@actsecurity/iam-lens 0.1.163 → 0.1.165

package/README.md

@@ -106,7 +106,7 @@ iam-lens simulate \
   --resource arn:aws:s3:::my-bucket \
   --action s3:ListBucket
 
-# Simulate a wildcard action (ListAllMyBuckets) – this will assume the principals account
+# Simulate a wildcard action (ListAllMyBuckets) – normal simulation uses the principal's account
 iam-lens simulate \
   --principal arn:aws:iam::222222222222:user/Alice \
   --action s3:ListAllMyBuckets
@@ -125,8 +125,37 @@ iam-lens simulate \
   --resource arn:aws:dynamodb:us-east-1:444444444444:table/Books \
   --action dynamodb:Query \
   --expect Allowed
+
+# Simulate unsigned access to a concrete resource ARN
+iam-lens simulate \
+  --anonymous \
+  --resource arn:aws:s3:::public-bucket/report.txt \
+  --action s3:GetObject
+
+# Simulate an administrator principal outside the dataset, without SCPs
+iam-lens simulate \
+  --external-principal \
+  --principal arn:aws:iam::999999999999:role/ExternalRole \
+  --resource arn:aws:s3:::example-bucket/report.txt \
+  --action s3:GetObject
+
+# Simulate access to a resource outside the dataset
+iam-lens simulate \
+  --external-resource \
+  --principal arn:aws:iam::444444444444:role/ReadOnly \
+  --resource arn:aws:s3:::external-bucket/report.txt \
+  --resource-account 999999999999 \
+  --action s3:GetObject
 ```
 
+The variants make their assumptions explicit:
+
+- **Anonymous** requests have no identity policy, session policy, permission boundary, or SCP. A concrete resource ARN is required, but the resource does not need to be collected; specify `--resource-account` when its account cannot be inferred. Principal-derived context keys cannot be supplied. Available resource policies, RCPs, VPC endpoint policies, and collected S3 controls still apply.
+- **External principal** requests model a principal from an uncollected account with a synthetic allow-all identity policy and no permission boundary or SCP. Session policies and collected resource-side controls still apply, so cross-account access still requires an applicable resource-side grant. In Discovery mode, unknown principal attributes such as principal tags are returned as conditions.
+- **External resource** requests require a concrete resource ARN and keep the collected principal's identity policies, permission boundary, session policy, SCPs, and VPC endpoint policies. They apply no RCPs and use a supplied or synthetic resource/trust policy. S3 ABAC and Block Public Access default to disabled for the uncollected resource; ABAC can be enabled with `--s3-abac-override enabled`.
+
+Anonymous, external-principal, and external-resource simulations do not support wildcard-only actions. See the full documentation for policy overrides and other details.
+
 [Full simulate documentation](docs/Simulate.md)
 
 ### `who-can` - Find who can perform an action on a resource

package/dist/cjs/cli.js

@@ -6,6 +6,7 @@ const client_js_1 = require("./collect/client.js");
 const collect_js_1 = require("./collect/collect.js");
 const principalCan_js_1 = require("./principalCan/principalCan.js");
 const makePrincipalIndex_js_1 = require("./principalIndex/makePrincipalIndex.js");
+const cliVariant_js_1 = require("./simulate/cliVariant.js");
 const simulate_js_1 = require("./simulate/simulate.js");
 const packageVersion_js_1 = require("./utils/packageVersion.js");
 const stringOrFileArgument_js_1 = require("./utils/stringOrFileArgument.js");
@@ -39,9 +40,20 @@ const main = async () => {
                     description: 'The expected result of the simulation, if the result does not match the expected response a non-zero exit code will be returned',
                     validValues: ['Allowed', 'ImplicitlyDenied', 'ExplicitlyDenied', 'AnyDeny']
                 }),
-                ignoreMissingPrincipal: (0, cli_1.booleanArgument)({
-                    description: 'Ignore if the principal does not exist. Useful for simulating actions from principals that may not exist or are outside your data set',
-                    character: 'i'
+                anonymous: (0, cli_1.booleanArgument)({
+                    description: 'Simulate an unsigned request to a concrete resource ARN. Wildcard-only actions are unsupported; cannot be combined with --principal or --session-policy',
+                    character: 'a'
+                }),
+                externalPrincipal: (0, cli_1.booleanArgument)({
+                    description: 'Simulate an uncollected principal with an allow-all identity policy and no SCPs. Wildcard-only actions are unsupported',
+                    character: 'e'
+                }),
+                externalResource: (0, cli_1.booleanArgument)({
+                    description: 'Simulate a concrete resource ARN outside the dataset with no RCPs and an allow-all resource or trust policy. Wildcard-only actions are unsupported',
+                    character: 'x'
+                }),
+                resourcePolicy: (0, stringOrFileArgument_js_1.stringOrFileArgument)({
+                    description: 'Resource policy for --external-resource, or trust policy for an STS assume-role action'
                 }),
                 s3AbacOverride: (0, cli_1.enumArgument)({
                     description: 'Override the S3 ABAC setting for S3 buckets. Defaults to the bucket setting stored in your iam-collect data',
@@ -112,24 +124,35 @@ const main = async () => {
             checkForUpdates: '@actsecurity/iam-lens'
         }
     });
+    const simulateSelection = cli.subcommand === 'simulate'
+        ? (0, cliVariant_js_1.selectSimulateCliVariant)({
+            anonymous: cli.args.anonymous,
+            externalPrincipal: cli.args.externalPrincipal,
+            externalResource: cli.args.externalResource,
+            principal: cli.args.principal,
+            resource: cli.args.resource,
+            resourceAccount: cli.args.resourceAccount,
+            action: cli.args.action,
+            customContextKeys: singularizeOneEntryArrays(cli.args.context),
+            sessionPolicy: cli.args.sessionPolicy,
+            resourcePolicy: cli.args.resourcePolicy,
+            s3AbacOverride: cli.args.s3AbacOverride
+        })
+        : undefined;
     if (cli.args.collectConfigs.length === 0) {
         cli.args.collectConfigs.push('./iam-collect.jsonc');
     }
     const collectConfigs = await (0, collect_js_1.loadCollectConfigs)(cli.args.collectConfigs);
     const collectClient = await (0, collect_js_1.getCollectClient)(collectConfigs, cli.args.partition);
     if (cli.subcommand === 'simulate') {
-        const { principal, resource, resourceAccount, action, context, ignoreMissingPrincipal, sessionPolicy } = cli.args;
-        const { request, result } = await (0, simulate_js_1.simulateRequest)({
-            sessionPolicy,
-            principal: principal,
-            resourceArn: resource,
-            resourceAccount: resourceAccount,
-            action: action,
-            customContextKeys: singularizeOneEntryArrays(context),
-            simulationMode: 'Strict',
-            ignoreMissingPrincipal,
-            s3AbacOverride: cli.args.s3AbacOverride
-        }, collectClient);
+        const selection = simulateSelection;
+        const { request, result } = selection.variant === 'anonymous'
+            ? await (0, simulate_js_1.simulateAnonymousRequest)(selection.request, collectClient)
+            : selection.variant === 'externalPrincipal'
+                ? await (0, simulate_js_1.simulateExternalPrincipalRequest)(selection.request, collectClient)
+                : selection.variant === 'externalResource'
+                    ? await (0, simulate_js_1.simulateExternalResourceRequest)(selection.request, collectClient)
+                    : await (0, simulate_js_1.simulateRequest)(selection.request, collectClient);
         if (result.resultType === 'error') {
             console.error('Simulation Errors:');
             console.log(JSON.stringify(result.errors, null, 2));

package/dist/cjs/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;;AAEA,0CAOyB;AACzB,mDAAqD;AACrD,qDAA2E;AAC3E,oEAA6D;AAC7D,kFAA2E;AAC3E,wDAAkF;AAClF,iEAA0D;AAC1D,6EAAsE;AACtE,kDAA2C;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAiB,EACjC,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,SAAS,EAAE;gBACT,SAAS,EAAE,IAAA,oBAAc,EAAC;oBACxB,WAAW,EAAE,yEAAyE;iBACvF,CAAC;gBACF,QAAQ,EAAE,IAAA,oBAAc,EAAC;oBACvB,WAAW,EACT,4EAA4E;iBAC/E,CAAC;gBACF,eAAe,EAAE,IAAA,oBAAc,EAAC;oBAC9B,WAAW,EACT,iGAAiG;iBACpG,CAAC;gBACF,MAAM,EAAE,IAAA,oBAAc,EAAC;oBACrB,WAAW,EACT,wFAAwF;iBAC3F,CAAC;gBACF,OAAO,EAAE,IAAA,iBAAW,EAAC;oBACnB,WAAW,EACT,6JAA6J;oBAC/J,YAAY,EAAE,EAAE;iBACjB,CAAC;gBACF,OAAO,EAAE,IAAA,qBAAe,EAAC;oBACvB,WAAW,EAAE,0CAA0C;oBACvD,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,MAAM,EAAE,IAAA,kBAAY,EAAC;oBACnB,WAAW,EACT,iIAAiI;oBACnI,WAAW,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,CAAC;iBAC5E,CAAC;gBACF,sBAAsB,EAAE,IAAA,qBAAe,EAAC;oBACtC,WAAW,EACT,uIAAuI;oBACzI,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,cAAc,EAAE,IAAA,kBAAY,EAAC;oBAC3B,WAAW,EACT,6GAA6G;oBAC/G,WAAW,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;oBACpC,YAAY,EAAE,SAAS;iBACxB,CAAC;gBACF,aAAa,EAAE,IAAA,8CAAoB,EAAC;oBAClC,WAAW,EACT,iFAAiF;iBACpF,CAAC;aACH;SACF;QACD,SAAS,EAAE;YACT,WAAW,EAAE,8CAA8C;YAC3D,SAAS,EAAE;gBACT,QAAQ,EAAE,IAAA,oBAAc,EAAC;oBACvB,WAAW,EACT,+EAA+E;iBAClF,CAAC;gBACF,eAAe,EAAE,IAAA,oBAAc,EAAC;oBAC9B,WAAW,EACT,+HAA+H;iBAClI,CAAC;gBACF,OAAO,EAAE,IAAA,yBAAmB,EAAC;oBAC3B,WAAW,EACT,qGAAqG;oBACvG,YAAY,EAAE,EAAE;iBACjB,CAAC;gBACF,cAAc,EAAE,IAAA,kBAAY,EAAC;oBAC3B,WAAW,EACT,6GAA6G;oBAC/G,WAAW,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;oBACpC,YAAY,EAAE,SAAS;iBACxB,CAAC;gBACF,IAAI,EAAE,IAAA,qBAAe,EAAC;oBACpB,WAAW,EAAE,oCAAoC;oBACjD,SAAS,EAAE,GAAG;iBACf,CAAC;aACH;SACF;QACD,eAAe,EAAE;YACf,WAAW,EACT,2FAA2F;YAC7F,SAAS,EAAE;gBACT,SAAS,EAAE,IAAA,oBAAc,EAAC;oBACxB,WAAW,EAAE,+DAA+D;iBAC7E,CAAC;gBACF,iBAAiB,EAAE,IAAA,qBAAe,EAAC;oBACjC,WAAW,EAAE,2CAA2C;oBACxD,SAAS,EAAE,GAAG;iBACf,CAAC;aACH;SACF;QACD,kBAAkB,EAAE;YAClB,WAAW,EAAE,sBAAsB;YACnC,SAAS,EAAE,EAAE;SACd;KACF,EACD;QACE,cAAc,EAAE,IAAA,yBAAmB,EAAC;YAClC,WAAW,EAAE,4CAA4C;YACzD,YAAY,EAAE,EAAE;SACjB,CAAC;QACF,SAAS,EAAE,IAAA,oBAAc,EAAC;YACxB,WAAW,EAAE,qEAAqE;YAClF,YAAY,EAAE,KAAK;SACpB,CAAC;KACH,EACD;QACE,SAAS,EAAE,UAAU;QACrB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,cAAc,EAAE,kCAAc;YAC9B,eAAe,EAAE,uBAAuB;SACzC;KACF,CACF,CAAA;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAkB,EAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACxE,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,EAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEhF,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,EACJ,SAAS,EACT,QAAQ,EACR,eAAe,EACf,MAAM,EACN,OAAO,EACP,sBAAsB,EACtB,aAAa,EACd,GAAG,GAAG,CAAC,IAAI,CAAA;QAEZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,6BAAe,EAC/C;YACE,aAAa;YACb,SAAS,EAAE,SAAU;YACrB,WAAW,EAAE,QAAQ;YACrB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,MAAO;YACf,iBAAiB,EAAE,yBAAyB,CAAC,OAAO,CAAC;YACrD,cAAc,EAAE,QAAQ;YACxB,sBAAsB;YACtB,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc;SACxC,EACD,aAAa,CACd,CAAA;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,CAAC,IAAA,sCAAwB,EAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,aAAc,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACvD,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,KAAK,CACX,qGAAqG,CACtG,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAM,EAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE;YAC/D,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAS;YAC5B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAQ;YAC1B,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;YACzC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc;YACvC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;SACpB,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC9C,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAA;YAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,8BAAY,EAAC,aAAa,EAAE;YAChD,SAAS,EAAE,SAAS;YACpB,iBAAiB;SAClB,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,IAAA,6BAAgB,EAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7E,aAAa,EAAE,IAAI,2BAAe,EAAE;SACrC,CAAC,CAAA;QACF,MAAM,IAAA,0CAAkB,EAAC,WAAW,CAAC,CAAA;IACvC,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,KAA+B;IAE/B,MAAM,MAAM,GAAsC,EAAE,CAAA;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC;KACD,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;KACd,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;;AAEA,0CAOyB;AACzB,mDAAqD;AACrD,qDAA2E;AAC3E,oEAA6D;AAC7D,kFAA2E;AAC3E,4DAAmE;AACnE,wDAM+B;AAC/B,iEAA0D;AAC1D,6EAAsE;AACtE,kDAA2C;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAiB,EACjC,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,SAAS,EAAE;gBACT,SAAS,EAAE,IAAA,oBAAc,EAAC;oBACxB,WAAW,EAAE,yEAAyE;iBACvF,CAAC;gBACF,QAAQ,EAAE,IAAA,oBAAc,EAAC;oBACvB,WAAW,EACT,4EAA4E;iBAC/E,CAAC;gBACF,eAAe,EAAE,IAAA,oBAAc,EAAC;oBAC9B,WAAW,EACT,iGAAiG;iBACpG,CAAC;gBACF,MAAM,EAAE,IAAA,oBAAc,EAAC;oBACrB,WAAW,EACT,wFAAwF;iBAC3F,CAAC;gBACF,OAAO,EAAE,IAAA,iBAAW,EAAC;oBACnB,WAAW,EACT,6JAA6J;oBAC/J,YAAY,EAAE,EAAE;iBACjB,CAAC;gBACF,OAAO,EAAE,IAAA,qBAAe,EAAC;oBACvB,WAAW,EAAE,0CAA0C;oBACvD,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,MAAM,EAAE,IAAA,kBAAY,EAAC;oBACnB,WAAW,EACT,iIAAiI;oBACnI,WAAW,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,CAAC;iBAC5E,CAAC;gBACF,SAAS,EAAE,IAAA,qBAAe,EAAC;oBACzB,WAAW,EACT,yJAAyJ;oBAC3J,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,iBAAiB,EAAE,IAAA,qBAAe,EAAC;oBACjC,WAAW,EACT,wHAAwH;oBAC1H,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,gBAAgB,EAAE,IAAA,qBAAe,EAAC;oBAChC,WAAW,EACT,oJAAoJ;oBACtJ,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,cAAc,EAAE,IAAA,8CAAoB,EAAC;oBACnC,WAAW,EACT,wFAAwF;iBAC3F,CAAC;gBACF,cAAc,EAAE,IAAA,kBAAY,EAAC;oBAC3B,WAAW,EACT,6GAA6G;oBAC/G,WAAW,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;oBACpC,YAAY,EAAE,SAAS;iBACxB,CAAC;gBACF,aAAa,EAAE,IAAA,8CAAoB,EAAC;oBAClC,WAAW,EACT,iFAAiF;iBACpF,CAAC;aACH;SACF;QACD,SAAS,EAAE;YACT,WAAW,EAAE,8CAA8C;YAC3D,SAAS,EAAE;gBACT,QAAQ,EAAE,IAAA,oBAAc,EAAC;oBACvB,WAAW,EACT,+EAA+E;iBAClF,CAAC;gBACF,eAAe,EAAE,IAAA,oBAAc,EAAC;oBAC9B,WAAW,EACT,+HAA+H;iBAClI,CAAC;gBACF,OAAO,EAAE,IAAA,yBAAmB,EAAC;oBAC3B,WAAW,EACT,qGAAqG;oBACvG,YAAY,EAAE,EAAE;iBACjB,CAAC;gBACF,cAAc,EAAE,IAAA,kBAAY,EAAC;oBAC3B,WAAW,EACT,6GAA6G;oBAC/G,WAAW,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;oBACpC,YAAY,EAAE,SAAS;iBACxB,CAAC;gBACF,IAAI,EAAE,IAAA,qBAAe,EAAC;oBACpB,WAAW,EAAE,oCAAoC;oBACjD,SAAS,EAAE,GAAG;iBACf,CAAC;aACH;SACF;QACD,eAAe,EAAE;YACf,WAAW,EACT,2FAA2F;YAC7F,SAAS,EAAE;gBACT,SAAS,EAAE,IAAA,oBAAc,EAAC;oBACxB,WAAW,EAAE,+DAA+D;iBAC7E,CAAC;gBACF,iBAAiB,EAAE,IAAA,qBAAe,EAAC;oBACjC,WAAW,EAAE,2CAA2C;oBACxD,SAAS,EAAE,GAAG;iBACf,CAAC;aACH;SACF;QACD,kBAAkB,EAAE;YAClB,WAAW,EAAE,sBAAsB;YACnC,SAAS,EAAE,EAAE;SACd;KACF,EACD;QACE,cAAc,EAAE,IAAA,yBAAmB,EAAC;YAClC,WAAW,EAAE,4CAA4C;YACzD,YAAY,EAAE,EAAE;SACjB,CAAC;QACF,SAAS,EAAE,IAAA,oBAAc,EAAC;YACxB,WAAW,EAAE,qEAAqE;YAClF,YAAY,EAAE,KAAK;SACpB,CAAC;KACH,EACD;QACE,SAAS,EAAE,UAAU;QACrB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,cAAc,EAAE,kCAAc;YAC9B,eAAe,EAAE,uBAAuB;SACzC;KACF,CACF,CAAA;IAED,MAAM,iBAAiB,GACrB,GAAG,CAAC,UAAU,KAAK,UAAU;QAC3B,CAAC,CAAC,IAAA,wCAAwB,EAAC;YACvB,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;YAC7B,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB;YAC7C,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB;YAC3C,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;YAC7B,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;YAC3B,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;YACzC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;YACvB,iBAAiB,EAAE,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9D,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa;YACrC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc;YACvC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc;SACxC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IAEf,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAkB,EAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACxE,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,EAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEhF,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,iBAAkB,CAAA;QACpC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GACvB,SAAS,CAAC,OAAO,KAAK,WAAW;YAC/B,CAAC,CAAC,MAAM,IAAA,sCAAwB,EAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;YAClE,CAAC,CAAC,SAAS,CAAC,OAAO,KAAK,mBAAmB;gBACzC,CAAC,CAAC,MAAM,IAAA,8CAAgC,EAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;gBAC1E,CAAC,CAAC,SAAS,CAAC,OAAO,KAAK,kBAAkB;oBACxC,CAAC,CAAC,MAAM,IAAA,6CAA+B,EAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;oBACzE,CAAC,CAAC,MAAM,IAAA,6BAAe,EAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;QAEjE,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,CAAC,IAAA,sCAAwB,EAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,aAAc,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACvD,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,KAAK,CACX,qGAAqG,CACtG,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAM,EAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE;YAC/D,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAS;YAC5B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAQ;YAC1B,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;YACzC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc;YACvC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;SACpB,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC9C,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAA;YAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,8BAAY,EAAC,aAAa,EAAE;YAChD,SAAS,EAAE,SAAS;YACpB,iBAAiB;SAClB,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,IAAA,6BAAgB,EAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7E,aAAa,EAAE,IAAI,2BAAe,EAAE;SACrC,CAAC,CAAA;QACF,MAAM,IAAA,0CAAkB,EAAC,WAAW,CAAC,CAAA;IACvC,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,KAA+B;IAE/B,MAAM,MAAM,GAAsC,EAAE,CAAA;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC;KACD,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;KACd,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA"}

package/dist/cjs/index.d.ts

@@ -4,7 +4,7 @@ export { getCollectClient, loadCollectConfigs, type ClientFactoryPlugin, type Co
 export { principalCan, type PrincipalCanInput } from './principalCan/principalCan.js';
 export { makePrincipalIndex } from './principalIndex/makePrincipalIndex.js';
 export type { ContextKeys } from './simulate/contextKeys.js';
-export { simulateRequest, type SimulationRequest } from './simulate/simulate.js';
+export { simulateRequest, simulateAnonymousRequest, simulateExternalPrincipalRequest, simulateExternalResourceRequest, type SimulationRequest, type AnonymousSimulationRequest, type ExternalResourceSimulationRequest, type SimulateRequestResult } from './simulate/simulate.js';
 export { whoCan, type WhoCanPrincipalScope, type ResourceAccessRequest, type WhoCanAllowed, type WhoCanAllowedResourcePattern, type WhoCanResponse } from './whoCan/whoCan.js';
 export { WhoCanProcessor, type WhoCanProcessorConfig, type WhoCanProcessorRequest, type WhoCanSettledEvent, type WhoCanSettledSuccess, type WhoCanSettledError, type WorkerBootstrapPlugin } from './whoCan/WhoCanProcessor.js';
 export { type LightRequestAnalysis, type LightResourceAnalysis, type LightResourceAnalysisWithPattern, type SingleResourceLightRequestAnalysis, type WildcardResourceLightRequestAnalysis } from './whoCan/requestAnalysis.js';

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,aAAa,EACb,YAAY,EACZ,SAAS,EACT,qBAAqB,EACrB,aAAa,EACb,cAAc,EACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAA;AAC3E,YAAY,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAChF,OAAO,EACL,MAAM,EACN,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC3B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,EACrC,KAAK,kCAAkC,EACvC,KAAK,oCAAoC,EAC1C,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,aAAa,EACb,8BAA8B,EAC9B,0BAA0B,EAC1B,kBAAkB,EAClB,KAAK,kCAAkC,EACxC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,8BAA8B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,aAAa,EACb,YAAY,EACZ,SAAS,EACT,qBAAqB,EACrB,aAAa,EACb,cAAc,EACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAA;AAC3E,YAAY,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,MAAM,EACN,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC3B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,EACrC,KAAK,kCAAkC,EACvC,KAAK,oCAAoC,EAC1C,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,aAAa,EACb,8BAA8B,EAC9B,0BAA0B,EAC1B,kBAAkB,EAClB,KAAK,kCAAkC,EACxC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,8BAA8B,CAAA"}

package/dist/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Permission = exports.toPolicyStatements = exports.addPoliciesToPermissionSet = exports.buildPermissionSetFromPolicies = exports.PermissionSet = exports.WhoCanProcessor = exports.whoCan = exports.simulateRequest = exports.makePrincipalIndex = exports.principalCan = exports.loadCollectConfigs = exports.getCollectClient = exports.NoCacheProvider = exports.InMemoryCacheProvider = exports.IamCollectClient = void 0;
+exports.Permission = exports.toPolicyStatements = exports.addPoliciesToPermissionSet = exports.buildPermissionSetFromPolicies = exports.PermissionSet = exports.WhoCanProcessor = exports.whoCan = exports.simulateExternalResourceRequest = exports.simulateExternalPrincipalRequest = exports.simulateAnonymousRequest = exports.simulateRequest = exports.makePrincipalIndex = exports.principalCan = exports.loadCollectConfigs = exports.getCollectClient = exports.NoCacheProvider = exports.InMemoryCacheProvider = exports.IamCollectClient = void 0;
 var client_js_1 = require("./collect/client.js");
 Object.defineProperty(exports, "IamCollectClient", { enumerable: true, get: function () { return client_js_1.IamCollectClient; } });
 Object.defineProperty(exports, "InMemoryCacheProvider", { enumerable: true, get: function () { return client_js_1.InMemoryCacheProvider; } });
@@ -14,6 +14,9 @@ var makePrincipalIndex_js_1 = require("./principalIndex/makePrincipalIndex.js");
 Object.defineProperty(exports, "makePrincipalIndex", { enumerable: true, get: function () { return makePrincipalIndex_js_1.makePrincipalIndex; } });
 var simulate_js_1 = require("./simulate/simulate.js");
 Object.defineProperty(exports, "simulateRequest", { enumerable: true, get: function () { return simulate_js_1.simulateRequest; } });
+Object.defineProperty(exports, "simulateAnonymousRequest", { enumerable: true, get: function () { return simulate_js_1.simulateAnonymousRequest; } });
+Object.defineProperty(exports, "simulateExternalPrincipalRequest", { enumerable: true, get: function () { return simulate_js_1.simulateExternalPrincipalRequest; } });
+Object.defineProperty(exports, "simulateExternalResourceRequest", { enumerable: true, get: function () { return simulate_js_1.simulateExternalResourceRequest; } });
 var whoCan_js_1 = require("./whoCan/whoCan.js");
 Object.defineProperty(exports, "whoCan", { enumerable: true, get: function () { return whoCan_js_1.whoCan; } });
 var WhoCanProcessor_js_1 = require("./whoCan/WhoCanProcessor.js");

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAM4B;AAL1B,6GAAA,gBAAgB,OAAA;AAChB,kHAAA,qBAAqB,OAAA;AACrB,4GAAA,eAAe,OAAA;AAYjB,mDAK6B;AAJ3B,8GAAA,gBAAgB,OAAA;AAChB,gHAAA,kBAAkB,OAAA;AAIpB,kEAAqF;AAA5E,+GAAA,YAAY,OAAA;AACrB,gFAA2E;AAAlE,2HAAA,kBAAkB,OAAA;AAE3B,sDAAgF;AAAvE,8GAAA,eAAe,OAAA;AACxB,gDAO2B;AANzB,mGAAA,MAAM,OAAA;AAOR,kEAQoC;AAPlC,qHAAA,eAAe,OAAA;AAejB,oEAMwC;AALtC,iHAAA,aAAa,OAAA;AACb,kIAAA,8BAA8B,OAAA;AAC9B,8HAAA,0BAA0B,OAAA;AAC1B,sHAAA,kBAAkB,OAAA;AAGpB,8DAMqC;AALnC,2GAAA,UAAU,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAM4B;AAL1B,6GAAA,gBAAgB,OAAA;AAChB,kHAAA,qBAAqB,OAAA;AACrB,4GAAA,eAAe,OAAA;AAYjB,mDAK6B;AAJ3B,8GAAA,gBAAgB,OAAA;AAChB,gHAAA,kBAAkB,OAAA;AAIpB,kEAAqF;AAA5E,+GAAA,YAAY,OAAA;AACrB,gFAA2E;AAAlE,2HAAA,kBAAkB,OAAA;AAE3B,sDAS+B;AAR7B,8GAAA,eAAe,OAAA;AACf,uHAAA,wBAAwB,OAAA;AACxB,+HAAA,gCAAgC,OAAA;AAChC,8HAAA,+BAA+B,OAAA;AAMjC,gDAO2B;AANzB,mGAAA,MAAM,OAAA;AAOR,kEAQoC;AAPlC,qHAAA,eAAe,OAAA;AAejB,oEAMwC;AALtC,iHAAA,aAAa,OAAA;AACb,kIAAA,8BAA8B,OAAA;AAC9B,8HAAA,0BAA0B,OAAA;AAC1B,sHAAA,kBAAkB,OAAA;AAGpB,8DAMqC;AALnC,2GAAA,UAAU,OAAA"}

package/dist/cjs/principals.d.ts

@@ -32,6 +32,7 @@ export declare function getAllPoliciesForRole(collectClient: IamCollectClient, p
  *
  * IAM role and assumed-role principals are resolved to their canonical stored ARN before
  * loading policies so pathless STS session principals can use path-qualified IAM role data.
+ * SCPs are omitted for service-linked roles because they are not subject to SCP enforcement.
  *
  * @param collectClient the IAM collect client to use for retrieving policies
  * @param principalArn the ARN or service principal to get policies for

package/dist/cjs/principals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principals.d.ts","sourceRoot":"","sources":["../../src/principals.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAE5B,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,aAAa,EAAE,CAAA;IAChC,cAAc,EAAE,YAAY,EAAE,CAAA;IAC9B,kBAAkB,EAAE,aAAa,GAAG,SAAS,CAAA;IAC7C,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC7B,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC7B,aAAa,CAAC,EAAE;QACd,KAAK,EAAE,MAAM,CAAA;QACb,eAAe,EAAE,aAAa,EAAE,CAAA;QAChC,cAAc,EAAE,YAAY,EAAE,CAAA;KAC/B,EAAE,CAAA;CACJ;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CA4B5B;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM1D;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM1D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAMlB"}
+{"version":3,"file":"principals.d.ts","sourceRoot":"","sources":["../../src/principals.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAE5B,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,aAAa,EAAE,CAAA;IAChC,cAAc,EAAE,YAAY,EAAE,CAAA;IAC9B,kBAAkB,EAAE,aAAa,GAAG,SAAS,CAAA;IAC7C,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC7B,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC7B,aAAa,CAAC,EAAE;QACd,KAAK,EAAE,MAAM,CAAA;QACb,eAAe,EAAE,aAAa,EAAE,CAAA;QAChC,cAAc,EAAE,YAAY,EAAE,CAAA;KAC/B,EAAE,CAAA;CACJ;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAgB5B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CA8B5B;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM1D;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM1D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAMlB"}

package/dist/cjs/principals.js

@@ -71,6 +71,7 @@ async function getAllPoliciesForRole(collectClient, principalArn) {
  *
  * IAM role and assumed-role principals are resolved to their canonical stored ARN before
  * loading policies so pathless STS session principals can use path-qualified IAM role data.
+ * SCPs are omitted for service-linked roles because they are not subject to SCP enforcement.
  *
  * @param collectClient the IAM collect client to use for retrieving policies
  * @param principalArn the ARN or service principal to get policies for
@@ -94,12 +95,14 @@ async function getAllPoliciesForPrincipal(collectClient, principalArn) {
     }
     else if ((0, iam_utils_1.isIamRoleArn)(principalArn)) {
         const roleArn = (await collectClient.resolvePrincipalArn(principalArn)) ?? principalArn;
-        return getAllPoliciesForRole(collectClient, roleArn);
+        const policies = await getAllPoliciesForRole(collectClient, roleArn);
+        return isServiceLinkedRole(roleArn) ? { ...policies, scps: [] } : policies;
     }
     else if ((0, iam_utils_1.isAssumedRoleArn)(principalArn)) {
         const roleArn = (await collectClient.resolvePrincipalArn(principalArn)) ??
             (0, iam_utils_1.convertAssumedRoleArnToRoleArn)(principalArn);
-        return getAllPoliciesForRole(collectClient, roleArn);
+        const policies = await getAllPoliciesForRole(collectClient, roleArn);
+        return isServiceLinkedRole(roleArn) ? { ...policies, scps: [] } : policies;
     }
     throw new Error(`Unsupported principal type: ${principalArn}`);
 }

package/dist/cjs/principals.js.map

@@ -1 +1 @@
-{"version":3,"file":"principals.js","sourceRoot":"","sources":["../../src/principals.ts"],"names":[],"mappings":";;AAkCA,sDA8BC;AASD,sDAmBC;AAYD,gEA+BC;AAED,wCAEC;AAED,gDAEC;AAED,kDAGC;AAED,0CAMC;AAED,0CAMC;AASD,0CASC;AAtLD,sDAM+B;AAqB/B;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,aAA+B,EAC/B,YAAoB;IAEpB,MAAM,SAAS,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC,SAAU,CAAA;IAExD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAA;IACnF,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAA;IACjF,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAA;IAC1F,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAA;IACjE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACrE,MAAM,aAAa,GAAG,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,oBAAoB,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAA;QAClF,MAAM,mBAAmB,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;QAChF,aAAa,CAAC,IAAI,CAAC;YACjB,KAAK;YACL,eAAe,EAAE,oBAAoB;YACrC,cAAc,EAAE,mBAAmB;SACpC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,eAAe;QACf,cAAc;QACd,kBAAkB;QAClB,aAAa;KACd,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,aAA+B,EAC/B,YAAoB;IAEpB,MAAM,SAAS,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC,SAAU,CAAA;IAExD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAA;IACnF,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAA;IACjF,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAA;IAC1F,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IAErE,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,eAAe;QACf,cAAc;QACd,kBAAkB;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,0BAA0B,CAC9C,aAA+B,EAC/B,YAAoB;IAEpB,IACE,kBAAkB,CAAC,YAAY,CAAC;QAChC,eAAe,CAAC,YAAY,CAAC;QAC7B,eAAe,CAAC,YAAY,CAAC,EAC7B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,EAAE;YACR,eAAe,EAAE,EAAE;YACnB,cAAc,EAAE,EAAE;YAClB,kBAAkB,EAAE,SAAS;YAC7B,aAAa,EAAE,EAAE;SAClB,CAAA;IACH,CAAC;IAED,IAAI,IAAA,wBAAY,EAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,OAAO,qBAAqB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAC3D,CAAC;SAAM,IAAI,IAAA,wBAAY,EAAC,YAAY,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,aAAa,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,IAAI,YAAY,CAAA;QACvF,OAAO,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;SAAM,IAAI,IAAA,4BAAgB,EAAC,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GACX,CAAC,MAAM,aAAa,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;YACvD,IAAA,0CAA8B,EAAC,YAAY,CAAC,CAAA;QAC9C,OAAO,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,YAAY,EAAE,CAAC,CAAA;AAChE,CAAC;AAED,SAAgB,cAAc,CAAC,SAAiB;IAC9C,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACrC,CAAC;AAED,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;AAC1E,CAAC;AAED,SAAgB,mBAAmB,CAAC,SAAiB;IACnD,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IACzC,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAA;AAC9F,CAAC;AAED,SAAgB,eAAe,CAAC,SAAiB;IAC/C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IACtC,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAA;AAC1E,CAAC;AAED,SAAgB,eAAe,CAAC,SAAiB;IAC/C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IACtC,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAA;AAC1E,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,aAA+B;IAE/B,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;AACjD,CAAC"}
+{"version":3,"file":"principals.js","sourceRoot":"","sources":["../../src/principals.ts"],"names":[],"mappings":";;AAkCA,sDA8BC;AASD,sDAmBC;AAaD,gEAiCC;AAED,wCAEC;AAED,gDAEC;AAED,kDAGC;AAED,0CAMC;AAED,0CAMC;AASD,0CASC;AAzLD,sDAM+B;AAqB/B;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,aAA+B,EAC/B,YAAoB;IAEpB,MAAM,SAAS,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC,SAAU,CAAA;IAExD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAA;IACnF,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAA;IACjF,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAA;IAC1F,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAA;IACjE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACrE,MAAM,aAAa,GAAG,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,oBAAoB,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAA;QAClF,MAAM,mBAAmB,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;QAChF,aAAa,CAAC,IAAI,CAAC;YACjB,KAAK;YACL,eAAe,EAAE,oBAAoB;YACrC,cAAc,EAAE,mBAAmB;SACpC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,eAAe;QACf,cAAc;QACd,kBAAkB;QAClB,aAAa;KACd,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,aAA+B,EAC/B,YAAoB;IAEpB,MAAM,SAAS,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC,SAAU,CAAA;IAExD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAA;IACnF,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAA;IACjF,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAA;IAC1F,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;IAErE,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,eAAe;QACf,cAAc;QACd,kBAAkB;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,0BAA0B,CAC9C,aAA+B,EAC/B,YAAoB;IAEpB,IACE,kBAAkB,CAAC,YAAY,CAAC;QAChC,eAAe,CAAC,YAAY,CAAC;QAC7B,eAAe,CAAC,YAAY,CAAC,EAC7B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,EAAE;YACR,eAAe,EAAE,EAAE;YACnB,cAAc,EAAE,EAAE;YAClB,kBAAkB,EAAE,SAAS;YAC7B,aAAa,EAAE,EAAE;SAClB,CAAA;IACH,CAAC;IAED,IAAI,IAAA,wBAAY,EAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,OAAO,qBAAqB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAC3D,CAAC;SAAM,IAAI,IAAA,wBAAY,EAAC,YAAY,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,aAAa,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,IAAI,YAAY,CAAA;QACvF,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;QACpE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC5E,CAAC;SAAM,IAAI,IAAA,4BAAgB,EAAC,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GACX,CAAC,MAAM,aAAa,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;YACvD,IAAA,0CAA8B,EAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;QACpE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC5E,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,YAAY,EAAE,CAAC,CAAA;AAChE,CAAC;AAED,SAAgB,cAAc,CAAC,SAAiB;IAC9C,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACrC,CAAC;AAED,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;AAC1E,CAAC;AAED,SAAgB,mBAAmB,CAAC,SAAiB;IACnD,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IACzC,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAA;AAC9F,CAAC;AAED,SAAgB,eAAe,CAAC,SAAiB;IAC/C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IACtC,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAA;AAC1E,CAAC;AAED,SAAgB,eAAe,CAAC,SAAiB;IAC/C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IACtC,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAA;AAC1E,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,aAA+B;IAE/B,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;AACjD,CAAC"}

package/dist/cjs/simulate/cliVariant.d.ts

@@ -0,0 +1,116 @@
+import type { S3AbacOverride } from '../utils/s3Abac.js';
+import { type ContextKeys } from './contextKeys.js';
+import type { AnonymousSimulationRequest, ExternalResourceSimulationRequest, SimulationRequest } from './simulate.js';
+/**
+ * Parsed CLI values used to select and construct a simulation request variant.
+ */
+export interface SimulateCliOptions {
+    /**
+     * Whether to simulate an unsigned request.
+     */
+    anonymous?: boolean;
+    /**
+     * Whether to simulate a synthetic administrator principal.
+     */
+    externalPrincipal?: boolean;
+    /**
+     * Whether to simulate a resource outside the collected dataset.
+     */
+    externalResource?: boolean;
+    /**
+     * Authenticated principal for non-anonymous simulations.
+     */
+    principal?: string;
+    /**
+     * Resource ARN supplied on the command line.
+     */
+    resource?: string;
+    /**
+     * Explicit resource account supplied on the command line.
+     */
+    resourceAccount?: string;
+    /**
+     * IAM action supplied on the command line.
+     */
+    action?: string;
+    /**
+     * Caller-provided IAM context values.
+     */
+    customContextKeys: ContextKeys;
+    /**
+     * Optional session policy parsed from JSON or a file.
+     */
+    sessionPolicy?: any;
+    /**
+     * Optional external resource or trust policy parsed from JSON or a file.
+     */
+    resourcePolicy?: unknown;
+    /**
+     * Optional S3 ABAC behavior override.
+     */
+    s3AbacOverride?: S3AbacOverride;
+}
+/**
+ * A validated normal simulation selected by CLI options.
+ */
+export interface NormalSimulateCliSelection {
+    /**
+     * Discriminant identifying normal collected-principal and collected-resource simulation.
+     */
+    variant: 'normal';
+    /**
+     * Request passed to {@link simulateRequest}.
+     */
+    request: SimulationRequest;
+}
+/**
+ * A validated anonymous simulation selected by CLI options.
+ */
+export interface AnonymousSimulateCliSelection {
+    /**
+     * Discriminant identifying unsigned simulation.
+     */
+    variant: 'anonymous';
+    /**
+     * Request passed to {@link simulateAnonymousRequest}.
+     */
+    request: AnonymousSimulationRequest;
+}
+/**
+ * A validated external-principal simulation selected by CLI options.
+ */
+export interface ExternalPrincipalSimulateCliSelection {
+    /**
+     * Discriminant identifying synthetic administrator-principal simulation.
+     */
+    variant: 'externalPrincipal';
+    /**
+     * Request passed to {@link simulateExternalPrincipalRequest}.
+     */
+    request: SimulationRequest;
+}
+/**
+ * A validated external-resource simulation selected by CLI options.
+ */
+export interface ExternalResourceSimulateCliSelection {
+    /**
+     * Discriminant identifying simulation against an uncollected resource.
+     */
+    variant: 'externalResource';
+    /**
+     * Request passed to {@link simulateExternalResourceRequest}.
+     */
+    request: ExternalResourceSimulationRequest;
+}
+/**
+ * Validated simulation selection produced from CLI arguments.
+ */
+export type SimulateCliSelection = NormalSimulateCliSelection | AnonymousSimulateCliSelection | ExternalPrincipalSimulateCliSelection | ExternalResourceSimulateCliSelection;
+/**
+ * Validate simulation CLI options and construct the corresponding library request.
+ *
+ * @param options parsed CLI simulation options
+ * @returns a discriminated simulation selection ready for dispatch
+ */
+export declare function selectSimulateCliVariant(options: SimulateCliOptions): SimulateCliSelection;
+//# sourceMappingURL=cliVariant.d.ts.map

package/dist/cjs/simulate/cliVariant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliVariant.d.ts","sourceRoot":"","sources":["../../../src/simulate/cliVariant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAkC,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnF,OAAO,KAAK,EACV,0BAA0B,EAC1B,iCAAiC,EACjC,iBAAiB,EAClB,MAAM,eAAe,CAAA;AAEtB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IAEnB;;OAEG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAE3B;;OAEG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAE1B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,iBAAiB,EAAE,WAAW,CAAA;IAE9B;;OAEG;IACH,aAAa,CAAC,EAAE,GAAG,CAAA;IAEnB;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IAExB;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,OAAO,EAAE,QAAQ,CAAA;IAEjB;;OAEG;IACH,OAAO,EAAE,iBAAiB,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;OAEG;IACH,OAAO,EAAE,WAAW,CAAA;IAEpB;;OAEG;IACH,OAAO,EAAE,0BAA0B,CAAA;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD;;OAEG;IACH,OAAO,EAAE,mBAAmB,CAAA;IAE5B;;OAEG;IACH,OAAO,EAAE,iBAAiB,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,oCAAoC;IACnD;;OAEG;IACH,OAAO,EAAE,kBAAkB,CAAA;IAE3B;;OAEG;IACH,OAAO,EAAE,iCAAiC,CAAA;CAC3C;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC5B,0BAA0B,GAC1B,6BAA6B,GAC7B,qCAAqC,GACrC,oCAAoC,CAAA;AAExC;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,GAAG,oBAAoB,CAiF1F"}

package/dist/cjs/simulate/cliVariant.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectSimulateCliVariant = selectSimulateCliVariant;
+const contextKeys_js_1 = require("./contextKeys.js");
+/**
+ * Validate simulation CLI options and construct the corresponding library request.
+ *
+ * @param options parsed CLI simulation options
+ * @returns a discriminated simulation selection ready for dispatch
+ */
+function selectSimulateCliVariant(options) {
+    const variants = [options.anonymous, options.externalPrincipal, options.externalResource].filter(Boolean);
+    if (variants.length > 1) {
+        throw new Error('Only one of --anonymous, --external-principal, or --external-resource may be specified.');
+    }
+    if (!options.action) {
+        throw new Error('--action is required for simulate.');
+    }
+    if (options.resourcePolicy !== undefined && !options.externalResource) {
+        throw new Error('--resource-policy may only be used with --external-resource.');
+    }
+    const commonRequest = {
+        resourceArn: options.resource,
+        resourceAccount: options.resourceAccount,
+        action: options.action,
+        customContextKeys: options.customContextKeys,
+        simulationMode: 'Strict',
+        s3AbacOverride: options.s3AbacOverride
+    };
+    if (options.anonymous) {
+        if (options.principal) {
+            throw new Error('--principal cannot be used with --anonymous.');
+        }
+        if (options.sessionPolicy !== undefined) {
+            throw new Error('--session-policy cannot be used with --anonymous.');
+        }
+        if (!options.resource) {
+            throw new Error('--resource is required with --anonymous.');
+        }
+        const invalidContextKey = Object.keys(options.customContextKeys).find(contextKeys_js_1.isAnonymousPrincipalContextKey);
+        if (invalidContextKey) {
+            throw new Error(`Anonymous simulations cannot specify principal-derived context key ${invalidContextKey}.`);
+        }
+        return {
+            variant: 'anonymous',
+            request: { ...commonRequest, resourceArn: options.resource }
+        };
+    }
+    if (!options.principal) {
+        throw new Error('--principal is required unless --anonymous is specified.');
+    }
+    const authenticatedRequest = {
+        ...commonRequest,
+        principal: options.principal,
+        sessionPolicy: options.sessionPolicy
+    };
+    if (options.externalPrincipal) {
+        return { variant: 'externalPrincipal', request: authenticatedRequest };
+    }
+    if (options.externalResource) {
+        if (!options.resource) {
+            throw new Error('--resource is required with --external-resource.');
+        }
+        if (options.resourcePolicy !== undefined && !isJsonObject(options.resourcePolicy)) {
+            throw new Error('--resource-policy must contain a JSON object.');
+        }
+        return {
+            variant: 'externalResource',
+            request: {
+                ...authenticatedRequest,
+                resourceArn: options.resource,
+                resourcePolicy: options.resourcePolicy
+            }
+        };
+    }
+    return { variant: 'normal', request: authenticatedRequest };
+}
+/**
+ * Check whether a parsed JSON value is an object suitable for policy validation.
+ *
+ * @param value parsed JSON value
+ * @returns true for non-null, non-array objects
+ */
+function isJsonObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=cliVariant.js.map

package/dist/cjs/simulate/cliVariant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliVariant.js","sourceRoot":"","sources":["../../../src/simulate/cliVariant.ts"],"names":[],"mappings":";;AA+IA,4DAiFC;AA/ND,qDAAmF;AAwInF;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,OAA2B;IAClE,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAC9F,OAAO,CACR,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAA;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,aAAa,GAAG;QACpB,WAAW,EAAE,OAAO,CAAC,QAAQ;QAC7B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,cAAc,EAAE,QAAiB;QACjC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAA;IAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACtE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACnE,+CAA8B,CAC/B,CAAA;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,sEAAsE,iBAAiB,GAAG,CAC3F,CAAA;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE;SAC7D,CAAA;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IAED,MAAM,oBAAoB,GAAsB;QAC9C,GAAG,aAAa;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAA;IAED,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAA;IACxE,CAAC;IAED,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACrE,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,OAAO;YACL,OAAO,EAAE,kBAAkB;YAC3B,OAAO,EAAE;gBACP,GAAG,oBAAoB;gBACvB,WAAW,EAAE,OAAO,CAAC,QAAQ;gBAC7B,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC;SACF,CAAA;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC"}

package/dist/cjs/simulate/contextKeys.d.ts

@@ -1,5 +1,5 @@
 import { IamCollectClient } from '../collect/client.js';
-import { type SimulationRequest } from './simulate.js';
+import type { InternalSimulationRequest } from './simulate.js';
 /**
  * Context keys for IAM simulation requests.
  *
@@ -8,6 +8,15 @@ import { type SimulationRequest } from './simulate.js';
  * context keys that may be required for the simulation.
  */
 export type ContextKeys = Record<string, string | string[]>;
+/**
+ * Controls optional collected metadata lookups while deriving context keys.
+ */
+export interface CreateContextKeysOptions {
+    /**
+     * Whether resource tags and presence should be loaded from collected data.
+     */
+    includeResourceMetadata?: boolean;
+}
 /**
  * Placeholder for the caller account AWS supplies on a service-mediated KMS request.
  *
@@ -25,6 +34,17 @@ export declare const CONTEXT_KEYS: {
     vpcEndpointOrgPaths: string;
     vpcArn: string;
 };
+/**
+ * Determine whether a context key requires an authenticated principal or its credentials.
+ *
+ * Anonymous requests cannot supply these keys as overrides because AWS treats the corresponding
+ * principal identity as absent. Principal-prefixed keys include fixed keys such as
+ * `aws:PrincipalArn` and dynamic keys such as `aws:PrincipalTag/team`.
+ *
+ * @param key context key name to classify
+ * @returns whether the key is unavailable to anonymous requests
+ */
+export declare function isAnonymousPrincipalContextKey(key: string): boolean;
 /**
  * Checks if a context has a specific key (case-insensitive).
  *
@@ -49,9 +69,10 @@ export declare function contextValue(context: ContextKeys, key: string): string
  * @param service the service the request is for
  * @param contextKeyOverrides the context key overrides to apply
  * @param resolvedPrincipalArnForContext canonical principal ARN to use for role-backed context keys
+ * @param options controls collected resource metadata lookups
  * @returns a promise that resolves to the context keys for the simulation request
  */
-export declare function createContextKeys(collectClient: IamCollectClient, simulationRequest: SimulationRequest, service: string, contextKeyOverrides: ContextKeys, resolvedPrincipalArnForContext?: string): Promise<{
+export declare function createContextKeys(collectClient: IamCollectClient, simulationRequest: InternalSimulationRequest, service: string, contextKeyOverrides: ContextKeys, resolvedPrincipalArnForContext?: string, options?: CreateContextKeysOptions): Promise<{
     resourceTagsAreKnown: boolean;
     contextKeys: ContextKeys;
 }>;

package/dist/cjs/simulate/contextKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/simulate/contextKeys.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEtD;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;AAE3D;;;;GAIG;AACH,eAAO,MAAM,2CAA2C,iBAAiB,CAAA;AAEzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAyB7C,CAAA;AAED,eAAO,MAAM,YAAY;;;;;;;;;CASxB,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAK7F;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,gBAAgB,EAC/B,iBAAiB,EAAE,iBAAiB,EACpC,OAAO,EAAE,MAAM,EACf,mBAAmB,EAAE,WAAW,EAChC,8BAA8B,CAAC,EAAE,MAAM,GACtC,OAAO,CAAC;IAAE,oBAAoB,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,WAAW,CAAA;CAAE,CAAC,CAuItE;AAwBD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAgEtB;AAyCD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5E"}
+{"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/simulate/contextKeys.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;AAE3D;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,2CAA2C,iBAAiB,CAAA;AAEzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAyB7C,CAAA;AAED,eAAO,MAAM,YAAY;;;;;;;;;CASxB,CAAA;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAKnE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAK7F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,gBAAgB,EAC/B,iBAAiB,EAAE,yBAAyB,EAC5C,OAAO,EAAE,MAAM,EACf,mBAAmB,EAAE,WAAW,EAChC,8BAA8B,CAAC,EAAE,MAAM,EACvC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC;IAAE,oBAAoB,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,WAAW,CAAA;CAAE,CAAC,CAsItE;AAwBD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAgEtB;AAyCD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5E"}