@actsecurity/iam-lens 0.1.156

package/dist/cjs/principalIndex/makePrincipalIndex.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makePrincipalIndex = makePrincipalIndex;
+const bitset_1 = require("bitset");
+const bitset_js_1 = require("../utils/bitset.js");
+/**
+ * Make a principal index for all principals in the collect client
+ *
+ * @param collectClient the collect client to use
+ */
+async function makePrincipalIndex(collectClient) {
+    const principalIndex = {
+        prefix: 'arn:aws:iam::',
+        principals: [],
+        accounts: {},
+        action: {},
+        notAction: {}
+    };
+    const allAccounts = await collectClient.allAccounts();
+    let globalIndex = 0;
+    for (const accountId of allAccounts) {
+        const accountBitSet = new bitset_1.default();
+        const principals = await collectClient.getAllPrincipalsInAccount(accountId);
+        const accountStart = globalIndex;
+        for (const principalArn of principals) {
+            principalIndex.principals.push((0, bitset_js_1.compressPrincipalString)(principalArn));
+            accountBitSet.set(globalIndex, 1);
+            const allowPolicies = await collectClient.getAllowPoliciesForPrincipal(principalArn);
+            addPoliciesToCache(allowPolicies, principalIndex, globalIndex);
+            globalIndex++;
+        }
+        const accountEnd = globalIndex - 1;
+        principalIndex.accounts[accountId] = [accountStart, accountEnd];
+    }
+    for (const type of ['action', 'notAction']) {
+        for (const [, actions] of Object.entries(principalIndex[type])) {
+            for (const [action, bitset] of Object.entries(actions)) {
+                actions[action] = (0, bitset_js_1.encodeBitSet)(bitset);
+            }
+        }
+    }
+    delete principalIndex.notAction['*'];
+    await collectClient.savePrincipalIndex('principals', {
+        principals: principalIndex.principals,
+        prefix: principalIndex.prefix
+    });
+    await collectClient.savePrincipalIndex('accounts', principalIndex.accounts);
+    await collectClient.savePrincipalIndex('not-actions', principalIndex.notAction);
+    for (const [service, serviceIndex] of Object.entries(principalIndex.action)) {
+        const serviceKey = service === '*' ? 'wildcard' : service;
+        await collectClient.savePrincipalIndex(`actions-${serviceKey}`, serviceIndex);
+    }
+}
+/**
+ * Add policies to the existing cache
+ *
+ * @param policies the policies to add
+ * @param existingCache the existing cache
+ * @param principalIndex the index of the principal to add
+ */
+function addPoliciesToCache(policies, existingCache, principalIndex) {
+    for (const policy of policies) {
+        for (const statement of policy.statements()) {
+            if (statement.isAllow()) {
+                if (statement.isActionStatement()) {
+                    for (const action of statement.actions()) {
+                        setCacheAction(existingCache.action, action, principalIndex);
+                    }
+                }
+                else if (statement.isNotActionStatement()) {
+                    for (const action of statement.notActions()) {
+                        setCacheAction(existingCache.notAction, action, principalIndex);
+                    }
+                }
+            }
+        }
+    }
+}
+/**
+ * Sets an action for a principal in a cache.
+ *
+ * @param cache The cache to update.
+ * @param action The action to set.
+ * @param principalIndex The index of the principal.
+ */
+function setCacheAction(cache, action, principalIndex) {
+    if (action.isWildcardAction()) {
+        if (!cache['*']) {
+            cache['*'] = { '*': new bitset_1.default() };
+        }
+        cache['*']['*'].set(principalIndex, 1);
+    }
+    else if (action.isServiceAction()) {
+        const service = action.service().toLowerCase();
+        const serviceAction = action.action().toLowerCase();
+        if (!cache[service]) {
+            cache[service] = {};
+        }
+        if (!cache[service][serviceAction]) {
+            cache[service][serviceAction] = new bitset_1.default();
+        }
+        cache[service][serviceAction].set(principalIndex, 1);
+    }
+}
+//# sourceMappingURL=makePrincipalIndex.js.map

package/dist/cjs/principalIndex/makePrincipalIndex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"makePrincipalIndex.js","sourceRoot":"","sources":["../../../src/principalIndex/makePrincipalIndex.ts"],"names":[],"mappings":";;AAUA,gDAgDC;AAzDD,mCAA2B;AAE3B,kDAA0E;AAE1E;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CAAC,aAA+B;IACtE,MAAM,cAAc,GAAmB;QACrC,MAAM,EAAE,eAAe;QACvB,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE;QACV,SAAS,EAAE,EAAE;KACd,CAAA;IAED,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAA;IACrD,IAAI,WAAW,GAAG,CAAC,CAAA;IAEnB,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,IAAI,gBAAM,EAAE,CAAA;QAClC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;QAC3E,MAAM,YAAY,GAAG,WAAW,CAAA;QAChC,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;YACtC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,IAAA,mCAAuB,EAAC,YAAY,CAAC,CAAC,CAAA;YACrE,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;YACjC,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAA;YACpF,kBAAkB,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,CAAC,CAAA;YAC9D,WAAW,EAAE,CAAA;QACf,CAAC;QACD,MAAM,UAAU,GAAG,WAAW,GAAG,CAAC,CAAA;QAElC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAU,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvD,OAAO,CAAC,MAAM,CAAC,GAAG,IAAA,wBAAY,EAAC,MAAM,CAAQ,CAAA;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAEpC,MAAM,aAAa,CAAC,kBAAkB,CAAC,YAAY,EAAE;QACnD,UAAU,EAAE,cAAc,CAAC,UAAU;QACrC,MAAM,EAAE,cAAc,CAAC,MAAM;KAC9B,CAAC,CAAA;IACF,MAAM,aAAa,CAAC,kBAAkB,CAAC,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC3E,MAAM,aAAa,CAAC,kBAAkB,CAAC,aAAa,EAAE,cAAc,CAAC,SAAS,CAAC,CAAA;IAC/E,KAAK,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,MAAM,UAAU,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAA;QACzD,MAAM,aAAa,CAAC,kBAAkB,CAAC,WAAW,UAAU,EAAE,EAAE,YAAY,CAAC,CAAA;IAC/E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AAEH,SAAS,kBAAkB,CACzB,QAAkB,EAClB,aAA6B,EAC7B,cAAsB;IAEtB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YAC5C,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;gBACxB,IAAI,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;oBAClC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;wBACzC,cAAc,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;qBAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;oBAC5C,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;wBAC5C,cAAc,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,CAAA;oBACjE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CACrB,KAA6D,EAC7D,MAAoB,EACpB,cAAsB;IAEtB,IAAI,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAChB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,gBAAM,EAAE,EAAE,CAAA;QACpC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA;IACxC,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAA;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAA;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QACrB,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,GAAG,IAAI,gBAAM,EAAE,CAAA;QAC9C,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA;IACtD,CAAC;AACH,CAAC"}

package/dist/cjs/principals.d.ts

@@ -0,0 +1,54 @@
+import { IamCollectClient, type InlinePolicy, type ManagedPolicy, type SimulationOrgPolicies } from './collect/client.js';
+export interface PrincipalPolicies {
+    managedPolicies: ManagedPolicy[];
+    inlinePolicies: InlinePolicy[];
+    permissionBoundary: ManagedPolicy | undefined;
+    scps: SimulationOrgPolicies[];
+    rcps: SimulationOrgPolicies[];
+    groupPolicies?: {
+        group: string;
+        managedPolicies: ManagedPolicy[];
+        inlinePolicies: InlinePolicy[];
+    }[];
+}
+/**
+ * Get all the IAM policies for a user, including managed and inline policies, permission boundaries, and group policies.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies
+ * @param principalArn the ARN of the user to get policies for
+ * @returns an object containing the managed policies, inline policies, permission boundary, and group policies
+ */
+export declare function getAllPoliciesForUser(collectClient: IamCollectClient, principalArn: string): Promise<PrincipalPolicies>;
+/**
+ * Get all the IAM policies for a role, including managed and inline policies and permission boundaries.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies
+ * @param principalArn the ARN of the role to get policies for
+ * @returns an object containing the managed policies, inline policies, and permission boundary
+ */
+export declare function getAllPoliciesForRole(collectClient: IamCollectClient, principalArn: string): Promise<PrincipalPolicies>;
+/**
+ * Get all IAM policies for a supported principal.
+ *
+ * IAM role and assumed-role principals are resolved to their canonical stored ARN before
+ * loading policies so pathless STS session principals can use path-qualified IAM role data.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies
+ * @param principalArn the ARN or service principal to get policies for
+ * @returns all policies that apply directly to the principal
+ */
+export declare function getAllPoliciesForPrincipal(collectClient: IamCollectClient, principalArn: string): Promise<PrincipalPolicies>;
+export declare function isArnPrincipal(principal: string): boolean;
+export declare function isServicePrincipal(principal: string): boolean;
+export declare function isServiceLinkedRole(principal: string): boolean;
+export declare function isOidcPrincipal(principal: string): boolean;
+export declare function isSamlPrincipal(principal: string): boolean;
+/**
+ * Check to see if a principal exists or is an AWS service principal.
+ *
+ * @param principal the principal to check
+ * @param collectClient the IAM collect client to use for checking existence
+ * @returns true if the principal exists or is a service principal, false otherwise
+ */
+export declare function principalExists(principal: string, collectClient: IamCollectClient): Promise<boolean>;
+//# sourceMappingURL=principals.d.ts.map

package/dist/cjs/principals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.d.ts","sourceRoot":"","sources":["../../src/principals.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAE5B,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,aAAa,EAAE,CAAA;IAChC,cAAc,EAAE,YAAY,EAAE,CAAA;IAC9B,kBAAkB,EAAE,aAAa,GAAG,SAAS,CAAA;IAC7C,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC7B,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC7B,aAAa,CAAC,EAAE;QACd,KAAK,EAAE,MAAM,CAAA;QACb,eAAe,EAAE,aAAa,EAAE,CAAA;QAChC,cAAc,EAAE,YAAY,EAAE,CAAA;KAC/B,EAAE,CAAA;CACJ;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CA4B5B;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM1D;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM1D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAMlB"}

package/dist/cjs/principals.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAllPoliciesForUser = getAllPoliciesForUser;
+exports.getAllPoliciesForRole = getAllPoliciesForRole;
+exports.getAllPoliciesForPrincipal = getAllPoliciesForPrincipal;
+exports.isArnPrincipal = isArnPrincipal;
+exports.isServicePrincipal = isServicePrincipal;
+exports.isServiceLinkedRole = isServiceLinkedRole;
+exports.isOidcPrincipal = isOidcPrincipal;
+exports.isSamlPrincipal = isSamlPrincipal;
+exports.principalExists = principalExists;
+const iam_utils_1 = require("@actsecurity/iam-utils");
+/**
+ * Get all the IAM policies for a user, including managed and inline policies, permission boundaries, and group policies.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies
+ * @param principalArn the ARN of the user to get policies for
+ * @returns an object containing the managed policies, inline policies, permission boundary, and group policies
+ */
+async function getAllPoliciesForUser(collectClient, principalArn) {
+    const accountId = (0, iam_utils_1.splitArnParts)(principalArn).accountId;
+    const managedPolicies = await collectClient.getManagedPoliciesForUser(principalArn);
+    const inlinePolicies = await collectClient.getInlinePoliciesForUser(principalArn);
+    const permissionBoundary = await collectClient.getPermissionsBoundaryForUser(principalArn);
+    const groups = await collectClient.getGroupsForUser(principalArn);
+    const scps = await collectClient.getScpHierarchyForAccount(accountId);
+    const rcps = await collectClient.getRcpHierarchyForAccount(accountId);
+    const groupPolicies = [];
+    for (const group of groups) {
+        const groupManagedPolicies = await collectClient.getManagedPoliciesForGroup(group);
+        const groupInlinePolicies = await collectClient.getInlinePoliciesForGroup(group);
+        groupPolicies.push({
+            group,
+            managedPolicies: groupManagedPolicies,
+            inlinePolicies: groupInlinePolicies
+        });
+    }
+    return {
+        scps,
+        rcps,
+        managedPolicies,
+        inlinePolicies,
+        permissionBoundary,
+        groupPolicies
+    };
+}
+/**
+ * Get all the IAM policies for a role, including managed and inline policies and permission boundaries.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies
+ * @param principalArn the ARN of the role to get policies for
+ * @returns an object containing the managed policies, inline policies, and permission boundary
+ */
+async function getAllPoliciesForRole(collectClient, principalArn) {
+    const accountId = (0, iam_utils_1.splitArnParts)(principalArn).accountId;
+    const managedPolicies = await collectClient.getManagedPoliciesForRole(principalArn);
+    const inlinePolicies = await collectClient.getInlinePoliciesForRole(principalArn);
+    const permissionBoundary = await collectClient.getPermissionsBoundaryForRole(principalArn);
+    const scps = await collectClient.getScpHierarchyForAccount(accountId);
+    const rcps = await collectClient.getRcpHierarchyForAccount(accountId);
+    return {
+        scps,
+        rcps,
+        managedPolicies,
+        inlinePolicies,
+        permissionBoundary
+    };
+}
+/**
+ * Get all IAM policies for a supported principal.
+ *
+ * IAM role and assumed-role principals are resolved to their canonical stored ARN before
+ * loading policies so pathless STS session principals can use path-qualified IAM role data.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies
+ * @param principalArn the ARN or service principal to get policies for
+ * @returns all policies that apply directly to the principal
+ */
+async function getAllPoliciesForPrincipal(collectClient, principalArn) {
+    if (isServicePrincipal(principalArn) ||
+        isSamlPrincipal(principalArn) ||
+        isOidcPrincipal(principalArn)) {
+        return {
+            scps: [],
+            rcps: [],
+            managedPolicies: [],
+            inlinePolicies: [],
+            permissionBoundary: undefined,
+            groupPolicies: []
+        };
+    }
+    if ((0, iam_utils_1.isIamUserArn)(principalArn)) {
+        return getAllPoliciesForUser(collectClient, principalArn);
+    }
+    else if ((0, iam_utils_1.isIamRoleArn)(principalArn)) {
+        const roleArn = (await collectClient.resolvePrincipalArn(principalArn)) ?? principalArn;
+        return getAllPoliciesForRole(collectClient, roleArn);
+    }
+    else if ((0, iam_utils_1.isAssumedRoleArn)(principalArn)) {
+        const roleArn = (await collectClient.resolvePrincipalArn(principalArn)) ??
+            (0, iam_utils_1.convertAssumedRoleArnToRoleArn)(principalArn);
+        return getAllPoliciesForRole(collectClient, roleArn);
+    }
+    throw new Error(`Unsupported principal type: ${principalArn}`);
+}
+function isArnPrincipal(principal) {
+    return principal.startsWith('arn:');
+}
+function isServicePrincipal(principal) {
+    return !isArnPrincipal(principal) && principal.endsWith('amazonaws.com');
+}
+function isServiceLinkedRole(principal) {
+    const arnParts = (0, iam_utils_1.splitArnParts)(principal);
+    return isArnPrincipal(principal) && !!arnParts.resourcePath?.startsWith('aws-service-role/');
+}
+function isOidcPrincipal(principal) {
+    if (!isArnPrincipal(principal)) {
+        return false;
+    }
+    const parts = (0, iam_utils_1.splitArnParts)(principal);
+    return parts.service === 'iam' && parts.resourceType === 'oidc-provider';
+}
+function isSamlPrincipal(principal) {
+    if (!isArnPrincipal(principal)) {
+        return false;
+    }
+    const parts = (0, iam_utils_1.splitArnParts)(principal);
+    return parts.service === 'iam' && parts.resourceType === 'saml-provider';
+}
+/**
+ * Check to see if a principal exists or is an AWS service principal.
+ *
+ * @param principal the principal to check
+ * @param collectClient the IAM collect client to use for checking existence
+ * @returns true if the principal exists or is a service principal, false otherwise
+ */
+async function principalExists(principal, collectClient) {
+    if (isServicePrincipal(principal)) {
+        return true;
+    }
+    return collectClient.principalExists(principal);
+}
+//# sourceMappingURL=principals.js.map

package/dist/cjs/principals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.js","sourceRoot":"","sources":["../../src/principals.ts"],"names":[],"mappings":";;AAkCA,sDA8BC;AASD,sDAmBC;AAYD,gEA+BC;AAED,wCAEC;AAED,gDAEC;AAED,kDAGC;AAED,0CAMC;AAED,0CAMC;AASD,0CASC;AAtLD,sDAM+B;AAqB/B;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,aAA+B,EAC/B,YAAoB;IAEpB,MAAM,SAAS,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC,SAAU,CAAA;IAExD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAA;IACnF,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAA;IACjF,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAA;IAC1F,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAA;IACjE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACrE,MAAM,aAAa,GAAG,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,oBAAoB,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAA;QAClF,MAAM,mBAAmB,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;QAChF,aAAa,CAAC,IAAI,CAAC;YACjB,KAAK;YACL,eAAe,EAAE,oBAAoB;YACrC,cAAc,EAAE,mBAAmB;SACpC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,eAAe;QACf,cAAc;QACd,kBAAkB;QAClB,aAAa;KACd,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,aAA+B,EAC/B,YAAoB;IAEpB,MAAM,SAAS,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC,SAAU,CAAA;IAExD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAA;IACnF,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAA;IACjF,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAA;IAC1F,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IAErE,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,eAAe;QACf,cAAc;QACd,kBAAkB;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,0BAA0B,CAC9C,aAA+B,EAC/B,YAAoB;IAEpB,IACE,kBAAkB,CAAC,YAAY,CAAC;QAChC,eAAe,CAAC,YAAY,CAAC;QAC7B,eAAe,CAAC,YAAY,CAAC,EAC7B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,EAAE;YACR,eAAe,EAAE,EAAE;YACnB,cAAc,EAAE,EAAE;YAClB,kBAAkB,EAAE,SAAS;YAC7B,aAAa,EAAE,EAAE;SAClB,CAAA;IACH,CAAC;IAED,IAAI,IAAA,wBAAY,EAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,OAAO,qBAAqB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAC3D,CAAC;SAAM,IAAI,IAAA,wBAAY,EAAC,YAAY,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,aAAa,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,IAAI,YAAY,CAAA;QACvF,OAAO,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;SAAM,IAAI,IAAA,4BAAgB,EAAC,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GACX,CAAC,MAAM,aAAa,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;YACvD,IAAA,0CAA8B,EAAC,YAAY,CAAC,CAAA;QAC9C,OAAO,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,YAAY,EAAE,CAAC,CAAA;AAChE,CAAC;AAED,SAAgB,cAAc,CAAC,SAAiB;IAC9C,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACrC,CAAC;AAED,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;AAC1E,CAAC;AAED,SAAgB,mBAAmB,CAAC,SAAiB;IACnD,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IACzC,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAA;AAC9F,CAAC;AAED,SAAgB,eAAe,CAAC,SAAiB;IAC/C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IACtC,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAA;AAC1E,CAAC;AAED,SAAgB,eAAe,CAAC,SAAiB;IAC/C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IACtC,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAA;AAC1E,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,aAA+B;IAE/B,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;AACjD,CAAC"}

package/dist/cjs/resources.d.ts

@@ -0,0 +1,32 @@
+import { type ValidatedPolicy } from '@actsecurity/iam-policy';
+import { type Simulation } from '@actsecurity/iam-simulate';
+import { IamCollectClient } from './collect/client.js';
+/**
+ * Get the account ID for a given resource ARN. Lookup index if necessary to find the account ID.
+ *
+ * @param collectClient the IAM collect client to use for retrieving the account ID
+ * @param resourceArn the ARN of the resource to get the account ID for
+ * @returns the account ID for the specified resource, or undefined if not found
+ */
+export declare function getAccountIdForResource(collectClient: IamCollectClient, resourceArn: string): Promise<string | undefined>;
+/**
+ * Get the resource control policies (RCPs) for a given resource ARN.
+ *
+ * @param collectClient the IAM collect client to use for retrieving RCPs
+ * @param resourceArn the ARN of the resource to get RCPs for
+ * @param resourceAccount the account ID of the resource, if known
+ * @returns an array of resource control policies for the specified resource
+ */
+export declare function getRcpsForResource(collectClient: IamCollectClient, resourceArn: string, resourceAccount: string | undefined): Promise<Simulation['resourceControlPolicies']>;
+/**
+ * Get the resource policy for a resource, if any.
+ *
+ * @param collectClient the IAM collect client to use for retrieving the resource policy
+ * @param resourceArn the ARN of the resource to get the policy for
+ * @param resourceAccount the account ID of the resource, if known
+ * @returns  the resource policy for the specified resource, or undefined if not found
+ */
+export declare function getResourcePolicyForResource(collectClient: IamCollectClient, resourceArn: string, resourceAccount: string | undefined): Promise<ValidatedPolicy<{
+    name: string;
+}> | undefined>;
+//# sourceMappingURL=resources.d.ts.map

package/dist/cjs/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAE3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAgB7B;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAMhD;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,CAAC,CAiBxD"}

package/dist/cjs/resources.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAccountIdForResource = getAccountIdForResource;
+exports.getRcpsForResource = getRcpsForResource;
+exports.getResourcePolicyForResource = getResourcePolicyForResource;
+const iam_utils_1 = require("@actsecurity/iam-utils");
+/**
+ * Get the account ID for a given resource ARN. Lookup index if necessary to find the account ID.
+ *
+ * @param collectClient the IAM collect client to use for retrieving the account ID
+ * @param resourceArn the ARN of the resource to get the account ID for
+ * @returns the account ID for the specified resource, or undefined if not found
+ */
+async function getAccountIdForResource(collectClient, resourceArn) {
+    if (!resourceArn.startsWith('arn:')) {
+        return undefined;
+    }
+    const arnParts = (0, iam_utils_1.splitArnParts)(resourceArn);
+    let accountId = arnParts.accountId;
+    if (accountId && accountId !== 'aws') {
+        return accountId;
+    }
+    if (arnParts.service === 's3' && arnParts.resourceType === '') {
+        const bucketName = arnParts.resourcePath.split('/')[0];
+        return collectClient.getAccountIdForBucket(bucketName);
+    }
+    else if (arnParts.service === 'apigateway' && arnParts.resourceType === 'restapis') {
+        return collectClient.getAccountIdForRestApi(resourceArn);
+    }
+    return undefined;
+}
+/**
+ * Get the resource control policies (RCPs) for a given resource ARN.
+ *
+ * @param collectClient the IAM collect client to use for retrieving RCPs
+ * @param resourceArn the ARN of the resource to get RCPs for
+ * @param resourceAccount the account ID of the resource, if known
+ * @returns an array of resource control policies for the specified resource
+ */
+async function getRcpsForResource(collectClient, resourceArn, resourceAccount) {
+    const accountId = resourceAccount || (await getAccountIdForResource(collectClient, resourceArn));
+    if (!accountId) {
+        throw new Error(`Unable to determine account ID for resource ARN: ${resourceArn}`);
+    }
+    return collectClient.getRcpHierarchyForAccount(accountId);
+}
+/**
+ * Get the resource policy for a resource, if any.
+ *
+ * @param collectClient the IAM collect client to use for retrieving the resource policy
+ * @param resourceArn the ARN of the resource to get the policy for
+ * @param resourceAccount the account ID of the resource, if known
+ * @returns  the resource policy for the specified resource, or undefined if not found
+ */
+async function getResourcePolicyForResource(collectClient, resourceArn, resourceAccount) {
+    const accountId = resourceAccount || (await getAccountIdForResource(collectClient, resourceArn));
+    if (!accountId) {
+        throw new Error(`Unable to determine account ID for resource ARN: ${resourceArn}`);
+    }
+    const resourcePolicy = await collectClient.getResourcePolicyForArn(resourceArn, accountId);
+    if (resourcePolicy) {
+        return resourcePolicy;
+    }
+    const ramPolicy = await collectClient.getRamSharePolicyForArn(resourceArn, accountId);
+    if (ramPolicy) {
+        return ramPolicy;
+    }
+    //TODO: there should be more here for things like glue resources
+    return undefined;
+}
+//# sourceMappingURL=resources.js.map

package/dist/cjs/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":";;AAYA,0DAmBC;AAUD,gDAUC;AAUD,oEAqBC;AAhFD,sDAAsD;AAGtD;;;;;;GAMG;AACI,KAAK,UAAU,uBAAuB,CAC3C,aAA+B,EAC/B,WAAmB;IAEnB,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;IAClC,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,OAAO,aAAa,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAA;IACxD,CAAC;SAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QACrF,OAAO,aAAa,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,aAA+B,EAC/B,WAAmB,EACnB,eAAmC;IAEnC,MAAM,SAAS,GAAG,eAAe,IAAI,CAAC,MAAM,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;IAChG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,WAAW,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,4BAA4B,CAChD,aAA+B,EAC/B,WAAmB,EACnB,eAAmC;IAEnC,MAAM,SAAS,GAAG,eAAe,IAAI,CAAC,MAAM,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;IAChG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,WAAW,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAC1F,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IACrF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,gEAAgE;IAChE,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/cjs/simulate/contextKeys.d.ts

@@ -0,0 +1,68 @@
+import { IamCollectClient } from '../collect/client.js';
+import { type SimulationRequest } from './simulate.js';
+/**
+ * Context keys for IAM simulation requests.
+ *
+ * These keys are used to provide additional context for the simulation, such as
+ * the principal making the request, the resource being accessed, and any additional
+ * context keys that may be required for the simulation.
+ */
+export type ContextKeys = Record<string, string | string[]>;
+export declare const knownContextKeys: readonly string[];
+export declare const CONTEXT_KEYS: {
+    assumedRoot: string;
+    userId: string;
+    vpc: string;
+    vpcEndpointId: string;
+    vpcEndpointAccount: string;
+    vpcEndpointOrgId: string;
+    vpcEndpointOrgPaths: string;
+    vpcArn: string;
+};
+/**
+ * Checks if a context has a specific key (case-insensitive).
+ *
+ * @param context - The context to check.
+ * @param key - The key to check for.
+ * @returns True if the context has the key, false otherwise.
+ */
+export declare function contextHasKey(context: ContextKeys, key: string): boolean;
+/**
+ * Get the value of a context key (case-insensitive).
+ *
+ * @param context - The context to check.
+ * @param key - The key to get the value for.
+ * @returns The value of the context key, or undefined if it doesn't exist.
+ */
+export declare function contextValue(context: ContextKeys, key: string): string | string[] | undefined;
+/**
+ * Get the context keys for a simulation request.
+ *
+ * @param collectClient the collect client to use for fetching data
+ * @param simulationRequest the simulation request to create context keys for
+ * @param service the service the request is for
+ * @param contextKeyOverrides the context key overrides to apply
+ * @param resolvedPrincipalArnForContext canonical principal ARN to use for role-backed context keys
+ * @returns a promise that resolves to the context keys for the simulation request
+ */
+export declare function createContextKeys(collectClient: IamCollectClient, simulationRequest: SimulationRequest, service: string, contextKeyOverrides: ContextKeys, resolvedPrincipalArnForContext?: string): Promise<{
+    resourceTagsAreKnown: boolean;
+    contextKeys: ContextKeys;
+}>;
+/**
+ * Get the VPC keys that should be added to the context for a simulation.
+ *
+ * @param context the existing context
+ * @param service the service the request is for
+ * @param collectClient the IAM collect client
+ * @returns a record of VPC context keys
+ */
+export declare function getVpcKeys(context: ContextKeys, service: string, collectClient: IamCollectClient): Promise<ContextKeys>;
+/**
+ * Check if a service supports extra VPC endpoint data.
+ *
+ * @param service the service to check
+ * @returns true if the service supports extra VPC endpoint data, false otherwise
+ */
+export declare function serviceSupportsExtraVpcEndpointData(service: string): boolean;
+//# sourceMappingURL=contextKeys.d.ts.map

package/dist/cjs/simulate/contextKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/simulate/contextKeys.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEtD;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;AAE3D,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAyB7C,CAAA;AAED,eAAO,MAAM,YAAY;;;;;;;;;CASxB,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAK7F;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,gBAAgB,EAC/B,iBAAiB,EAAE,iBAAiB,EACpC,OAAO,EAAE,MAAM,EACf,mBAAmB,EAAE,WAAW,EAChC,8BAA8B,CAAC,EAAE,MAAM,GACtC,OAAO,CAAC;IAAE,oBAAoB,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,WAAW,CAAA;CAAE,CAAC,CAoItE;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAgEtB;AAyCD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5E"}