@actsecurity/iam-collect 0.1.215

package/dist/cjs/awsConfigClients/clients/AwsConfigOrganizationsClient.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsConfigOrganizationsClient = void 0;
+const client_organizations_1 = require("@aws-sdk/client-organizations");
+const AbstractClient_js_1 = require("../../customClients/AbstractClient.js");
+const AwsConfigClientContext_js_1 = require("../AwsConfigClientContext.js");
+/**
+ * AWS Config-based Organizations client implementation
+ * Returns empty responses since organization data is not tracked in AWS Config
+ *
+ * Since policies are not available in AWS Config, this client provides limited functionality
+ * and returns empty results for all operations.
+ */
+class AwsConfigOrganizationsClient extends AbstractClient_js_1.AbstractClient {
+    static clientName = client_organizations_1.OrganizationsClient.name;
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    /**
+     * Register all Organizations command implementations
+     */
+    registerCommands() {
+        this.registerCommand(AwsConfigDescribeOrganizationCommand);
+        this.registerCommand(AwsConfigDescribePolicyCommand);
+        this.registerCommand(AwsConfigDescribeResourcePolicyCommand);
+        this.registerCommand(AwsConfigListAccountsForParentCommand);
+        this.registerCommand(AwsConfigListDelegatedAdministratorsCommand);
+        this.registerCommand(AwsConfigListDelegatedServicesForAccountCommand);
+        this.registerCommand(AwsConfigListOrganizationalUnitsForParentCommand);
+        this.registerCommand(AwsConfigListPoliciesCommand);
+        this.registerCommand(AwsConfigListPoliciesForTargetCommand);
+        this.registerCommand(AwsConfigListRootsCommand);
+        this.registerCommand(AwsConfigListTagsForResourceCommand);
+    }
+}
+exports.AwsConfigOrganizationsClient = AwsConfigOrganizationsClient;
+/**
+ * Config-based implementation of Organizations DescribeOrganizationCommand
+ * Returns empty result since organization data is not available in Config
+ */
+const AwsConfigDescribeOrganizationCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_organizations_1.DescribeOrganizationCommand,
+    execute: async (input, context) => {
+        // Organization data is not available in AWS Config
+        return {};
+    }
+});
+/**
+ * Config-based implementation of Organizations DescribePolicyCommand
+ * Returns empty result since organization policies are not available in Config
+ */
+const AwsConfigDescribePolicyCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_organizations_1.DescribePolicyCommand,
+    execute: async (input, context) => {
+        // Organization policies are not available in AWS Config
+        return {};
+    }
+});
+/**
+ * Config-based implementation of Organizations DescribeResourcePolicyCommand
+ * Returns empty result since organization resource policies are not available in Config
+ */
+const AwsConfigDescribeResourcePolicyCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_organizations_1.DescribeResourcePolicyCommand,
+    execute: async (input, context) => {
+        // Organization resource policies are not available in AWS Config
+        return {};
+    }
+});
+/**
+ * Config-based implementation of Organizations ListAccountsForParentCommand
+ * Returns empty list since organization structure is not available in Config
+ */
+const AwsConfigListAccountsForParentCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_organizations_1.ListAccountsForParentCommand,
+    execute: async (input, context) => {
+        // Organization structure is not available in AWS Config
+        return {
+            Accounts: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListDelegatedAdministratorsCommand
+ * Returns empty list since delegated administrators are not available in Config
+ */
+const AwsConfigListDelegatedAdministratorsCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_organizations_1.ListDelegatedAdministratorsCommand,
+    execute: async (input, context) => {
+        // Delegated administrators are not available in AWS Config
+        return {
+            DelegatedAdministrators: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListDelegatedServicesForAccountCommand
+ * Returns empty list since delegated services are not available in Config
+ */
+const AwsConfigListDelegatedServicesForAccountCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_organizations_1.ListDelegatedServicesForAccountCommand,
+    execute: async (input, context) => {
+        // Delegated services are not available in AWS Config
+        return {
+            DelegatedServices: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListOrganizationalUnitsForParentCommand
+ * Returns empty list since organizational units are not available in Config
+ */
+const AwsConfigListOrganizationalUnitsForParentCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_organizations_1.ListOrganizationalUnitsForParentCommand,
+    execute: async (input, context) => {
+        // Organizational units are not available in AWS Config
+        return {
+            OrganizationalUnits: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListPoliciesCommand
+ * Returns empty list since organization policies are not available in Config
+ */
+const AwsConfigListPoliciesCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_organizations_1.ListPoliciesCommand,
+    execute: async (input, context) => {
+        // Organization policies are not available in AWS Config
+        return {
+            Policies: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListPoliciesForTargetCommand
+ * Returns empty list since organization policies are not available in Config
+ */
+const AwsConfigListPoliciesForTargetCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_organizations_1.ListPoliciesForTargetCommand,
+    execute: async (input, context) => {
+        // Organization policies are not available in AWS Config
+        return {
+            Policies: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListRootsCommand
+ * Returns empty list since organization structure is not available in Config
+ */
+const AwsConfigListRootsCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_organizations_1.ListRootsCommand,
+    execute: async (input, context) => {
+        // Organization structure is not available in AWS Config
+        return {
+            Roots: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListTagsForResourceCommand
+ * Returns empty list since organization resource tags are not available in Config
+ */
+const AwsConfigListTagsForResourceCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_organizations_1.ListTagsForResourceCommand,
+    execute: async (input, context) => {
+        // Organization resource tags are not available in AWS Config
+        return {
+            Tags: []
+        };
+    }
+});
+//# sourceMappingURL=AwsConfigOrganizationsClient.js.map

package/dist/cjs/awsConfigClients/clients/AwsConfigOrganizationsClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigOrganizationsClient.js","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigOrganizationsClient.ts"],"names":[],"mappings":";;;AAAA,wEAasC;AAEtC,6EAAsE;AACtE,4EAA4F;AAE5F;;;;;;GAMG;AACH,MAAa,4BAA6B,SAAQ,kCAAsC;IACtF,MAAM,CAAU,UAAU,GAAG,0CAAmB,CAAC,IAAI,CAAA;IAErD,YACE,OAGC,EACD,aAAqC;QAErC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACO,gBAAgB;QACxB,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,CAAA;QAC1D,IAAI,CAAC,eAAe,CAAC,8BAA8B,CAAC,CAAA;QACpD,IAAI,CAAC,eAAe,CAAC,sCAAsC,CAAC,CAAA;QAC5D,IAAI,CAAC,eAAe,CAAC,qCAAqC,CAAC,CAAA;QAC3D,IAAI,CAAC,eAAe,CAAC,2CAA2C,CAAC,CAAA;QACjE,IAAI,CAAC,eAAe,CAAC,+CAA+C,CAAC,CAAA;QACrE,IAAI,CAAC,eAAe,CAAC,gDAAgD,CAAC,CAAA;QACtE,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAA;QAClD,IAAI,CAAC,eAAe,CAAC,qCAAqC,CAAC,CAAA;QAC3D,IAAI,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAA;QAC/C,IAAI,CAAC,eAAe,CAAC,mCAAmC,CAAC,CAAA;IAC3D,CAAC;;AA5BH,oEA6BC;AAED;;;GAGG;AACH,MAAM,oCAAoC,GAAG,IAAA,4CAAgB,EAAC;IAC5D,OAAO,EAAE,kDAA2B;IACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,mDAAmD;QACnD,OAAO,EAAE,CAAA;IACX,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,8BAA8B,GAAG,IAAA,4CAAgB,EAAC;IACtD,OAAO,EAAE,4CAAqB;IAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,wDAAwD;QACxD,OAAO,EAAE,CAAA;IACX,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,sCAAsC,GAAG,IAAA,4CAAgB,EAAC;IAC9D,OAAO,EAAE,oDAA6B;IACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,iEAAiE;QACjE,OAAO,EAAE,CAAA;IACX,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,qCAAqC,GAAG,IAAA,4CAAgB,EAAC;IAC7D,OAAO,EAAE,mDAA4B;IACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,wDAAwD;QACxD,OAAO;YACL,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,2CAA2C,GAAG,IAAA,4CAAgB,EAAC;IACnE,OAAO,EAAE,yDAAkC;IAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,2DAA2D;QAC3D,OAAO;YACL,uBAAuB,EAAE,EAAE;SAC5B,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,+CAA+C,GAAG,IAAA,4CAAgB,EAAC;IACvE,OAAO,EAAE,6DAAsC;IAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,qDAAqD;QACrD,OAAO;YACL,iBAAiB,EAAE,EAAE;SACtB,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,gDAAgD,GAAG,IAAA,4CAAgB,EAAC;IACxE,OAAO,EAAE,8DAAuC;IAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,uDAAuD;QACvD,OAAO;YACL,mBAAmB,EAAE,EAAE;SACxB,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,4BAA4B,GAAG,IAAA,4CAAgB,EAAC;IACpD,OAAO,EAAE,0CAAmB;IAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,wDAAwD;QACxD,OAAO;YACL,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,qCAAqC,GAAG,IAAA,4CAAgB,EAAC;IAC7D,OAAO,EAAE,mDAA4B;IACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,wDAAwD;QACxD,OAAO;YACL,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,yBAAyB,GAAG,IAAA,4CAAgB,EAAC;IACjD,OAAO,EAAE,uCAAgB;IACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,wDAAwD;QACxD,OAAO;YACL,KAAK,EAAE,EAAE;SACV,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,mCAAmC,GAAG,IAAA,4CAAgB,EAAC;IAC3D,OAAO,EAAE,iDAA0B;IACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,6DAA6D;QAC7D,OAAO;YACL,IAAI,EAAE,EAAE;SACT,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cjs/awsConfigClients/clients/AwsConfigS3Client.d.ts

@@ -0,0 +1,15 @@
+import { type AwsCredentialProviderWithMetaData } from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { type AwsConfigClientContext } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config-based S3 client implementation
+ */
+export declare class AwsConfigS3Client extends AbstractClient<AwsConfigClientContext> {
+    static readonly clientName: string;
+    constructor(options: {
+        credentials: AwsCredentialProviderWithMetaData;
+        region: string | undefined;
+    }, customContext: AwsConfigClientContext);
+    protected registerCommands(): void;
+}
+//# sourceMappingURL=AwsConfigS3Client.d.ts.map

package/dist/cjs/awsConfigClients/clients/AwsConfigS3Client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigS3Client.d.ts","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigS3Client.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAGtE,OAAO,EAAE,KAAK,sBAAsB,EAAoB,MAAM,8BAA8B,CAAA;AAO5F;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,sBAAsB,CAAC;IAC3E,MAAM,CAAC,QAAQ,CAAC,UAAU,SAAgB;gBAGxC,OAAO,EAAE;QACP,WAAW,EAAE,iCAAiC,CAAA;QAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,EACD,aAAa,EAAE,sBAAsB;IAKvC,SAAS,CAAC,gBAAgB,IAAI,IAAI;CAQnC"}

package/dist/cjs/awsConfigClients/clients/AwsConfigS3Client.js

@@ -0,0 +1,239 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsConfigS3Client = void 0;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const AbstractClient_js_1 = require("../../customClients/AbstractClient.js");
+const ResourceNotFoundException_js_1 = require("../../customClients/ResourceNotFoundException.js");
+const json_js_1 = require("../../utils/json.js");
+const AwsConfigClientContext_js_1 = require("../AwsConfigClientContext.js");
+const awsConfigUtils_js_1 = require("../awsConfigUtils.js");
+/**
+ * AWS Config-based S3 client implementation
+ */
+class AwsConfigS3Client extends AbstractClient_js_1.AbstractClient {
+    static clientName = client_s3_1.S3Client.name;
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    registerCommands() {
+        this.registerCommand(AwsConfigGetBucketPolicyCommand);
+        this.registerCommand(AwsConfigGetBucketEncryptionCommand);
+        this.registerCommand(AwsConfigGetBucketTaggingCommand);
+        this.registerCommand(AwsConfigGetPublicAccessBlockCommand);
+        this.registerCommand(AwsConfigListBucketsCommand);
+        this.registerCommand(AwsConfigListDirectoryBucketsCommand);
+    }
+}
+exports.AwsConfigS3Client = AwsConfigS3Client;
+/**
+ * Config-based implementation of S3 ListBucketsCommand
+ * Returns bucket listing from AWS Config inventory data
+ */
+const AwsConfigListBucketsCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_s3_1.ListBucketsCommand,
+    execute: async (input, context) => {
+        // Query Config for S3 buckets
+        const query = `
+      SELECT
+        arn,
+        resourceName,
+        configuration.name,
+        configuration.creationDate,
+        supplementaryConfiguration.BucketPolicy,
+        supplementaryConfiguration.ServerSideEncryptionConfiguration,
+        supplementaryConfiguration.PublicAccessBlockConfiguration,
+        tags
+      WHERE
+        resourceType = 'AWS::S3::Bucket'
+        AND awsRegion = '${input.BucketRegion}'
+        AND accountId = '${context.accountId}'
+        AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+    `;
+        const configResults = await (0, awsConfigUtils_js_1.executeConfigQuery)(query, context);
+        const buckets = configResults.map((resultString) => {
+            const { configItem, configuration, supplementaryConfiguration, tags } = (0, awsConfigUtils_js_1.parseConfigItem)(resultString);
+            context.putCache(configItem.resourceName, 'policy', supplementaryConfiguration?.BucketPolicy.policyText);
+            context.putCache(configItem.resourceName, 'encryption', supplementaryConfiguration?.ServerSideEncryptionConfiguration);
+            context.putCache(configItem.resourceName, 'tags', tags);
+            context.putCache(configItem.resourceName, 'publicAccessBlock', supplementaryConfiguration?.PublicAccessBlockConfiguration);
+            return {
+                Name: configuration?.name || configItem.resourceName,
+                CreationDate: configuration?.creationDate ? new Date(configuration.creationDate) : undefined
+            };
+        });
+        return {
+            Buckets: buckets
+        };
+    }
+});
+/**
+ * Config-based implementation of S3 ListDirectoryBucketsCommand
+ * Uses AWS::S3Express::DirectoryBucket resource type
+ */
+const AwsConfigListDirectoryBucketsCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_s3_1.ListDirectoryBucketsCommand,
+    execute: async (input, context) => {
+        const query = `
+      SELECT
+        arn,
+        resourceId,
+        resourceName,
+        configuration.BucketEncryption,
+        tags
+      WHERE
+        resourceType = 'AWS::S3Express::DirectoryBucket'
+        AND awsRegion = '${context.region}'
+        AND accountId = '${context.accountId}'
+        AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+    `;
+        const results = await (0, awsConfigUtils_js_1.executeConfigQuery)(query, context);
+        const buckets = results?.map((resultString) => {
+            const { configItem, configuration } = (0, awsConfigUtils_js_1.parseConfigItem)(resultString);
+            context.putCache(configItem.resourceName, 'policy', configuration?.PolicyDocument);
+            context.putCache(configItem.resourceName, 'encryption', configuration?.BucketEncryption);
+            return {
+                Name: configItem.resourceName
+            };
+        }) || [];
+        return {
+            Buckets: buckets
+        };
+    }
+});
+/**
+ * Config-based implementation of S3 GetBucketPolicyCommand
+ * Returns bucket policy from AWS Config supplementary data
+ */
+const AwsConfigGetBucketPolicyCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_s3_1.GetBucketPolicyCommand,
+    execute: async (input, context) => {
+        const { Bucket } = input;
+        if (!Bucket) {
+            throw new Error('Bucket parameter is required');
+        }
+        if (isDirectoryBucket(Bucket)) {
+            const query = `
+        SELECT
+          resourceName,
+          configuration.PolicyDocument
+        WHERE
+          resourceType = 'AWS::S3Express::BucketPolicy'
+          AND resourceName = '${Bucket}'
+          AND accountId = '${context.accountId}'
+          AND awsRegion = '${context.region}'
+          AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+      `;
+            const configResults = await (0, awsConfigUtils_js_1.executeConfigQuery)(query, context);
+            if (configResults.length === 0) {
+                throw new ResourceNotFoundException_js_1.ResourceNotFoundException(`Bucket '${Bucket}' not found`);
+            }
+            const { configuration } = (0, awsConfigUtils_js_1.parseConfigItem)(configResults[0]);
+            return {
+                Policy: JSON.stringify(configuration?.PolicyDocument)
+            };
+        }
+        const cachedPolicy = context.getCache(Bucket, 'policy');
+        return {
+            Policy: (0, json_js_1.stringifyIfPresent)(cachedPolicy)
+        };
+    }
+});
+/**
+ * Config-based implementation of S3 GetBucketEncryptionCommand
+ * Returns bucket encryption configuration from AWS Config supplementary data
+ */
+const AwsConfigGetBucketEncryptionCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_s3_1.GetBucketEncryptionCommand,
+    execute: async (input, context) => {
+        const { Bucket } = input;
+        if (!Bucket) {
+            throw new Error('Bucket parameter is required');
+        }
+        if (isDirectoryBucket(Bucket)) {
+            const encryptionConfig = context.getCache(Bucket, 'encryption');
+            const seeConfig = encryptionConfig?.ServerSideEncryptionConfiguration?.at(0);
+            if (!seeConfig) {
+                // Return an empty result to indicate no encryption configuration is set
+                return {};
+            }
+            return {
+                ServerSideEncryptionConfiguration: {
+                    Rules: [
+                        {
+                            ApplyServerSideEncryptionByDefault: {
+                                SSEAlgorithm: seeConfig.ServerSideEncryptionByDefault?.SSEAlgorithm,
+                                KMSMasterKeyID: seeConfig.ServerSideEncryptionByDefault?.KMSMasterKeyID
+                            },
+                            BucketKeyEnabled: seeConfig.BucketKeyEnabled
+                        }
+                    ]
+                }
+            };
+        }
+        const serverSideEncryption = context.getCache(Bucket, 'encryption');
+        if (!serverSideEncryption) {
+            // Return undefined to indicate no encryption configuration is set
+            return undefined;
+        }
+        // Convert Config encryption format to S3 ServerSideEncryptionConfiguration format
+        const rules = serverSideEncryption.rules?.map((rule) => ({
+            ApplyServerSideEncryptionByDefault: {
+                SSEAlgorithm: rule.applyServerSideEncryptionByDefault?.sseAlgorithm,
+                KMSMasterKeyID: rule.applyServerSideEncryptionByDefault?.kmsMasterKeyID
+            },
+            BucketKeyEnabled: rule.bucketKeyEnabled
+        })) || [];
+        return {
+            ServerSideEncryptionConfiguration: {
+                Rules: rules
+            }
+        };
+    }
+});
+/**
+ * Config-based implementation of S3 GetBucketTaggingCommand
+ * Returns bucket tags from AWS Config tags data
+ */
+const AwsConfigGetBucketTaggingCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_s3_1.GetBucketTaggingCommand,
+    execute: async (input, context) => {
+        const { Bucket } = input;
+        if (!Bucket) {
+            throw new Error('Bucket parameter is required');
+        }
+        const tags = context.getCache(Bucket, 'tags');
+        return {
+            TagSet: tags
+        };
+    }
+});
+/**
+ * Config-based implementation of S3 GetPublicAccessBlockCommand
+ * Returns public access block configuration from AWS Config supplementary data
+ */
+const AwsConfigGetPublicAccessBlockCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_s3_1.GetPublicAccessBlockCommand,
+    execute: async (input, context) => {
+        const { Bucket } = input;
+        if (!Bucket) {
+            throw new Error('Bucket parameter is required');
+        }
+        const publicAccessBlock = context.getCache(Bucket, 'publicAccessBlock');
+        if (!publicAccessBlock) {
+            // Return undefined to indicate no public access block configuration is set
+            return undefined;
+        }
+        return {
+            PublicAccessBlockConfiguration: {
+                BlockPublicAcls: publicAccessBlock.blockPublicAcls,
+                BlockPublicPolicy: publicAccessBlock.blockPublicPolicy,
+                IgnorePublicAcls: publicAccessBlock.ignorePublicAcls,
+                RestrictPublicBuckets: publicAccessBlock.restrictPublicBuckets
+            }
+        };
+    }
+});
+function isDirectoryBucket(bucketName) {
+    return bucketName.endsWith('-x-s3');
+}
+//# sourceMappingURL=AwsConfigS3Client.js.map

package/dist/cjs/awsConfigClients/clients/AwsConfigS3Client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigS3Client.js","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigS3Client.ts"],"names":[],"mappings":";;;AAAA,kDAQ2B;AAE3B,6EAAsE;AACtE,mGAA4F;AAC5F,iDAAwD;AACxD,4EAA4F;AAC5F,4DAI6B;AAE7B;;GAEG;AACH,MAAa,iBAAkB,SAAQ,kCAAsC;IAC3E,MAAM,CAAU,UAAU,GAAG,oBAAQ,CAAC,IAAI,CAAA;IAE1C,YACE,OAGC,EACD,aAAqC;QAErC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAES,gBAAgB;QACxB,IAAI,CAAC,eAAe,CAAC,+BAA+B,CAAC,CAAA;QACrD,IAAI,CAAC,eAAe,CAAC,mCAAmC,CAAC,CAAA;QACzD,IAAI,CAAC,eAAe,CAAC,gCAAgC,CAAC,CAAA;QACtD,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,CAAA;QAC1D,IAAI,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAA;QACjD,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,CAAA;IAC5D,CAAC;;AApBH,8CAqBC;AAED;;;GAGG;AACH,MAAM,2BAA2B,GAAG,IAAA,4CAAgB,EAAC;IACnD,OAAO,EAAE,8BAAkB;IAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,8BAA8B;QAC9B,MAAM,KAAK,GAAG;;;;;;;;;;;;2BAYS,KAAK,CAAC,YAAY;2BAClB,OAAO,CAAC,SAAS;cAC9B,6CAAyB;KAClC,CAAA;QAED,MAAM,aAAa,GAAG,MAAM,IAAA,sCAAkB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAE9D,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;YACjD,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,0BAA0B,EAAE,IAAI,EAAE,GACnE,IAAA,mCAAe,EAAC,YAAY,CAAC,CAAA;YAE/B,OAAO,CAAC,QAAQ,CACd,UAAU,CAAC,YAAY,EACvB,QAAQ,EACR,0BAA0B,EAAE,YAAY,CAAC,UAAU,CACpD,CAAA;YACD,OAAO,CAAC,QAAQ,CACd,UAAU,CAAC,YAAY,EACvB,YAAY,EACZ,0BAA0B,EAAE,iCAAiC,CAC9D,CAAA;YACD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;YACvD,OAAO,CAAC,QAAQ,CACd,UAAU,CAAC,YAAY,EACvB,mBAAmB,EACnB,0BAA0B,EAAE,8BAA8B,CAC3D,CAAA;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,UAAU,CAAC,YAAY;gBACpD,YAAY,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;aAC7F,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,OAAO,EAAE,OAAO;SACjB,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,oCAAoC,GAAG,IAAA,4CAAgB,EAAC;IAC5D,OAAO,EAAE,uCAA2B;IACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG;;;;;;;;;2BASS,OAAO,CAAC,MAAM;2BACd,OAAO,CAAC,SAAS;cAC9B,6CAAyB;KAClC,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAkB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAExD,MAAM,OAAO,GACX,OAAO,EAAE,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;YAC5B,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAA,mCAAe,EAAC,YAAY,CAAC,CAAA;YACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,CAAA;YAClF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAA;YAExF,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,YAAY;aAC9B,CAAA;QACH,CAAC,CAAC,IAAI,EAAE,CAAA;QAEV,OAAO;YACL,OAAO,EAAE,OAAO;SACjB,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,+BAA+B,GAAG,IAAA,4CAAgB,EAAC;IACvD,OAAO,EAAE,kCAAsB;IAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG;;;;;;gCAMY,MAAM;6BACT,OAAO,CAAC,SAAS;6BACjB,OAAO,CAAC,MAAM;gBAC3B,6CAAyB;OAClC,CAAA;YAED,MAAM,aAAa,GAAG,MAAM,IAAA,sCAAkB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YAE9D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,wDAAyB,CAAC,WAAW,MAAM,aAAa,CAAC,CAAA;YACrE,CAAC;YAED,MAAM,EAAE,aAAa,EAAE,GAAG,IAAA,mCAAe,EAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;YAE3D,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,cAAc,CAAC;aACtD,CAAA;QACH,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACvD,OAAO;YACL,MAAM,EAAE,IAAA,4BAAkB,EAAC,YAAY,CAAC;SACzC,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,mCAAmC,GAAG,IAAA,4CAAgB,EAAC;IAC3D,OAAO,EAAE,sCAA0B;IACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;QAExB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;YAE/D,MAAM,SAAS,GAAG,gBAAgB,EAAE,iCAAiC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;YAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,wEAAwE;gBACxE,OAAO,EAAE,CAAA;YACX,CAAC;YAED,OAAO;gBACL,iCAAiC,EAAE;oBACjC,KAAK,EAAE;wBACL;4BACE,kCAAkC,EAAE;gCAClC,YAAY,EAAE,SAAS,CAAC,6BAA6B,EAAE,YAAY;gCACnE,cAAc,EAAE,SAAS,CAAC,6BAA6B,EAAE,cAAc;6BACxE;4BACD,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;yBAC7C;qBACF;iBACF;aACF,CAAA;QACH,CAAC;QAED,MAAM,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAEnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,kEAAkE;YAClE,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,kFAAkF;QAClF,MAAM,KAAK,GACT,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,CAAC;YAC9C,kCAAkC,EAAE;gBAClC,YAAY,EAAE,IAAI,CAAC,kCAAkC,EAAE,YAAY;gBACnE,cAAc,EAAE,IAAI,CAAC,kCAAkC,EAAE,cAAc;aACxE;YACD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,CAAC,IAAI,EAAE,CAAA;QAEX,OAAO;YACL,iCAAiC,EAAE;gBACjC,KAAK,EAAE,KAAK;aACb;SACF,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,gCAAgC,GAAG,IAAA,4CAAgB,EAAC;IACxD,OAAO,EAAE,mCAAuB;IAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC7C,OAAO;YACL,MAAM,EAAE,IAAI;SACb,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,oCAAoC,GAAG,IAAA,4CAAgB,EAAC;IAC5D,OAAO,EAAE,uCAA2B;IACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QAEvE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,2EAA2E;YAC3E,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO;YACL,8BAA8B,EAAE;gBAC9B,eAAe,EAAE,iBAAiB,CAAC,eAAe;gBAClD,iBAAiB,EAAE,iBAAiB,CAAC,iBAAiB;gBACtD,gBAAgB,EAAE,iBAAiB,CAAC,gBAAgB;gBACpD,qBAAqB,EAAE,iBAAiB,CAAC,qBAAqB;aAC/D;SACF,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AACrC,CAAC"}

package/dist/cjs/awsConfigClients/clients/AwsConfigS3ControlClient.d.ts

@@ -0,0 +1,25 @@
+import { type AwsCredentialProviderWithMetaData } from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { type AwsConfigClientContext } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config client for S3 Control operations.
+ *
+ * Supported Commands:
+ * - ListAccessPointsCommand: Returns access point listing from Config using AWS::S3::AccessPoint
+ * - GetAccessPointCommand: Returns access point details from Config including alias, public access block config
+ * - GetPublicAccessBlockCommand: Returns account-level public access block configuration from Config
+ *
+ * Limitations:
+ * S3 access point policies, multi-region access point policies, and Object Lambda policies
+ * are not available in AWS Config. The Config service tracks access point configuration
+ * but not access policies. Most policy-related commands return undefined/empty responses.
+ */
+export declare class AwsConfigS3ControlClient extends AbstractClient<AwsConfigClientContext> {
+    static readonly clientName: string;
+    constructor(options: {
+        credentials: AwsCredentialProviderWithMetaData;
+        region: string | undefined;
+    }, customContext: AwsConfigClientContext);
+    protected registerCommands(): void;
+}
+//# sourceMappingURL=AwsConfigS3ControlClient.d.ts.map

package/dist/cjs/awsConfigClients/clients/AwsConfigS3ControlClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigS3ControlClient.d.ts","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigS3ControlClient.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAEtE,OAAO,EAAE,KAAK,sBAAsB,EAAoB,MAAM,8BAA8B,CAAA;AAO5F;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAAC,sBAAsB,CAAC;IAClF,MAAM,CAAC,QAAQ,CAAC,UAAU,SAAuB;gBAG/C,OAAO,EAAE;QACP,WAAW,EAAE,iCAAiC,CAAA;QAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,EACD,aAAa,EAAE,sBAAsB;IAKvC,SAAS,CAAC,gBAAgB,IAAI,IAAI;CAgBnC"}