
+                        username: accessEntry.username,
+                        type: accessEntry.type,
+                        kubernetesGroups: accessEntry.kubernetesGroups
+                    },
+                    accessPolicies: associatedAccessPolicies?.map((policy) => ({
+                        policyArn: policy.policyArn,
+                        accessScope: policy.accessScope
+                    })),
+                    tags: accessEntry.tags
+                });
+            }
+        }
+        await syncData(clusterRecords, storage, accountId, {
+            service: 'eks',
+            resourceType: 'cluster',
+            account: accountId,
+            region: region
+        }, syncOptions.writeOnly);
+        await syncData(accessEntryRecords, storage, accountId, {
+            service: 'eks',
+            resourceType: 'access-entry',
+            account: accountId,
+            region: region
+        }, syncOptions.writeOnly);
+    }
+};
+//# sourceMappingURL=accessEntries.js.map

package/dist/esm/syncs/eks/accessEntries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessEntries.js","sourceRoot":"","sources":["../../../../src/syncs/eks/accessEntries.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,SAAS,EACT,wBAAwB,EACxB,mCAAmC,EACnC,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAA;AAC5F,OAAO,EAA8B,QAAQ,EAAE,MAAM,YAAY,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAElD,MAAM,gBAAgB,GAAG;IACvB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,WAAW;CACd,CAAA;AAEV;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAS;IACxC,UAAU,EAAE,KAAK;IACjB,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;QAChF,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzF,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,SAAS,EACT,mBAAmB,EACnB,UAAU,EACV,gBAAgB,CACjB,CAAA;QAED,MAAM,cAAc,GAAiB,EAAE,CAAA;QACvC,MAAM,kBAAkB,GAAiB,EAAE,CAAA;QAE3C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,KAAK,IAAI,EAAE;gBACrD,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;YAC1E,CAAC,CAAC,CAAA;YACF,MAAM,OAAO,GAAG,cAAc,EAAE,OAAO,CAAA;YACvC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;gBAClB,SAAQ;YACV,CAAC;YAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,kBAAkB,CAAA;YACnE,cAAc,CAAC,IAAI,CAAC;gBAClB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,kBAAkB;iBACnB;gBACD,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAA;YAEF,wEAAwE;YACxE,IAAI,kBAAkB,KAAK,KAAK,IAAI,kBAAkB,KAAK,oBAAoB,EAAE,CAAC;gBAChF,SAAQ;YACV,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,SAAS,EACT,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,EAAE,WAAW,EAAE,CAChB,CAAA;YAED,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,MAAM,mBAAmB,GAAG,MAAM,cAAc,CAAC,KAAK,IAAI,EAAE;oBAC1D,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;gBACtF,CAAC,CAAC,CAAA;gBACF,MAAM,WAAW,GAAG,mBAAmB,EAAE,WAAW,CAAA;gBACpD,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC;oBACjC,SAAQ;gBACV,CAAC;gBAED,MAAM,wBAAwB,GAAG,MAAM,8BAA8B,CACnE,WAAW,CAAC,cAAc,EAC1B,KAAK,EACL,aAAa,EACb,gBAAgB,EAChB,KAAK,IAAI,EAAE;oBACT,OAAO,gBAAgB,CACrB,SAAS,EACT,mCAAmC,EACnC,0BAA0B,EAC1B,gBAAgB,EAChB,EAAE,WAAW,EAAE,YAAY,EAAE,CAC9B,CAAA;gBACH,CAAC,CACF,CAAA;gBAED,kBAAkB,CAAC,IAAI,CAAC;oBACtB,GAAG,EAAE,WAAW,CAAC,cAAc;oBAC/B,QAAQ,EAAE;wBACR,GAAG,EAAE,WAAW,CAAC,cAAc;wBAC/B,WAAW,EAAE,WAAW,CAAC,WAAW;wBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;wBACtC,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;wBACtB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;qBAC/C;oBACD,cAAc,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;wBACzD,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;qBAChC,CAAC,CAAC;oBACH,IAAI,EAAE,WAAW,CAAC,IAAI;iBACvB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,CACZ,cAAc,EACd,OAAO,EACP,SAAS,EACT;YACE,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,SAAS;YACvB,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,MAAM;SACf,EACD,WAAW,CAAC,SAAS,CACtB,CAAA;QAED,MAAM,QAAQ,CACZ,kBAAkB,EAClB,OAAO,EACP,SAAS,EACT;YACE,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,cAAc;YAC5B,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,MAAM;SACf,EACD,WAAW,CAAC,SAAS,CACtB,CAAA;IACH,CAAC;CACF,CAAA"}

package/dist/esm/syncs/events/eventBuses.d.ts

@@ -0,0 +1,2 @@
+export declare const EventBridgeEventBusesSync: import("../sync.js").Sync;
+//# sourceMappingURL=eventBuses.d.ts.map

package/dist/esm/syncs/events/eventBuses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eventBuses.d.ts","sourceRoot":"","sources":["../../../../src/syncs/events/eventBuses.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,yBAAyB,2BAiDrC,CAAA"}

package/dist/esm/syncs/events/eventBuses.js

@@ -0,0 +1,47 @@
+import { DescribeEventBusCommand, EventBridgeClient, ListEventBusesCommand, ListTagsForResourceCommand } from '@aws-sdk/client-eventbridge';
+import { runAndCatch404 } from '../../utils/client-tools.js';
+import { parseIfPresent } from '../../utils/json.js';
+import { createResourceSyncType, createTypedSyncOperation } from '../typedSync.js';
+export const EventBridgeEventBusesSync = createTypedSyncOperation('events', 'eventBuses', createResourceSyncType({
+    client: EventBridgeClient,
+    command: ListEventBusesCommand,
+    key: 'EventBuses',
+    paginationConfig: {
+        inputKey: 'NextToken',
+        outputKey: 'NextToken'
+    },
+    arn: (eventBus) => eventBus.Arn,
+    resourceTypeParts: (accountId, region) => ({
+        service: 'events',
+        resourceType: 'event-bus',
+        account: accountId,
+        region: region
+    }),
+    extraFields: {
+        details: async (client, eventBus) => {
+            return runAndCatch404(async () => {
+                const result = await client.send(new DescribeEventBusCommand({
+                    Name: eventBus.Name
+                }));
+                return result;
+            });
+        },
+        tags: async (client, eventBus, accountId, region, partition) => {
+            return runAndCatch404(async () => {
+                const result = await client.send(new ListTagsForResourceCommand({
+                    ResourceARN: eventBus.Arn
+                }));
+                return result.Tags;
+            });
+        }
+    },
+    tags: (eventBus) => eventBus.extraFields.tags,
+    results: (eventBus) => ({
+        metadata: {
+            name: eventBus.Name,
+            kmsKey: eventBus.extraFields.details?.KmsKeyIdentifier
+        },
+        policy: parseIfPresent(eventBus.extraFields.details?.Policy)
+    })
+}));
+//# sourceMappingURL=eventBuses.js.map

package/dist/esm/syncs/events/eventBuses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eventBuses.js","sourceRoot":"","sources":["../../../../src/syncs/events/eventBuses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,0BAA0B,EAC3B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAElF,MAAM,CAAC,MAAM,yBAAyB,GAAG,wBAAwB,CAC/D,QAAQ,EACR,YAAY,EACZ,sBAAsB,CAAC;IACrB,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,qBAAqB;IAC9B,GAAG,EAAE,YAAY;IACjB,gBAAgB,EAAE;QAChB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,WAAW;KACvB;IACD,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAI;IAChC,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,QAAQ;QACjB,YAAY,EAAE,WAAW;QACzB,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,MAAM;KACf,CAAC;IACF,WAAW,EAAE;QACX,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YAClC,OAAO,cAAc,CAAC,KAAK,IAAI,EAAE;gBAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,uBAAuB,CAAC;oBAC1B,IAAI,EAAE,QAAQ,CAAC,IAAI;iBACpB,CAAC,CACH,CAAA;gBACD,OAAO,MAAM,CAAA;YACf,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;YAC7D,OAAO,cAAc,CAAC,KAAK,IAAI,EAAE;gBAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,0BAA0B,CAAC;oBAC7B,WAAW,EAAE,QAAQ,CAAC,GAAI;iBAC3B,CAAC,CACH,CAAA;gBACD,OAAO,MAAM,CAAC,IAAI,CAAA;YACpB,CAAC,CAAC,CAAA;QACJ,CAAC;KACF;IACD,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI;IAC7C,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,gBAAgB;SACvD;QACD,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC;KAC7D,CAAC;CACH,CAAC,CACH,CAAA"}

package/dist/esm/syncs/glue/catalogs.d.ts

@@ -0,0 +1,3 @@
+import { type Sync } from '../sync.js';
+export declare const GlueCatalogSync: Sync;
+//# sourceMappingURL=catalogs.d.ts.map

package/dist/esm/syncs/glue/catalogs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogs.d.ts","sourceRoot":"","sources":["../../../../src/syncs/glue/catalogs.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,eAAO,MAAM,eAAe,EAAE,IAqB7B,CAAA"}

package/dist/esm/syncs/glue/catalogs.js

@@ -0,0 +1,37 @@
+import { GetResourcePolicyCommand, GlueClient } from '@aws-sdk/client-glue';
+import { runAndCatchError } from '../../utils/client-tools.js';
+import { parseIfPresent } from '../../utils/json.js';
+import {} from '../sync.js';
+export const GlueCatalogSync = {
+    name: 'GlueCatalogSync',
+    awsService: 'glue',
+    execute: async (accountId, region, credentials, storage, endpoint, syncOptions) => {
+        const glueClient = syncOptions.clientPool.client(GlueClient, credentials, region, endpoint);
+        const policy = await runAndCatchError('EntityNotFoundException', async () => {
+            const result = await glueClient.send(new GetResourcePolicyCommand());
+            return parseIfPresent(result.PolicyInJson);
+        });
+        const arn = rootCatalogArn(credentials.partition, accountId, region);
+        if (policy) {
+            await storage.saveResourceMetadata(accountId, arn, 'policy', policy);
+            await storage.saveResourceMetadata(accountId, arn, 'metadata', {
+                arn
+            });
+        }
+        else {
+            await storage.deleteResource(accountId, arn);
+        }
+    }
+};
+/**
+ * Get the ARN for a root Glue catalog
+ *
+ * @param partition the partition (aws, aws-cn, aws-us-gov)
+ * @param accountId the account id
+ * @param region the region
+ * @returns the ARN for the root Glue catalog
+ */
+function rootCatalogArn(partition, accountId, region) {
+    return `arn:${partition}:glue:${region}:${accountId}:catalog`;
+}
+//# sourceMappingURL=catalogs.js.map

package/dist/esm/syncs/glue/catalogs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogs.js","sourceRoot":"","sources":["../../../../src/syncs/glue/catalogs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAa,MAAM,YAAY,CAAA;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAS;IACnC,IAAI,EAAE,iBAAiB;IACvB,UAAU,EAAE,MAAM;IAClB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;QAChF,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAE3F,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,wBAAwB,EAAE,CAAC,CAAA;YACpE,OAAO,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QACpE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YACpE,MAAM,OAAO,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE;gBAC7D,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;CACF,CAAA;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,SAAiB,EAAE,SAAiB,EAAE,MAAc;IAC1E,OAAO,OAAO,SAAS,SAAS,MAAM,IAAI,SAAS,UAAU,CAAA;AAC/D,CAAC"}

package/dist/esm/syncs/iam/authorizationDetails.d.ts

@@ -0,0 +1,23 @@
+import { type GroupDetail, IAMClient, type ManagedPolicyDetail, type RoleDetail, type Tag, type UserDetail } from '@aws-sdk/client-iam';
+import { ConcurrentWorkerPool } from '@actsecurity/job';
+import { type Sync } from '../sync.js';
+export declare const AuthorizationDetailsSync: Sync;
+interface ManagedPolicyDetailWithExtraData extends ManagedPolicyDetail {
+    Tags?: Tag[];
+}
+/**
+ * Return the results of the Authorization Details call for this account.
+ * Excludes users and AWS managed policies.
+ *
+ * @param credentials The credentials to use for the API call
+ * @returns Returns the results of the Authorization Details call for this account
+ */
+export declare function getAuthorizationDetails(client: IAMClient, concurrentWorkerPool: ConcurrentWorkerPool<any, any>, customConfig?: Record<string, any>): Promise<{
+    groups: GroupDetail[];
+    roles: RoleDetail[];
+    policies: ManagedPolicyDetailWithExtraData[];
+    awsManagedPolicies: ManagedPolicyDetail[];
+    users: UserDetail[];
+}>;
+export {};
+//# sourceMappingURL=authorizationDetails.d.ts.map

package/dist/esm/syncs/iam/authorizationDetails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizationDetails.d.ts","sourceRoot":"","sources":["../../../../src/syncs/iam/authorizationDetails.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,WAAW,EAChB,SAAS,EAET,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,GAAG,EACR,KAAK,UAAU,EAChB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,oBAAoB,EAAY,MAAM,kBAAkB,CAAA;AAMjE,OAAO,EAAE,KAAK,IAAI,EAA8B,MAAM,YAAY,CAAA;AAElE,eAAO,MAAM,wBAAwB,EAAE,IAoLtC,CAAA;AAED,UAAU,gCAAiC,SAAQ,mBAAmB;IACpE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;CACb;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,SAAS,EACjB,oBAAoB,EAAE,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,EACpD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,OAAO,CAAC;IACT,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB,QAAQ,EAAE,gCAAgC,EAAE,CAAA;IAC5C,kBAAkB,EAAE,mBAAmB,EAAE,CAAA;IACzC,KAAK,EAAE,UAAU,EAAE,CAAA;CACpB,CAAC,CAiDD"}