@actsecurity/iam-lens 0.1.156

package/dist/cjs/principalCan/resources/resourceTypes/iamRoles.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stsRoleActions = stsRoleActions;
+exports.allIamRolesAssumeRolePermissionSets = allIamRolesAssumeRolePermissionSets;
+exports.iamRolesSameAccount = iamRolesSameAccount;
+const iam_expand_1 = require("@actsecurity/iam-expand");
+const iam_policy_1 = require("@actsecurity/iam-policy");
+const iam_utils_1 = require("@actsecurity/iam-utils");
+const permission_js_1 = require("../../permission.js");
+const permissionSet_js_1 = require("../../permissionSet.js");
+const statements_js_1 = require("../statements.js");
+/**
+ * Get the list of IAM Actions to assume a role.
+ *
+ * @returns the list of IAM Actions to assume a role
+ */
+async function stsRoleActions() {
+    const serviceActions = await (0, iam_expand_1.expandIamActions)('sts:AssumeRole*');
+    const actions = serviceActions.map((a) => a.split(':').at(1));
+    return [...actions, 'SetContext', 'TagSession', 'SetSourceIdentity'];
+}
+/**
+ * Get the permission sets for all IAM roles to assume a role.
+ *
+ * @returns the permission sets for all IAM roles to assume a role
+ */
+async function allIamRolesAssumeRolePermissionSets() {
+    const assumeRoleActions = await stsRoleActions();
+    const allowPerimeter = new permissionSet_js_1.PermissionSet('Allow');
+    const denyPerimeter = new permissionSet_js_1.PermissionSet('Deny');
+    for (const action of assumeRoleActions) {
+        allowPerimeter.addPermission(new permission_js_1.Permission('Allow', 'sts', action, ['*'], undefined, undefined));
+        denyPerimeter.addPermission(new permission_js_1.Permission('Deny', 'sts', action, ['*'], undefined, undefined));
+    }
+    return { roleAllows: allowPerimeter, roleDenies: denyPerimeter };
+}
+/**
+ * Get the permissions a principal has to assume roles in the same account.
+ * This will only return permissions for sts:AssumeRole and not other assume role actions.
+ *
+ * @param collectClient the client to use to collect IAM information
+ * @param principal the principal to check permissions for
+ * @returns the permissions the principal has to assume roles in the same account
+ */
+async function iamRolesSameAccount(collectClient, principal) {
+    const principalArnParts = (0, iam_utils_1.splitArnParts)(principal);
+    const principalAccountId = principalArnParts.accountId;
+    const assumeRoleActions = ['AssumeRole', 'SetContext', 'TagSession', 'SetSourceIdentity'];
+    const allRoles = await collectClient.listResources(principalAccountId, 'iam', 'role', undefined);
+    const accountAllows = [];
+    const principalAllows = [];
+    const denies = [];
+    for (const roleArn of allRoles) {
+        const rawPolicy = await collectClient.getResourcePolicyForArn(roleArn, principalAccountId);
+        if (!rawPolicy) {
+            continue;
+        }
+        const allowPerimeter = new permissionSet_js_1.PermissionSet('Allow');
+        const denyPerimeter = new permissionSet_js_1.PermissionSet('Deny');
+        for (const action of assumeRoleActions) {
+            allowPerimeter.addPermission(new permission_js_1.Permission('Allow', 'sts', action, [roleArn], undefined, undefined));
+            denyPerimeter.addPermission(new permission_js_1.Permission('Deny', 'sts', action, [roleArn], undefined, undefined));
+        }
+        const roleAcctAllow = new permissionSet_js_1.PermissionSet('Allow');
+        const rolePrincipalAllow = new permissionSet_js_1.PermissionSet('Allow');
+        const roleDeny = new permissionSet_js_1.PermissionSet('Deny');
+        addRoleArnToStatements(rawPolicy, roleArn);
+        const trustPolicy = (0, iam_policy_1.loadPolicy)(rawPolicy);
+        for (const statement of trustPolicy.statements()) {
+            const applies = await (0, statements_js_1.statementAppliesToPrincipal)(statement, principal, collectClient);
+            if (applies === 'PrincipalMatch') {
+                if (statement.isAllow()) {
+                    await (0, permissionSet_js_1.addStatementToPermissionSet)(statement, rolePrincipalAllow);
+                }
+                else {
+                    await (0, permissionSet_js_1.addStatementToPermissionSet)(statement, roleDeny);
+                }
+            }
+            else if (applies === 'AccountMatch' && statement.isAllow()) {
+                await (0, permissionSet_js_1.addStatementToPermissionSet)(statement, roleAcctAllow);
+            }
+        }
+        const effectivePrincipalAllow = rolePrincipalAllow.intersection(allowPerimeter);
+        const effectiveAccountAllow = roleAcctAllow.intersection(allowPerimeter);
+        const effectiveDeny = roleDeny.intersection(denyPerimeter);
+        if (!effectivePrincipalAllow.isEmpty()) {
+            principalAllows.push(effectivePrincipalAllow);
+        }
+        if (!effectiveAccountAllow.isEmpty()) {
+            accountAllows.push(effectiveAccountAllow);
+        }
+        if (!effectiveDeny.isEmpty()) {
+            denies.push(effectiveDeny);
+        }
+    }
+    return {
+        accountAllows,
+        principalAllows,
+        denies
+    };
+}
+function addRoleArnToStatements(policy, roleArn) {
+    const policyDoc = (0, iam_policy_1.isValidatedPolicy)(policy) ? policy.policyDocument : policy;
+    const statement = policyDoc.Statement;
+    if (Array.isArray(statement)) {
+        for (const stmt of statement) {
+            stmt.Resource = [roleArn];
+        }
+    }
+    else if (statement) {
+        statement.Resource = [roleArn];
+    }
+}
+//# sourceMappingURL=iamRoles.js.map

package/dist/cjs/principalCan/resources/resourceTypes/iamRoles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iamRoles.js","sourceRoot":"","sources":["../../../../../src/principalCan/resources/resourceTypes/iamRoles.ts"],"names":[],"mappings":";;AAaA,wCAIC;AAOD,kFAeC;AAUD,kDA2EC;AA5HD,wDAA0D;AAC1D,wDAAuE;AACvE,sDAAsD;AAEtD,uDAAgD;AAChD,6DAAmF;AACnF,oDAA8D;AAE9D;;;;GAIG;AACI,KAAK,UAAU,cAAc;IAClC,MAAM,cAAc,GAAG,MAAM,IAAA,6BAAgB,EAAC,iBAAiB,CAAC,CAAA;IAChE,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAA;IAC9D,OAAO,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAA;AACtE,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,mCAAmC;IAIvD,MAAM,iBAAiB,GAAG,MAAM,cAAc,EAAE,CAAA;IAChD,MAAM,cAAc,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;IACjD,MAAM,aAAa,GAAG,IAAI,gCAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,cAAc,CAAC,aAAa,CAC1B,IAAI,0BAAU,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CACpE,CAAA;QACD,aAAa,CAAC,aAAa,CAAC,IAAI,0BAAU,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;IACjG,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,CAAA;AAClE,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,mBAAmB,CACvC,aAA+B,EAC/B,SAAiB;IAMjB,MAAM,iBAAiB,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IAClD,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,SAAU,CAAA;IAEvD,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IAEhG,MAAM,aAAa,GAAoB,EAAE,CAAA;IACzC,MAAM,eAAe,GAAoB,EAAE,CAAA;IAC3C,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;QAC1F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAQ;QACV,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;QACjD,MAAM,aAAa,GAAG,IAAI,gCAAa,CAAC,MAAM,CAAC,CAAA;QAC/C,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;YACvC,cAAc,CAAC,aAAa,CAC1B,IAAI,0BAAU,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CACxE,CAAA;YACD,aAAa,CAAC,aAAa,CACzB,IAAI,0BAAU,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CACvE,CAAA;QACH,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,kBAAkB,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;QACrD,MAAM,QAAQ,GAAG,IAAI,gCAAa,CAAC,MAAM,CAAC,CAAA;QAE1C,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC1C,MAAM,WAAW,GAAG,IAAA,uBAAU,EAAC,SAAS,CAAC,CAAA;QAEzC,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,IAAA,2CAA2B,EAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;YACtF,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBACjC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;oBACxB,MAAM,IAAA,8CAA2B,EAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;gBAClE,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAA,8CAA2B,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;gBACxD,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,KAAK,cAAc,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC7D,MAAM,IAAA,8CAA2B,EAAC,SAAS,EAAE,aAAa,CAAC,CAAA;YAC7D,CAAC;QACH,CAAC;QAED,MAAM,uBAAuB,GAAG,kBAAkB,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;QAC/E,MAAM,qBAAqB,GAAG,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;QACxE,MAAM,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,CAAA;QAE1D,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,EAAE,CAAC;YACvC,eAAe,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,EAAE,CAAC;YACrC,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAC3C,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa;QACb,eAAe;QACf,MAAM;KACP,CAAA;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAW,EAAE,OAAe;IAC1D,MAAM,SAAS,GAAG,IAAA,8BAAiB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAA;IAC5E,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAA;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,SAAS,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;AACH,CAAC"}

package/dist/cjs/principalCan/resources/resourceTypes/kmsKeys.d.ts

@@ -0,0 +1,30 @@
+import { IamCollectClient } from '../../../collect/client.js';
+import { PermissionSet } from '../../permissionSet.js';
+/**
+ * Get the list of KMS actions.
+ *
+ * @returns All options available for KMS keys.
+ */
+export declare function kmsKeyActions(): Promise<string[]>;
+/**
+ * Create permission sets that include all KMS key actions on all resources.
+ *
+ * @returns Permission sets that include all KMS key actions on all resources both for Allow and Deny.
+ */
+export declare function allKmsKeysAllActionsPermissionSets(): Promise<{
+    keyAllows: PermissionSet;
+    keyDenies: PermissionSet;
+}>;
+/**
+ * Get the permissions a principal has on KMS keys in the same account.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies.
+ * @param principal the principal to check permissions for.
+ * @returns the permissions the principal has on KMS keys in the same account.
+ */
+export declare function kmsKeysSameAccount(collectClient: IamCollectClient, principal: string): Promise<{
+    accountAllows: PermissionSet[];
+    principalAllows: PermissionSet[];
+    denies: PermissionSet[];
+}>;
+//# sourceMappingURL=kmsKeys.d.ts.map

package/dist/cjs/principalCan/resources/resourceTypes/kmsKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kmsKeys.d.ts","sourceRoot":"","sources":["../../../../../src/principalCan/resources/resourceTypes/kmsKeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,EAA+B,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAInF;;;;GAIG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAEvD;AAED;;;;GAIG;AACH,wBAAsB,kCAAkC,IAAI,OAAO,CAAC;IAClE,SAAS,EAAE,aAAa,CAAA;IACxB,SAAS,EAAE,aAAa,CAAA;CACzB,CAAC,CAYD;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,gBAAgB,EAC/B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IACT,aAAa,EAAE,aAAa,EAAE,CAAA;IAC9B,eAAe,EAAE,aAAa,EAAE,CAAA;IAChC,MAAM,EAAE,aAAa,EAAE,CAAA;CACxB,CAAC,CAsED"}

package/dist/cjs/principalCan/resources/resourceTypes/kmsKeys.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.kmsKeyActions = kmsKeyActions;
+exports.allKmsKeysAllActionsPermissionSets = allKmsKeysAllActionsPermissionSets;
+exports.kmsKeysSameAccount = kmsKeysSameAccount;
+const iam_policy_1 = require("@actsecurity/iam-policy");
+const iam_utils_1 = require("@actsecurity/iam-utils");
+const permission_js_1 = require("../../permission.js");
+const permissionSet_js_1 = require("../../permissionSet.js");
+const actions_js_1 = require("../actions.js");
+const statements_js_1 = require("../statements.js");
+/**
+ * Get the list of KMS actions.
+ *
+ * @returns All options available for KMS keys.
+ */
+async function kmsKeyActions() {
+    return (0, actions_js_1.actionsForResourceType)('kms', 'key');
+}
+/**
+ * Create permission sets that include all KMS key actions on all resources.
+ *
+ * @returns Permission sets that include all KMS key actions on all resources both for Allow and Deny.
+ */
+async function allKmsKeysAllActionsPermissionSets() {
+    const keyActions = await kmsKeyActions();
+    const allowPerimeter = new permissionSet_js_1.PermissionSet('Allow');
+    const denyPerimeter = new permissionSet_js_1.PermissionSet('Deny');
+    for (const action of keyActions) {
+        allowPerimeter.addPermission(new permission_js_1.Permission('Allow', 'kms', action, ['*'], undefined, undefined));
+        denyPerimeter.addPermission(new permission_js_1.Permission('Deny', 'kms', action, ['*'], undefined, undefined));
+    }
+    return { keyAllows: allowPerimeter, keyDenies: denyPerimeter };
+}
+/**
+ * Get the permissions a principal has on KMS keys in the same account.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies.
+ * @param principal the principal to check permissions for.
+ * @returns the permissions the principal has on KMS keys in the same account.
+ */
+async function kmsKeysSameAccount(collectClient, principal) {
+    const principalArnParts = (0, iam_utils_1.splitArnParts)(principal);
+    const principalAccountId = principalArnParts.accountId;
+    const keyActions = await kmsKeyActions();
+    const allKeys = await collectClient.listResources(principalAccountId, 'kms', 'key', '*');
+    const accountAllows = [];
+    const principalAllows = [];
+    const denies = [];
+    for (const keyArn of allKeys) {
+        const rawKeyPolicy = await collectClient.getResourcePolicyForArn(keyArn, principalAccountId);
+        if (!rawKeyPolicy) {
+            continue;
+        }
+        const allowPerimeter = new permissionSet_js_1.PermissionSet('Allow');
+        const denyPerimeter = new permissionSet_js_1.PermissionSet('Deny');
+        for (const action of keyActions) {
+            allowPerimeter.addPermission(new permission_js_1.Permission('Allow', 'kms', action, [keyArn], undefined, undefined));
+            denyPerimeter.addPermission(new permission_js_1.Permission('Deny', 'kms', action, [keyArn], undefined, undefined));
+        }
+        const keyAcctAllow = new permissionSet_js_1.PermissionSet('Allow');
+        const keyPrincipalAllow = new permissionSet_js_1.PermissionSet('Allow');
+        const keyDeny = new permissionSet_js_1.PermissionSet('Deny');
+        const keyPolicy = (0, iam_policy_1.loadPolicy)(rawKeyPolicy);
+        for (const statement of keyPolicy.statements()) {
+            const applies = await (0, statements_js_1.statementAppliesToPrincipal)(statement, principal, collectClient);
+            const hasViaService = statementHasViaServiceCondition(statement);
+            if (applies === 'PrincipalMatch') {
+                if (statement.isAllow()) {
+                    if (!hasViaService) {
+                        await (0, permissionSet_js_1.addStatementToPermissionSet)(statement, keyPrincipalAllow);
+                    }
+                }
+                else {
+                    await (0, permissionSet_js_1.addStatementToPermissionSet)(statement, keyDeny);
+                }
+            }
+            else if (applies === 'AccountMatch' && statement.isAllow() && !hasViaService) {
+                await (0, permissionSet_js_1.addStatementToPermissionSet)(statement, keyAcctAllow);
+            }
+        }
+        const effectivePrincipalAllow = keyPrincipalAllow.intersection(allowPerimeter);
+        const effectiveAccountAllow = keyAcctAllow.intersection(allowPerimeter);
+        const effectiveDeny = keyDeny.intersection(denyPerimeter);
+        if (!effectivePrincipalAllow.isEmpty()) {
+            principalAllows.push(effectivePrincipalAllow);
+        }
+        if (!effectiveAccountAllow.isEmpty()) {
+            accountAllows.push(effectiveAccountAllow);
+        }
+        if (!effectiveDeny.isEmpty()) {
+            denies.push(effectiveDeny);
+        }
+    }
+    return {
+        accountAllows,
+        principalAllows,
+        denies
+    };
+}
+/**
+ * Check if the statement has the condition key kms:ViaService.
+ *
+ * @param statement the statement to check
+ * @returns true if the statement has a kms:ViaService condition, false otherwise
+ */
+function statementHasViaServiceCondition(statement) {
+    return statement.conditions().some((c) => c.conditionKey().toLowerCase() === 'kms:viaservice');
+}
+//# sourceMappingURL=kmsKeys.js.map

package/dist/cjs/principalCan/resources/resourceTypes/kmsKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kmsKeys.js","sourceRoot":"","sources":["../../../../../src/principalCan/resources/resourceTypes/kmsKeys.ts"],"names":[],"mappings":";;AAaA,sCAEC;AAOD,gFAeC;AASD,gDA6EC;AA3HD,wDAAoE;AACpE,sDAAsD;AAEtD,uDAAgD;AAChD,6DAAmF;AACnF,8CAAsD;AACtD,oDAA8D;AAE9D;;;;GAIG;AACI,KAAK,UAAU,aAAa;IACjC,OAAO,IAAA,mCAAsB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAC7C,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,kCAAkC;IAItD,MAAM,UAAU,GAAG,MAAM,aAAa,EAAE,CAAA;IACxC,MAAM,cAAc,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;IACjD,MAAM,aAAa,GAAG,IAAI,gCAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,cAAc,CAAC,aAAa,CAC1B,IAAI,0BAAU,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CACpE,CAAA;QACD,aAAa,CAAC,aAAa,CAAC,IAAI,0BAAU,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;IACjG,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,CAAA;AAChE,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CACtC,aAA+B,EAC/B,SAAiB;IAMjB,MAAM,iBAAiB,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IAClD,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,SAAU,CAAA;IAEvD,MAAM,UAAU,GAAG,MAAM,aAAa,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;IAExF,MAAM,aAAa,GAAoB,EAAE,CAAA;IACzC,MAAM,eAAe,GAAoB,EAAE,CAAA;IAC3C,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,SAAQ;QACV,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;QACjD,MAAM,aAAa,GAAG,IAAI,gCAAa,CAAC,MAAM,CAAC,CAAA;QAC/C,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,cAAc,CAAC,aAAa,CAC1B,IAAI,0BAAU,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CACvE,CAAA;YACD,aAAa,CAAC,aAAa,CACzB,IAAI,0BAAU,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CACtE,CAAA;QACH,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,iBAAiB,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,OAAO,GAAG,IAAI,gCAAa,CAAC,MAAM,CAAC,CAAA;QAEzC,MAAM,SAAS,GAAG,IAAA,uBAAU,EAAC,YAAY,CAAC,CAAA;QAE1C,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,IAAA,2CAA2B,EAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;YACtF,MAAM,aAAa,GAAG,+BAA+B,CAAC,SAAS,CAAC,CAAA;YAChE,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBACjC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;oBACxB,IAAI,CAAC,aAAa,EAAE,CAAC;wBACnB,MAAM,IAAA,8CAA2B,EAAC,SAAS,EAAE,iBAAiB,CAAC,CAAA;oBACjE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAA,8CAA2B,EAAC,SAAS,EAAE,OAAO,CAAC,CAAA;gBACvD,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,KAAK,cAAc,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC/E,MAAM,IAAA,8CAA2B,EAAC,SAAS,EAAE,YAAY,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;QAED,MAAM,uBAAuB,GAAG,iBAAiB,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;QAC9E,MAAM,qBAAqB,GAAG,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;QACvE,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,CAAA;QAEzD,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,EAAE,CAAC;YACvC,eAAe,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,EAAE,CAAC;YACrC,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAC3C,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa;QACb,eAAe;QACf,MAAM;KACP,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,+BAA+B,CAAC,SAAoB;IAC3D,OAAO,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,CAAA;AAChG,CAAC"}

package/dist/cjs/principalCan/resources/resourceTypes/s3Buckets.d.ts

@@ -0,0 +1,18 @@
+import { IamCollectClient } from '../../../collect/client.js';
+import { PermissionSet } from '../../permissionSet.js';
+/**
+ * Get the permission sets for S3 buckets in the same account as the principal.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies and resources
+ * @param principal the ARN of the principal to check
+ * @returns the Allow and Deny permission sets for S3 buckets in the same account as the principal
+ */
+export declare function s3BucketsSameAccount(collectClient: IamCollectClient, principal: string): Promise<{
+    allows: PermissionSet[];
+    denies: PermissionSet[];
+}>;
+export declare function s3BucketsCrossAccount(collectClient: IamCollectClient, accountId: string, rcpDenies: PermissionSet, principal: string): Promise<{
+    allows: PermissionSet[];
+    denies: PermissionSet[];
+}>;
+//# sourceMappingURL=s3Buckets.d.ts.map

package/dist/cjs/principalCan/resources/resourceTypes/s3Buckets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3Buckets.d.ts","sourceRoot":"","sources":["../../../../../src/principalCan/resources/resourceTypes/s3Buckets.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,EAA+B,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAInF;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,gBAAgB,EAC/B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC,CA+D/D;AAED,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC,CAyE/D"}

package/dist/cjs/principalCan/resources/resourceTypes/s3Buckets.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.s3BucketsSameAccount = s3BucketsSameAccount;
+exports.s3BucketsCrossAccount = s3BucketsCrossAccount;
+const iam_policy_1 = require("@actsecurity/iam-policy");
+const iam_utils_1 = require("@actsecurity/iam-utils");
+const permission_js_1 = require("../../permission.js");
+const permissionSet_js_1 = require("../../permissionSet.js");
+const actions_js_1 = require("../actions.js");
+const statements_js_1 = require("../statements.js");
+/**
+ * Get the permission sets for S3 buckets in the same account as the principal.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies and resources
+ * @param principal the ARN of the principal to check
+ * @returns the Allow and Deny permission sets for S3 buckets in the same account as the principal
+ */
+async function s3BucketsSameAccount(collectClient, principal) {
+    const principalArnParts = (0, iam_utils_1.splitArnParts)(principal);
+    const principalAccountId = principalArnParts.accountId;
+    const allBuckets = await collectClient.listResources(principalAccountId, 's3', 'bucket', undefined);
+    const bucketActions = await (0, actions_js_1.actionsForResourceType)('s3', 'bucket');
+    const objectActions = await (0, actions_js_1.actionsForResourceType)('s3', 'object');
+    const s3Actions = [...bucketActions, ...objectActions];
+    const bucketAllowPermissionSets = [];
+    const bucketDenyPermissionSets = [];
+    for (const bucket of allBuckets) {
+        const bucketPolicy = await collectClient.getResourcePolicyForArn(bucket, principalAccountId);
+        if (bucketPolicy) {
+            const loadedPolicy = (0, iam_policy_1.loadPolicy)(bucketPolicy);
+            if (loadedPolicy) {
+                const bucketArns = [bucket, `${bucket}/*`];
+                const bucketAllowPerimeter = new permissionSet_js_1.PermissionSet('Allow');
+                const bucketDenyPerimeter = new permissionSet_js_1.PermissionSet('Deny');
+                for (const action of s3Actions) {
+                    bucketAllowPerimeter.addPermission(new permission_js_1.Permission('Allow', 's3', action, bucketArns, undefined, undefined));
+                    bucketDenyPerimeter.addPermission(new permission_js_1.Permission('Deny', 's3', action, bucketArns, undefined, undefined));
+                }
+                const allowPermissionSet = new permissionSet_js_1.PermissionSet('Allow');
+                const denyPermissionSet = new permissionSet_js_1.PermissionSet('Deny');
+                for (const statement of loadedPolicy.statements()) {
+                    const applies = await (0, statements_js_1.statementAppliesToPrincipal)(statement, principal, collectClient);
+                    if (applies === 'PrincipalMatch') {
+                        if (statement.isAllow()) {
+                            await (0, permissionSet_js_1.addStatementToPermissionSet)(statement, allowPermissionSet);
+                        }
+                        else {
+                            await (0, permissionSet_js_1.addStatementToPermissionSet)(statement, denyPermissionSet);
+                        }
+                    }
+                }
+                const effectiveAllows = allowPermissionSet.intersection(bucketAllowPerimeter);
+                const effectiveDenies = denyPermissionSet.intersection(bucketDenyPerimeter);
+                if (!effectiveAllows.isEmpty()) {
+                    bucketAllowPermissionSets.push(effectiveAllows);
+                }
+                if (!effectiveDenies.isEmpty()) {
+                    bucketDenyPermissionSets.push(effectiveDenies);
+                }
+            }
+        }
+    }
+    return { allows: bucketAllowPermissionSets, denies: bucketDenyPermissionSets };
+}
+async function s3BucketsCrossAccount(collectClient, accountId, rcpDenies, principal) {
+    // For every account:
+    // List the buckets
+    // Get the allow statements in the account buckets intersected with the bucket perimeter
+    // Collect all the deny statements intersected with the bucket perimeter
+    // Intersect the allow statements with the account RCPs
+    const bucketActions = await (0, actions_js_1.actionsForResourceType)('s3', 'bucket');
+    const objectActions = await (0, actions_js_1.actionsForResourceType)('s3', 'object');
+    const s3Actions = [...bucketActions, ...objectActions];
+    const bucketAllowPermissionSets = [];
+    const bucketDenyPermissionSets = [];
+    const allBuckets = await collectClient.listResources(accountId, 's3', 'bucket', undefined);
+    for (const bucket of allBuckets) {
+        const bucketPolicy = await collectClient.getResourcePolicyForArn(bucket, accountId);
+        if (!bucketPolicy) {
+            continue;
+        }
+        const loadedPolicy = (0, iam_policy_1.loadPolicy)(bucketPolicy);
+        const bucketArns = [bucket, `${bucket}/*`];
+        const bucketAllowPerimeter = new permissionSet_js_1.PermissionSet('Allow');
+        const bucketDenyPerimeter = new permissionSet_js_1.PermissionSet('Deny');
+        for (const action of s3Actions) {
+            bucketAllowPerimeter.addPermission(new permission_js_1.Permission('Allow', 's3', action, bucketArns, undefined, undefined));
+            bucketDenyPerimeter.addPermission(new permission_js_1.Permission('Deny', 's3', action, bucketArns, undefined, undefined));
+        }
+        const allowPermissionSet = new permissionSet_js_1.PermissionSet('Allow');
+        const denyPermissionSet = new permissionSet_js_1.PermissionSet('Deny');
+        for (const statement of loadedPolicy.statements()) {
+            const applies = await (0, statements_js_1.statementAppliesToPrincipal)(statement, principal, collectClient);
+            if (applies === 'PrincipalMatch' || applies === 'AccountMatch') {
+                if (statement.isAllow()) {
+                    await (0, permissionSet_js_1.addStatementToPermissionSet)(statement, allowPermissionSet);
+                }
+                else {
+                    await (0, permissionSet_js_1.addStatementToPermissionSet)(statement, denyPermissionSet);
+                }
+            }
+        }
+        // Intersect the allows with the perimeter and subtract RCP denies
+        // Intersect the RCP denies with the perimeter
+        let { allow: effectiveAllows, deny: effectiveDenies } = allowPermissionSet
+            .intersection(bucketAllowPerimeter)
+            .subtract(rcpDenies.intersection(bucketDenyPerimeter));
+        const maximumDenies = denyPermissionSet.intersection(bucketDenyPerimeter);
+        const afterDenies = effectiveAllows.subtract(maximumDenies);
+        effectiveAllows = afterDenies.allow;
+        effectiveDenies.addAll(afterDenies.deny);
+        // For cross account only, we only add denies if there was a corresponding allow
+        if (!effectiveAllows.isEmpty()) {
+            bucketAllowPermissionSets.push(effectiveAllows);
+            // For cross account only, we only add denies if there was a corresponding allow
+            if (!effectiveDenies.isEmpty()) {
+                bucketDenyPermissionSets.push(effectiveDenies);
+            }
+        }
+    }
+    return { allows: bucketAllowPermissionSets, denies: bucketDenyPermissionSets };
+}
+//# sourceMappingURL=s3Buckets.js.map

package/dist/cjs/principalCan/resources/resourceTypes/s3Buckets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3Buckets.js","sourceRoot":"","sources":["../../../../../src/principalCan/resources/resourceTypes/s3Buckets.ts"],"names":[],"mappings":";;AAeA,oDAkEC;AAED,sDA8EC;AAjKD,wDAAoD;AACpD,sDAAsD;AAEtD,uDAAgD;AAChD,6DAAmF;AACnF,8CAAsD;AACtD,oDAA8D;AAE9D;;;;;;GAMG;AACI,KAAK,UAAU,oBAAoB,CACxC,aAA+B,EAC/B,SAAiB;IAEjB,MAAM,iBAAiB,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IAClD,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,SAAU,CAAA;IAEvD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,aAAa,CAClD,kBAAkB,EAClB,IAAI,EACJ,QAAQ,EACR,SAAS,CACV,CAAA;IAED,MAAM,aAAa,GAAG,MAAM,IAAA,mCAAsB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,MAAM,IAAA,mCAAsB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAElE,MAAM,SAAS,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,aAAa,CAAC,CAAA;IAEtD,MAAM,yBAAyB,GAAoB,EAAE,CAAA;IACrD,MAAM,wBAAwB,GAAoB,EAAE,CAAA;IAEpD,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QAC5F,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,IAAA,uBAAU,EAAC,YAAY,CAAC,CAAA;YAC7C,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAA;gBAC1C,MAAM,oBAAoB,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;gBACvD,MAAM,mBAAmB,GAAG,IAAI,gCAAa,CAAC,MAAM,CAAC,CAAA;gBACrD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;oBAC/B,oBAAoB,CAAC,aAAa,CAChC,IAAI,0BAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CACxE,CAAA;oBACD,mBAAmB,CAAC,aAAa,CAC/B,IAAI,0BAAU,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CACvE,CAAA;gBACH,CAAC;gBAED,MAAM,kBAAkB,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;gBACrD,MAAM,iBAAiB,GAAG,IAAI,gCAAa,CAAC,MAAM,CAAC,CAAA;gBAEnD,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC;oBAClD,MAAM,OAAO,GAAG,MAAM,IAAA,2CAA2B,EAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;oBACtF,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;wBACjC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;4BACxB,MAAM,IAAA,8CAA2B,EAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;wBAClE,CAAC;6BAAM,CAAC;4BACN,MAAM,IAAA,8CAA2B,EAAC,SAAS,EAAE,iBAAiB,CAAC,CAAA;wBACjE,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAA;gBAC7E,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAA;gBAC3E,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC/B,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;gBACjD,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC/B,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;AAChF,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,aAA+B,EAC/B,SAAiB,EACjB,SAAwB,EACxB,SAAiB;IAEjB,qBAAqB;IACrB,mBAAmB;IACnB,wFAAwF;IACxF,wEAAwE;IACxE,uDAAuD;IAEvD,MAAM,aAAa,GAAG,MAAM,IAAA,mCAAsB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,MAAM,IAAA,mCAAsB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,aAAa,CAAC,CAAA;IAEtD,MAAM,yBAAyB,GAAoB,EAAE,CAAA;IACrD,MAAM,wBAAwB,GAAoB,EAAE,CAAA;IAEpD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;IAE1F,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACnF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,SAAQ;QACV,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,uBAAU,EAAC,YAAY,CAAC,CAAA;QAC7C,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAA;QAC1C,MAAM,oBAAoB,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;QACvD,MAAM,mBAAmB,GAAG,IAAI,gCAAa,CAAC,MAAM,CAAC,CAAA;QACrD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/B,oBAAoB,CAAC,aAAa,CAChC,IAAI,0BAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CACxE,CAAA;YACD,mBAAmB,CAAC,aAAa,CAC/B,IAAI,0BAAU,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CACvE,CAAA;QACH,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,gCAAa,CAAC,OAAO,CAAC,CAAA;QACrD,MAAM,iBAAiB,GAAG,IAAI,gCAAa,CAAC,MAAM,CAAC,CAAA;QAEnD,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,MAAM,IAAA,2CAA2B,EAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;YACtF,IAAI,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;gBAC/D,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;oBACxB,MAAM,IAAA,8CAA2B,EAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;gBAClE,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAA,8CAA2B,EAAC,SAAS,EAAE,iBAAiB,CAAC,CAAA;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,8CAA8C;QAC9C,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,kBAAkB;aACvE,YAAY,CAAC,oBAAoB,CAAC;aAClC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAA;QAExD,MAAM,aAAa,GAAG,iBAAiB,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAA;QAEzE,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;QAC3D,eAAe,GAAG,WAAW,CAAC,KAAK,CAAA;QACnC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAExC,gFAAgF;QAEhF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/B,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YAC/C,gFAAgF;YAChF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC/B,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;AAChF,CAAC"}

package/dist/cjs/principalCan/resources/statements.d.ts

@@ -0,0 +1,27 @@
+import { type Policy, type Statement } from '@actsecurity/iam-policy';
+import { IamCollectClient } from '../../collect/client.js';
+export type StatementPrincipalMatchType = 'PrincipalMatch' | 'AccountMatch' | 'NoMatch';
+/**
+ * Checks to see if a statement applies to a principal by running a simulation.
+ *
+ * If the principal is a match return 'PrincipalMatch'
+ * If the account is a match return 'AccountMatch'
+ * Otherwise return 'NoMatch'
+ *
+ * @param statement the statement to check
+ * @param principalArn the arn of the principal to check
+ * @param client the IAM collect client to use for retrieving principal information
+ * @returns Whether the statement applies to the principal
+ */
+export declare function statementAppliesToPrincipal(statement: Statement, principalArn: string, client: IamCollectClient): Promise<StatementPrincipalMatchType>;
+/**
+ * Makes a policy that captures the principal and principal conditions from a statement
+ * and allows all actions on all resources.
+ *
+ * The conditions returned are only those that relate to the principal.
+ *
+ * @param statement the statement to extract the principal from
+ * @returns
+ */
+export declare function makePrincipalOnlyPolicyFromStatement(statement: Statement): Policy;
+//# sourceMappingURL=statements.d.ts.map

package/dist/cjs/principalCan/resources/statements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statements.d.ts","sourceRoot":"","sources":["../../../../src/principalCan/resources/statements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAGjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAI1D,MAAM,MAAM,2BAA2B,GAAG,gBAAgB,GAAG,cAAc,GAAG,SAAS,CAAA;AAEvF;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,2BAA2B,CAAC,CAkDtC;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,oCAAoC,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAiCjF"}

package/dist/cjs/principalCan/resources/statements.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.statementAppliesToPrincipal = statementAppliesToPrincipal;
+exports.makePrincipalOnlyPolicyFromStatement = makePrincipalOnlyPolicyFromStatement;
+const iam_policy_1 = require("@actsecurity/iam-policy");
+const iam_simulate_1 = require("@actsecurity/iam-simulate");
+const iam_utils_1 = require("@actsecurity/iam-utils");
+const contextKeys_js_1 = require("../../simulate/contextKeys.js");
+/**
+ * Checks to see if a statement applies to a principal by running a simulation.
+ *
+ * If the principal is a match return 'PrincipalMatch'
+ * If the account is a match return 'AccountMatch'
+ * Otherwise return 'NoMatch'
+ *
+ * @param statement the statement to check
+ * @param principalArn the arn of the principal to check
+ * @param client the IAM collect client to use for retrieving principal information
+ * @returns Whether the statement applies to the principal
+ */
+async function statementAppliesToPrincipal(statement, principalArn, client) {
+    const principalAccount = (0, iam_utils_1.splitArnParts)(principalArn).accountId;
+    const resourcePolicy = makePrincipalOnlyPolicyFromStatement(statement);
+    const simulationRequest = {
+        principal: principalArn,
+        action: 'kms:DescribeKey',
+        resourceAccount: principalAccount,
+        resourceArn: undefined,
+        customContextKeys: {},
+        simulationMode: 'Strict'
+    };
+    // We use KMS, so we get kms:CallerAccount context key support
+    const { contextKeys } = await (0, contextKeys_js_1.createContextKeys)(client, simulationRequest, 'kms', {});
+    const request = {
+        action: 'kms:DescribeKey',
+        resource: {
+            resource: 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-ab12-cd34-ef23-456789abcdef',
+            accountId: principalAccount
+        },
+        principal: principalArn,
+        contextVariables: contextKeys
+    };
+    const simulation = {
+        request,
+        identityPolicies: [],
+        resourcePolicy: resourcePolicy.toJSON(),
+        serviceControlPolicies: [],
+        resourceControlPolicies: []
+    };
+    const result = await (0, iam_simulate_1.runSimulation)(simulation, {
+        simulationMode: simulationRequest.simulationMode
+    });
+    if (result.resultType === 'error') {
+        return 'NoMatch';
+    }
+    const analysis = result.resultType === 'single' ? result.result.analysis : undefined;
+    if (analysis?.result === 'Allowed') {
+        return 'PrincipalMatch';
+    }
+    if (analysis?.resourceAnalysis?.result === 'AllowedForAccount') {
+        return 'AccountMatch';
+    }
+    return 'NoMatch';
+}
+const principalKeys = new Set([
+    'aws:PrincipalArn',
+    'aws:PrincipalAccount',
+    'aws:PrincipalOrgId',
+    'aws:PrincipalOrgPaths',
+    'aws:PrincipalType',
+    'aws:userid',
+    'aws:username',
+    'aws:PrincipalIsAWSService',
+    'kms:CallerAccount'
+].map((k) => k.toLowerCase()));
+/**
+ * Makes a policy that captures the principal and principal conditions from a statement
+ * and allows all actions on all resources.
+ *
+ * The conditions returned are only those that relate to the principal.
+ *
+ * @param statement the statement to extract the principal from
+ * @returns
+ */
+function makePrincipalOnlyPolicyFromStatement(statement) {
+    const rawStatement = structuredClone(statement.toJSON());
+    const rawStatementValues = {};
+    if (statement.isPrincipalStatement()) {
+        rawStatementValues.Principal = rawStatement.Principal;
+    }
+    else if (statement.isNotPrincipalStatement()) {
+        rawStatementValues.NotPrincipal = rawStatement.NotPrincipal;
+    }
+    if (rawStatement.Condition) {
+        for (const operator of Object.keys(rawStatement.Condition)) {
+            for (const key of Object.keys(rawStatement.Condition[operator])) {
+                if (!principalKeys.has(key.toLowerCase())) {
+                    delete rawStatement.Condition[operator][key];
+                }
+            }
+            if (Object.keys(rawStatement.Condition[operator]).length === 0) {
+                delete rawStatement.Condition[operator];
+            }
+        }
+        if (Object.keys(rawStatement.Condition).length > 0) {
+            rawStatementValues.Condition = rawStatement.Condition;
+        }
+    }
+    return (0, iam_policy_1.loadPolicy)({
+        Version: '2012-10-17',
+        Statement: {
+            Effect: 'Allow',
+            Resource: '*',
+            Action: '*',
+            ...rawStatementValues
+        }
+    });
+}
+//# sourceMappingURL=statements.js.map

package/dist/cjs/principalCan/resources/statements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statements.js","sourceRoot":"","sources":["../../../../src/principalCan/resources/statements.ts"],"names":[],"mappings":";;AAqBA,kEAsDC;AAyBD,oFAiCC;AArID,wDAAiF;AACjF,4DAA0E;AAC1E,sDAAsD;AAEtD,kEAAiE;AAKjE;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,2BAA2B,CAC/C,SAAoB,EACpB,YAAoB,EACpB,MAAwB;IAExB,MAAM,gBAAgB,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC,SAAU,CAAA;IAC/D,MAAM,cAAc,GAAG,oCAAoC,CAAC,SAAS,CAAC,CAAA;IACtE,MAAM,iBAAiB,GAAsB;QAC3C,SAAS,EAAE,YAAY;QACvB,MAAM,EAAE,iBAAiB;QACzB,eAAe,EAAE,gBAAgB;QACjC,WAAW,EAAE,SAAS;QACtB,iBAAiB,EAAE,EAAE;QACrB,cAAc,EAAE,QAAQ;KACzB,CAAA;IAED,8DAA8D;IAC9D,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,kCAAiB,EAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;IAErF,MAAM,OAAO,GAA0B;QACrC,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE;YACR,QAAQ,EAAE,6EAA6E;YACvF,SAAS,EAAE,gBAAgB;SAC5B;QACD,SAAS,EAAE,YAAY;QACvB,gBAAgB,EAAE,WAAW;KAC9B,CAAA;IAED,MAAM,UAAU,GAAe;QAC7B,OAAO;QACP,gBAAgB,EAAE,EAAE;QACpB,cAAc,EAAE,cAAc,CAAC,MAAM,EAAE;QACvC,sBAAsB,EAAE,EAAE;QAC1B,uBAAuB,EAAE,EAAE;KAC5B,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAa,EAAC,UAAU,EAAE;QAC7C,cAAc,EAAE,iBAAiB,CAAC,cAAc;KACjD,CAAC,CAAA;IAEF,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IACpF,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC/D,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B;IACE,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;IACpB,uBAAuB;IACvB,mBAAmB;IACnB,YAAY;IACZ,cAAc;IACd,2BAA2B;IAC3B,mBAAmB;CACpB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC9B,CAAA;AAED;;;;;;;;GAQG;AACH,SAAgB,oCAAoC,CAAC,SAAoB;IACvE,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IACxD,MAAM,kBAAkB,GAAQ,EAAE,CAAA;IAClC,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACrC,kBAAkB,CAAC,SAAS,GAAG,YAAY,CAAC,SAAS,CAAA;IACvD,CAAC;SAAM,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/C,kBAAkB,CAAC,YAAY,GAAG,YAAY,CAAC,YAAY,CAAA;IAC7D,CAAC;IACD,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;QAC3B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBAC1C,OAAO,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC9C,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,OAAO,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACzC,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,kBAAkB,CAAC,SAAS,GAAG,YAAY,CAAC,SAAS,CAAA;QACvD,CAAC;IACH,CAAC;IAED,OAAO,IAAA,uBAAU,EAAC;QAChB,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,GAAG;YACX,GAAG,kBAAkB;SACtB;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/cjs/principalIndex/makePrincipalIndex.d.ts

@@ -0,0 +1,8 @@
+import { IamCollectClient } from '../collect/client.js';
+/**
+ * Make a principal index for all principals in the collect client
+ *
+ * @param collectClient the collect client to use
+ */
+export declare function makePrincipalIndex(collectClient: IamCollectClient): Promise<void>;
+//# sourceMappingURL=makePrincipalIndex.d.ts.map

package/dist/cjs/principalIndex/makePrincipalIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"makePrincipalIndex.d.ts","sourceRoot":"","sources":["../../../src/principalIndex/makePrincipalIndex.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAG5E;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,gBAAgB,iBAgDvE"}