@actsecurity/iam-lens 0.1.156

package/dist/esm/simulate/contextKeys.js

@@ -0,0 +1,287 @@
+import { actionSupportsAwsResourceInfoContextKeys, bucketArn, convertAssumedRoleArnToRoleArn, isS3BucketOrObjectArn, splitArnParts } from '@actsecurity/iam-utils';
+import { IamCollectClient } from '../collect/client.js';
+import { isArnPrincipal, isServicePrincipal } from '../principals.js';
+import {} from './simulate.js';
+export const knownContextKeys = [
+    'aws:SecureTransport',
+    'aws:CurrentTime',
+    'aws:EpochTime',
+    'aws:PrincipalArn',
+    'aws:PrincipalAccount',
+    'aws:PrincipalOrgId',
+    'aws:PrincipalOrgPaths',
+    'aws:PrincipalType',
+    'aws:username',
+    'aws:ResourceAccount',
+    'aws:ResourceOrgID',
+    'aws:ResourceOrgPaths',
+    'aws:PrincipalIsAWSService',
+    'aws:PrincipalServiceName',
+    'aws:SourceAccount',
+    'aws:SourceOrgID',
+    'aws:SourceOrgPaths',
+    'aws:SourceOwner',
+    'aws:SourceArn',
+    'kms:CallerAccount'
+];
+export const CONTEXT_KEYS = {
+    assumedRoot: 'aws:AssumedRoot',
+    userId: 'aws:userid',
+    vpc: 'aws:SourceVpc',
+    vpcEndpointId: 'aws:SourceVpce',
+    vpcEndpointAccount: 'aws:VpceAccount',
+    vpcEndpointOrgId: 'aws:VpceOrgID',
+    vpcEndpointOrgPaths: 'aws:VpceOrgPaths',
+    vpcArn: 'aws:SourceVpcArn'
+};
+/**
+ * Checks if a context has a specific key (case-insensitive).
+ *
+ * @param context - The context to check.
+ * @param key - The key to check for.
+ * @returns True if the context has the key, false otherwise.
+ */
+export function contextHasKey(context, key) {
+    return !!contextValue(context, key);
+}
+/**
+ * Get the value of a context key (case-insensitive).
+ *
+ * @param context - The context to check.
+ * @param key - The key to get the value for.
+ * @returns The value of the context key, or undefined if it doesn't exist.
+ */
+export function contextValue(context, key) {
+    const matchingKey = Object.keys(context).find((contextKey) => contextKey.toLowerCase() === key.toLowerCase());
+    return matchingKey ? context[matchingKey] : undefined;
+}
+/**
+ * Get the context keys for a simulation request.
+ *
+ * @param collectClient the collect client to use for fetching data
+ * @param simulationRequest the simulation request to create context keys for
+ * @param service the service the request is for
+ * @param contextKeyOverrides the context key overrides to apply
+ * @param resolvedPrincipalArnForContext canonical principal ARN to use for role-backed context keys
+ * @returns a promise that resolves to the context keys for the simulation request
+ */
+export async function createContextKeys(collectClient, simulationRequest, service, contextKeyOverrides, resolvedPrincipalArnForContext) {
+    const contextKeys = {
+        'aws:SecureTransport': 'true',
+        'aws:CurrentTime': new Date().toISOString(),
+        'aws:EpochTime': Math.floor(Date.now() / 1000).toString()
+    };
+    if (isArnPrincipal(simulationRequest.principal)) {
+        const arnParts = splitArnParts(simulationRequest.principal);
+        const principalArnForContext = resolvedPrincipalArnForContext ??
+            (arnParts.resourceType === 'assumed-role'
+                ? convertAssumedRoleArnToRoleArn(simulationRequest.principal)
+                : simulationRequest.principal);
+        contextKeys['aws:PrincipalArn'] = principalArnForContext;
+        const principalAccountId = arnParts.accountId;
+        contextKeys['aws:PrincipalAccount'] = arnParts.accountId || '';
+        const orgId = await collectClient.getOrgIdForAccount(principalAccountId);
+        if (orgId) {
+            contextKeys['aws:PrincipalOrgId'] = orgId;
+            const orgStructure = await collectClient.getOrgUnitHierarchyForAccount(principalAccountId);
+            contextKeys['aws:PrincipalOrgPaths'] = makeOrgPaths(orgId, orgStructure);
+        }
+        const { tags } = await collectClient.getTagsForResource(principalArnForContext, principalAccountId);
+        for (const [key, value] of Object.entries(tags)) {
+            contextKeys[`aws:PrincipalTag/${key}`] = value;
+        }
+        contextKeys['aws:PrincipalIsAWSService'] = 'false';
+        if (service.toLowerCase() === 'kms') {
+            contextKeys['kms:CallerAccount'] = principalAccountId;
+        }
+        if (simulationRequest.principal.endsWith(':root')) {
+            contextKeys['aws:PrincipalType'] = 'Account';
+            contextKeys['aws:userid'] = principalAccountId;
+        }
+        else if (arnParts.resourceType === 'user') {
+            contextKeys['aws:PrincipalType'] = 'User';
+            const userUniqueId = await collectClient.getUniqueIdForIamResource(simulationRequest.principal);
+            contextKeys['aws:userid'] = userUniqueId || 'UNKNOWN';
+            const userName = arnParts.resourcePath?.split('/').at(-1);
+            contextKeys['aws:username'] = userName;
+        }
+        else if (arnParts.resourceType === 'federated-user') {
+            contextKeys['aws:PrincipalType'] = 'FederatedUser';
+            contextKeys['aws:userid'] = `${arnParts.accountId}:${arnParts.resourcePath}`;
+        }
+        else if (arnParts.resourceType === 'assumed-role' || arnParts.resourceType === 'role') {
+            contextKeys['aws:PrincipalType'] = 'AssumedRole';
+            //TODO: Set aws:userId for role principals
+            if (arnParts.resourceType === 'assumed-role') {
+                const sessionName = arnParts.resourcePath?.split('/').at(-1);
+                const roleArn = convertAssumedRoleArnToRoleArn(simulationRequest.principal);
+                const roleUniqueId = await collectClient.getUniqueIdForIamResource(roleArn);
+                contextKeys['aws:userid'] = `${roleUniqueId || 'UNKNOWN'}:${sessionName}`;
+            }
+        }
+    }
+    //Resource context keys
+    if (actionSupportsAwsResourceInfoContextKeys(simulationRequest.action)) {
+        contextKeys['aws:ResourceAccount'] = simulationRequest.resourceAccount;
+        const resourceOrgId = await collectClient.getOrgIdForAccount(simulationRequest.resourceAccount);
+        if (resourceOrgId) {
+            contextKeys['aws:ResourceOrgID'] = resourceOrgId;
+            const orgStructure = await collectClient.getOrgUnitHierarchyForAccount(simulationRequest.resourceAccount);
+            contextKeys['aws:ResourceOrgPaths'] = makeOrgPaths(resourceOrgId, orgStructure);
+        }
+    }
+    let resourceTagsAreKnown = false;
+    if (simulationRequest.resourceArn) {
+        const isBucket = isS3BucketOrObjectArn(simulationRequest.resourceArn);
+        const { tags: resourceTags, present: resourceTagsPreset } = await collectClient.getTagsForResource(isBucket ? bucketArn(simulationRequest.resourceArn) : simulationRequest.resourceArn, simulationRequest.resourceAccount);
+        resourceTagsAreKnown = resourceTagsPreset;
+        for (const [key, value] of Object.entries(resourceTags)) {
+            contextKeys[`aws:ResourceTag/${key}`] = value;
+            if (isBucket) {
+                contextKeys[`s3:BucketTag/${key}`] = value;
+            }
+        }
+    }
+    //Service Principal context keys
+    if (isServicePrincipal(simulationRequest.principal)) {
+        contextKeys['aws:PrincipalIsAWSService'] = 'true';
+        contextKeys['aws:PrincipalServiceName'] = simulationRequest.principal;
+        contextKeys['aws:SourceAccount'] = simulationRequest.resourceAccount;
+        contextKeys['aws:SourceOwner'] = simulationRequest.resourceAccount;
+        contextKeys['aws:SourceOrgID'] = contextKeys['aws:ResourceOrgID'];
+        contextKeys['aws:SourceOrgPaths'] = contextKeys['aws:ResourceOrgPaths'];
+        if (simulationRequest.simulationMode === 'Discovery') {
+            // Source key Discovery constraints make the concrete value non-authoritative;
+            // this placeholder only marks the key as present for service-originated requests.
+            contextKeys['aws:SourceArn'] = 'arn:aws:iam::000000000000:role/unknown-source';
+        }
+    }
+    //Apply any custom context key overrides
+    for (const [key, value] of Object.entries(contextKeyOverrides)) {
+        contextKeys[key] = value;
+    }
+    //Add VPC context keys
+    const vpcKeys = await getVpcKeys(contextKeys, service, collectClient);
+    for (const [key, value] of Object.entries(vpcKeys)) {
+        contextKeys[key] = value;
+    }
+    return {
+        resourceTagsAreKnown,
+        contextKeys
+    };
+}
+/**
+ * Get the VPC keys that should be added to the context for a simulation.
+ *
+ * @param context the existing context
+ * @param service the service the request is for
+ * @param collectClient the IAM collect client
+ * @returns a record of VPC context keys
+ */
+export async function getVpcKeys(context, service, collectClient) {
+    const vpcKeys = {};
+    let vpcEndpointId = contextValue(context, CONTEXT_KEYS.vpcEndpointId);
+    const hasVpcEndpoint = !!vpcEndpointId;
+    let vpcId = contextValue(context, CONTEXT_KEYS.vpc);
+    let vpcArn = contextValue(context, CONTEXT_KEYS.vpcArn);
+    //If we know the VPC ID but not the endpoint, lookup the endpoint
+    if (!vpcEndpointId && vpcId && typeof vpcId === 'string') {
+        vpcEndpointId = await collectClient.getVpcEndpointIdForVpcService(vpcId, service);
+    }
+    //If we know the VPC ARN but not the endpoint, lookup the endpoint
+    if (!vpcEndpointId && vpcArn && typeof vpcArn === 'string') {
+        vpcEndpointId = await collectClient.getVpcEndpointIdForVpcService(vpcArn, service);
+    }
+    if (vpcEndpointId && !vpcId) {
+        if (typeof vpcEndpointId == 'string') {
+            const vpcId = await collectClient.getVpcIdForVpcEndpointId(vpcEndpointId);
+            if (vpcId) {
+                vpcKeys[CONTEXT_KEYS.vpc] = vpcId;
+            }
+        }
+    }
+    if (vpcEndpointId && !hasVpcEndpoint) {
+        vpcKeys[CONTEXT_KEYS.vpcEndpointId] = vpcEndpointId;
+    }
+    if (vpcEndpointId &&
+        typeof vpcEndpointId === 'string' &&
+        serviceSupportsExtraVpcEndpointData(service)) {
+        const vpcEndpointAccount = await collectClient.getAccountIdForVpcEndpointId(vpcEndpointId);
+        const vpcEndpointOrgId = await collectClient.getOrgIdForVpcEndpointId(vpcEndpointId);
+        const vpcEndpointOrgStructure = await collectClient.getOrgUnitHierarchyForVpcEndpointId(vpcEndpointId);
+        const vpcArn = await collectClient.getVpcArnForVpcEndpointId(vpcEndpointId);
+        if (vpcEndpointAccount && !contextHasKey(context, CONTEXT_KEYS.vpcEndpointAccount)) {
+            vpcKeys[CONTEXT_KEYS.vpcEndpointAccount] = vpcEndpointAccount;
+        }
+        if (vpcEndpointOrgId && !contextHasKey(context, CONTEXT_KEYS.vpcEndpointOrgId)) {
+            vpcKeys[CONTEXT_KEYS.vpcEndpointOrgId] = vpcEndpointOrgId;
+        }
+        if (vpcArn && !contextHasKey(context, CONTEXT_KEYS.vpcArn)) {
+            vpcKeys[CONTEXT_KEYS.vpcArn] = vpcArn;
+        }
+        if (vpcEndpointOrgId &&
+            vpcEndpointOrgStructure &&
+            !contextHasKey(context, CONTEXT_KEYS.vpcEndpointOrgPaths)) {
+            vpcKeys[CONTEXT_KEYS.vpcEndpointOrgPaths] = makeOrgPaths(vpcEndpointOrgId, vpcEndpointOrgStructure);
+        }
+    }
+    return vpcKeys;
+}
+const servicesThatSupportExtraVpcEndpointData = new Set([
+    'apprunner',
+    'discovery',
+    'athena',
+    'servicediscovery',
+    'applicationinsights',
+    'cloudformation',
+    'comprehendmedical',
+    'compute-optimizer',
+    'ecr',
+    'ecs',
+    'kinesisanalytics',
+    'route53',
+    'datasync',
+    'ebs',
+    'scheduler',
+    'firehose',
+    'medical-imaging',
+    'healthlake',
+    'omics',
+    'iam',
+    'iotfleetwise',
+    'iotwireless',
+    'kms',
+    'lambda',
+    'payment-cryptography',
+    'polly',
+    'acm-pca',
+    'rbin',
+    'rekognition',
+    'servicequotas',
+    's3',
+    'storagegateway',
+    'ssm-contacts',
+    'textract',
+    'transcribe',
+    'transfer'
+]);
+/**
+ * Check if a service supports extra VPC endpoint data.
+ *
+ * @param service the service to check
+ * @returns true if the service supports extra VPC endpoint data, false otherwise
+ */
+export function serviceSupportsExtraVpcEndpointData(service) {
+    return servicesThatSupportExtraVpcEndpointData.has(service.toLowerCase());
+}
+/**
+ * Create a string array for an aws:xxOrgPaths context key value.
+ *
+ * @param orgId the organization ID
+ * @param hierarchy the organizational hierarchy
+ * @returns a string array representing the organizational paths
+ */
+function makeOrgPaths(orgId, hierarchy) {
+    return [`${orgId}/${hierarchy.join('/')}/`];
+}
+//# sourceMappingURL=contextKeys.js.map

package/dist/esm/simulate/contextKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/simulate/contextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wCAAwC,EACxC,SAAS,EACT,8BAA8B,EAC9B,qBAAqB,EACrB,aAAa,EACd,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAA0B,MAAM,eAAe,CAAA;AAWtD,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,qBAAqB;IACrB,iBAAiB;IACjB,eAAe;IAEf,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;IACpB,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IAEd,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;IAEtB,2BAA2B;IAC3B,0BAA0B;IAC1B,mBAAmB;IACnB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,eAAe;IAEf,mBAAmB;CACpB,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,WAAW,EAAE,iBAAiB;IAC9B,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,eAAe;IACpB,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,iBAAiB;IACrC,gBAAgB,EAAE,eAAe;IACjC,mBAAmB,EAAE,kBAAkB;IACvC,MAAM,EAAE,kBAAkB;CAC3B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB,EAAE,GAAW;IAC7D,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAoB,EAAE,GAAW;IAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAC/D,CAAA;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAA+B,EAC/B,iBAAoC,EACpC,OAAe,EACf,mBAAgC,EAChC,8BAAuC;IAEvC,MAAM,WAAW,GAAgB;QAC/B,qBAAqB,EAAE,MAAM;QAC7B,iBAAiB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC3C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAA;IAED,IAAI,cAAc,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAC3D,MAAM,sBAAsB,GAC1B,8BAA8B;YAC9B,CAAC,QAAQ,CAAC,YAAY,KAAK,cAAc;gBACvC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,SAAS,CAAC;gBAC7D,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAClC,WAAW,CAAC,kBAAkB,CAAC,GAAG,sBAAsB,CAAA;QACxD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,SAAU,CAAA;QAC9C,WAAW,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;QAE9D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;QACxE,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAA;YAEzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,CAAA;YAC1F,WAAW,CAAC,uBAAuB,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,kBAAkB,CACrD,sBAAsB,EACtB,kBAAkB,CACnB,CAAA;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,WAAW,CAAC,oBAAoB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;QAChD,CAAC;QAED,WAAW,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,WAAW,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,CAAA;QACvD,CAAC;QAED,IAAI,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,WAAW,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAA;YAC5C,WAAW,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAA;QAChD,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5C,WAAW,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAA;YACzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAChE,iBAAiB,CAAC,SAAS,CAC5B,CAAA;YACD,WAAW,CAAC,YAAY,CAAC,GAAG,YAAY,IAAI,SAAS,CAAA;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;YAC1D,WAAW,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAA;QACxC,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtD,WAAW,CAAC,mBAAmB,CAAC,GAAG,eAAe,CAAA;YAClD,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAA;QAC9E,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACxF,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,0CAA0C;YAC1C,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;gBAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;gBAC7D,MAAM,OAAO,GAAG,8BAA8B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;gBAC3E,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAA;gBAC3E,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,YAAY,IAAI,SAAS,IAAI,WAAW,EAAE,CAAA;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,wCAAwC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,WAAW,CAAC,qBAAqB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QAEvE,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,eAAgB,CAAC,CAAA;QAChG,IAAI,aAAa,EAAE,CAAC;YAClB,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CACpE,iBAAiB,CAAC,eAAgB,CACnC,CAAA;YAED,WAAW,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,IAAI,oBAAoB,GAAG,KAAK,CAAA;IAChC,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACrE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,GACvD,MAAM,aAAa,CAAC,kBAAkB,CACpC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,EACnF,iBAAiB,CAAC,eAAgB,CACnC,CAAA;QACH,oBAAoB,GAAG,kBAAkB,CAAA;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,WAAW,CAAC,mBAAmB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC7C,IAAI,QAAQ,EAAE,CAAC;gBACb,WAAW,CAAC,gBAAgB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,WAAW,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAA;QACjD,WAAW,CAAC,0BAA0B,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAA;QACrE,WAAW,CAAC,mBAAmB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACrE,WAAW,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACnE,WAAW,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAA;QACjE,WAAW,CAAC,oBAAoB,CAAC,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAEvE,IAAI,iBAAiB,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;YACrD,8EAA8E;YAC9E,kFAAkF;YAClF,WAAW,CAAC,eAAe,CAAC,GAAG,+CAA+C,CAAA;QAChF,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/D,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED,sBAAsB;IACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED,OAAO;QACL,oBAAoB;QACpB,WAAW;KACZ,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,OAAe,EACf,aAA+B;IAE/B,MAAM,OAAO,GAAgB,EAAE,CAAA;IAE/B,IAAI,aAAa,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,aAAa,CAAC,CAAA;IACrE,MAAM,cAAc,GAAG,CAAC,CAAC,aAAa,CAAA;IACtC,IAAI,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;IAEvD,iEAAiE;IACjE,IAAI,CAAC,aAAa,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzD,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACnF,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpF,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,OAAO,aAAa,IAAI,QAAQ,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;YACzE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,aAAa,CAAA;IACrD,CAAC;IAED,IACE,aAAa;QACb,OAAO,aAAa,KAAK,QAAQ;QACjC,mCAAmC,CAAC,OAAO,CAAC,EAC5C,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC1F,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;QACpF,MAAM,uBAAuB,GAC3B,MAAM,aAAa,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;QAE3E,IAAI,kBAAkB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACnF,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAA;QAC/D,CAAC;QACD,IAAI,gBAAgB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;QAC3D,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;QACvC,CAAC;QACD,IACE,gBAAgB;YAChB,uBAAuB;YACvB,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,mBAAmB,CAAC,EACzD,CAAC;YACD,OAAO,CAAC,YAAY,CAAC,mBAAmB,CAAC,GAAG,YAAY,CACtD,gBAAgB,EAChB,uBAAuB,CACxB,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,uCAAuC,GAAG,IAAI,GAAG,CAAC;IACtD,WAAW;IACX,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,qBAAqB;IACrB,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,KAAK;IACL,KAAK;IACL,kBAAkB;IAClB,SAAS;IACT,UAAU;IACV,KAAK;IACL,WAAW;IACX,UAAU;IACV,iBAAiB;IACjB,YAAY;IACZ,OAAO;IACP,KAAK;IACL,cAAc;IACd,aAAa;IACb,KAAK;IACL,QAAQ;IACR,sBAAsB;IACtB,OAAO;IACP,SAAS;IACT,MAAM;IACN,aAAa;IACb,eAAe;IACf,IAAI;IACJ,gBAAgB;IAChB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,UAAU;CACX,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,OAAO,uCAAuC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,SAAmB;IACtD,OAAO,CAAC,GAAG,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAC7C,CAAC"}

package/dist/esm/simulate/simulate.d.ts

@@ -0,0 +1,72 @@
+import { type EvaluationResult, type RunSimulationResults, type Simulation, type SimulationMode } from '@actsecurity/iam-simulate';
+import { IamCollectClient } from '../collect/client.js';
+import { type S3AbacOverride } from '../utils/s3Abac.js';
+import { type ContextKeys } from './contextKeys.js';
+/**
+ * The request details for simulating an IAM request.
+ */
+export interface SimulationRequest {
+    /**
+     * The ARN of the resource to simulate access to. Can be undefined for wildcard actions.
+     */
+    resourceArn: string | undefined;
+    /**
+     * The account ID of the resource, only required if it cannot be determined from the resource ARN.
+     */
+    resourceAccount: string | undefined;
+    /**
+     * The action to simulate; must be a valid IAM service and action such as `s3:ListBucket`.
+     */
+    action: string;
+    /**
+     * The ARN of the principal to simulate. Can be a user, role, session, or AWS service.
+     */
+    principal: string;
+    /**
+     * Any custom context keys to use for the simulation.
+     */
+    customContextKeys: ContextKeys;
+    /**
+     * The simulation mode to use for the request.
+     */
+    simulationMode: SimulationMode;
+    /**
+     * Whether to ignore missing principal errors.
+     */
+    ignoreMissingPrincipal?: boolean;
+    /**
+     * Override for S3 ABAC settings for the simulation.
+     */
+    s3AbacOverride?: S3AbacOverride;
+    /**
+     * The session policy to use for the simulation, if the principal type supports it.
+     */
+    sessionPolicy?: any;
+    /**
+     * Additional strict context keys to include for the simulation. These will be added to the default strict context keys.
+     */
+    additionalStrictContextKeys?: string[];
+}
+/**
+ * The result of a simulation request, containing the original request and the simulation result.
+ */
+export interface SimulateRequestResult {
+    /**
+     * The simulation request that was evaluated.
+     */
+    request: Simulation['request'];
+    /**
+     * The result of the simulation, which may be an error, a single result, or a wildcard result.
+     */
+    result: RunSimulationResults;
+}
+/**
+ * Simulate an IAM request against the collected IAM data.
+ *
+ * @param simulationRequest the simulation request details.
+ * @param collectClient the IAM collect client to use for data access.
+ * @returns the simulation result, including the request and the evaluation result.
+ */
+export declare function simulateRequest(simulationRequest: SimulationRequest, collectClient: IamCollectClient): Promise<SimulateRequestResult>;
+export declare function resultMatchesExpectation(expected: EvaluationResult | 'AnyDeny' | undefined, result: EvaluationResult): boolean;
+//# sourceMappingURL=simulate.d.ts.map

package/dist/esm/simulate/simulate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulate.d.ts","sourceRoot":"","sources":["../../../src/simulate/simulate.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAEzB,KAAK,UAAU,EACf,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAA;AAQlC,OAAO,EAAE,gBAAgB,EAA8B,MAAM,sBAAsB,CAAA;AAYnF,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,EAEL,KAAK,WAAW,EAIjB,MAAM,kBAAkB,CAAA;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAE/B;;OAEG;IACH,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IAEnC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAGjB;;OAEG;IACH,iBAAiB,EAAE,WAAW,CAAA;IAE9B;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAE9B;;OAEG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAEhC;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;OAEG;IACH,aAAa,CAAC,EAAE,GAAG,CAAA;IAEnB;;OAEG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAA;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;IAE9B;;OAEG;IACH,MAAM,EAAE,oBAAoB,CAAA;CAC7B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA4LhC;AA2KD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,EAClD,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAQT"}

package/dist/esm/simulate/simulate.js

@@ -0,0 +1,295 @@
+import { iamActionDetails, iamActionExists, iamServiceExists } from '@actsecurity/iam-data';
+import {} from '@actsecurity/iam-policy';
+import { runSimulation } from '@actsecurity/iam-simulate';
+import { convertAssumedRoleArnToRoleArn, isAssumedRoleArn, isIamRoleArn, isS3BucketOrObjectArn, splitArnParts } from '@actsecurity/iam-utils';
+import { IamCollectClient } from '../collect/client.js';
+import { getAllPoliciesForPrincipal, isServiceLinkedRole, principalExists } from '../principals.js';
+import { getAccountIdForResource, getRcpsForResource, getResourcePolicyForResource } from '../resources.js';
+import {} from '../utils/s3Abac.js';
+import { AssumeRoleActions } from '../utils/sts.js';
+import { CONTEXT_KEYS, contextValue, createContextKeys, knownContextKeys } from './contextKeys.js';
+/**
+ * Simulate an IAM request against the collected IAM data.
+ *
+ * @param simulationRequest the simulation request details.
+ * @param collectClient the IAM collect client to use for data access.
+ * @returns the simulation result, including the request and the evaluation result.
+ */
+export async function simulateRequest(simulationRequest, collectClient) {
+    const actionParts = simulationRequest.action.split(':');
+    const service = actionParts[0];
+    const serviceAction = actionParts[1];
+    const serviceExists = await iamServiceExists(service);
+    const actionExists = serviceExists && (await iamActionExists(service, serviceAction));
+    if (!serviceExists || !actionExists) {
+        throw new Error(`Unable to find action details for ${simulationRequest.action}`);
+    }
+    const actionDetails = await iamActionDetails(service, serviceAction);
+    // If it is a wildcard action, the resource account is always the principal account
+    if (actionDetails.isWildcardOnly) {
+        simulationRequest.resourceAccount = splitArnParts(simulationRequest.principal).accountId;
+    }
+    if (!simulationRequest.resourceAccount && !simulationRequest.resourceArn) {
+        throw new Error('Non wildcard actions require a resource ARN or resource account to be specified.');
+    }
+    simulationRequest.resourceAccount =
+        simulationRequest.resourceAccount ||
+            (await getAccountIdForResource(collectClient, simulationRequest.resourceArn));
+    if (!simulationRequest.resourceAccount) {
+        throw new Error(`Unable to find account ID for resource ${simulationRequest.resourceArn}`);
+    }
+    const principalFound = await principalExists(simulationRequest.principal, collectClient);
+    if (!principalFound && !simulationRequest.ignoreMissingPrincipal) {
+        throw new Error(`Principal ${simulationRequest.principal} does not exist. Use --ignore-missing-principal to ignore this.`);
+    }
+    const request = {
+        action: simulationRequest.action,
+        resource: {
+            resource: simulationRequest.resourceArn || '*',
+            accountId: simulationRequest.resourceAccount
+        },
+        principal: simulationRequest.principal,
+        contextVariables: {}
+    };
+    //Lookup the principal policies
+    const principalPolicies = await getAllPoliciesForPrincipal(collectClient, simulationRequest.principal);
+    const { resourcePolicy, resourceRcps } = await getResourcePolicies(collectClient, simulationRequest.resourceArn, simulationRequest.resourceAccount);
+    const useResourcePolicy = simulationRequest.resourceArn &&
+        !(isIamRoleArn(simulationRequest.resourceArn) && service.toLowerCase() === 'iam');
+    if (AssumeRoleActions.has(simulationRequest.action.toLowerCase()) && !resourcePolicy) {
+        throw new Error(`Trust policy not found for resource ${simulationRequest.resourceArn}. sts assume role actions require a trust policy.`);
+    }
+    const principalArnForContext = await resolvePrincipalArnForContext(collectClient, simulationRequest.principal);
+    const { contextKeys, resourceTagsAreKnown } = await createContextKeys(collectClient, simulationRequest, service, simulationRequest.customContextKeys, principalArnForContext);
+    const vpcEndpointId = contextValue(contextKeys, CONTEXT_KEYS.vpcEndpointId);
+    let vpcEndpointPolicy = undefined;
+    if (vpcEndpointId && typeof vpcEndpointId === 'string') {
+        const vpcEndpointArn = await collectClient.getVpcEndpointArnForVpcEndpointId(vpcEndpointId);
+        if (vpcEndpointArn) {
+            const vpcPolicy = await collectClient.getVpcEndpointPolicyForArn(vpcEndpointArn);
+            if (vpcPolicy) {
+                vpcEndpointPolicy = { name: vpcEndpointArn, policy: vpcPolicy };
+            }
+        }
+    }
+    const applicableScps = isServiceLinkedRole(simulationRequest.principal)
+        ? []
+        : principalPolicies.scps;
+    request.contextVariables = contextKeys;
+    const simulation = {
+        request,
+        sessionPolicy: simulationRequest.sessionPolicy,
+        identityPolicies: prepareIdentityPolicies(simulationRequest.principal, principalPolicies),
+        serviceControlPolicies: applicableScps,
+        resourceControlPolicies: rcpsForRequest(simulationRequest.principal, actionDetails.isWildcardOnly, resourceRcps, principalPolicies.rcps),
+        resourcePolicy: useResourcePolicy ? resourcePolicy : undefined,
+        permissionBoundaryPolicies: preparePermissionBoundary(principalPolicies),
+        vpcEndpointPolicies: vpcEndpointPolicy ? [vpcEndpointPolicy] : undefined
+    };
+    const s3BucketOrObjectRequest = simulationRequest.resourceArn && isS3BucketOrObjectArn(simulationRequest.resourceArn);
+    if (s3BucketOrObjectRequest) {
+        const [bucketAbacEnabled, blockPublicAccess] = await Promise.all([
+            evaluateAbacForBucket(simulationRequest.s3AbacOverride, collectClient, simulationRequest.resourceAccount, simulationRequest.resourceArn),
+            collectClient.getBlockPublicAccessEnabledForBucket(simulationRequest.resourceAccount, simulationRequest.resourceArn)
+        ]);
+        simulation.additionalSettings = {
+            s3: {
+                bucketAbacEnabled,
+                blockPublicAccess
+            }
+        };
+    }
+    // Assemble the strict context keys for the simulation
+    // Start with the default known context keys
+    const strictContextKeys = [
+        ...knownContextKeys,
+        ...(simulationRequest.additionalStrictContextKeys ?? [])
+    ];
+    if (!isIamRoleArn(simulationRequest.principal)) {
+        strictContextKeys.push(CONTEXT_KEYS.userId);
+    }
+    if (!simulationRequest.principal.endsWith(':root')) {
+        // Treat this as strict unless it is a root principal
+        strictContextKeys.push(CONTEXT_KEYS.assumedRoot);
+    }
+    // S3 Access Points are Not Supported Right Now, Don't Add Noise
+    if (simulationRequest.action.startsWith('s3:')) {
+        strictContextKeys.push('s3:DataAccessPointAccount');
+        strictContextKeys.push('s3:DataAccessPointArn');
+    }
+    // Add the custom context keys from the simulation request
+    for (const key of Object.keys(simulationRequest.customContextKeys)) {
+        strictContextKeys.push(key);
+    }
+    //If we know the tag keys, just make all tag keys strict
+    if (resourceTagsAreKnown) {
+        strictContextKeys.push('/^aws:ResourceTag\/.*/');
+        if (s3BucketOrObjectRequest) {
+            strictContextKeys.push('/^s3:BucketTag\/.*/');
+        }
+    }
+    // There also may be other tag context keys, so add those too
+    for (const key of Object.keys(contextKeys)) {
+        if (key.toLowerCase().includes('tag/')) {
+            strictContextKeys.push(key);
+        }
+    }
+    const discoveryContextKeyConstraints = strictContextKeys.map(discoveryConstraintForStrictKey);
+    const result = await runSimulation(simulation, {
+        simulationMode: simulationRequest.simulationMode,
+        discoveryContextKeyConstraints
+    });
+    return { request, result };
+}
+const awsSourceKeyPrefix = 'aws:source';
+/**
+ * Converts an iam-lens strict context key into an iam-simulate Discovery constraint.
+ *
+ * Most strict keys should preserve the old behavior where both presence and
+ * value are authoritative. Service source context keys are different during
+ * who-can discovery: iam-lens supplies resource-derived placeholder values, but
+ * the actual source account/org for a service principal request may differ.
+ * Treating those values as unknown lets who-can return conditional access
+ * instead of incorrectly denying service-principal statements.
+ *
+ * @param keyName the literal context key or slash-delimited key pattern
+ * @returns the Discovery constraint to pass to iam-simulate
+ */
+function discoveryConstraintForStrictKey(keyName) {
+    if (keyName.slice(0, 10).localeCompare(awsSourceKeyPrefix, undefined, { sensitivity: 'base' }) === 0) {
+        return {
+            keyName,
+            presenceIsKnown: true,
+            valueIsKnown: false
+        };
+    }
+    return {
+        keyName,
+        presenceIsKnown: true,
+        valueIsKnown: true
+    };
+}
+async function getResourcePolicies(collectClient, resourceArn, resourceAccount) {
+    if (!resourceArn) {
+        return { resourcePolicy: undefined, resourceRcps: [] };
+    }
+    const resourcePolicy = await getResourcePolicyForResource(collectClient, resourceArn, resourceAccount);
+    const resourceRcps = await getRcpsForResource(collectClient, resourceArn, resourceAccount);
+    return { resourcePolicy, resourceRcps };
+}
+function rcpsForRequest(principalArn, actionIsWildcard, resourceRcps, principalRcps) {
+    if (isServiceLinkedRole(principalArn)) {
+        return [];
+    }
+    let theRcps = resourceRcps;
+    if (actionIsWildcard) {
+        theRcps = principalRcps;
+    }
+    return theRcps.map((rcp) => {
+        rcp.orgIdentifier;
+        return {
+            orgIdentifier: rcp.orgIdentifier,
+            policies: rcp.policies.filter((policy) => {
+                return !policy.name.toLowerCase().endsWith('rcpfullawsaccess');
+            })
+        };
+    });
+}
+/**
+ * Resolves the principal ARN to use for role-backed context keys.
+ *
+ * Direct simulations can use STS assumed-role session ARNs, but collected tags
+ * and the canonical `aws:PrincipalArn` value belong to the underlying IAM role.
+ * This function performs the collected-data lookup only after the principal ARN
+ * passes the cheap assumed-role ARN check, avoiding unnecessary storage lookups
+ * for users, role ARNs, root principals, and service principals.
+ *
+ * @param collectClient the IAM collect client to use for resolving role ARNs
+ * @param principalArn the simulation principal ARN or service principal
+ * @returns the canonical role ARN for assumed-role sessions, otherwise undefined
+ */
+async function resolvePrincipalArnForContext(collectClient, principalArn) {
+    if (!isAssumedRoleArn(principalArn)) {
+        return undefined;
+    }
+    return ((await collectClient.resolvePrincipalArn(principalArn)) ??
+        convertAssumedRoleArnToRoleArn(principalArn));
+}
+function prepareIdentityPolicies(principalArn, principalPolicies) {
+    //Collect unique managed policies
+    const uniqueIdentityPolicies = {};
+    principalPolicies.managedPolicies.forEach((policy) => {
+        if (!uniqueIdentityPolicies[policy.arn]) {
+            uniqueIdentityPolicies[policy.arn] = {
+                name: policy.arn,
+                policy: policy.policy
+            };
+        }
+    });
+    principalPolicies.groupPolicies?.forEach((groupPolicy) => {
+        groupPolicy.managedPolicies.forEach((policy) => {
+            if (!uniqueIdentityPolicies[policy.arn]) {
+                uniqueIdentityPolicies[policy.arn] = {
+                    name: policy.arn,
+                    policy: policy.policy
+                };
+            }
+        });
+    });
+    const identityPolicies = Object.values(uniqueIdentityPolicies);
+    principalPolicies.inlinePolicies.forEach((policy) => {
+        identityPolicies.push({
+            name: `${principalArn}#${policy.name}`,
+            policy: policy.policy
+        });
+    });
+    principalPolicies.groupPolicies?.forEach((groupPolicy) => {
+        groupPolicy.inlinePolicies.forEach((policy) => {
+            identityPolicies.push({
+                name: `${groupPolicy.group}#${policy.name}`,
+                policy: policy.policy
+            });
+        });
+    });
+    return identityPolicies;
+}
+function preparePermissionBoundary(principalPolicies) {
+    if (principalPolicies.permissionBoundary) {
+        return [
+            {
+                name: principalPolicies.permissionBoundary.arn,
+                policy: principalPolicies.permissionBoundary.policy
+            }
+        ];
+    }
+    return undefined;
+}
+export function resultMatchesExpectation(expected, result) {
+    if (!expected) {
+        return true;
+    }
+    if (expected === 'AnyDeny') {
+        return result.includes('Denied');
+    }
+    return expected === result;
+}
+/**
+ * Evaluates whether ABAC (Attribute-Based Access Control) is enabled for a given S3 bucket or object.
+ * The evaluation can be overridden by the `s3AbacOverride` parameter.
+ *
+ * @param s3AbacOverride the override setting for S3 ABAC or undefined to auto-detect
+ * @param collectClient the IAM collect client to use for data access
+ * @param bucketAccountId the account ID the bucket belongs to
+ * @param bucketOrObjectArn the ARN of the bucket or bucket object
+ * @returns whether ABAC should be used to evaluate access for the bucket or object
+ */
+async function evaluateAbacForBucket(s3AbacOverride, collectClient, bucketAccountId, bucketOrObjectArn) {
+    if (s3AbacOverride === 'enabled') {
+        return true;
+    }
+    if (s3AbacOverride === 'disabled') {
+        return false;
+    }
+    return collectClient.getAbacEnabledForBucket(bucketAccountId, bucketOrObjectArn);
+}
+//# sourceMappingURL=simulate.js.map