@actsecurity/iam-simulate 0.1.173

package/dist/esm/services/s3/s3BlockPublicAccess.js

@@ -0,0 +1,299 @@
+import {} from '@actsecurity/iam-policy';
+import { splitArnParts } from '../../util.js';
+/**
+ * Classifies a standard S3 bucket policy as public or non-public for runtime
+ * RestrictPublicBuckets behavior.
+ *
+ * @param policy the loaded S3 bucket policy to classify
+ * @returns whether the policy is runtime-public and, when public, the public statements
+ */
+export function classifyS3RuntimePublicBucketPolicy(policy) {
+    const publicStatements = policy
+        .statements()
+        .filter((statement) => statement.isAllow() && statementIsRuntimePublic(statement))
+        .map((statement) => statementIdentifier(statement));
+    if (publicStatements.length > 0) {
+        return { result: 'public', publicStatements };
+    }
+    return { result: 'nonPublic' };
+}
+/**
+ * Determines whether an individual Allow statement makes a bucket policy runtime-public.
+ *
+ * @param statement the statement to classify
+ * @returns true if the statement is public for runtime RestrictPublicBuckets behavior
+ */
+function statementIsRuntimePublic(statement) {
+    if (!statement.isPrincipalStatement()) {
+        return true;
+    }
+    const principals = statement.principals();
+    if (principals.some((principal) => principal.isWildcardPrincipal())) {
+        return !hasPublicAccessLimitingCondition(statement);
+    }
+    return false;
+}
+/**
+ * Gets the statement index and Sid for classifier output.
+ *
+ * @param statement the statement to identify
+ * @returns the statement index and optional Sid
+ */
+function statementIdentifier(statement) {
+    return {
+        index: statement.index(),
+        ...(statement.sid() ? { sid: statement.sid() } : {})
+    };
+}
+/**
+ * Determines whether a wildcard-principal statement has a condition that limits access
+ * enough to be non-public for S3 BPA runtime classification.
+ *
+ * @param statement the wildcard-principal statement to inspect
+ * @returns true if a supported condition makes the statement non-public
+ */
+function hasPublicAccessLimitingCondition(statement) {
+    const conditionMap = statement.conditionMap();
+    if (!conditionMap) {
+        return false;
+    }
+    return (hasFixedValueCondition(conditionMap, 'aws:PrincipalOrgID') ||
+        hasFixedValueCondition(conditionMap, 'aws:PrincipalAccount') ||
+        hasPrincipalArnLimitingCondition(conditionMap) ||
+        hasOrgPathLimitingCondition(conditionMap, 'aws:PrincipalOrgPaths') ||
+        hasAwsServicePrincipalLimitingCondition(conditionMap) ||
+        hasPrincipalServiceNameLimitingCondition(conditionMap) ||
+        hasUseridLimitingCondition(conditionMap) ||
+        hasFixedValueCondition(conditionMap, 'aws:SourceVpce') ||
+        hasFixedValueCondition(conditionMap, 'aws:SourceVpc') ||
+        hasSourceVpcArnLimitingCondition(conditionMap) ||
+        hasFixedValueCondition(conditionMap, 'aws:VpceAccount') ||
+        hasFixedValueCondition(conditionMap, 'aws:VpceOrgID') ||
+        hasOrgPathLimitingCondition(conditionMap, 'aws:VpceOrgPaths') ||
+        hasSourceIpLimitingCondition(conditionMap) ||
+        hasFixedArnCondition(conditionMap, 'aws:SourceArn') ||
+        hasFixedValueCondition(conditionMap, 'aws:SourceAccount'));
+}
+/**
+ * Checks for exact fixed-value conditions for account, org, VPC, and similar keys.
+ *
+ * @param conditionMap the statement condition map
+ * @param key the condition key to inspect
+ * @returns true if the key is constrained to fixed values by supported operators
+ */
+function hasFixedValueCondition(conditionMap, key) {
+    return conditionEntries(conditionMap, key).some(({ operator, values }) => ['StringEquals', 'StringEqualsIgnoreCase', 'ForAnyValue:StringEquals'].includes(operator) ||
+        (operator === 'StringLike' && values.every((value) => !hasWildcard(value))));
+}
+/**
+ * Checks for public-access-limiting aws:PrincipalArn conditions.
+ *
+ * @param conditionMap the statement condition map
+ * @returns true if PrincipalArn is constrained to a fixed account principal pattern
+ */
+function hasPrincipalArnLimitingCondition(conditionMap) {
+    return conditionEntries(conditionMap, 'aws:PrincipalArn').some(({ operator, values }) => {
+        if (operator === 'ArnEquals') {
+            return values.every(isArnWithFixedAccount);
+        }
+        if (operator === 'ArnLike') {
+            return values.every((value) => isArnWithFixedAccount(value) && arnWildcardOnlyInResource(value));
+        }
+        return false;
+    });
+}
+/**
+ * Checks for exact SourceVpcArn conditions.
+ *
+ * @param conditionMap the statement condition map
+ * @returns true if SourceVpcArn is constrained to exact ARNs
+ */
+function hasSourceVpcArnLimitingCondition(conditionMap) {
+    return hasFixedArnCondition(conditionMap, 'aws:SourceVpcArn');
+}
+/**
+ * Checks for fixed ARN conditions.
+ *
+ * @param conditionMap the statement condition map
+ * @param key the condition key to inspect
+ * @returns true if the key is constrained to fixed ARN values
+ */
+function hasFixedArnCondition(conditionMap, key) {
+    return conditionEntries(conditionMap, key).some(({ operator, values }) => operator === 'ArnEquals' && values.every(isArnWithFixedAccount));
+}
+/**
+ * Checks for AWS Organizations path conditions with fixed org path prefixes.
+ *
+ * @param conditionMap the statement condition map
+ * @param key the condition key to inspect
+ * @returns true if the path condition is fixed or uses a documented suffix wildcard shape
+ */
+function hasOrgPathLimitingCondition(conditionMap, key) {
+    return conditionEntries(conditionMap, key).some(({ operator, values }) => {
+        if (operator === 'StringEquals') {
+            return values.every(isFixedOrgPath);
+        }
+        if (operator === 'StringLike') {
+            return values.every(isFixedOrgPathWithOptionalSuffixWildcard);
+        }
+        return false;
+    });
+}
+/**
+ * Checks for conditions that limit access to AWS service principals.
+ *
+ * @param conditionMap the statement condition map
+ * @returns true if the statement is limited to AWS service principals
+ */
+function hasAwsServicePrincipalLimitingCondition(conditionMap) {
+    return conditionEntries(conditionMap, 'aws:PrincipalIsAWSService').some(({ operator, values }) => ['Bool', 'StringEquals', 'StringEqualsIgnoreCase', 'StringLike'].includes(operator) &&
+        values.every((value) => value.toLowerCase() === 'true'));
+}
+/**
+ * Checks for service-principal name conditions.
+ *
+ * @param conditionMap the statement condition map
+ * @returns true if the statement is limited to service principal names
+ */
+function hasPrincipalServiceNameLimitingCondition(conditionMap) {
+    return ['aws:PrincipalServiceName', 'aws:PrincipalServiceNamesList'].some((key) => conditionEntries(conditionMap, key).some(({ operator, values }) => {
+        return ([
+            'StringEquals',
+            'ForAnyValue:StringEquals',
+            'StringLike',
+            'ForAnyValue:StringLike'
+        ].includes(operator) && values.every(isServiceNamePattern));
+    }));
+}
+/**
+ * Checks for aws:userid conditions with a fixed stable ID prefix.
+ *
+ * @param conditionMap the statement condition map
+ * @returns true if userid is constrained to exact values or fixed-prefix session suffix wildcards
+ */
+function hasUseridLimitingCondition(conditionMap) {
+    return conditionEntries(conditionMap, 'aws:userid').some(({ operator, values }) => {
+        if (operator === 'StringEquals') {
+            return values.every((value) => !hasWildcard(value));
+        }
+        if (operator === 'StringLike') {
+            return values.every((value) => /^[A-Z0-9]+:\*$/.test(value));
+        }
+        return false;
+    });
+}
+/**
+ * Checks for sufficiently narrow aws:SourceIp conditions.
+ *
+ * @param conditionMap the statement condition map
+ * @returns true if SourceIp ranges are narrow enough to be non-public
+ */
+function hasSourceIpLimitingCondition(conditionMap) {
+    return conditionEntries(conditionMap, 'aws:SourceIp').some(({ operator, values }) => operator === 'IpAddress' && values.every(sourceIpRangeIsNonPublic));
+}
+/**
+ * Gets condition entries for a key using case-insensitive key matching.
+ *
+ * @param conditionMap the statement condition map
+ * @param key the condition key to inspect
+ * @returns matching condition entries
+ */
+function conditionEntries(conditionMap, key) {
+    const entries = [];
+    for (const [operator, keyValues] of Object.entries(conditionMap)) {
+        for (const [conditionKey, values] of Object.entries(keyValues)) {
+            if (conditionKey.toLowerCase() === key.toLowerCase()) {
+                entries.push({ operator, values });
+            }
+        }
+    }
+    return entries;
+}
+/**
+ * Checks whether an ARN pattern has a fixed account component.
+ *
+ * @param value the ARN or ARN pattern to inspect
+ * @returns true if the account component is fixed and non-wildcard
+ */
+function isArnWithFixedAccount(value) {
+    const arn = splitArnParts(value);
+    return !!arn.accountId && !hasWildcard(arn.accountId);
+}
+/**
+ * Checks whether ARN wildcards are limited to the resource component.
+ *
+ * @param value the ARN pattern to inspect
+ * @returns true if partition, service, region, and account are fixed
+ */
+function arnWildcardOnlyInResource(value) {
+    const arn = splitArnParts(value);
+    return ![arn.partition, arn.service, arn.region, arn.accountId].some((part) => part ? hasWildcard(part) : false);
+}
+/**
+ * Checks whether a string has IAM wildcard characters.
+ *
+ * @param value the value to inspect
+ * @returns true if the value contains `*` or `?`
+ */
+function hasWildcard(value) {
+    return value.includes('*') || value.includes('?');
+}
+/**
+ * Checks whether an Organizations path has a fixed org/root path prefix.
+ *
+ * @param value the org path value to inspect
+ * @returns true if the value is fixed and starts with an org path
+ */
+function isFixedOrgPath(value) {
+    return /^o-[a-z0-9]+\/[^*?]+/.test(value) && !hasWildcard(value);
+}
+/**
+ * Checks whether an Organizations path is fixed or uses a suffix wildcard.
+ *
+ * @param value the org path value to inspect
+ * @returns true if the value has a fixed org path prefix and optional trailing wildcard
+ */
+function isFixedOrgPathWithOptionalSuffixWildcard(value) {
+    if (!value.endsWith('*')) {
+        return isFixedOrgPath(value);
+    }
+    const prefix = value.slice(0, -1);
+    return /^o-[a-z0-9]+\/[^*?]+/.test(prefix) && !hasWildcard(prefix);
+}
+/**
+ * Checks whether a value is an AWS service-name pattern.
+ *
+ * @param value the service name or pattern to inspect
+ * @returns true if the value is an amazonaws.com service name pattern
+ */
+function isServiceNamePattern(value) {
+    return /^([a-z0-9-]+|\*)\.(amazonaws\.com|amazonaws\.com\.cn)$/.test(value);
+}
+/**
+ * Determines whether a SourceIp CIDR is narrow/private enough to be non-public.
+ *
+ * @param cidr the CIDR value to inspect
+ * @returns true if the CIDR is non-public for S3 BPA classification
+ */
+function sourceIpRangeIsNonPublic(cidr) {
+    const [address, prefixString] = cidr.split('/');
+    const prefix = Number(prefixString);
+    if (!address || !Number.isInteger(prefix)) {
+        return false;
+    }
+    if (address.includes(':')) {
+        return prefix >= 32;
+    }
+    const firstOctet = Number(address.split('.')[0]);
+    const secondOctet = Number(address.split('.')[1]);
+    if (!Number.isInteger(firstOctet) || !Number.isInteger(secondOctet)) {
+        return false;
+    }
+    if (firstOctet === 10 ||
+        (firstOctet === 172 && secondOctet >= 16 && secondOctet <= 31) ||
+        (firstOctet === 192 && secondOctet === 168)) {
+        return true;
+    }
+    return prefix >= 8;
+}
+//# sourceMappingURL=s3BlockPublicAccess.js.map

package/dist/esm/services/s3/s3BlockPublicAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3BlockPublicAccess.js","sourceRoot":"","sources":["../../../../src/services/s3/s3BlockPublicAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAiD7C;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,MAAuB;IAEvB,MAAM,gBAAgB,GAAG,MAAM;SAC5B,UAAU,EAAE;SACZ,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,wBAAwB,CAAC,SAAS,CAAC,CAAC;SACjF,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAA;IAErD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAA;IAC/C,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,SAAoB;IACpD,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,SAAoB;IAC/C,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE;QACxB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gCAAgC,CAAC,SAAoB;IAC5D,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,EAAE,CAAA;IAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,CACL,sBAAsB,CAAC,YAAY,EAAE,oBAAoB,CAAC;QAC1D,sBAAsB,CAAC,YAAY,EAAE,sBAAsB,CAAC;QAC5D,gCAAgC,CAAC,YAAY,CAAC;QAC9C,2BAA2B,CAAC,YAAY,EAAE,uBAAuB,CAAC;QAClE,uCAAuC,CAAC,YAAY,CAAC;QACrD,wCAAwC,CAAC,YAAY,CAAC;QACtD,0BAA0B,CAAC,YAAY,CAAC;QACxC,sBAAsB,CAAC,YAAY,EAAE,gBAAgB,CAAC;QACtD,sBAAsB,CAAC,YAAY,EAAE,eAAe,CAAC;QACrD,gCAAgC,CAAC,YAAY,CAAC;QAC9C,sBAAsB,CAAC,YAAY,EAAE,iBAAiB,CAAC;QACvD,sBAAsB,CAAC,YAAY,EAAE,eAAe,CAAC;QACrD,2BAA2B,CAAC,YAAY,EAAE,kBAAkB,CAAC;QAC7D,4BAA4B,CAAC,YAAY,CAAC;QAC1C,oBAAoB,CAAC,YAAY,EAAE,eAAe,CAAC;QACnD,sBAAsB,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAC1D,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAC7B,YAAsD,EACtD,GAAW;IAEX,OAAO,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAC7C,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CACvB,CAAC,cAAc,EAAE,wBAAwB,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzF,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAC9E,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,gCAAgC,CACvC,YAAsD;IAEtD,OAAO,gBAAgB,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;QACtF,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAA;QAC5C,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,KAAK,CACjB,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAC5E,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,gCAAgC,CACvC,YAAsD;IAEtD,OAAO,oBAAoB,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,YAAsD,EACtD,GAAW;IAEX,OAAO,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAC7C,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAC1F,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B,CAClC,YAAsD,EACtD,GAAW;IAEX,OAAO,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;QACvE,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QACD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC/D,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,uCAAuC,CAC9C,YAAsD;IAEtD,OAAO,gBAAgB,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC,IAAI,CACrE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CACvB,CAAC,MAAM,EAAE,cAAc,EAAE,wBAAwB,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnF,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAC1D,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,wCAAwC,CAC/C,YAAsD;IAEtD,OAAO,CAAC,0BAA0B,EAAE,+BAA+B,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAChF,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;QAChE,OAAO,CACL;YACE,cAAc;YACd,0BAA0B;YAC1B,YAAY;YACZ,wBAAwB;SACzB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAC3D,CAAA;IACH,CAAC,CAAC,CACH,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CACjC,YAAsD;IAEtD,OAAO,gBAAgB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;QAChF,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,4BAA4B,CACnC,YAAsD;IAEtD,OAAO,gBAAgB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,IAAI,CACxD,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAC7F,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,YAAsD,EACtD,GAAW;IAEX,MAAM,OAAO,GAAkD,EAAE,CAAA;IACjE,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,KAAK,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/D,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IAChC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,KAAa;IAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IAChC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5E,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CACjC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,wCAAwC,CAAC,KAAa;IAC7D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,cAAc,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACjC,OAAO,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,wDAAwD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;IACnC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,IAAI,EAAE,CAAA;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IACE,UAAU,KAAK,EAAE;QACjB,CAAC,UAAU,KAAK,GAAG,IAAI,WAAW,IAAI,EAAE,IAAI,WAAW,IAAI,EAAE,CAAC;QAC9D,CAAC,UAAU,KAAK,GAAG,IAAI,WAAW,KAAK,GAAG,CAAC,EAC3C,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,MAAM,IAAI,CAAC,CAAA;AACpB,CAAC"}

package/dist/esm/simulation_engine/contextKeys.d.ts

@@ -0,0 +1,13 @@
+import { type ResourceType } from '@actsecurity/iam-data';
+/**
+ * Get the allowed context keys for a request.
+ *
+ * @param service The service the action belongs to
+ * @param action The action to get the allowed context keys for
+ * @param resource The resource the action is being performed on
+ * @param bucketAbacEnabled Whether ABAC is enabled on the S3 bucket (only applies to S3)
+ * @returns The allowed context keys for the request as lower case strings
+ * @throws error if the service or action does not exist
+ */
+export declare function allowedContextKeysForRequest(service: string, action: string, resource: string, bucketAbacEnabled: boolean, suggestedResourceType: ResourceType | undefined): Promise<string[]>;
+//# sourceMappingURL=contextKeys.d.ts.map

package/dist/esm/simulation_engine/contextKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/contextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAA;AAI9B;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,iBAAiB,EAAE,OAAO,EAC1B,qBAAqB,EAAE,YAAY,GAAG,SAAS,GAC9C,OAAO,CAAC,MAAM,EAAE,CAAC,CAwCnB"}

package/dist/esm/simulation_engine/contextKeys.js

@@ -0,0 +1,55 @@
+import { getAllGlobalConditionKeys, iamActionDetails } from '@actsecurity/iam-data';
+import { isS3BucketOrObjectArn, isWildcardOnlyAction, lowerCaseAll } from '../util.js';
+import { getResourceTypesForAction } from './resourceTypes.js';
+/**
+ * Get the allowed context keys for a request.
+ *
+ * @param service The service the action belongs to
+ * @param action The action to get the allowed context keys for
+ * @param resource The resource the action is being performed on
+ * @param bucketAbacEnabled Whether ABAC is enabled on the S3 bucket (only applies to S3)
+ * @returns The allowed context keys for the request as lower case strings
+ * @throws error if the service or action does not exist
+ */
+export async function allowedContextKeysForRequest(service, action, resource, bucketAbacEnabled, suggestedResourceType) {
+    const actionDetails = await iamActionDetails(service, action);
+    const actionConditionKeys = lowerCaseAll(actionDetails.conditionKeys);
+    const isWildCardOnly = await isWildcardOnlyAction(service, action);
+    if (isWildCardOnly) {
+        return [...actionConditionKeys, ...lowerCaseGlobalConditionKeys()];
+    }
+    let resourceType = suggestedResourceType;
+    if (!resourceType) {
+        const resourceTypes = await getResourceTypesForAction(service, action, resource);
+        if (resourceTypes.length === 0) {
+            throw new Error(`No resource types found for action ${action} on service ${service}`);
+        }
+        else if (resourceTypes.length > 1) {
+            throw new Error(`Multiple resource types found for action ${action} on service ${service}`);
+        }
+        resourceType = resourceTypes[0];
+    }
+    const resourceTypeConditions = [
+        ...(resourceType.conditionKeys ?? []),
+        ...(actionDetails.resourceTypes.find((rt) => rt.name === resourceType.key)?.conditionKeys ??
+            [])
+    ];
+    const allKeys = [
+        ...lowerCaseAll(resourceTypeConditions),
+        ...actionConditionKeys,
+        ...lowerCaseGlobalConditionKeys()
+    ];
+    if (!isS3BucketOrObjectArn(resource) || bucketAbacEnabled) {
+        return allKeys;
+    }
+    // Filter out S3 ABAC keys if bucket ABAC is not enabled
+    return allKeys.filter((key) => !key.startsWith('aws:resourcetag/') && !key.startsWith('s3:buckettag/'));
+}
+let lowerCaseConditionKeys;
+function lowerCaseGlobalConditionKeys() {
+    if (!lowerCaseConditionKeys) {
+        lowerCaseConditionKeys = getAllGlobalConditionKeys().map((k) => k.toLowerCase());
+    }
+    return lowerCaseConditionKeys;
+}
+//# sourceMappingURL=contextKeys.js.map

package/dist/esm/simulation_engine/contextKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/simulation_engine/contextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAEjB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAE9D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,MAAc,EACd,QAAgB,EAChB,iBAA0B,EAC1B,qBAA+C;IAE/C,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7D,MAAM,mBAAmB,GAAG,YAAY,CAAC,aAAa,CAAC,aAAa,CAAC,CAAA;IAErE,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClE,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,mBAAmB,EAAE,GAAG,4BAA4B,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,IAAI,YAAY,GAAG,qBAAqB,CAAA;IACxC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAChF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,eAAe,OAAO,EAAE,CAAC,CAAA;QACvF,CAAC;aAAM,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,eAAe,OAAO,EAAE,CAAC,CAAA;QAC7F,CAAC;QACD,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,sBAAsB,GAAG;QAC7B,GAAG,CAAC,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC;QACrC,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,YAAa,CAAC,GAAG,CAAC,EAAE,aAAa;YACxF,EAAE,CAAC;KACN,CAAA;IAED,MAAM,OAAO,GAAG;QACd,GAAG,YAAY,CAAC,sBAAsB,CAAC;QACvC,GAAG,mBAAmB;QACtB,GAAG,4BAA4B,EAAE;KAClC,CAAA;IAED,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAC1D,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,wDAAwD;IACxD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CACjF,CAAA;AACH,CAAC;AAED,IAAI,sBAA4C,CAAA;AAChD,SAAS,4BAA4B;IACnC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,sBAAsB,GAAG,yBAAyB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,OAAO,sBAAsB,CAAA;AAC/B,CAAC"}

package/dist/esm/simulation_engine/overallResult.d.ts

@@ -0,0 +1,13 @@
+import type { EvaluationResult } from '../evaluate.js';
+import type { SimulationResourceResult } from './simulationEngine.js';
+/**
+ * Calculates the overall evaluation result from multiple simulation resource results.
+ *
+ * @param results Array of simulation resource results to evaluate
+ * @returns The overall evaluation result following AWS IAM evaluation logic:
+ *   - 'Allowed' if any result is allowed
+ *   - 'ExplicitlyDenied' if all results are explicitly denied
+ *   - 'ImplicitlyDenied' for all other cases (including empty results)
+ */
+export declare function calculateOverallResult(results: SimulationResourceResult[]): EvaluationResult;
+//# sourceMappingURL=overallResult.d.ts.map

package/dist/esm/simulation_engine/overallResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"overallResult.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/overallResult.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAErE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,EAAE,GAAG,gBAAgB,CAyB5F"}

package/dist/esm/simulation_engine/overallResult.js

@@ -0,0 +1,32 @@
+/**
+ * Calculates the overall evaluation result from multiple simulation resource results.
+ *
+ * @param results Array of simulation resource results to evaluate
+ * @returns The overall evaluation result following AWS IAM evaluation logic:
+ *   - 'Allowed' if any result is allowed
+ *   - 'ExplicitlyDenied' if all results are explicitly denied
+ *   - 'ImplicitlyDenied' for all other cases (including empty results)
+ */
+export function calculateOverallResult(results) {
+    if (results.length === 0) {
+        return 'ImplicitlyDenied';
+    }
+    let hasExplicitlyDenied = false;
+    let hasImplicitlyDenied = false;
+    for (const result of results) {
+        const evaluationResult = result.analysis?.result;
+        if (evaluationResult === 'Allowed') {
+            return 'Allowed';
+        }
+        if (evaluationResult === 'ExplicitlyDenied') {
+            hasExplicitlyDenied = true;
+            continue;
+        }
+        hasImplicitlyDenied = true;
+    }
+    if (hasExplicitlyDenied && !hasImplicitlyDenied) {
+        return 'ExplicitlyDenied';
+    }
+    return 'ImplicitlyDenied';
+}
+//# sourceMappingURL=overallResult.js.map

package/dist/esm/simulation_engine/overallResult.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overallResult.js","sourceRoot":"","sources":["../../../src/simulation_engine/overallResult.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAmC;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IAED,IAAI,mBAAmB,GAAG,KAAK,CAAA;IAC/B,IAAI,mBAAmB,GAAG,KAAK,CAAA;IAE/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAA;QAChD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,gBAAgB,KAAK,kBAAkB,EAAE,CAAC;YAC5C,mBAAmB,GAAG,IAAI,CAAA;YAC1B,SAAQ;QACV,CAAC;QACD,mBAAmB,GAAG,IAAI,CAAA;IAC5B,CAAC;IAED,IAAI,mBAAmB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IAED,OAAO,kBAAkB,CAAA;AAC3B,CAAC"}

package/dist/esm/simulation_engine/policyResources.d.ts

@@ -0,0 +1,44 @@
+import { type ResourceType } from '@actsecurity/iam-data';
+import { type Statement } from '@actsecurity/iam-policy';
+import { type PolicyWithName } from '../core_engine/CoreSimulatorEngine.js';
+/**
+ * Extracts matching resource strings from a set of policies for a given action and resource pattern.
+ *
+ * @param policies Array of policies to search through (undefined entries are skipped)
+ * @param action The action to match against policy statements
+ * @param resourceType The resource type to filter resource strings by
+ * @param resourceArnPattern The resource ARN pattern to match against
+ * @param shouldExpandShortArns Whether to expand short ARNs (fewer than 6 segments) by padding with wildcards
+ * @returns Array of unique resource strings that match the criteria
+ */
+export declare function getMatchingResourceStringsForPolicies(policies: (PolicyWithName | undefined)[], action: string, resourceType: ResourceType, resourceArnPattern: string, shouldExpandShortArns: boolean): string[];
+/**
+ * Extracts resource strings from a single policy statement that allows the specified action.
+ *
+ * @param statement The policy statement to analyze
+ * @param action The action to check if the statement allows
+ * @param resourceType The resource type to filter by
+ * @param resourceArnPattern The resource ARN pattern to match
+ * @param shouldExpandShortArns Whether to expand short ARNs (fewer than 6 segments) by padding with wildcards
+ * @returns Array of resource strings from the statement, or empty array if statement doesn't allow the action
+ */
+export declare function getResourceStringsFromStatement(statement: Statement, action: string, resourceType: ResourceType, resourceArnPattern: string, shouldExpandShortArns: boolean): string[];
+/**
+ * Extracts resource strings from a statement's Resource or NotResource elements that match the given criteria.
+ *
+ * @param statement The policy statement to analyze
+ * @param resourceType The resource type to filter by
+ * @param resourceArnPattern The resource ARN pattern to check for overlap
+ * @param shouldExpandShortArns Whether to expand short ARNs (fewer than 6 segments) by padding with wildcards
+ * @returns Array of matching resource strings, or ['*'] for certain NotResource cases
+ */
+export declare function statementResourceStringsForResourceTypeAndPattern(statement: Statement, resourceType: ResourceType, resourceArnPattern: string, shouldExpandShortArns: boolean): string[];
+/**
+ * Determines if a policy statement allows the specified action.
+ *
+ * @param statement The policy statement to check
+ * @param action The action to test against the statement
+ * @returns true if the statement allows the action, false otherwise
+ */
+export declare function statementAllowsAction(statement: Statement, action: string): boolean;
+//# sourceMappingURL=policyResources.d.ts.map

package/dist/esm/simulation_engine/policyResources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyResources.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/policyResources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAMxD,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAG3E;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CACnD,QAAQ,EAAE,CAAC,cAAc,GAAG,SAAS,CAAC,EAAE,EACxC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,OAAO,GAC7B,MAAM,EAAE,CAoBV;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,OAAO,GAC7B,MAAM,EAAE,CAUV;AAED;;;;;;;;GAQG;AACH,wBAAgB,iDAAiD,CAC/D,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,OAAO,GAC7B,MAAM,EAAE,CAkCV;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBnF"}

package/dist/esm/simulation_engine/policyResources.js

@@ -0,0 +1,117 @@
+import {} from '@actsecurity/iam-data';
+import {} from '@actsecurity/iam-policy';
+import { actionMatchesPattern, resourceArnWithWildcardsToRegex, resourceStringMatchesResourceTypePattern } from '@actsecurity/iam-utils';
+import {} from '../core_engine/CoreSimulatorEngine.js';
+import { expandShortArn, resourceArnsOverlap } from '../util/resourceStrings.js';
+/**
+ * Extracts matching resource strings from a set of policies for a given action and resource pattern.
+ *
+ * @param policies Array of policies to search through (undefined entries are skipped)
+ * @param action The action to match against policy statements
+ * @param resourceType The resource type to filter resource strings by
+ * @param resourceArnPattern The resource ARN pattern to match against
+ * @param shouldExpandShortArns Whether to expand short ARNs (fewer than 6 segments) by padding with wildcards
+ * @returns Array of unique resource strings that match the criteria
+ */
+export function getMatchingResourceStringsForPolicies(policies, action, resourceType, resourceArnPattern, shouldExpandShortArns) {
+    const resourceStrings = new Set();
+    for (const policy of policies) {
+        if (!policy) {
+            continue;
+        }
+        for (const statement of policy.statements()) {
+            const stmtResourceStrings = getResourceStringsFromStatement(statement, action, resourceType, resourceArnPattern, shouldExpandShortArns);
+            for (const rs of stmtResourceStrings) {
+                resourceStrings.add(rs);
+            }
+        }
+    }
+    return Array.from(resourceStrings);
+}
+/**
+ * Extracts resource strings from a single policy statement that allows the specified action.
+ *
+ * @param statement The policy statement to analyze
+ * @param action The action to check if the statement allows
+ * @param resourceType The resource type to filter by
+ * @param resourceArnPattern The resource ARN pattern to match
+ * @param shouldExpandShortArns Whether to expand short ARNs (fewer than 6 segments) by padding with wildcards
+ * @returns Array of resource strings from the statement, or empty array if statement doesn't allow the action
+ */
+export function getResourceStringsFromStatement(statement, action, resourceType, resourceArnPattern, shouldExpandShortArns) {
+    if (statementAllowsAction(statement, action)) {
+        return statementResourceStringsForResourceTypeAndPattern(statement, resourceType, resourceArnPattern, shouldExpandShortArns);
+    }
+    return [];
+}
+/**
+ * Extracts resource strings from a statement's Resource or NotResource elements that match the given criteria.
+ *
+ * @param statement The policy statement to analyze
+ * @param resourceType The resource type to filter by
+ * @param resourceArnPattern The resource ARN pattern to check for overlap
+ * @param shouldExpandShortArns Whether to expand short ARNs (fewer than 6 segments) by padding with wildcards
+ * @returns Array of matching resource strings, or ['*'] for certain NotResource cases
+ */
+export function statementResourceStringsForResourceTypeAndPattern(statement, resourceType, resourceArnPattern, shouldExpandShortArns) {
+    if (statement.isResourceStatement() && statement.isAllow()) {
+        const resourceStrings = [];
+        for (const stmtResource of statement.resources()) {
+            const effectiveValue = shouldExpandShortArns
+                ? expandShortArn(stmtResource.value())
+                : stmtResource.value();
+            if (resourceStringMatchesResourceTypePattern(effectiveValue, resourceType.arn)) {
+                if (resourceArnsOverlap(resourceArnPattern, effectiveValue)) {
+                    resourceStrings.push(stmtResource.value());
+                }
+            }
+        }
+        return resourceStrings;
+    }
+    if (statement.isNotResourceStatement() && statement.isAllow()) {
+        for (const stmtNotResource of statement.notResources()) {
+            const effectiveValue = shouldExpandShortArns
+                ? expandShortArn(stmtNotResource.value())
+                : stmtNotResource.value();
+            // If any NotResource string equals or is a superset of the resource type pattern, then the statement does not apply to the string. Otherwise, it should return the string '*'
+            if (effectiveValue === resourceArnPattern ||
+                isResourceArnSuperset(effectiveValue, resourceArnPattern)) {
+                return [];
+            }
+        }
+        return ['*'];
+    }
+    // If it's a statement that has no Resource or NotResource such as a trust policy, just return the original pattern
+    return [resourceArnPattern];
+}
+/**
+ * Determines if a policy statement allows the specified action.
+ *
+ * @param statement The policy statement to check
+ * @param action The action to test against the statement
+ * @returns true if the statement allows the action, false otherwise
+ */
+export function statementAllowsAction(statement, action) {
+    if (statement.isActionStatement() && statement.isAllow()) {
+        for (const stmtAction of statement.actions()) {
+            if (actionMatchesPattern(action, stmtAction.value())) {
+                return true;
+            }
+        }
+        return false;
+    }
+    else if (statement.isNotActionStatement() && statement.isAllow()) {
+        for (const stmtAction of statement.notActions()) {
+            if (actionMatchesPattern(action, stmtAction.value())) {
+                return false;
+            }
+        }
+        return true;
+    }
+    return false;
+}
+function isResourceArnSuperset(arnSuperset, arnSubset) {
+    const regexSuperset = resourceArnWithWildcardsToRegex(arnSuperset);
+    return regexSuperset.test(arnSubset);
+}
+//# sourceMappingURL=policyResources.js.map

package/dist/esm/simulation_engine/policyResources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyResources.js","sourceRoot":"","sources":["../../../src/simulation_engine/policyResources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAkB,MAAM,yBAAyB,CAAA;AACxD,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,wCAAwC,EACzC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAuB,MAAM,uCAAuC,CAAA;AAC3E,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhF;;;;;;;;;GASG;AACH,MAAM,UAAU,qCAAqC,CACnD,QAAwC,EACxC,MAAc,EACd,YAA0B,EAC1B,kBAA0B,EAC1B,qBAA8B;IAE9B,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAA;IACzC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YAC5C,MAAM,mBAAmB,GAAG,+BAA+B,CACzD,SAAS,EACT,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,CACtB,CAAA;YACD,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;gBACrC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAC7C,SAAoB,EACpB,MAAc,EACd,YAA0B,EAC1B,kBAA0B,EAC1B,qBAA8B;IAE9B,IAAI,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7C,OAAO,iDAAiD,CACtD,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,CACtB,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iDAAiD,CAC/D,SAAoB,EACpB,YAA0B,EAC1B,kBAA0B,EAC1B,qBAA8B;IAE9B,IAAI,SAAS,CAAC,mBAAmB,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,MAAM,eAAe,GAAa,EAAE,CAAA;QACpC,KAAK,MAAM,YAAY,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YACjD,MAAM,cAAc,GAAG,qBAAqB;gBAC1C,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACtC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAA;YACxB,IAAI,wCAAwC,CAAC,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/E,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAAE,CAAC;oBAC5D,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAA;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,IAAI,SAAS,CAAC,sBAAsB,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9D,KAAK,MAAM,eAAe,IAAI,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;YACvD,MAAM,cAAc,GAAG,qBAAqB;gBAC1C,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;gBACzC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAA;YAC3B,8KAA8K;YAC9K,IACE,cAAc,KAAK,kBAAkB;gBACrC,qBAAqB,CAAC,cAAc,EAAE,kBAAkB,CAAC,EACzD,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IAED,mHAAmH;IACnH,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAoB,EAAE,MAAc;IACxE,IAAI,SAAS,CAAC,iBAAiB,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,KAAK,MAAM,UAAU,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;SAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QACnE,KAAK,MAAM,UAAU,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;YAChD,IAAI,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;gBACrD,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAmB,EAAE,SAAiB;IACnE,MAAM,aAAa,GAAG,+BAA+B,CAAC,WAAW,CAAC,CAAA;IAClE,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACtC,CAAC"}

package/dist/esm/simulation_engine/resourceTypes.d.ts

@@ -0,0 +1,11 @@
+import { type ResourceType } from '@actsecurity/iam-data';
+/**
+ * Get the the possible resource types for an action and resource
+ *
+ * @param service the service the action belongs to
+ * @param action the action to get the resource type for
+ * @param resource the resource type matching the action, if any
+ * @throws an error if the service or action does not exist, or if the action is a wildcard only action
+ */
+export declare function getResourceTypesForAction(service: string, action: string, resource: string): Promise<ResourceType[]>;
+//# sourceMappingURL=resourceTypes.d.ts.map

package/dist/esm/simulation_engine/resourceTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceTypes.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/resourceTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAA;AAG9B;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CAiBzB"}