@actsecurity/iam-lens 0.1.156

package/dist/cjs/simulate/contextKeys.js

@@ -0,0 +1,293 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONTEXT_KEYS = exports.knownContextKeys = void 0;
+exports.contextHasKey = contextHasKey;
+exports.contextValue = contextValue;
+exports.createContextKeys = createContextKeys;
+exports.getVpcKeys = getVpcKeys;
+exports.serviceSupportsExtraVpcEndpointData = serviceSupportsExtraVpcEndpointData;
+const iam_utils_1 = require("@actsecurity/iam-utils");
+const principals_js_1 = require("../principals.js");
+exports.knownContextKeys = [
+    'aws:SecureTransport',
+    'aws:CurrentTime',
+    'aws:EpochTime',
+    'aws:PrincipalArn',
+    'aws:PrincipalAccount',
+    'aws:PrincipalOrgId',
+    'aws:PrincipalOrgPaths',
+    'aws:PrincipalType',
+    'aws:username',
+    'aws:ResourceAccount',
+    'aws:ResourceOrgID',
+    'aws:ResourceOrgPaths',
+    'aws:PrincipalIsAWSService',
+    'aws:PrincipalServiceName',
+    'aws:SourceAccount',
+    'aws:SourceOrgID',
+    'aws:SourceOrgPaths',
+    'aws:SourceOwner',
+    'aws:SourceArn',
+    'kms:CallerAccount'
+];
+exports.CONTEXT_KEYS = {
+    assumedRoot: 'aws:AssumedRoot',
+    userId: 'aws:userid',
+    vpc: 'aws:SourceVpc',
+    vpcEndpointId: 'aws:SourceVpce',
+    vpcEndpointAccount: 'aws:VpceAccount',
+    vpcEndpointOrgId: 'aws:VpceOrgID',
+    vpcEndpointOrgPaths: 'aws:VpceOrgPaths',
+    vpcArn: 'aws:SourceVpcArn'
+};
+/**
+ * Checks if a context has a specific key (case-insensitive).
+ *
+ * @param context - The context to check.
+ * @param key - The key to check for.
+ * @returns True if the context has the key, false otherwise.
+ */
+function contextHasKey(context, key) {
+    return !!contextValue(context, key);
+}
+/**
+ * Get the value of a context key (case-insensitive).
+ *
+ * @param context - The context to check.
+ * @param key - The key to get the value for.
+ * @returns The value of the context key, or undefined if it doesn't exist.
+ */
+function contextValue(context, key) {
+    const matchingKey = Object.keys(context).find((contextKey) => contextKey.toLowerCase() === key.toLowerCase());
+    return matchingKey ? context[matchingKey] : undefined;
+}
+/**
+ * Get the context keys for a simulation request.
+ *
+ * @param collectClient the collect client to use for fetching data
+ * @param simulationRequest the simulation request to create context keys for
+ * @param service the service the request is for
+ * @param contextKeyOverrides the context key overrides to apply
+ * @param resolvedPrincipalArnForContext canonical principal ARN to use for role-backed context keys
+ * @returns a promise that resolves to the context keys for the simulation request
+ */
+async function createContextKeys(collectClient, simulationRequest, service, contextKeyOverrides, resolvedPrincipalArnForContext) {
+    const contextKeys = {
+        'aws:SecureTransport': 'true',
+        'aws:CurrentTime': new Date().toISOString(),
+        'aws:EpochTime': Math.floor(Date.now() / 1000).toString()
+    };
+    if ((0, principals_js_1.isArnPrincipal)(simulationRequest.principal)) {
+        const arnParts = (0, iam_utils_1.splitArnParts)(simulationRequest.principal);
+        const principalArnForContext = resolvedPrincipalArnForContext ??
+            (arnParts.resourceType === 'assumed-role'
+                ? (0, iam_utils_1.convertAssumedRoleArnToRoleArn)(simulationRequest.principal)
+                : simulationRequest.principal);
+        contextKeys['aws:PrincipalArn'] = principalArnForContext;
+        const principalAccountId = arnParts.accountId;
+        contextKeys['aws:PrincipalAccount'] = arnParts.accountId || '';
+        const orgId = await collectClient.getOrgIdForAccount(principalAccountId);
+        if (orgId) {
+            contextKeys['aws:PrincipalOrgId'] = orgId;
+            const orgStructure = await collectClient.getOrgUnitHierarchyForAccount(principalAccountId);
+            contextKeys['aws:PrincipalOrgPaths'] = makeOrgPaths(orgId, orgStructure);
+        }
+        const { tags } = await collectClient.getTagsForResource(principalArnForContext, principalAccountId);
+        for (const [key, value] of Object.entries(tags)) {
+            contextKeys[`aws:PrincipalTag/${key}`] = value;
+        }
+        contextKeys['aws:PrincipalIsAWSService'] = 'false';
+        if (service.toLowerCase() === 'kms') {
+            contextKeys['kms:CallerAccount'] = principalAccountId;
+        }
+        if (simulationRequest.principal.endsWith(':root')) {
+            contextKeys['aws:PrincipalType'] = 'Account';
+            contextKeys['aws:userid'] = principalAccountId;
+        }
+        else if (arnParts.resourceType === 'user') {
+            contextKeys['aws:PrincipalType'] = 'User';
+            const userUniqueId = await collectClient.getUniqueIdForIamResource(simulationRequest.principal);
+            contextKeys['aws:userid'] = userUniqueId || 'UNKNOWN';
+            const userName = arnParts.resourcePath?.split('/').at(-1);
+            contextKeys['aws:username'] = userName;
+        }
+        else if (arnParts.resourceType === 'federated-user') {
+            contextKeys['aws:PrincipalType'] = 'FederatedUser';
+            contextKeys['aws:userid'] = `${arnParts.accountId}:${arnParts.resourcePath}`;
+        }
+        else if (arnParts.resourceType === 'assumed-role' || arnParts.resourceType === 'role') {
+            contextKeys['aws:PrincipalType'] = 'AssumedRole';
+            //TODO: Set aws:userId for role principals
+            if (arnParts.resourceType === 'assumed-role') {
+                const sessionName = arnParts.resourcePath?.split('/').at(-1);
+                const roleArn = (0, iam_utils_1.convertAssumedRoleArnToRoleArn)(simulationRequest.principal);
+                const roleUniqueId = await collectClient.getUniqueIdForIamResource(roleArn);
+                contextKeys['aws:userid'] = `${roleUniqueId || 'UNKNOWN'}:${sessionName}`;
+            }
+        }
+    }
+    //Resource context keys
+    if ((0, iam_utils_1.actionSupportsAwsResourceInfoContextKeys)(simulationRequest.action)) {
+        contextKeys['aws:ResourceAccount'] = simulationRequest.resourceAccount;
+        const resourceOrgId = await collectClient.getOrgIdForAccount(simulationRequest.resourceAccount);
+        if (resourceOrgId) {
+            contextKeys['aws:ResourceOrgID'] = resourceOrgId;
+            const orgStructure = await collectClient.getOrgUnitHierarchyForAccount(simulationRequest.resourceAccount);
+            contextKeys['aws:ResourceOrgPaths'] = makeOrgPaths(resourceOrgId, orgStructure);
+        }
+    }
+    let resourceTagsAreKnown = false;
+    if (simulationRequest.resourceArn) {
+        const isBucket = (0, iam_utils_1.isS3BucketOrObjectArn)(simulationRequest.resourceArn);
+        const { tags: resourceTags, present: resourceTagsPreset } = await collectClient.getTagsForResource(isBucket ? (0, iam_utils_1.bucketArn)(simulationRequest.resourceArn) : simulationRequest.resourceArn, simulationRequest.resourceAccount);
+        resourceTagsAreKnown = resourceTagsPreset;
+        for (const [key, value] of Object.entries(resourceTags)) {
+            contextKeys[`aws:ResourceTag/${key}`] = value;
+            if (isBucket) {
+                contextKeys[`s3:BucketTag/${key}`] = value;
+            }
+        }
+    }
+    //Service Principal context keys
+    if ((0, principals_js_1.isServicePrincipal)(simulationRequest.principal)) {
+        contextKeys['aws:PrincipalIsAWSService'] = 'true';
+        contextKeys['aws:PrincipalServiceName'] = simulationRequest.principal;
+        contextKeys['aws:SourceAccount'] = simulationRequest.resourceAccount;
+        contextKeys['aws:SourceOwner'] = simulationRequest.resourceAccount;
+        contextKeys['aws:SourceOrgID'] = contextKeys['aws:ResourceOrgID'];
+        contextKeys['aws:SourceOrgPaths'] = contextKeys['aws:ResourceOrgPaths'];
+        if (simulationRequest.simulationMode === 'Discovery') {
+            // Source key Discovery constraints make the concrete value non-authoritative;
+            // this placeholder only marks the key as present for service-originated requests.
+            contextKeys['aws:SourceArn'] = 'arn:aws:iam::000000000000:role/unknown-source';
+        }
+    }
+    //Apply any custom context key overrides
+    for (const [key, value] of Object.entries(contextKeyOverrides)) {
+        contextKeys[key] = value;
+    }
+    //Add VPC context keys
+    const vpcKeys = await getVpcKeys(contextKeys, service, collectClient);
+    for (const [key, value] of Object.entries(vpcKeys)) {
+        contextKeys[key] = value;
+    }
+    return {
+        resourceTagsAreKnown,
+        contextKeys
+    };
+}
+/**
+ * Get the VPC keys that should be added to the context for a simulation.
+ *
+ * @param context the existing context
+ * @param service the service the request is for
+ * @param collectClient the IAM collect client
+ * @returns a record of VPC context keys
+ */
+async function getVpcKeys(context, service, collectClient) {
+    const vpcKeys = {};
+    let vpcEndpointId = contextValue(context, exports.CONTEXT_KEYS.vpcEndpointId);
+    const hasVpcEndpoint = !!vpcEndpointId;
+    let vpcId = contextValue(context, exports.CONTEXT_KEYS.vpc);
+    let vpcArn = contextValue(context, exports.CONTEXT_KEYS.vpcArn);
+    //If we know the VPC ID but not the endpoint, lookup the endpoint
+    if (!vpcEndpointId && vpcId && typeof vpcId === 'string') {
+        vpcEndpointId = await collectClient.getVpcEndpointIdForVpcService(vpcId, service);
+    }
+    //If we know the VPC ARN but not the endpoint, lookup the endpoint
+    if (!vpcEndpointId && vpcArn && typeof vpcArn === 'string') {
+        vpcEndpointId = await collectClient.getVpcEndpointIdForVpcService(vpcArn, service);
+    }
+    if (vpcEndpointId && !vpcId) {
+        if (typeof vpcEndpointId == 'string') {
+            const vpcId = await collectClient.getVpcIdForVpcEndpointId(vpcEndpointId);
+            if (vpcId) {
+                vpcKeys[exports.CONTEXT_KEYS.vpc] = vpcId;
+            }
+        }
+    }
+    if (vpcEndpointId && !hasVpcEndpoint) {
+        vpcKeys[exports.CONTEXT_KEYS.vpcEndpointId] = vpcEndpointId;
+    }
+    if (vpcEndpointId &&
+        typeof vpcEndpointId === 'string' &&
+        serviceSupportsExtraVpcEndpointData(service)) {
+        const vpcEndpointAccount = await collectClient.getAccountIdForVpcEndpointId(vpcEndpointId);
+        const vpcEndpointOrgId = await collectClient.getOrgIdForVpcEndpointId(vpcEndpointId);
+        const vpcEndpointOrgStructure = await collectClient.getOrgUnitHierarchyForVpcEndpointId(vpcEndpointId);
+        const vpcArn = await collectClient.getVpcArnForVpcEndpointId(vpcEndpointId);
+        if (vpcEndpointAccount && !contextHasKey(context, exports.CONTEXT_KEYS.vpcEndpointAccount)) {
+            vpcKeys[exports.CONTEXT_KEYS.vpcEndpointAccount] = vpcEndpointAccount;
+        }
+        if (vpcEndpointOrgId && !contextHasKey(context, exports.CONTEXT_KEYS.vpcEndpointOrgId)) {
+            vpcKeys[exports.CONTEXT_KEYS.vpcEndpointOrgId] = vpcEndpointOrgId;
+        }
+        if (vpcArn && !contextHasKey(context, exports.CONTEXT_KEYS.vpcArn)) {
+            vpcKeys[exports.CONTEXT_KEYS.vpcArn] = vpcArn;
+        }
+        if (vpcEndpointOrgId &&
+            vpcEndpointOrgStructure &&
+            !contextHasKey(context, exports.CONTEXT_KEYS.vpcEndpointOrgPaths)) {
+            vpcKeys[exports.CONTEXT_KEYS.vpcEndpointOrgPaths] = makeOrgPaths(vpcEndpointOrgId, vpcEndpointOrgStructure);
+        }
+    }
+    return vpcKeys;
+}
+const servicesThatSupportExtraVpcEndpointData = new Set([
+    'apprunner',
+    'discovery',
+    'athena',
+    'servicediscovery',
+    'applicationinsights',
+    'cloudformation',
+    'comprehendmedical',
+    'compute-optimizer',
+    'ecr',
+    'ecs',
+    'kinesisanalytics',
+    'route53',
+    'datasync',
+    'ebs',
+    'scheduler',
+    'firehose',
+    'medical-imaging',
+    'healthlake',
+    'omics',
+    'iam',
+    'iotfleetwise',
+    'iotwireless',
+    'kms',
+    'lambda',
+    'payment-cryptography',
+    'polly',
+    'acm-pca',
+    'rbin',
+    'rekognition',
+    'servicequotas',
+    's3',
+    'storagegateway',
+    'ssm-contacts',
+    'textract',
+    'transcribe',
+    'transfer'
+]);
+/**
+ * Check if a service supports extra VPC endpoint data.
+ *
+ * @param service the service to check
+ * @returns true if the service supports extra VPC endpoint data, false otherwise
+ */
+function serviceSupportsExtraVpcEndpointData(service) {
+    return servicesThatSupportExtraVpcEndpointData.has(service.toLowerCase());
+}
+/**
+ * Create a string array for an aws:xxOrgPaths context key value.
+ *
+ * @param orgId the organization ID
+ * @param hierarchy the organizational hierarchy
+ * @returns a string array representing the organizational paths
+ */
+function makeOrgPaths(orgId, hierarchy) {
+    return [`${orgId}/${hierarchy.join('/')}/`];
+}
+//# sourceMappingURL=contextKeys.js.map

package/dist/cjs/simulate/contextKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/simulate/contextKeys.ts"],"names":[],"mappings":";;;AAiEA,sCAEC;AASD,oCAKC;AAYD,8CA0IC;AAUD,gCAoEC;AA+CD,kFAEC;AAtWD,sDAM+B;AAE/B,oDAAqE;AAYxD,QAAA,gBAAgB,GAAsB;IACjD,qBAAqB;IACrB,iBAAiB;IACjB,eAAe;IAEf,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;IACpB,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IAEd,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;IAEtB,2BAA2B;IAC3B,0BAA0B;IAC1B,mBAAmB;IACnB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,eAAe;IAEf,mBAAmB;CACpB,CAAA;AAEY,QAAA,YAAY,GAAG;IAC1B,WAAW,EAAE,iBAAiB;IAC9B,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,eAAe;IACpB,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,iBAAiB;IACrC,gBAAgB,EAAE,eAAe;IACjC,mBAAmB,EAAE,kBAAkB;IACvC,MAAM,EAAE,kBAAkB;CAC3B,CAAA;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,OAAoB,EAAE,GAAW;IAC7D,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,OAAoB,EAAE,GAAW;IAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAC/D,CAAA;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvD,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,iBAAiB,CACrC,aAA+B,EAC/B,iBAAoC,EACpC,OAAe,EACf,mBAAgC,EAChC,8BAAuC;IAEvC,MAAM,WAAW,GAAgB;QAC/B,qBAAqB,EAAE,MAAM;QAC7B,iBAAiB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC3C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAA;IAED,IAAI,IAAA,8BAAc,EAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAC3D,MAAM,sBAAsB,GAC1B,8BAA8B;YAC9B,CAAC,QAAQ,CAAC,YAAY,KAAK,cAAc;gBACvC,CAAC,CAAC,IAAA,0CAA8B,EAAC,iBAAiB,CAAC,SAAS,CAAC;gBAC7D,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAClC,WAAW,CAAC,kBAAkB,CAAC,GAAG,sBAAsB,CAAA;QACxD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,SAAU,CAAA;QAC9C,WAAW,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;QAE9D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;QACxE,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAA;YAEzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,CAAA;YAC1F,WAAW,CAAC,uBAAuB,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,kBAAkB,CACrD,sBAAsB,EACtB,kBAAkB,CACnB,CAAA;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,WAAW,CAAC,oBAAoB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;QAChD,CAAC;QAED,WAAW,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,WAAW,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,CAAA;QACvD,CAAC;QAED,IAAI,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,WAAW,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAA;YAC5C,WAAW,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAA;QAChD,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5C,WAAW,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAA;YACzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAChE,iBAAiB,CAAC,SAAS,CAC5B,CAAA;YACD,WAAW,CAAC,YAAY,CAAC,GAAG,YAAY,IAAI,SAAS,CAAA;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;YAC1D,WAAW,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAA;QACxC,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtD,WAAW,CAAC,mBAAmB,CAAC,GAAG,eAAe,CAAA;YAClD,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAA;QAC9E,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACxF,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,0CAA0C;YAC1C,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;gBAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;gBAC7D,MAAM,OAAO,GAAG,IAAA,0CAA8B,EAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;gBAC3E,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAA;gBAC3E,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,YAAY,IAAI,SAAS,IAAI,WAAW,EAAE,CAAA;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,IAAA,oDAAwC,EAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,WAAW,CAAC,qBAAqB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QAEvE,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,eAAgB,CAAC,CAAA;QAChG,IAAI,aAAa,EAAE,CAAC;YAClB,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CACpE,iBAAiB,CAAC,eAAgB,CACnC,CAAA;YAED,WAAW,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,IAAI,oBAAoB,GAAG,KAAK,CAAA;IAChC,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAA,iCAAqB,EAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACrE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,GACvD,MAAM,aAAa,CAAC,kBAAkB,CACpC,QAAQ,CAAC,CAAC,CAAC,IAAA,qBAAS,EAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,EACnF,iBAAiB,CAAC,eAAgB,CACnC,CAAA;QACH,oBAAoB,GAAG,kBAAkB,CAAA;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,WAAW,CAAC,mBAAmB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC7C,IAAI,QAAQ,EAAE,CAAC;gBACb,WAAW,CAAC,gBAAgB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,IAAA,kCAAkB,EAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,WAAW,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAA;QACjD,WAAW,CAAC,0BAA0B,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAA;QACrE,WAAW,CAAC,mBAAmB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACrE,WAAW,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACnE,WAAW,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAA;QACjE,WAAW,CAAC,oBAAoB,CAAC,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAEvE,IAAI,iBAAiB,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;YACrD,8EAA8E;YAC9E,kFAAkF;YAClF,WAAW,CAAC,eAAe,CAAC,GAAG,+CAA+C,CAAA;QAChF,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/D,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED,sBAAsB;IACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED,OAAO;QACL,oBAAoB;QACpB,WAAW;KACZ,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,OAAe,EACf,aAA+B;IAE/B,MAAM,OAAO,GAAgB,EAAE,CAAA;IAE/B,IAAI,aAAa,GAAG,YAAY,CAAC,OAAO,EAAE,oBAAY,CAAC,aAAa,CAAC,CAAA;IACrE,MAAM,cAAc,GAAG,CAAC,CAAC,aAAa,CAAA;IACtC,IAAI,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,oBAAY,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,oBAAY,CAAC,MAAM,CAAC,CAAA;IAEvD,iEAAiE;IACjE,IAAI,CAAC,aAAa,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzD,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACnF,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpF,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,OAAO,aAAa,IAAI,QAAQ,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;YACzE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,oBAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,OAAO,CAAC,oBAAY,CAAC,aAAa,CAAC,GAAG,aAAa,CAAA;IACrD,CAAC;IAED,IACE,aAAa;QACb,OAAO,aAAa,KAAK,QAAQ;QACjC,mCAAmC,CAAC,OAAO,CAAC,EAC5C,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC1F,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;QACpF,MAAM,uBAAuB,GAC3B,MAAM,aAAa,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;QAE3E,IAAI,kBAAkB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACnF,OAAO,CAAC,oBAAY,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAA;QAC/D,CAAC;QACD,IAAI,gBAAgB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAC,oBAAY,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;QAC3D,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,oBAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;QACvC,CAAC;QACD,IACE,gBAAgB;YAChB,uBAAuB;YACvB,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,mBAAmB,CAAC,EACzD,CAAC;YACD,OAAO,CAAC,oBAAY,CAAC,mBAAmB,CAAC,GAAG,YAAY,CACtD,gBAAgB,EAChB,uBAAuB,CACxB,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,uCAAuC,GAAG,IAAI,GAAG,CAAC;IACtD,WAAW;IACX,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,qBAAqB;IACrB,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,KAAK;IACL,KAAK;IACL,kBAAkB;IAClB,SAAS;IACT,UAAU;IACV,KAAK;IACL,WAAW;IACX,UAAU;IACV,iBAAiB;IACjB,YAAY;IACZ,OAAO;IACP,KAAK;IACL,cAAc;IACd,aAAa;IACb,KAAK;IACL,QAAQ;IACR,sBAAsB;IACtB,OAAO;IACP,SAAS;IACT,MAAM;IACN,aAAa;IACb,eAAe;IACf,IAAI;IACJ,gBAAgB;IAChB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,UAAU;CACX,CAAC,CAAA;AAEF;;;;;GAKG;AACH,SAAgB,mCAAmC,CAAC,OAAe;IACjE,OAAO,uCAAuC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,SAAmB;IACtD,OAAO,CAAC,GAAG,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAC7C,CAAC"}

package/dist/cjs/simulate/simulate.d.ts

@@ -0,0 +1,72 @@
+import { type EvaluationResult, type RunSimulationResults, type Simulation, type SimulationMode } from '@actsecurity/iam-simulate';
+import { IamCollectClient } from '../collect/client.js';
+import { type S3AbacOverride } from '../utils/s3Abac.js';
+import { type ContextKeys } from './contextKeys.js';
+/**
+ * The request details for simulating an IAM request.
+ */
+export interface SimulationRequest {
+    /**
+     * The ARN of the resource to simulate access to. Can be undefined for wildcard actions.
+     */
+    resourceArn: string | undefined;
+    /**
+     * The account ID of the resource, only required if it cannot be determined from the resource ARN.
+     */
+    resourceAccount: string | undefined;
+    /**
+     * The action to simulate; must be a valid IAM service and action such as `s3:ListBucket`.
+     */
+    action: string;
+    /**
+     * The ARN of the principal to simulate. Can be a user, role, session, or AWS service.
+     */
+    principal: string;
+    /**
+     * Any custom context keys to use for the simulation.
+     */
+    customContextKeys: ContextKeys;
+    /**
+     * The simulation mode to use for the request.
+     */
+    simulationMode: SimulationMode;
+    /**
+     * Whether to ignore missing principal errors.
+     */
+    ignoreMissingPrincipal?: boolean;
+    /**
+     * Override for S3 ABAC settings for the simulation.
+     */
+    s3AbacOverride?: S3AbacOverride;
+    /**
+     * The session policy to use for the simulation, if the principal type supports it.
+     */
+    sessionPolicy?: any;
+    /**
+     * Additional strict context keys to include for the simulation. These will be added to the default strict context keys.
+     */
+    additionalStrictContextKeys?: string[];
+}
+/**
+ * The result of a simulation request, containing the original request and the simulation result.
+ */
+export interface SimulateRequestResult {
+    /**
+     * The simulation request that was evaluated.
+     */
+    request: Simulation['request'];
+    /**
+     * The result of the simulation, which may be an error, a single result, or a wildcard result.
+     */
+    result: RunSimulationResults;
+}
+/**
+ * Simulate an IAM request against the collected IAM data.
+ *
+ * @param simulationRequest the simulation request details.
+ * @param collectClient the IAM collect client to use for data access.
+ * @returns the simulation result, including the request and the evaluation result.
+ */
+export declare function simulateRequest(simulationRequest: SimulationRequest, collectClient: IamCollectClient): Promise<SimulateRequestResult>;
+export declare function resultMatchesExpectation(expected: EvaluationResult | 'AnyDeny' | undefined, result: EvaluationResult): boolean;
+//# sourceMappingURL=simulate.d.ts.map

package/dist/cjs/simulate/simulate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulate.d.ts","sourceRoot":"","sources":["../../../src/simulate/simulate.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAEzB,KAAK,UAAU,EACf,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAA;AAQlC,OAAO,EAAE,gBAAgB,EAA8B,MAAM,sBAAsB,CAAA;AAYnF,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,EAEL,KAAK,WAAW,EAIjB,MAAM,kBAAkB,CAAA;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAE/B;;OAEG;IACH,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IAEnC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAGjB;;OAEG;IACH,iBAAiB,EAAE,WAAW,CAAA;IAE9B;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAE9B;;OAEG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAEhC;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;OAEG;IACH,aAAa,CAAC,EAAE,GAAG,CAAA;IAEnB;;OAEG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAA;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;IAE9B;;OAEG;IACH,MAAM,EAAE,oBAAoB,CAAA;CAC7B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA4LhC;AA2KD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,EAClD,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAQT"}