@actsecurity/iam-lens 0.1.156

package/dist/esm/cli.js

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+import { booleanArgument, enumArgument, mapArgument, parseCliArguments, stringArgument, stringArrayArgument } from '@actsecurity/cli';
+import { NoCacheProvider } from './collect/client.js';
+import { getCollectClient, loadCollectConfigs } from './collect/collect.js';
+import { principalCan } from './principalCan/principalCan.js';
+import { makePrincipalIndex } from './principalIndex/makePrincipalIndex.js';
+import { resultMatchesExpectation, simulateRequest } from './simulate/simulate.js';
+import { iamLensVersion } from './utils/packageVersion.js';
+import { stringOrFileArgument } from './utils/stringOrFileArgument.js';
+import { whoCan } from './whoCan/whoCan.js';
+const main = async () => {
+    const cli = await parseCliArguments('iam-lens', {
+        simulate: {
+            description: 'Simulate an IAM request',
+            arguments: {
+                principal: stringArgument({
+                    description: 'The principal to simulate. Can be a user, role, session, or AWS service'
+                }),
+                resource: stringArgument({
+                    description: 'The ARN of the resource to simulate access to. Ignore for wildcard actions'
+                }),
+                resourceAccount: stringArgument({
+                    description: 'The account ID of the resource, only required if it cannot be determined from the resource ARN.'
+                }),
+                action: stringArgument({
+                    description: 'The action to simulate; must be a valid IAM service and action such as `s3:ListBucket`'
+                }),
+                context: mapArgument({
+                    description: 'The context keys to use for the simulation. The first value is the key and the rest are the values. Specify multiple keys by using --context multiple times',
+                    defaultValue: {}
+                }),
+                verbose: booleanArgument({
+                    description: 'Enable verbose output for the simulation',
+                    character: 'v'
+                }),
+                expect: enumArgument({
+                    description: 'The expected result of the simulation, if the result does not match the expected response a non-zero exit code will be returned',
+                    validValues: ['Allowed', 'ImplicitlyDenied', 'ExplicitlyDenied', 'AnyDeny']
+                }),
+                ignoreMissingPrincipal: booleanArgument({
+                    description: 'Ignore if the principal does not exist. Useful for simulating actions from principals that may not exist or are outside your data set',
+                    character: 'i'
+                }),
+                s3AbacOverride: enumArgument({
+                    description: 'Override the S3 ABAC setting for S3 buckets. Defaults to the bucket setting stored in your iam-collect data',
+                    validValues: ['enabled', 'disabled'],
+                    defaultValue: undefined
+                }),
+                sessionPolicy: stringOrFileArgument({
+                    description: 'The session policy to use for the simulation, if the principal type supports it'
+                })
+            }
+        },
+        'who-can': {
+            description: 'Find who can perform an action on a resource',
+            arguments: {
+                resource: stringArgument({
+                    description: 'The ARN of the resource to check permissions for. Ignore for wildcard actions'
+                }),
+                resourceAccount: stringArgument({
+                    description: 'The account ID of the resource, only required if it cannot be determined from the resource ARN. Required for wildcard actions'
+                }),
+                actions: stringArrayArgument({
+                    description: 'The actions to check permissions for; must be a valid IAM service and action such as `s3:GetObject`',
+                    defaultValue: []
+                }),
+                s3AbacOverride: enumArgument({
+                    description: 'Override the S3 ABAC setting for S3 buckets. Defaults to the bucket setting stored in your iam-collect data',
+                    validValues: ['enabled', 'disabled'],
+                    defaultValue: undefined
+                }),
+                sort: booleanArgument({
+                    description: 'Sort the results before outputting',
+                    character: 's'
+                })
+            }
+        },
+        'principal-can': {
+            description: 'Create a consolidated view of all permissions for a principal, see readme for limitations',
+            arguments: {
+                principal: stringArgument({
+                    description: 'The principal to check permissions for. Can be a user or role'
+                }),
+                shrinkActionLists: booleanArgument({
+                    description: 'Shrink action lists to reduce policy size',
+                    character: 's'
+                })
+            }
+        },
+        'index-principals': {
+            description: 'Index all principals',
+            arguments: {}
+        }
+    }, {
+        collectConfigs: stringArrayArgument({
+            description: 'The iam-collect configuration files to use',
+            defaultValue: []
+        }),
+        partition: stringArgument({
+            description: 'The AWS partition to use (aws, aws-cn, aws-us-gov). Defaults to aws',
+            defaultValue: 'aws'
+        })
+    }, {
+        envPrefix: 'IAM_LENS',
+        showHelpIfNoArgs: true,
+        requireSubcommand: true,
+        expectOperands: false,
+        version: {
+            currentVersion: iamLensVersion,
+            checkForUpdates: '@cloud-copilot/iam-lens'
+        }
+    });
+    if (cli.args.collectConfigs.length === 0) {
+        cli.args.collectConfigs.push('./iam-collect.jsonc');
+    }
+    const collectConfigs = await loadCollectConfigs(cli.args.collectConfigs);
+    const collectClient = await getCollectClient(collectConfigs, cli.args.partition);
+    if (cli.subcommand === 'simulate') {
+        const { principal, resource, resourceAccount, action, context, ignoreMissingPrincipal, sessionPolicy } = cli.args;
+        const { request, result } = await simulateRequest({
+            sessionPolicy,
+            principal: principal,
+            resourceArn: resource,
+            resourceAccount: resourceAccount,
+            action: action,
+            customContextKeys: singularizeOneEntryArrays(context),
+            simulationMode: 'Strict',
+            ignoreMissingPrincipal,
+            s3AbacOverride: cli.args.s3AbacOverride
+        }, collectClient);
+        if (result.resultType === 'error') {
+            console.error('Simulation Errors:');
+            console.log(JSON.stringify(result.errors, null, 2));
+            process.exit(1);
+        }
+        console.log(`Simulation Result: ${result.overallResult}`);
+        if (cli.args.verbose) {
+            console.log(JSON.stringify({ request, result }, null, 2));
+        }
+        if (!resultMatchesExpectation(cli.args.expect, result.overallResult)) {
+            process.exit(1);
+        }
+    }
+    else if (cli.subcommand === 'who-can') {
+        const { resource, resourceAccount, actions } = cli.args;
+        if (!resourceAccount && !resource && actions.length === 0) {
+            console.error('Error: At least 1) resource or 2) resource-account and actions must be provided for who-can command');
+            process.exit(1);
+        }
+        const results = await whoCan(collectConfigs, cli.args.partition, {
+            resource: cli.args.resource,
+            actions: cli.args.actions,
+            resourceAccount: cli.args.resourceAccount,
+            s3AbacOverride: cli.args.s3AbacOverride,
+            sort: cli.args.sort
+        });
+        console.log(JSON.stringify(results, null, 2));
+    }
+    else if (cli.subcommand === 'principal-can') {
+        const { principal, shrinkActionLists } = cli.args;
+        if (!principal) {
+            console.error('Error: Principal must be provided for principal-can command');
+            process.exit(1);
+        }
+        const results = await principalCan(collectClient, {
+            principal: principal,
+            shrinkActionLists
+        });
+        console.log(JSON.stringify(results, null, 2));
+    }
+    else if (cli.subcommand === 'index-principals') {
+        const indexClient = await getCollectClient(collectConfigs, cli.args.partition, {
+            cacheProvider: new NoCacheProvider()
+        });
+        await makePrincipalIndex(indexClient);
+    }
+};
+/**
+ * Take a record of string arrays and convert it to a record of strings or string arrays,
+ * where any array with a single element is converted to a string.
+ *
+ * @param input - The input record of string arrays.
+ * @returns A new record with singularized values.
+ */
+function singularizeOneEntryArrays(input) {
+    const output = {};
+    for (const [key, value] of Object.entries(input)) {
+        if (value.length === 1) {
+            output[key] = value[0];
+        }
+        else {
+            output[key] = value;
+        }
+    }
+    return output;
+}
+main()
+    .catch((e) => {
+    console.error(e);
+    process.exit(1);
+})
+    .then(() => { })
+    .finally(() => { });
+//# sourceMappingURL=cli.js.map

package/dist/esm/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EACL,eAAe,EACf,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAA;AAC3E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CACjC,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,SAAS,EAAE;gBACT,SAAS,EAAE,cAAc,CAAC;oBACxB,WAAW,EAAE,yEAAyE;iBACvF,CAAC;gBACF,QAAQ,EAAE,cAAc,CAAC;oBACvB,WAAW,EACT,4EAA4E;iBAC/E,CAAC;gBACF,eAAe,EAAE,cAAc,CAAC;oBAC9B,WAAW,EACT,iGAAiG;iBACpG,CAAC;gBACF,MAAM,EAAE,cAAc,CAAC;oBACrB,WAAW,EACT,wFAAwF;iBAC3F,CAAC;gBACF,OAAO,EAAE,WAAW,CAAC;oBACnB,WAAW,EACT,6JAA6J;oBAC/J,YAAY,EAAE,EAAE;iBACjB,CAAC;gBACF,OAAO,EAAE,eAAe,CAAC;oBACvB,WAAW,EAAE,0CAA0C;oBACvD,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,MAAM,EAAE,YAAY,CAAC;oBACnB,WAAW,EACT,iIAAiI;oBACnI,WAAW,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,CAAC;iBAC5E,CAAC;gBACF,sBAAsB,EAAE,eAAe,CAAC;oBACtC,WAAW,EACT,uIAAuI;oBACzI,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,cAAc,EAAE,YAAY,CAAC;oBAC3B,WAAW,EACT,6GAA6G;oBAC/G,WAAW,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;oBACpC,YAAY,EAAE,SAAS;iBACxB,CAAC;gBACF,aAAa,EAAE,oBAAoB,CAAC;oBAClC,WAAW,EACT,iFAAiF;iBACpF,CAAC;aACH;SACF;QACD,SAAS,EAAE;YACT,WAAW,EAAE,8CAA8C;YAC3D,SAAS,EAAE;gBACT,QAAQ,EAAE,cAAc,CAAC;oBACvB,WAAW,EACT,+EAA+E;iBAClF,CAAC;gBACF,eAAe,EAAE,cAAc,CAAC;oBAC9B,WAAW,EACT,+HAA+H;iBAClI,CAAC;gBACF,OAAO,EAAE,mBAAmB,CAAC;oBAC3B,WAAW,EACT,qGAAqG;oBACvG,YAAY,EAAE,EAAE;iBACjB,CAAC;gBACF,cAAc,EAAE,YAAY,CAAC;oBAC3B,WAAW,EACT,6GAA6G;oBAC/G,WAAW,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;oBACpC,YAAY,EAAE,SAAS;iBACxB,CAAC;gBACF,IAAI,EAAE,eAAe,CAAC;oBACpB,WAAW,EAAE,oCAAoC;oBACjD,SAAS,EAAE,GAAG;iBACf,CAAC;aACH;SACF;QACD,eAAe,EAAE;YACf,WAAW,EACT,2FAA2F;YAC7F,SAAS,EAAE;gBACT,SAAS,EAAE,cAAc,CAAC;oBACxB,WAAW,EAAE,+DAA+D;iBAC7E,CAAC;gBACF,iBAAiB,EAAE,eAAe,CAAC;oBACjC,WAAW,EAAE,2CAA2C;oBACxD,SAAS,EAAE,GAAG;iBACf,CAAC;aACH;SACF;QACD,kBAAkB,EAAE;YAClB,WAAW,EAAE,sBAAsB;YACnC,SAAS,EAAE,EAAE;SACd;KACF,EACD;QACE,cAAc,EAAE,mBAAmB,CAAC;YAClC,WAAW,EAAE,4CAA4C;YACzD,YAAY,EAAE,EAAE;SACjB,CAAC;QACF,SAAS,EAAE,cAAc,CAAC;YACxB,WAAW,EAAE,qEAAqE;YAClF,YAAY,EAAE,KAAK;SACpB,CAAC;KACH,EACD;QACE,SAAS,EAAE,UAAU;QACrB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,cAAc,EAAE,cAAc;YAC9B,eAAe,EAAE,yBAAyB;SAC3C;KACF,CACF,CAAA;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACxE,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEhF,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,EACJ,SAAS,EACT,QAAQ,EACR,eAAe,EACf,MAAM,EACN,OAAO,EACP,sBAAsB,EACtB,aAAa,EACd,GAAG,GAAG,CAAC,IAAI,CAAA;QAEZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAC/C;YACE,aAAa;YACb,SAAS,EAAE,SAAU;YACrB,WAAW,EAAE,QAAQ;YACrB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,MAAO;YACf,iBAAiB,EAAE,yBAAyB,CAAC,OAAO,CAAC;YACrD,cAAc,EAAE,QAAQ;YACxB,sBAAsB;YACtB,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc;SACxC,EACD,aAAa,CACd,CAAA;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,aAAc,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACvD,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,KAAK,CACX,qGAAqG,CACtG,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE;YAC/D,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAS;YAC5B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAQ;YAC1B,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;YACzC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc;YACvC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;SACpB,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC9C,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAA;YAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE;YAChD,SAAS,EAAE,SAAS;YACpB,iBAAiB;SAClB,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7E,aAAa,EAAE,IAAI,eAAe,EAAE;SACrC,CAAC,CAAA;QACF,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,KAA+B;IAE/B,MAAM,MAAM,GAAsC,EAAE,CAAA;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC;KACD,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;KACd,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA"}