@actsecurity/iam-collect 0.1.215

package/dist/esm/syncs/organizations/organizations.js

@@ -0,0 +1,410 @@
+import { DescribeOrganizationCommand, DescribePolicyCommand, DescribeResourcePolicyCommand, ListAccountsForParentCommand, ListDelegatedAdministratorsCommand, ListDelegatedServicesForAccountCommand, ListOrganizationalUnitsForParentCommand, ListPoliciesCommand, ListPoliciesForTargetCommand, ListRootsCommand, ListTagsForResourceCommand, OrganizationsClient, PolicyType, PolicyTypeStatus } from '@aws-sdk/client-organizations';
+import {} from '../../aws/coreAuth.js';
+import {} from '../../persistence/AwsIamStore.js';
+import { runAndCatch404, runAndCatchAccessDenied, runAndCatchAccessDeniedWithLog } from '../../utils/client-tools.js';
+import { convertTagsToRecord } from '../../utils/tags.js';
+import {} from '../sync.js';
+import { paginateResource } from '../typedSync.js';
+export const OrganizationSync = {
+    awsService: 'organizations',
+    name: 'organization',
+    global: true,
+    execute: async function (accountId, region, credentials, storage, endpoint, syncOptions) {
+        var _a;
+        const organizationClient = syncOptions.clientPool.client(OrganizationsClient, credentials, region, endpoint);
+        const organization = await getOrganizationDetails(organizationClient);
+        if (!organization) {
+            await saveOrgForAccount(storage, accountId, undefined);
+            return;
+        }
+        const organizationId = organization.Id;
+        const root = await getOrganizationRoot(organizationClient);
+        if (!root) {
+            await saveOrgForAccount(storage, accountId, undefined);
+            return;
+        }
+        const features = root.PolicyTypes?.reduce((acc, type) => {
+            acc[type.Type] = type.Status === PolicyTypeStatus.ENABLED;
+            return acc;
+        }, {}) || {};
+        const scpsEnabled = !!features[PolicyType.SERVICE_CONTROL_POLICY];
+        const rcpsEnabled = !!features[PolicyType.RESOURCE_CONTROL_POLICY];
+        const s3PoliciesEnabled = !!features[PolicyType.S3_POLICY];
+        const allAccounts = {};
+        const allOus = {};
+        const ouDetails = {};
+        allOus[root.Id] = {
+            parent: undefined,
+            scps: await getPoliciesForTarget(organizationClient, root.Id, PolicyType.SERVICE_CONTROL_POLICY, scpsEnabled),
+            rcps: await getPoliciesForTarget(organizationClient, root.Id, PolicyType.RESOURCE_CONTROL_POLICY, rcpsEnabled),
+            s3Policies: await getPoliciesForTarget(organizationClient, root.Id, PolicyType.S3_POLICY, s3PoliciesEnabled)
+        };
+        ouDetails[root.Id] = await getOuDetails(organizationClient, root);
+        const structure = {
+            [root.Id]: {
+                children: {},
+                accounts: []
+            }
+        };
+        // const children = await getChildOrgUnits(organizationClient, root.Id!)
+        const parents = [structure];
+        let parent = parents.pop();
+        while (parent) {
+            for (const key in parent) {
+                // Get structure information
+                const children = await getChildOrgUnits(organizationClient, key);
+                for (const child of children) {
+                    ouDetails[child.Id] = await getOuDetails(organizationClient, child);
+                    const childId = child.Id;
+                    allOus[childId] = {
+                        parent: key,
+                        scps: await getPoliciesForTarget(organizationClient, childId, PolicyType.SERVICE_CONTROL_POLICY, scpsEnabled),
+                        rcps: await getPoliciesForTarget(organizationClient, childId, PolicyType.RESOURCE_CONTROL_POLICY, rcpsEnabled),
+                        s3Policies: await getPoliciesForTarget(organizationClient, childId, PolicyType.S3_POLICY, s3PoliciesEnabled)
+                    };
+                    (_a = parent[key]).children || (_a.children = {});
+                    parent[key].children[childId] = {
+                        children: undefined,
+                        accounts: undefined
+                    };
+                }
+                const accounts = await getAccountsForParent(organizationClient, key);
+                if (accounts.length > 0) {
+                    parent[key].accounts = [];
+                }
+                for (const account of accounts) {
+                    const accountTags = await getTagsForAccount(organizationClient, account.Id);
+                    allAccounts[account.Id] = {
+                        ou: key,
+                        scps: await getPoliciesForTarget(organizationClient, account.Id, PolicyType.SERVICE_CONTROL_POLICY, scpsEnabled),
+                        rcps: await getPoliciesForTarget(organizationClient, account.Id, PolicyType.RESOURCE_CONTROL_POLICY, rcpsEnabled),
+                        s3Policies: await getPoliciesForTarget(organizationClient, account.Id, PolicyType.S3_POLICY, s3PoliciesEnabled),
+                        tags: accountTags
+                    };
+                    parent[key].accounts.push(account.Arn);
+                }
+                // parent[key].accounts = accounts.map((a) => a.Arn!)
+                if (parent[key].children) {
+                    parents.push(parent[key].children);
+                }
+            }
+            parent = parents.pop();
+        }
+        // Get delegated administrators
+        const delegatedAdministrators = await getDelegatedAdministrators(organizationClient, organization.Arn);
+        storage.saveOrganizationMetadata(organizationId, 'structure', structure);
+        storage.saveOrganizationMetadata(organizationId, 'metadata', {
+            id: organizationId,
+            arn: organization.Arn,
+            rootOu: root.Id,
+            rootAccountArn: organization.MasterAccountArn,
+            rootAccountId: organization.MasterAccountId,
+            features
+        });
+        storage.saveOrganizationMetadata(organizationId, 'accounts', allAccounts);
+        storage.saveOrganizationMetadata(organizationId, 'ous', allOus);
+        storage.saveOrganizationMetadata(organizationId, 'delegated-admins', delegatedAdministrators);
+        // Sync OUs
+        if (!syncOptions.writeOnly) {
+            const persistedOus = await storage.listOrganizationalUnits(organizationId);
+            const newOus = new Set(Object.keys(ouDetails));
+            const deletedOus = persistedOus.filter((ou) => !newOus.has(ou));
+            for (const ouToDelete of deletedOus) {
+                await storage.deleteOrganizationalUnit(organizationId, ouToDelete);
+            }
+        }
+        for (const ouId of Object.keys(ouDetails)) {
+            const ou = ouDetails[ouId];
+            await storage.saveOrganizationalUnitMetadata(organizationId, ouId, 'metadata', ou.metadata);
+            await storage.saveOrganizationalUnitMetadata(organizationId, ouId, 'tags', ou.tags);
+        }
+        // Sync policies
+        await syncPolicies(organizationId, organizationClient, storage, PolicyType.SERVICE_CONTROL_POLICY, 'scps', scpsEnabled, syncOptions.writeOnly);
+        await syncPolicies(organizationId, organizationClient, storage, PolicyType.RESOURCE_CONTROL_POLICY, 'rcps', rcpsEnabled, syncOptions.writeOnly);
+        await syncPolicies(organizationId, organizationClient, storage, PolicyType.S3_POLICY, 's3-policies', s3PoliciesEnabled, syncOptions.writeOnly);
+        // Sync organization resource policy
+        await syncOrganizationResourcePolicy(organizationClient, storage, organizationId);
+        await saveOrgForAccount(storage, accountId, organizationId);
+    }
+};
+/**
+ * Get the details of an organization or an account.
+ *
+ * @param client The OrganizationsClient to use
+ * @returns the details of the organization the account belongs to or undefined if the account is not part of an organization or does not have permission.
+ */
+export async function getOrganizationDetails(client) {
+    const command = new DescribeOrganizationCommand();
+    try {
+        const response = await runAndCatch404(() => client.send(command));
+        if (!response) {
+            return undefined;
+        }
+        return response.Organization;
+    }
+    catch (e) {
+        if (e.name === 'AWSOrganizationsNotInUseException') {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+/**
+ * Get the root Organizational Unit for an organization
+ *
+ * @param client The OrganizationsClient to use
+ * @returns the root Organizational Unit for the organization if it exists
+ */
+export async function getOrganizationRoot(client) {
+    return runAndCatchAccessDenied(async () => {
+        const roots = await paginateResource(client, ListRootsCommand, 'Roots', {
+            inputKey: 'NextToken',
+            outputKey: 'NextToken'
+        }, {});
+        return roots.at(0);
+    });
+}
+/**
+ * Get the delegated administrators for an organization
+ *
+ * @param client The OrganizationsClient to use
+ * @param organizationArn The ARN of the organization
+ * @returns a map of service principals to account IDs that are delegated administrators for those services
+ */
+export async function getDelegatedAdministrators(client, organizationArn) {
+    const result = await runAndCatchAccessDeniedWithLog(organizationArn, 'organizations', 'organization', 'delegatedAdministrators', async () => {
+        const delegatedAdmins = await paginateResource(client, ListDelegatedAdministratorsCommand, 'DelegatedAdministrators', {
+            inputKey: 'NextToken',
+            outputKey: 'NextToken'
+        });
+        // Create a map of service principals to account IDs
+        const servicePrincipalMap = {};
+        // For each delegated administrator, get the services they manage sequentially
+        for (const admin of delegatedAdmins) {
+            const delegatedServices = await runAndCatchAccessDeniedWithLog(admin.Arn, 'organizations', 'delegatedAdministrator', 'delegatedServices', async () => {
+                const services = await paginateResource(client, ListDelegatedServicesForAccountCommand, 'DelegatedServices', {
+                    inputKey: 'NextToken',
+                    outputKey: 'NextToken'
+                }, { AccountId: admin.Id });
+                return services;
+            });
+            // Add this account to each service principal it manages
+            if (delegatedServices) {
+                for (const service of delegatedServices) {
+                    const servicePrincipal = service.ServicePrincipal;
+                    if (!servicePrincipalMap[servicePrincipal]) {
+                        servicePrincipalMap[servicePrincipal] = [];
+                    }
+                    servicePrincipalMap[servicePrincipal].push(admin.Id);
+                }
+            }
+        }
+        return servicePrincipalMap;
+    });
+    return result || {};
+}
+/**
+ * Get the tags for an Organizational Unit
+ *
+ * @param client The OrganizationsClient to use
+ * @param ouId The AWS id of the Organizational Unit to get the tags for
+ * @returns The tags for the Organizational Unit
+ */
+export async function getTagsForOu(client, ouId) {
+    return getTags(client, ouId);
+}
+/**
+ * Get the tags for an account
+ * @param client The OrganizationsClient to use
+ * @param accountId The AWS id of the account to get the tags for
+ * @returns The tags for the account
+ */
+export async function getTagsForAccount(client, accountId) {
+    return getTags(client, accountId);
+}
+/**
+ * Get the tags for a resource in AWS Organizations
+ *
+ * @param client The OrganizationsClient to use
+ * @param resourceId The AWS id of the resource to get the tags for
+ * @returns The tags for the resource
+ */
+async function getTags(client, resourceId) {
+    const command = new ListTagsForResourceCommand({ ResourceId: resourceId });
+    const response = await runAndCatch404(() => client.send(command));
+    if (!response) {
+        return {};
+    }
+    return convertTagsToRecord(response.Tags);
+}
+/**
+ * Get the organizational units for a parent organizational unit
+ *
+ * @param client The OrganizationsClient to use
+ * @param parentId The AWS id of the parent organizational unit
+ * @returns The organizational units directly under the parent
+ */
+export async function getChildOrgUnits(client, parentId) {
+    return await paginateResource(client, ListOrganizationalUnitsForParentCommand, 'OrganizationalUnits', { inputKey: 'NextToken', outputKey: 'NextToken' }, { ParentId: parentId });
+}
+/**
+ * Get the accounts for a parent organizational unit
+ *
+ * @param client The OrganizationsClient to use
+ * @param parentId The AWS id of the parent organizational unit
+ * @returns The accounts directly under the parent
+ */
+export async function getAccountsForParent(client, parentId) {
+    const accounts = await paginateResource(client, ListAccountsForParentCommand, 'Accounts', {
+        inputKey: 'NextToken',
+        outputKey: 'NextToken'
+    }, { ParentId: parentId });
+    return accounts;
+}
+/**
+ * Get the details of an Organizational Unit (OU).
+ *
+ * @param organizationClient the OrganizationsClient to use
+ * @param ou the Organizational Unit to get the details for
+ * @returns an object containing the OU's tags and metadata
+ */
+async function getOuDetails(organizationClient, ou) {
+    return {
+        tags: await getTagsForOu(organizationClient, ou.Id),
+        metadata: {
+            arn: ou.Arn,
+            name: ou.Name
+        }
+    };
+}
+/**
+ * Get the policies for a target
+ *
+ * @param client the OrganizationsClient to use
+ * @param targetId the id of the target to get the policies for
+ * @param policyType the type of policy to get
+ * @param enabled whether the policy type is enabled
+ * @returns the Arns of the policies for the target
+ */
+async function getPoliciesForTarget(client, targetId, policyType, enabled) {
+    if (!enabled) {
+        return [];
+    }
+    const policies = await paginateResource(client, ListPoliciesForTargetCommand, 'Policies', { inputKey: 'NextToken', outputKey: 'NextToken' }, {
+        TargetId: targetId,
+        Filter: policyType
+    });
+    return policies.map((policy) => policy.Arn);
+}
+/**
+ * Sync the policies for an organization and a specific policy type.
+ *
+ * @param organizationId the id of the organization to sync policies for
+ * @param organizationClient the OrganizationsClient to use
+ * @param storage the AwsIamStore to use for persistence
+ * @param policyType the type of policy to sync (e.g., SERVICE_CONTROL_POLICY, RESOURCE_CONTROL_POLICY)
+ * @param fileType the type of policy file to sync to storage (e.g., 'scps', 'rcps', 's3-policies')
+ * @param enabled whether the policy type is enabled in the organization
+ * @param writeOnly whether to skip deleting stale policies from storage
+ */
+async function syncPolicies(organizationId, organizationClient, storage, policyType, fileType, enabled, writeOnly) {
+    if (!enabled) {
+        if (!writeOnly) {
+            const existingPolicies = await storage.listOrganizationPolicies(organizationId, fileType);
+            for (const policyId of existingPolicies) {
+                await storage.deleteOrganizationPolicy(organizationId, fileType, policyId);
+            }
+        }
+        return;
+    }
+    const policies = await paginateResource(organizationClient, ListPoliciesCommand, 'Policies', { inputKey: 'NextToken', outputKey: 'NextToken' }, {
+        Filter: policyType
+    });
+    if (!writeOnly) {
+        // Delete policies that are no longer present in the organization
+        const existingPolicies = await storage.listOrganizationPolicies(organizationId, fileType);
+        const newPolicyIds = new Set(policies.map((p) => p.Id.toLowerCase()));
+        const policiesToDelete = existingPolicies.filter((id) => !newPolicyIds.has(id));
+        for (const policyToDelete of policiesToDelete) {
+            await storage.deleteOrganizationPolicy(organizationId, fileType, policyToDelete);
+        }
+    }
+    for (const policy of policies) {
+        const metadata = {
+            arn: policy.Arn,
+            name: policy.Name,
+            description: policy.Description,
+            awsManaged: policy.AwsManaged
+        };
+        await storage.saveOrganizationPolicyMetadata(organizationId, fileType, policy.Id, 'metadata', metadata);
+        const content = await getPolicyContent(organizationClient, policy.Id);
+        await storage.saveOrganizationPolicyMetadata(organizationId, fileType, policy.Id, 'policy', content);
+        const tags = await getTags(organizationClient, policy.Id);
+        await storage.saveOrganizationPolicyMetadata(organizationId, fileType, policy.Id, 'tags', tags);
+    }
+}
+/**
+ * Get the content of a policy by its ID.
+ *
+ * @param organizationClient the OrganizationsClient to use
+ * @param policyId the ID of the policy to get the content for
+ * @returns the content of the policy as a parsed JSON object, or undefined if the policy does not exist or has no content
+ */
+async function getPolicyContent(organizationClient, policyId) {
+    const command = new DescribePolicyCommand({ PolicyId: policyId });
+    const response = await runAndCatch404(() => organizationClient.send(command));
+    if (response?.Policy?.Content) {
+        return JSON.parse(response.Policy.Content);
+    }
+    return undefined;
+}
+/**
+ * Sync the organization resource policy.
+ *
+ * @param organizationClient the OrganizationsClient to use
+ * @param storage the AwsIamStore to use for persistence
+ * @param organizationId the id of the organization to sync the resource policy for
+ */
+async function syncOrganizationResourcePolicy(organizationClient, storage, organizationId) {
+    const policy = await getOrganizationResourcePolicy(organizationClient, organizationId);
+    await storage.saveOrganizationMetadata(organizationId, 'policy', policy);
+}
+/**
+ * Get the resource policy for an organization.
+ *
+ * @param organizationClient the OrganizationsClient to use
+ * @param organizationId the id of the organization to get the resource policy for
+ * @returns the resource policy as a parsed JSON object, or undefined if the policy does not exist or has no content
+ */
+async function getOrganizationResourcePolicy(organizationClient, organizationId) {
+    const command = new DescribeResourcePolicyCommand({ PolicyId: organizationId });
+    try {
+        const response = await organizationClient.send(command);
+        if (response?.ResourcePolicy?.Content) {
+            return JSON.parse(response.ResourcePolicy.Content);
+        }
+        return undefined;
+    }
+    catch (error) {
+        if (error.name === 'ResourcePolicyNotFoundException') {
+            return undefined;
+        }
+        throw error;
+    }
+}
+/**
+ * Save the organization ID for an account if it is not already saved.
+ *
+ * @param storage the AwsIamStore to use for persistence
+ * @param accountId the ID of the account to save the organization ID for
+ * @param organizationId the ID of the organization to save
+ */
+async function saveOrgForAccount(storage, accountId, organizationId) {
+    if (organizationId) {
+        await storage.saveAccountMetadata(accountId, 'organization', { organizationId });
+    }
+    else {
+        await storage.saveAccountMetadata(accountId, 'organization', undefined);
+    }
+}
+//# sourceMappingURL=organizations.js.map

package/dist/esm/syncs/organizations/organizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../../../src/syncs/organizations/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,2BAA2B,EAC3B,qBAAqB,EACrB,6BAA6B,EAC7B,4BAA4B,EAC5B,kCAAkC,EAClC,sCAAsC,EACtC,uCAAuC,EACvC,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,0BAA0B,EAG1B,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAEjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAA0C,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAiD,MAAM,kCAAkC,CAAA;AAChG,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,8BAA8B,EAC/B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAA+B,MAAM,YAAY,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AA+BlD,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,UAAU,EAAE,eAAe;IAC3B,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,KAAK,WACZ,SAAiB,EACjB,MAAc,EACd,WAA8C,EAC9C,OAAoB,EACpB,QAA4B,EAC5B,WAAwB;;QAExB,MAAM,kBAAkB,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CACtD,mBAAmB,EACnB,WAAW,EACX,MAAM,EACN,QAAQ,CACT,CAAA;QAED,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,kBAAkB,CAAC,CAAA;QACrE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;YACtD,OAAM;QACR,CAAC;QACD,MAAM,cAAc,GAAG,YAAY,CAAC,EAAG,CAAA;QAEvC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,kBAAkB,CAAC,CAAA;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;YACtD,OAAM;QACR,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,IAAK,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,OAAO,CAAA;YAC1D,OAAO,GAAG,CAAA;QACZ,CAAC,EAAE,EAAc,CAAC,IAAK,EAAe,CAAA;QAExC,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAA;QACjE,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAA;QAClE,MAAM,iBAAiB,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QAE1D,MAAM,WAAW,GAAsB,EAAE,CAAA;QACzC,MAAM,MAAM,GAQR,EAAE,CAAA;QAEN,MAAM,SAAS,GAA8B,EAAE,CAAA;QAE/C,MAAM,CAAC,IAAI,CAAC,EAAG,CAAC,GAAG;YACjB,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,MAAM,oBAAoB,CAC9B,kBAAkB,EAClB,IAAI,CAAC,EAAG,EACR,UAAU,CAAC,sBAAsB,EACjC,WAAW,CACZ;YACD,IAAI,EAAE,MAAM,oBAAoB,CAC9B,kBAAkB,EAClB,IAAI,CAAC,EAAG,EACR,UAAU,CAAC,uBAAuB,EAClC,WAAW,CACZ;YACD,UAAU,EAAE,MAAM,oBAAoB,CACpC,kBAAkB,EAClB,IAAI,CAAC,EAAG,EACR,UAAU,CAAC,SAAS,EACpB,iBAAiB,CAClB;SACF,CAAA;QACD,SAAS,CAAC,IAAI,CAAC,EAAG,CAAC,GAAG,MAAM,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAA;QAElE,MAAM,SAAS,GAAiB;YAC9B,CAAC,IAAI,CAAC,EAAG,CAAC,EAAE;gBACV,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,EAAE;aACb;SACF,CAAA;QAED,wEAAwE;QACxE,MAAM,OAAO,GAAmB,CAAC,SAAS,CAAC,CAAA;QAE3C,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;QAC1B,OAAO,MAAM,EAAE,CAAC;YACd,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,4BAA4B;gBAC5B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;gBAChE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;oBAC7B,SAAS,CAAC,KAAK,CAAC,EAAG,CAAC,GAAG,MAAM,YAAY,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;oBAEpE,MAAM,OAAO,GAAG,KAAK,CAAC,EAAG,CAAA;oBACzB,MAAM,CAAC,OAAO,CAAC,GAAG;wBAChB,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,MAAM,oBAAoB,CAC9B,kBAAkB,EAClB,OAAO,EACP,UAAU,CAAC,sBAAsB,EACjC,WAAW,CACZ;wBACD,IAAI,EAAE,MAAM,oBAAoB,CAC9B,kBAAkB,EAClB,OAAO,EACP,UAAU,CAAC,uBAAuB,EAClC,WAAW,CACZ;wBACD,UAAU,EAAE,MAAM,oBAAoB,CACpC,kBAAkB,EAClB,OAAO,EACP,UAAU,CAAC,SAAS,EACpB,iBAAiB,CAClB;qBACF,CAAA;oBACD,MAAA,MAAM,CAAC,GAAG,CAAC,EAAC,QAAQ,QAAR,QAAQ,GAAK,EAAE,EAAA;oBAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG;wBAC9B,QAAQ,EAAE,SAAS;wBACnB,QAAQ,EAAE,SAAS;qBACpB,CAAA;gBACH,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;gBACpE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAA;gBAC3B,CAAC;gBACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,MAAM,WAAW,GAAuC,MAAM,iBAAiB,CAC7E,kBAAkB,EAClB,OAAO,CAAC,EAAG,CACZ,CAAA;oBACD,WAAW,CAAC,OAAO,CAAC,EAAG,CAAC,GAAG;wBACzB,EAAE,EAAE,GAAG;wBACP,IAAI,EAAE,MAAM,oBAAoB,CAC9B,kBAAkB,EAClB,OAAO,CAAC,EAAG,EACX,UAAU,CAAC,sBAAsB,EACjC,WAAW,CACZ;wBACD,IAAI,EAAE,MAAM,oBAAoB,CAC9B,kBAAkB,EAClB,OAAO,CAAC,EAAG,EACX,UAAU,CAAC,uBAAuB,EAClC,WAAW,CACZ;wBACD,UAAU,EAAE,MAAM,oBAAoB,CACpC,kBAAkB,EAClB,OAAO,CAAC,EAAG,EACX,UAAU,CAAC,SAAS,EACpB,iBAAiB,CAClB;wBACD,IAAI,EAAE,WAAW;qBAClB,CAAA;oBACD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAI,CAAC,CAAA;gBAC1C,CAAC;gBAED,qDAAqD;gBACrD,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;gBACpC,CAAC;YACH,CAAC;YAED,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;QACxB,CAAC;QAED,+BAA+B;QAC/B,MAAM,uBAAuB,GAAG,MAAM,0BAA0B,CAC9D,kBAAkB,EAClB,YAAY,CAAC,GAAI,CAClB,CAAA;QAED,OAAO,CAAC,wBAAwB,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;QACxE,OAAO,CAAC,wBAAwB,CAAC,cAAc,EAAE,UAAU,EAAE;YAC3D,EAAE,EAAE,cAAc;YAClB,GAAG,EAAE,YAAY,CAAC,GAAG;YACrB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,cAAc,EAAE,YAAY,CAAC,gBAAgB;YAC7C,aAAa,EAAE,YAAY,CAAC,eAAe;YAC3C,QAAQ;SACT,CAAC,CAAA;QACF,OAAO,CAAC,wBAAwB,CAAC,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;QACzE,OAAO,CAAC,wBAAwB,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAC/D,OAAO,CAAC,wBAAwB,CAAC,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAA;QAE7F,WAAW;QACX,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAA;YAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;YAC9C,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/D,KAAK,MAAM,UAAU,IAAI,UAAU,EAAE,CAAC;gBACpC,MAAM,OAAO,CAAC,wBAAwB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;YACpE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;YAC1B,MAAM,OAAO,CAAC,8BAA8B,CAAC,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAA;YAC3F,MAAM,OAAO,CAAC,8BAA8B,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;QACrF,CAAC;QAED,gBAAgB;QAChB,MAAM,YAAY,CAChB,cAAc,EACd,kBAAkB,EAClB,OAAO,EACP,UAAU,CAAC,sBAAsB,EACjC,MAAM,EACN,WAAW,EACX,WAAW,CAAC,SAAS,CACtB,CAAA;QAED,MAAM,YAAY,CAChB,cAAc,EACd,kBAAkB,EAClB,OAAO,EACP,UAAU,CAAC,uBAAuB,EAClC,MAAM,EACN,WAAW,EACX,WAAW,CAAC,SAAS,CACtB,CAAA;QAED,MAAM,YAAY,CAChB,cAAc,EACd,kBAAkB,EAClB,OAAO,EACP,UAAU,CAAC,SAAS,EACpB,aAAa,EACb,iBAAiB,EACjB,WAAW,CAAC,SAAS,CACtB,CAAA;QAED,oCAAoC;QACpC,MAAM,8BAA8B,CAAC,kBAAkB,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;QACjF,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC7D,CAAC;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,2BAA2B,EAAE,CAAA;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO,QAAQ,CAAC,YAAY,CAAA;IAC9B,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,IAAI,KAAK,mCAAmC,EAAE,CAAC;YACnD,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAA2B;IACnE,OAAO,uBAAuB,CAAC,KAAK,IAAI,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,MAAM,EACN,gBAAgB,EAChB,OAAO,EACP;YACE,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,WAAW;SACvB,EACD,EAAE,CACH,CAAA;QACD,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAA2B,EAC3B,eAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,eAAe,EACf,eAAe,EACf,cAAc,EACd,yBAAyB,EACzB,KAAK,IAAI,EAAE;QACT,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAC5C,MAAM,EACN,kCAAkC,EAClC,yBAAyB,EACzB;YACE,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,WAAW;SACvB,CACF,CAAA;QAED,oDAAoD;QACpD,MAAM,mBAAmB,GAA6B,EAAE,CAAA;QAExD,8EAA8E;QAC9E,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAC5D,KAAK,CAAC,GAAI,EACV,eAAe,EACf,wBAAwB,EACxB,mBAAmB,EACnB,KAAK,IAAI,EAAE;gBACT,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,MAAM,EACN,sCAAsC,EACtC,mBAAmB,EACnB;oBACE,QAAQ,EAAE,WAAW;oBACrB,SAAS,EAAE,WAAW;iBACvB,EACD,EAAE,SAAS,EAAE,KAAK,CAAC,EAAG,EAAE,CACzB,CAAA;gBACD,OAAO,QAAQ,CAAA;YACjB,CAAC,CACF,CAAA;YAED,wDAAwD;YACxD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;oBACxC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAiB,CAAA;oBAClD,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,EAAE,CAAC;wBAC3C,mBAAmB,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAA;oBAC5C,CAAC;oBACD,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAG,CAAC,CAAA;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,mBAAmB,CAAA;IAC5B,CAAC,CACF,CAAA;IAED,OAAO,MAAM,IAAI,EAAE,CAAA;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA2B,EAC3B,IAAY;IAEZ,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B,EAC3B,SAAiB;IAEjB,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,OAAO,CACpB,MAA2B,EAC3B,UAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,0BAA0B,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1E,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA2B,EAC3B,QAAgB;IAEhB,OAAO,MAAM,gBAAgB,CAC3B,MAAM,EACN,uCAAuC,EACvC,qBAAqB,EACrB,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,EACjD,EAAE,QAAQ,EAAE,QAAQ,EAAE,CACvB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAA2B,EAC3B,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,MAAM,EACN,4BAA4B,EAC5B,UAAU,EACV;QACE,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,WAAW;KACvB,EACD,EAAE,QAAQ,EAAE,QAAQ,EAAE,CACvB,CAAA;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,kBAAuC,EACvC,EAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,MAAM,YAAY,CAAC,kBAAkB,EAAE,EAAE,CAAC,EAAG,CAAC;QACpD,QAAQ,EAAE;YACR,GAAG,EAAE,EAAE,CAAC,GAAI;YACZ,IAAI,EAAE,EAAE,CAAC,IAAK;SACf;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CACjC,MAA2B,EAC3B,QAAgB,EAChB,UAAsB,EACtB,OAAgB;IAEhB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,MAAM,EACN,4BAA4B,EAC5B,UAAU,EACV,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,EACjD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,UAAU;KACnB,CACF,CAAA;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAI,CAAC,CAAA;AAC9C,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,YAAY,CACzB,cAAsB,EACtB,kBAAuC,EACvC,OAAoB,EACpB,UAAsB,EACtB,QAAgC,EAChC,OAAgB,EAChB,SAAkB;IAElB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;YACzF,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACxC,MAAM,OAAO,CAAC,wBAAwB,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAC5E,CAAC;QACH,CAAC;QACD,OAAM;IACR,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,EACjD;QACE,MAAM,EAAE,UAAU;KACnB,CACF,CAAA;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iEAAiE;QACjE,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;QACzF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACtE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/E,KAAK,MAAM,cAAc,IAAI,gBAAgB,EAAE,CAAC;YAC9C,MAAM,OAAO,CAAC,wBAAwB,CAAC,cAAc,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;QAClF,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAA;QACD,MAAM,OAAO,CAAC,8BAA8B,CAC1C,cAAc,EACd,QAAQ,EACR,MAAM,CAAC,EAAG,EACV,UAAU,EACV,QAAQ,CACT,CAAA;QACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QACtE,MAAM,OAAO,CAAC,8BAA8B,CAC1C,cAAc,EACd,QAAQ,EACR,MAAM,CAAC,EAAG,EACV,QAAQ,EACR,OAAO,CACR,CAAA;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QAC1D,MAAM,OAAO,CAAC,8BAA8B,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IAClG,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,kBAAuC,EACvC,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7E,IAAI,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,8BAA8B,CAC3C,kBAAuC,EACvC,OAAoB,EACpB,cAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;IACtF,MAAM,OAAO,CAAC,wBAAwB,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,6BAA6B,CAC1C,kBAAuC,EACvC,cAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,6BAA6B,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvD,IAAI,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;YACrD,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,OAAoB,EACpB,SAAiB,EACjB,cAAkC;IAElC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,OAAO,CAAC,mBAAmB,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,cAAc,EAAE,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,CAAC,mBAAmB,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,CAAA;IACzE,CAAC;AACH,CAAC"}

package/dist/esm/syncs/ram/ramShares.d.ts

@@ -0,0 +1,3 @@
+import { type Sync } from '../sync.js';
+export declare const RamResourcesSync: Sync;
+//# sourceMappingURL=ramShares.d.ts.map

package/dist/esm/syncs/ram/ramShares.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ramShares.d.ts","sourceRoot":"","sources":["../../../../src/syncs/ram/ramShares.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAA;AAGtC,eAAO,MAAM,gBAAgB,EAAE,IAsE9B,CAAA"}

package/dist/esm/syncs/ram/ramShares.js

@@ -0,0 +1,58 @@
+import { ResourceOwner } from '@aws-sdk/client-api-gateway';
+import { GetResourcePoliciesCommand, ListResourcesCommand, RAMClient } from '@aws-sdk/client-ram';
+import { splitArnParts } from '@actsecurity/iam-utils';
+import { parseIfPresent } from '../../utils/json.js';
+import {} from '../sync.js';
+import { paginateResource } from '../typedSync.js';
+export const RamResourcesSync = {
+    awsService: 'ram',
+    name: 'resourcePolicies',
+    execute: async (accountId, region, credentials, storage, endpoint, syncOptions) => {
+        const ramClient = syncOptions.clientPool.client(RAMClient, credentials, region, endpoint);
+        // List all the resources
+        const resources = await paginateResource(ramClient, ListResourcesCommand, 'resources', {
+            inputKey: 'nextToken',
+            outputKey: 'nextToken'
+        }, {
+            resourceOwner: ResourceOwner.SELF
+        });
+        // Group shares by resource ARN
+        const resourceMap = new Map();
+        for (const resource of resources) {
+            const arn = resource.arn;
+            if (!resourceMap.has(arn)) {
+                resourceMap.set(arn, new Set());
+            }
+            if (resource.resourceShareArn) {
+                resourceMap.get(arn).add(resource.resourceShareArn);
+            }
+        }
+        // Group ARNs by their region
+        const regionMap = new Map();
+        for (const arn of resourceMap.keys()) {
+            const parts = splitArnParts(arn);
+            const arnRegion = parts.region || '';
+            if (!regionMap.has(arnRegion)) {
+                regionMap.set(arnRegion, []);
+            }
+            regionMap.get(arnRegion).push(arn);
+        }
+        // Sync and save per region
+        for (const [arnRegion, regionArns] of regionMap) {
+            if (!syncOptions.writeOnly) {
+                await storage.syncRamResources(accountId, arnRegion, regionArns);
+            }
+            for (const arn of regionArns) {
+                const policies = await paginateResource(ramClient, GetResourcePoliciesCommand, 'policies', { inputKey: 'nextToken', outputKey: 'nextToken' }, { resourceArns: [arn] });
+                const policy = parseIfPresent(policies.at(0));
+                const shares = Array.from(resourceMap.get(arn));
+                await storage.saveRamResource(accountId, arn, {
+                    arn,
+                    shares,
+                    policy
+                });
+            }
+        }
+    }
+};
+//# sourceMappingURL=ramShares.js.map

package/dist/esm/syncs/ram/ramShares.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ramShares.js","sourceRoot":"","sources":["../../../../src/syncs/ram/ramShares.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAa,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,UAAU,EAAE,KAAK;IACjB,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;QAChF,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAEzF,yBAAyB;QACzB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,SAAS,EACT,oBAAoB,EACpB,WAAW,EACX;YACE,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,WAAW;SACvB,EACD;YACE,aAAa,EAAE,aAAa,CAAC,IAAI;SAClC,CACF,CAAA;QAED,+BAA+B;QAC/B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAA;QAClD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAI,CAAA;YACzB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;YACjC,CAAC;YACD,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;gBAC9B,WAAW,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;YACtD,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAA;QAC7C,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;YAChC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;YACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;YAC9B,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,SAAS,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;YAClE,CAAC;YAED,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,SAAS,EACT,0BAA0B,EAC1B,UAAU,EACV,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,EACjD,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CACxB,CAAA;gBAED,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;gBAE7C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,CAAA;gBAEhD,MAAM,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE;oBAC5C,GAAG;oBACH,MAAM;oBACN,MAAM;iBACP,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/esm/syncs/s3/accessPoints.d.ts

@@ -0,0 +1,3 @@
+import { type Sync } from '../sync.js';
+export declare const S3AccessPointsSync: Sync;
+//# sourceMappingURL=accessPoints.d.ts.map

package/dist/esm/syncs/s3/accessPoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessPoints.d.ts","sourceRoot":"","sources":["../../../../src/syncs/s3/accessPoints.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAA;AAGtC,eAAO,MAAM,kBAAkB,EAAE,IA2DhC,CAAA"}

package/dist/esm/syncs/s3/accessPoints.js

@@ -0,0 +1,58 @@
+import { GetAccessPointCommand, GetAccessPointPolicyCommand, ListAccessPointsCommand, S3ControlClient } from '@aws-sdk/client-s3-control';
+import { runAndCatch404 } from '../../utils/client-tools.js';
+import { parseIfPresent } from '../../utils/json.js';
+import {} from '../sync.js';
+import { createResourceSyncType, createTypedSyncOperation } from '../typedSync.js';
+export const S3AccessPointsSync = createTypedSyncOperation('s3', 'accessPoints', createResourceSyncType({
+    client: S3ControlClient,
+    command: ListAccessPointsCommand,
+    key: 'AccessPointList',
+    arguments: (accountId, region) => ({
+        AccountId: accountId
+    }),
+    paginationConfig: {
+        inputKey: 'NextToken',
+        outputKey: 'NextToken'
+    },
+    arn: (accessPoint) => accessPoint.AccessPointArn,
+    resourceTypeParts: (account, region) => ({
+        service: 's3',
+        resource: 'accesspoint',
+        account,
+        region
+    }),
+    extraFields: {
+        details: async (client, accessPoint, accountId) => {
+            const result = await client.send(new GetAccessPointCommand({
+                AccountId: accountId,
+                Name: accessPoint.Name
+            }));
+            return result;
+        },
+        policy: async (client, accessPoint, accountId) => {
+            const policy = runAndCatch404(async () => {
+                const result = await client.send(new GetAccessPointPolicyCommand({
+                    Name: accessPoint.Name,
+                    AccountId: accountId
+                }));
+                return parseIfPresent(result.Policy);
+            });
+            return policy;
+        }
+    },
+    tags: () => undefined, // Access points do not have tags
+    results: (accessPoint) => ({
+        metadata: {
+            name: accessPoint.Name,
+            alias: accessPoint.extraFields.details?.Alias,
+            networkOrigin: accessPoint.NetworkOrigin,
+            vpc: accessPoint.VpcConfiguration?.VpcId,
+            bucket: accessPoint.Bucket,
+            bucketAccount: accessPoint.BucketAccountId,
+            endpoints: accessPoint.extraFields.details?.Endpoints
+        },
+        bpa: accessPoint.extraFields.details?.PublicAccessBlockConfiguration,
+        policy: accessPoint.extraFields.policy
+    })
+}));
+//# sourceMappingURL=accessPoints.js.map

package/dist/esm/syncs/s3/accessPoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessPoints.js","sourceRoot":"","sources":["../../../../src/syncs/s3/accessPoints.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,eAAe,EAChB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAa,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAElF,MAAM,CAAC,MAAM,kBAAkB,GAAS,wBAAwB,CAC9D,IAAI,EACJ,cAAc,EACd,sBAAsB,CAAC;IACrB,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,uBAAuB;IAChC,GAAG,EAAE,iBAAiB;IACtB,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,SAAS,EAAE,SAAS;KACrB,CAAC;IACF,gBAAgB,EAAE;QAChB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,WAAW;KACvB;IACD,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,cAAe;IACjD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,aAAa;QACvB,OAAO;QACP,MAAM;KACP,CAAC;IACF,WAAW,EAAE;QACX,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE;YAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,qBAAqB,CAAC;gBACxB,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,WAAW,CAAC,IAAK;aACxB,CAAC,CACH,CAAA;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE;YAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE;gBACvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,2BAA2B,CAAC;oBAC9B,IAAI,EAAE,WAAW,CAAC,IAAK;oBACvB,SAAS,EAAE,SAAS;iBACrB,CAAC,CACH,CAAA;gBACD,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACtC,CAAC,CAAC,CAAA;YACF,OAAO,MAAM,CAAA;QACf,CAAC;KACF;IACD,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,iCAAiC;IACxD,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACzB,QAAQ,EAAE;YACR,IAAI,EAAE,WAAW,CAAC,IAAK;YACvB,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK;YAC7C,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,GAAG,EAAE,WAAW,CAAC,gBAAgB,EAAE,KAAK;YACxC,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,aAAa,EAAE,WAAW,CAAC,eAAe;YAC1C,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS;SACtD;QACD,GAAG,EAAE,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,8BAA8B;QACpE,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,MAAM;KACvC,CAAC;CACH,CAAC,CACH,CAAA"}

package/dist/esm/syncs/s3/accountBpa.d.ts

@@ -0,0 +1,3 @@
+import { type Sync } from '../sync.js';
+export declare const AccountS3BpaSync: Sync;
+//# sourceMappingURL=accountBpa.d.ts.map

package/dist/esm/syncs/s3/accountBpa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountBpa.d.ts","sourceRoot":"","sources":["../../../../src/syncs/s3/accountBpa.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,eAAO,MAAM,gBAAgB,EAAE,IAc9B,CAAA"}

package/dist/esm/syncs/s3/accountBpa.js

@@ -0,0 +1,17 @@
+import { GetPublicAccessBlockCommand, S3ControlClient } from '@aws-sdk/client-s3-control';
+import { runAndCatch404 } from '../../utils/client-tools.js';
+import {} from '../sync.js';
+export const AccountS3BpaSync = {
+    awsService: 's3',
+    name: 'accountBpa',
+    global: true,
+    execute: async (accountId, region, credentials, storage, endpoint, syncOptions) => {
+        const client = syncOptions.clientPool.client(S3ControlClient, credentials, region, endpoint);
+        const bpa = await runAndCatch404(async () => {
+            const result = client.send(new GetPublicAccessBlockCommand({ AccountId: accountId }));
+            return (await result).PublicAccessBlockConfiguration;
+        });
+        await storage.saveAccountMetadata(accountId, 's3-bpa', bpa);
+    }
+};
+//# sourceMappingURL=accountBpa.js.map

package/dist/esm/syncs/s3/accountBpa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountBpa.js","sourceRoot":"","sources":["../../../../src/syncs/s3/accountBpa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAa,MAAM,YAAY,CAAA;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,UAAU,EAAE,IAAI;IAChB,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;QAChF,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAE5F,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,IAAI,EAAE;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;YACrF,OAAO,CAAC,MAAM,MAAM,CAAC,CAAC,8BAA8B,CAAA;QACtD,CAAC,CAAC,CAAA;QAEF,MAAM,OAAO,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;CACF,CAAA"}

package/dist/esm/syncs/s3/buckets.d.ts

@@ -0,0 +1,3 @@
+import { type Sync } from '../sync.js';
+export declare const S3GeneralPurposeBucketSync: Sync;
+//# sourceMappingURL=buckets.d.ts.map

package/dist/esm/syncs/s3/buckets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buckets.d.ts","sourceRoot":"","sources":["../../../../src/syncs/s3/buckets.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,KAAK,IAAI,EAA8B,MAAM,YAAY,CAAA;AAWlE,eAAO,MAAM,0BAA0B,EAAE,IAmIxC,CAAA"}