@actsecurity/iam-simulate 0.1.173

package/dist/esm/services/IamServiceAuthorizer.js

@@ -0,0 +1,63 @@
+import {} from '../evaluate.js';
+import { splitArnParts } from '../util.js';
+import { DefaultServiceAuthorizer } from './DefaultServiceAuthorizer.js';
+import {} from './ServiceAuthorizer.js';
+const deniedActionsForManagedPolicies = new Set([
+    'iam:createpolicy',
+    'iam:createpolicyversion',
+    'iam:deletepolicy',
+    'iam:deletepolicyversion',
+    'iam:setdefaultpolicyversion',
+    'iam:tagpolicy',
+    'iam:untagpolicy'
+]);
+const deniedActionsForAwsManagedRoles = new Set([
+    'iam:attachrolepolicy',
+    'iam:createrole',
+    'iam:createservicelinkedrole',
+    'iam:deleterole',
+    'iam:deleterolepermissionsboundary',
+    'iam:deleterolepolicy',
+    'iam:deleteservicelinkedrole',
+    'iam:detachrolepolicy',
+    'iam:passrole',
+    'iam:putrolepermissionsboundary',
+    'iam:putrolepolicy',
+    'iam:tagrole',
+    'iam:untagrole',
+    'iam:updateassumerolepolicy',
+    'iam:updaterole',
+    'iam:updateroledescription'
+]);
+/**
+ * Service authorizer for IAM service requests.
+ */
+export class IamServiceAuthorizer extends DefaultServiceAuthorizer {
+    authorize(request) {
+        const baseResult = super.authorize(request);
+        const resourceParts = splitArnParts(request.request.resource.value());
+        // If the request is for a managed policy and the action is one of the denied actions,
+        // we return implicitly denied.
+        if (deniedActionsForManagedPolicies.has(request.request.action.value().toLowerCase()) &&
+            resourceParts.resource?.toLowerCase()?.startsWith('policy/') &&
+            resourceParts.accountId == 'aws') {
+            return {
+                ...baseResult,
+                result: 'ImplicitlyDenied',
+                conditions: undefined
+            };
+        }
+        // If the request is for an AWS managed role and the action is one of the denied actions,
+        // we return implicitly denied.
+        if (deniedActionsForAwsManagedRoles.has(request.request.action.value().toLowerCase()) &&
+            resourceParts.resource?.toLowerCase()?.startsWith('role/aws-reserved/')) {
+            return {
+                ...baseResult,
+                result: 'ImplicitlyDenied',
+                conditions: undefined
+            };
+        }
+        return baseResult;
+    }
+}
+//# sourceMappingURL=IamServiceAuthorizer.js.map

package/dist/esm/services/IamServiceAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IamServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/IamServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAoC,MAAM,wBAAwB,CAAA;AAEzE,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,kBAAkB;IAClB,yBAAyB;IACzB,kBAAkB;IAClB,yBAAyB;IACzB,6BAA6B;IAC7B,eAAe;IACf,iBAAiB;CAClB,CAAC,CAAA;AAEF,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,sBAAsB;IACtB,gBAAgB;IAChB,6BAA6B;IAC7B,gBAAgB;IAChB,mCAAmC;IACnC,sBAAsB;IACtB,6BAA6B;IAC7B,sBAAsB;IACtB,cAAc;IACd,gCAAgC;IAChC,mBAAmB;IACnB,aAAa;IACb,eAAe;IACf,4BAA4B;IAC5B,gBAAgB;IAChB,2BAA2B;CAC5B,CAAC,CAAA;AACF;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,wBAAwB;IAChD,SAAS,CAAC,OAAoC;QAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAE3C,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;QACrE,sFAAsF;QACtF,+BAA+B;QAC/B,IACE,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;YACjF,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;YAC5D,aAAa,CAAC,SAAS,IAAI,KAAK,EAChC,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,yFAAyF;QACzF,+BAA+B;QAC/B,IACE,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;YACjF,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,UAAU,CAAC,oBAAoB,CAAC,EACvE,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;CACF"}

package/dist/esm/services/KmsServiceAuthorizer.d.ts

@@ -0,0 +1,29 @@
+import { type RequestAnalysis, type ResourceAnalysis } from '../evaluate.js';
+import { type RequestResource } from '../request/requestResource.js';
+import { DefaultServiceAuthorizer, type PrincipalAccountTrust } from './DefaultServiceAuthorizer.js';
+import { type ServiceAuthorizationRequest } from './ServiceAuthorizer.js';
+/**
+ * Service authorizer for AWS KMS requests.
+ */
+export declare class KmsServiceAuthorizer extends DefaultServiceAuthorizer {
+    /**
+     * Authorize a KMS service request after policy analysis and KMS-specific managed alias checks.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns the KMS authorization result
+     */
+    authorize(request: ServiceAuthorizationRequest): RequestAnalysis;
+    /**
+     * Determines how KMS trusts the principal account's IAM policies.
+     *
+     * KMS key resources keep KMS key-policy trust behavior, while other KMS resource types use the
+     * default service authorizer trust behavior.
+     *
+     * @param sameAccount if the principal and resource are in the same account
+     * @param resourceAnalysis the resource policy analysis
+     * @param resource the request resource used to choose key or default trust behavior
+     * @returns how KMS trusts the principal account's IAM policies
+     */
+    serviceTrustsPrincipalAccount(sameAccount: boolean, resourceAnalysis: ResourceAnalysis, resource: RequestResource): PrincipalAccountTrust;
+}
+//# sourceMappingURL=KmsServiceAuthorizer.d.ts.map

package/dist/esm/services/KmsServiceAuthorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KmsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/KmsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAkCzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChE;;;;;OAKG;IACa,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IAqBhF;;;;;;;;;;OAUG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAgBzB"}

package/dist/esm/services/KmsServiceAuthorizer.js

@@ -0,0 +1,82 @@
+import {} from '../evaluate.js';
+import {} from '../request/requestResource.js';
+import { DefaultServiceAuthorizer } from './DefaultServiceAuthorizer.js';
+import {} from './ServiceAuthorizer.js';
+const deniedActionsForAwsManagedAliases = new Set([
+    'kms:createalias',
+    'kms:deletealias',
+    'kms:updatealias'
+]);
+const awsManagedAliasPrefix = 'alias/aws/';
+/**
+ * Checks whether the KMS resource should use KMS key-policy principal-account trust behavior.
+ *
+ * @param resource the request resource to classify
+ * @returns true when the resource is all resources or a KMS key resource
+ */
+function usesKmsKeyPrincipalAccountTrust(resource) {
+    return resource.isAllResources() || resource.resource().toLowerCase().startsWith('key/');
+}
+/**
+ * Checks whether the KMS resource is an AWS-managed key alias.
+ *
+ * @param resource the request resource to classify
+ * @returns true when the resource is an alias/aws/... ARN resource
+ */
+function isAwsManagedAlias(resource) {
+    return (resource
+        .resource()
+        .slice(0, awsManagedAliasPrefix.length)
+        .localeCompare(awsManagedAliasPrefix, undefined, { sensitivity: 'accent' }) === 0);
+}
+/**
+ * Service authorizer for AWS KMS requests.
+ */
+export class KmsServiceAuthorizer extends DefaultServiceAuthorizer {
+    /**
+     * Authorize a KMS service request after policy analysis and KMS-specific managed alias checks.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns the KMS authorization result
+     */
+    authorize(request) {
+        const baseResult = super.authorize(request);
+        if (baseResult.result === 'ExplicitlyDenied') {
+            return baseResult;
+        }
+        if (deniedActionsForAwsManagedAliases.has(request.request.action.value().toLowerCase()) &&
+            isAwsManagedAlias(request.request.resource)) {
+            return {
+                ...baseResult,
+                result: 'ImplicitlyDenied',
+                conditions: undefined
+            };
+        }
+        return baseResult;
+    }
+    /**
+     * Determines how KMS trusts the principal account's IAM policies.
+     *
+     * KMS key resources keep KMS key-policy trust behavior, while other KMS resource types use the
+     * default service authorizer trust behavior.
+     *
+     * @param sameAccount if the principal and resource are in the same account
+     * @param resourceAnalysis the resource policy analysis
+     * @param resource the request resource used to choose key or default trust behavior
+     * @returns how KMS trusts the principal account's IAM policies
+     */
+    serviceTrustsPrincipalAccount(sameAccount, resourceAnalysis, resource) {
+        if (!usesKmsKeyPrincipalAccountTrust(resource)) {
+            return super.serviceTrustsPrincipalAccount(sameAccount, resourceAnalysis, resource);
+        }
+        if (sameAccount && resource.isAllResources()) {
+            return { trustType: 'Implicit' };
+        }
+        const accountLevelStatements = this.accountLevelResourceAllowStatements(resourceAnalysis);
+        if (accountLevelStatements.length > 0) {
+            return { trustType: 'Explicit', statements: accountLevelStatements };
+        }
+        return { trustType: 'None' };
+    }
+}
+//# sourceMappingURL=KmsServiceAuthorizer.js.map

package/dist/esm/services/KmsServiceAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KmsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/KmsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAwB,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAA8B,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAoC,MAAM,wBAAwB,CAAA;AAEzE,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC;IAChD,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;CAClB,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,YAAY,CAAA;AAE1C;;;;;GAKG;AACH,SAAS,+BAA+B,CAAC,QAAyB;IAChE,OAAO,QAAQ,CAAC,cAAc,EAAE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1F,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,QAAyB;IAClD,OAAO,CACL,QAAQ;SACL,QAAQ,EAAE;SACV,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC;SACtC,aAAa,CAAC,qBAAqB,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CACpF,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,wBAAwB;IAChE;;;;;OAKG;IACa,SAAS,CAAC,OAAoC;QAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAE3C,IAAI,UAAU,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAC7C,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,IACE,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;YACnF,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAC3C,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,6BAA6B,CAAC,WAAW,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAA;QACrF,CAAC;QAED,IAAI,WAAW,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF"}

package/dist/esm/services/ServiceAuthorizer.d.ts

@@ -0,0 +1,27 @@
+import { type PolicyWithName, type SimulationParameters } from '../core_engine/CoreSimulatorEngine.js';
+import { type IdentityAnalysis, type RcpAnalysis, type RequestAnalysis, type ResourceAnalysis, type ScpAnalysis } from '../evaluate.js';
+import { type AwsRequest } from '../request/request.js';
+import { type S3ServiceSettings } from './s3/s3BlockPublicAccess.js';
+export interface ServiceSettings {
+    /**
+     * S3-specific service settings.
+     */
+    s3?: S3ServiceSettings;
+}
+export interface ServiceAuthorizationRequest {
+    request: AwsRequest;
+    sessionAnalysis: IdentityAnalysis | undefined;
+    identityAnalysis: IdentityAnalysis;
+    scpAnalysis: ScpAnalysis;
+    resourceAnalysis: ResourceAnalysis;
+    resourcePolicy: PolicyWithName | undefined;
+    rcpAnalysis: RcpAnalysis;
+    permissionBoundaryAnalysis: IdentityAnalysis | undefined;
+    endpointAnalysis: IdentityAnalysis | undefined;
+    simulationParameters: SimulationParameters;
+    serviceSettings?: ServiceSettings;
+}
+export interface ServiceAuthorizer {
+    authorize(request: ServiceAuthorizationRequest): RequestAnalysis;
+}
+//# sourceMappingURL=ServiceAuthorizer.d.ts.map

package/dist/esm/services/ServiceAuthorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/ServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAEpE,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAA;CACvB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,UAAU,CAAA;IACnB,eAAe,EAAE,gBAAgB,GAAG,SAAS,CAAA;IAC7C,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,WAAW,EAAE,WAAW,CAAA;IACxB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAA;IAC1C,WAAW,EAAE,WAAW,CAAA;IACxB,0BAA0B,EAAE,gBAAgB,GAAG,SAAS,CAAA;IACxD,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAA;IAC9C,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe,CAAA;CACjE"}

package/dist/esm/services/ServiceAuthorizer.js

@@ -0,0 +1,5 @@
+import {} from '../core_engine/CoreSimulatorEngine.js';
+import {} from '../evaluate.js';
+import {} from '../request/request.js';
+import {} from './s3/s3BlockPublicAccess.js';
+//# sourceMappingURL=ServiceAuthorizer.js.map

package/dist/esm/services/ServiceAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/ServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EAMN,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAmB,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAA0B,MAAM,6BAA6B,CAAA"}

package/dist/esm/services/StsServiceAuthorizer.d.ts

@@ -0,0 +1,19 @@
+import { type RequestAnalysis, type ResourceAnalysis } from '../evaluate.js';
+import { type RequestResource } from '../request/requestResource.js';
+import { DefaultServiceAuthorizer, type PrincipalAccountTrust } from './DefaultServiceAuthorizer.js';
+import { type ServiceAuthorizationRequest } from './ServiceAuthorizer.js';
+/**
+ * The default authorizer for services.
+ */
+export declare class StsServiceAuthorizer extends DefaultServiceAuthorizer {
+    authorize(request: ServiceAuthorizationRequest): RequestAnalysis;
+    /**
+     * Determines if the service trusts the principal's Account's IAM policies
+     *
+     * @param sameAccount - If the principal and resource are in the same account
+     * @param resourceAnalysis - The resource policy analysis
+     * @returns how the service trusts the principal's account IAM policies
+     */
+    serviceTrustsPrincipalAccount(sameAccount: boolean, resourceAnalysis: ResourceAnalysis, resource: RequestResource): PrincipalAccountTrust;
+}
+//# sourceMappingURL=StsServiceAuthorizer.d.ts.map

package/dist/esm/services/StsServiceAuthorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAEzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChD,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IAchF;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAkBzB"}

package/dist/esm/services/StsServiceAuthorizer.js

@@ -0,0 +1,44 @@
+import {} from '../evaluate.js';
+import {} from '../request/requestResource.js';
+import { DefaultServiceAuthorizer } from './DefaultServiceAuthorizer.js';
+import {} from './ServiceAuthorizer.js';
+/**
+ * The default authorizer for services.
+ */
+export class StsServiceAuthorizer extends DefaultServiceAuthorizer {
+    authorize(request) {
+        if (request.request.action.value().toLowerCase() === 'sts:getcalleridentity' &&
+            request.request.principal.isAuthenticated()) {
+            return {
+                result: 'Allowed',
+                sameAccount: true,
+                conditions: undefined
+            };
+        }
+        return super.authorize(request);
+    }
+    /**
+     * Determines if the service trusts the principal's Account's IAM policies
+     *
+     * @param sameAccount - If the principal and resource are in the same account
+     * @param resourceAnalysis - The resource policy analysis
+     * @returns how the service trusts the principal's account IAM policies
+     */
+    serviceTrustsPrincipalAccount(sameAccount, resourceAnalysis, resource) {
+        //If there is no resource policy, the service trusts the principal's account IAM policies
+        if (sameAccount && resourceAnalysis.result === 'NotApplicable') {
+            return { trustType: 'Implicit' };
+        }
+        /*
+          If there is a resource policy, for instance a role trust policy,
+          the trust policy must explicitly allow the principal's account,
+          even if the principal and resource are in the same account.
+        */
+        const accountLevelStatements = this.accountLevelResourceAllowStatements(resourceAnalysis);
+        if (accountLevelStatements.length > 0) {
+            return { trustType: 'Explicit', statements: accountLevelStatements };
+        }
+        return { trustType: 'None' };
+    }
+}
+//# sourceMappingURL=StsServiceAuthorizer.js.map

package/dist/esm/services/StsServiceAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAwB,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAA8B,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAoC,MAAM,wBAAwB,CAAA;AAEzE;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,wBAAwB;IAChD,SAAS,CAAC,OAAoC;QAC5D,IACE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,KAAK,uBAAuB;YACxE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,EAC3C,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,yFAAyF;QACzF,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED;;;;UAIE;QACF,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF"}

package/dist/esm/services/s3/S3ServiceAuthorizer.d.ts

@@ -0,0 +1,24 @@
+import { type RequestAnalysis } from '../../evaluate.js';
+import { DefaultServiceAuthorizer } from '../DefaultServiceAuthorizer.js';
+import { type ServiceAuthorizationRequest } from '../ServiceAuthorizer.js';
+/**
+ * Service authorizer for S3 requests that applies S3 Block Public Access runtime behavior.
+ */
+export declare class S3ServiceAuthorizer extends DefaultServiceAuthorizer {
+    /**
+     * Authorizes an S3 request and applies RestrictPublicBuckets when the caller supplied
+     * S3 Block Public Access as enabled for the target bucket/account.
+     *
+     * @param request the service authorization request containing policy analyses and S3 settings
+     * @returns the final request analysis including an S3 BPA block when applicable
+     */
+    authorize(request: ServiceAuthorizationRequest): RequestAnalysis;
+}
+/**
+ * Checks whether a resource string is a standard S3 bucket or object ARN.
+ *
+ * @param resource the resource string to check
+ * @returns true if the resource is a standard S3 bucket/object ARN
+ */
+export declare function isStandardS3BucketResource(resource: string): boolean;
+//# sourceMappingURL=S3ServiceAuthorizer.d.ts.map

package/dist/esm/services/s3/S3ServiceAuthorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3ServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../../src/services/s3/S3ServiceAuthorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AACzE,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AAG1E;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,wBAAwB;IAC/D;;;;;;OAMG;IACa,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;CAyCjF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAuBpE"}

package/dist/esm/services/s3/S3ServiceAuthorizer.js

@@ -0,0 +1,76 @@
+import { isServicePrincipal } from '@actsecurity/iam-utils';
+import {} from '../../evaluate.js';
+import { DefaultServiceAuthorizer } from '../DefaultServiceAuthorizer.js';
+import {} from '../ServiceAuthorizer.js';
+import { classifyS3RuntimePublicBucketPolicy } from './s3BlockPublicAccess.js';
+/**
+ * Service authorizer for S3 requests that applies S3 Block Public Access runtime behavior.
+ */
+export class S3ServiceAuthorizer extends DefaultServiceAuthorizer {
+    /**
+     * Authorizes an S3 request and applies RestrictPublicBuckets when the caller supplied
+     * S3 Block Public Access as enabled for the target bucket/account.
+     *
+     * @param request the service authorization request containing policy analyses and S3 settings
+     * @returns the final request analysis including an S3 BPA block when applicable
+     */
+    authorize(request) {
+        const baseResult = super.authorize(request);
+        if (baseResult.result !== 'Allowed') {
+            return baseResult;
+        }
+        if (!isStandardS3BucketResource(request.request.resource.value())) {
+            return baseResult;
+        }
+        if (request.serviceSettings?.s3?.blockPublicAccess !== true) {
+            return baseResult;
+        }
+        if (!request.resourcePolicy) {
+            return baseResult;
+        }
+        const classification = classifyS3RuntimePublicBucketPolicy(request.resourcePolicy);
+        if (classification.result === 'nonPublic') {
+            return baseResult;
+        }
+        if (baseResult.sameAccount) {
+            return baseResult;
+        }
+        const principal = request.request.principal;
+        if (principal.isAuthenticated() && isServicePrincipal(principal.value())) {
+            return baseResult;
+        }
+        // The base result is Allowed here, so there are no prior blocking reasons to merge.
+        return {
+            ...baseResult,
+            result: 'ExplicitlyDenied',
+            blockedBy: ['s3-bpa'],
+            conditions: undefined
+        };
+    }
+}
+/**
+ * Checks whether a resource string is a standard S3 bucket or object ARN.
+ *
+ * @param resource the resource string to check
+ * @returns true if the resource is a standard S3 bucket/object ARN
+ */
+export function isStandardS3BucketResource(resource) {
+    if (resource === '*') {
+        return true;
+    }
+    const parts = resource.split(':');
+    if (parts.length < 6) {
+        return false;
+    }
+    const service = parts[2];
+    const region = parts[3];
+    const account = parts[4];
+    const resourcePart = parts.slice(5).join(':');
+    const bucketNamePattern = resourcePart.split('/')[0];
+    return (service === 's3' &&
+        region === '' &&
+        account === '' &&
+        resourcePart.length > 0 &&
+        bucketNamePattern.length > 0);
+}
+//# sourceMappingURL=S3ServiceAuthorizer.js.map

package/dist/esm/services/s3/S3ServiceAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3ServiceAuthorizer.js","sourceRoot":"","sources":["../../../../src/services/s3/S3ServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAwB,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AACzE,OAAO,EAAoC,MAAM,yBAAyB,CAAA;AAC1E,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAA;AAE9E;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,wBAAwB;IAC/D;;;;;;OAMG;IACa,SAAS,CAAC,OAAoC;QAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAE3C,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAClE,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,EAAE,EAAE,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC5D,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,MAAM,cAAc,GAAG,mCAAmC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;QAClF,IAAI,cAAc,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC1C,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAC3C,IAAI,SAAS,CAAC,eAAe,EAAE,IAAI,kBAAkB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YACzE,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,oFAAoF;QACpF,OAAO;YACL,GAAG,UAAU;YACb,MAAM,EAAE,kBAAkB;YAC1B,SAAS,EAAE,CAAC,QAAQ,CAAC;YACrB,UAAU,EAAE,SAAS;SACtB,CAAA;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACvB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACxB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7C,MAAM,iBAAiB,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAEpD,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,MAAM,KAAK,EAAE;QACb,OAAO,KAAK,EAAE;QACd,YAAY,CAAC,MAAM,GAAG,CAAC;QACvB,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAC7B,CAAA;AACH,CAAC"}

package/dist/esm/services/s3/s3BlockPublicAccess.d.ts

@@ -0,0 +1,50 @@
+import { type Policy } from '@actsecurity/iam-policy';
+/**
+ * Caller-supplied S3 Block Public Access settings for simulation.
+ */
+export interface S3ServiceSettings {
+    /**
+     * Whether S3 Block Public Access is enabled for the request target.
+     */
+    blockPublicAccess?: boolean;
+}
+/**
+ * Classification of a standard S3 bucket policy for runtime RestrictPublicBuckets behavior.
+ */
+export type S3RuntimePublicPolicyClassification = {
+    /**
+     * The bucket policy is public for runtime RestrictPublicBuckets behavior.
+     */
+    result: 'public';
+    /**
+     * Allow statements that make the policy public.
+     */
+    publicStatements: S3RuntimePublicStatement[];
+} | {
+    /**
+     * The bucket policy is not public for runtime RestrictPublicBuckets behavior.
+     */
+    result: 'nonPublic';
+};
+/**
+ * Identifies an Allow statement that makes a bucket policy public.
+ */
+export interface S3RuntimePublicStatement {
+    /**
+     * The 1-based statement index in the policy.
+     */
+    index: number;
+    /**
+     * The statement Sid, if present.
+     */
+    sid?: string;
+}
+/**
+ * Classifies a standard S3 bucket policy as public or non-public for runtime
+ * RestrictPublicBuckets behavior.
+ *
+ * @param policy the loaded S3 bucket policy to classify
+ * @returns whether the policy is runtime-public and, when public, the public statements
+ */
+export declare function classifyS3RuntimePublicBucketPolicy(policy: Policy<unknown>): S3RuntimePublicPolicyClassification;
+//# sourceMappingURL=s3BlockPublicAccess.d.ts.map

package/dist/esm/services/s3/s3BlockPublicAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3BlockPublicAccess.d.ts","sourceRoot":"","sources":["../../../../src/services/s3/s3BlockPublicAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAkB,MAAM,yBAAyB,CAAA;AAGrE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,MAAM,mCAAmC,GAC3C;IACE;;OAEG;IACH,MAAM,EAAE,QAAQ,CAAA;IAEhB;;OAEG;IACH,gBAAgB,EAAE,wBAAwB,EAAE,CAAA;CAC7C,GACD;IACE;;OAEG;IACH,MAAM,EAAE,WAAW,CAAA;CACpB,CAAA;AAEL;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GACtB,mCAAmC,CAWrC"}