@actsecurity/iam-simulate 0.1.173

package/dist/esm/simulation_engine/resourceTypes.js

@@ -0,0 +1,23 @@
+import { iamActionDetails, iamResourceTypeDetails } from '@actsecurity/iam-data';
+import { mostSpecificMatchingResourceTypePatterns } from '@actsecurity/iam-utils';
+/**
+ * Get the the possible resource types for an action and resource
+ *
+ * @param service the service the action belongs to
+ * @param action the action to get the resource type for
+ * @param resource the resource type matching the action, if any
+ * @throws an error if the service or action does not exist, or if the action is a wildcard only action
+ */
+export async function getResourceTypesForAction(service, action, resource) {
+    const actionDetails = await iamActionDetails(service, action);
+    if (actionDetails.resourceTypes.length === 0) {
+        throw new Error(`${service}:${action} does not have any resource types`);
+    }
+    const actionResourceTypes = [];
+    for (const rt of actionDetails.resourceTypes) {
+        actionResourceTypes.push(await iamResourceTypeDetails(service, rt.name));
+    }
+    const matchingPatterns = mostSpecificMatchingResourceTypePatterns(resource, actionResourceTypes.map((resourceType) => resourceType.arn));
+    return actionResourceTypes.filter((resourceType) => matchingPatterns.includes(resourceType.arn));
+}
+//# sourceMappingURL=resourceTypes.js.map

package/dist/esm/simulation_engine/resourceTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceTypes.js","sourceRoot":"","sources":["../../../src/simulation_engine/resourceTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EAEvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,wCAAwC,EAAE,MAAM,wBAAwB,CAAA;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,MAAc,EACd,QAAgB;IAEhB,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7D,IAAI,aAAa,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,IAAI,MAAM,mCAAmC,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,mBAAmB,GAAmB,EAAE,CAAA;IAC9C,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,aAAa,EAAE,CAAC;QAC7C,mBAAmB,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,gBAAgB,GAAG,wCAAwC,CAC/D,QAAQ,EACR,mBAAmB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAC5D,CAAA;IAED,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;AAClG,CAAC"}

package/dist/esm/simulation_engine/simulation.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Explicit marker for an unsigned anonymous request.
+ */
+export interface AnonymousRequestPrincipal {
+    type: 'Anonymous';
+}
+/**
+ * Principal value for a simulation request.
+ */
+export type SimulationRequestPrincipal = string | AnonymousRequestPrincipal;
+/**
+ * Convenience value for anonymous simulations.
+ */
+export declare const anonymousPrincipal: AnonymousRequestPrincipal;
+/**
+ * Checks whether a value is the anonymous request-principal marker.
+ *
+ * This guard intentionally accepts only the exact public anonymous shape so unsupported object fields
+ * cannot be confused with future principal variants.
+ *
+ * @param value the value to check.
+ * @returns true if the value is an anonymous request principal.
+ */
+export declare function isAnonymousRequestPrincipal(value: unknown): value is AnonymousRequestPrincipal;
+/**
+ * Checks whether a value is a supported simulation request principal.
+ *
+ * @param value the value to check.
+ * @returns true if the value is a string principal or the anonymous marker.
+ */
+export declare function isSimulationRequestPrincipal(value: unknown): value is SimulationRequestPrincipal;
+/**
+ * Represents the policies attached to an OU, or account
+ */
+export interface SimulationOrgPolicies {
+    orgIdentifier: string;
+    policies: {
+        name: string;
+        policy: any;
+    }[];
+}
+/**
+ * Represent a policy attached to an identity
+ */
+export interface SimulationIdentityPolicy {
+    name: string;
+    policy: any;
+}
+export interface Simulation {
+    request: {
+        principal: SimulationRequestPrincipal;
+        action: string;
+        resource: {
+            resource: string;
+            accountId: string;
+        };
+        contextVariables: Record<string, string | string[]>;
+    };
+    /**
+     * A session policy, if any, for the current Role or Federated User session.
+     */
+    sessionPolicy?: any | undefined;
+    /**
+     * The identity policies that are attached to the principal making the request
+     */
+    identityPolicies: SimulationIdentityPolicy[];
+    /**
+     * The service control policies that apply to the simulation.
+     * The root OU should be the first element in the array.
+     * The account specific SCPs should be the last element in the array.
+     */
+    serviceControlPolicies: SimulationOrgPolicies[];
+    /**
+     * The resource control policies for the simulation.
+     * One per level of the OU/Account hierarchy.
+     * The default Resource Control Policy, RCPFullAWSAccess, is automatically added to the simulation.
+     */
+    resourceControlPolicies: SimulationOrgPolicies[];
+    /**
+     * The resource policy, if any
+     */
+    resourcePolicy?: any;
+    /**
+     * The permission boundary policies, if any.
+     */
+    permissionBoundaryPolicies?: {
+        name: string;
+        policy: any;
+    }[];
+    /**
+     * The VPC endpoint policies, if any.
+     */
+    vpcEndpointPolicies?: {
+        name: string;
+        policy: any;
+    }[];
+    /**
+     * Additional settings that may affect the simulation
+     */
+    additionalSettings?: {
+        s3?: {
+            /**
+             * If an S3 bucket request, whether ABAC is enabled on the bucket
+             */
+            bucketAbacEnabled?: boolean;
+            /**
+             * Caller-supplied effective S3 Block Public Access setting for RestrictPublicBuckets.
+             * iam-simulate does not determine this value from AWS; callers must provide it.
+             */
+            blockPublicAccess?: boolean;
+        };
+    };
+}
+//# sourceMappingURL=simulation.d.ts.map

package/dist/esm/simulation_engine/simulation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulation.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/simulation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,WAAW,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,yBAAyB,CAAA;AAE3E;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,yBAAiD,CAAA;AAElF;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,yBAAyB,CAQ9F;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAEhG;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,EAAE,CAAA;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,GAAG,CAAA;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE;QACP,SAAS,EAAE,0BAA0B,CAAA;QACrC,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE;YACR,QAAQ,EAAE,MAAM,CAAA;YAChB,SAAS,EAAE,MAAM,CAAA;SAClB,CAAA;QACD,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;KACpD,CAAA;IAED;;OAEG;IACH,aAAa,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;IAE/B;;OAEG;IACH,gBAAgB,EAAE,wBAAwB,EAAE,CAAA;IAE5C;;;;OAIG;IACH,sBAAsB,EAAE,qBAAqB,EAAE,CAAA;IAE/C;;;;OAIG;IACH,uBAAuB,EAAE,qBAAqB,EAAE,CAAA;IAEhD;;OAEG;IACH,cAAc,CAAC,EAAE,GAAG,CAAA;IAEpB;;OAEG;IACH,0BAA0B,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,EAAE,CAAA;IAE5D;;OAEG;IACH,mBAAmB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,EAAE,CAAA;IAErD;;OAEG;IACH,kBAAkB,CAAC,EAAE;QACnB,EAAE,CAAC,EAAE;YACH;;eAEG;YACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;YAE3B;;;eAGG;YACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;SAC5B,CAAA;KACF,CAAA;CACF"}

package/dist/esm/simulation_engine/simulation.js

@@ -0,0 +1,30 @@
+/**
+ * Convenience value for anonymous simulations.
+ */
+export const anonymousPrincipal = { type: 'Anonymous' };
+/**
+ * Checks whether a value is the anonymous request-principal marker.
+ *
+ * This guard intentionally accepts only the exact public anonymous shape so unsupported object fields
+ * cannot be confused with future principal variants.
+ *
+ * @param value the value to check.
+ * @returns true if the value is an anonymous request principal.
+ */
+export function isAnonymousRequestPrincipal(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.keys(value).length === 1 &&
+        value.type === 'Anonymous');
+}
+/**
+ * Checks whether a value is a supported simulation request principal.
+ *
+ * @param value the value to check.
+ * @returns true if the value is a string principal or the anonymous marker.
+ */
+export function isSimulationRequestPrincipal(value) {
+    return typeof value === 'string' || isAnonymousRequestPrincipal(value);
+}
+//# sourceMappingURL=simulation.js.map

package/dist/esm/simulation_engine/simulation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulation.js","sourceRoot":"","sources":["../../../src/simulation_engine/simulation.ts"],"names":[],"mappings":"AAYA;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA8B,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;AAElF;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAC9B,KAA4B,CAAC,IAAI,KAAK,WAAW,CACnD,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,2BAA2B,CAAC,KAAK,CAAC,CAAA;AACxE,CAAC"}

package/dist/esm/simulation_engine/simulationEngine.d.ts

@@ -0,0 +1,128 @@
+import { type ResourceType } from '@actsecurity/iam-data';
+import { type ValidationError } from '@actsecurity/iam-policy';
+import { type EvaluationResult, type RequestAnalysis } from '../evaluate.js';
+import { type Simulation } from './simulation.js';
+import { type SimulationOptions } from './simulationOptions.js';
+export interface SimulationErrors {
+    sessionPolicyErrors?: ValidationError[];
+    identityPolicyErrors?: Record<string, ValidationError[]>;
+    serviceControlPolicyErrors?: Record<string, ValidationError[]>;
+    resourceControlPolicyErrors?: Record<string, ValidationError[]>;
+    permissionBoundaryErrors?: Record<string, ValidationError[]>;
+    resourcePolicyErrors?: ValidationError[];
+    vpcEndpointErrors?: Record<string, ValidationError[]>;
+    anonymousRequestErrors?: string[];
+    message: string;
+}
+/**
+ * Result of evaluating a single resource simulation, containing the analysis and any ignored context keys.
+ */
+export interface SimulationResourceResult {
+    analysis: RequestAnalysis;
+    /**
+     * Any context keys provided in the request that were filtered out before
+     * policy evaluation because they do not apply to the action/resource type.
+     *
+     * This will only be present if the request passes validation to reach the
+     * policy evaluation stage.
+     *
+     * If no context keys were ignored, this will be present and an empty array.
+     */
+    ignoredContextKeys?: string[];
+    /**
+     * The resource type that was used for the simulation.
+     */
+    resourceType?: string | undefined;
+}
+/**
+ * Extended simulation resource result that includes resource type and pattern information
+ * for wildcard resource simulations.
+ */
+export interface WildcardSimulationResourceResult extends SimulationResourceResult {
+    /**
+     * The resource type that was used for the simulation.
+     */
+    resourceType: string;
+    /**
+     * The resource pattern that was used for the simulation, if applicable. If a wildcard
+     * resource was provided and multiple simulations were run, this will indicate the
+     * specific resource string that was simulated.
+     */
+    resourcePattern: string;
+}
+/**
+ * Simulation result indicating that errors prevented the simulation from running.
+ */
+export interface ErrorSimulationResult {
+    resultType: 'error';
+    /**
+     * Errors in the simulation input that prevented the simulation from being run.
+     */
+    errors: SimulationErrors;
+}
+/**
+ * Simulation result for a single resource (non-wildcard) evaluation.
+ */
+export interface SingleResourceSimulationResult {
+    /**
+     * A single resource simulation result.
+     */
+    resultType: 'single';
+    /**
+     * The overall result of the one simulation that was run.
+     */
+    overallResult: EvaluationResult;
+    /**
+     * The detailed result of the simulation that was run and the request analysis
+     */
+    result: SimulationResourceResult;
+}
+/**
+ * Simulation results for wildcard resource evaluations, containing multiple individual results.
+ */
+export interface WildcardResourceSimulationResults {
+    /**
+     * Whether a wildcard was detected in the resource ARN of the request and the
+     * simulation was not a wildcard-only action, which can cause multiple simulations to be run.
+     */
+    resultType: 'wildcard';
+    /**
+     * The overall result of the simulation, calculated based on the results of individual simulations if
+     * multiple were run.
+     */
+    overallResult: EvaluationResult;
+    /**
+     * The results of the simulation or simulations that were run.
+     * If it is a wildcard only action or the resource ARN contains no wildcards, this will contain a single result.
+     * If the resource ARN contains a wildcard and the action is not a wildcard-only action, this may contain no
+     * results, or one result for each matching pattern found in the provided identity and resource policies.
+     */
+    results: WildcardSimulationResourceResult[];
+}
+/**
+ * The result of running a simulation.
+ * Can be an error, a single result, or a wildcard result.
+ * Discriminated by the `resultType` field.
+ */
+export type RunSimulationResults = ErrorSimulationResult | SingleResourceSimulationResult | WildcardResourceSimulationResults;
+/**
+ * Union type representing successful simulation results (excluding error cases).
+ */
+export type SuccessfulRunSimulationResults = SingleResourceSimulationResult | WildcardResourceSimulationResults;
+/**
+ * Discriminant type for the different kinds of simulation results.
+ */
+export type SimulationResultType = RunSimulationResults['resultType'];
+/**
+ * Run a simulation with validation
+ *
+ * @param simulation The simulation to run
+ * @param simulationOptions Options for the simulation
+ * @returns The results of the simulation, or errors if the simulation could not be run
+ */
+export declare function runSimulation(simulation: Simulation, simulationOptions: Partial<SimulationOptions>): Promise<RunSimulationResults>;
+export declare function normalizeSimulationParameters(simulation: Simulation, suggestedResourceType: ResourceType | undefined): Promise<{
+    validContextValues: Record<string, string | string[]>;
+    ignoredContextKeys: string[];
+}>;
+//# sourceMappingURL=simulationEngine.d.ts.map

package/dist/esm/simulation_engine/simulationEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulationEngine.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/simulationEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAC5F,OAAO,EAQL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAA;AAYhC,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAS5E,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAiB/D,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB,CAAC,EAAE,eAAe,EAAE,CAAA;IACvC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IAC9D,2BAA2B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IAC/D,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IAC5D,oBAAoB,CAAC,EAAE,eAAe,EAAE,CAAA;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IACrD,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,eAAe,CAAA;IAEzB;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE7B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,gCAAiC,SAAQ,wBAAwB;IAChF;;OAEG;IACH,YAAY,EAAE,MAAM,CAAA;IAEpB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,OAAO,CAAA;IAEnB;;OAEG;IACH,MAAM,EAAE,gBAAgB,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,UAAU,EAAE,QAAQ,CAAA;IAEpB;;OAEG;IACH,aAAa,EAAE,gBAAgB,CAAA;IAE/B;;OAEG;IACH,MAAM,EAAE,wBAAwB,CAAA;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;;OAGG;IACH,UAAU,EAAE,UAAU,CAAA;IAEtB;;;OAGG;IACH,aAAa,EAAE,gBAAgB,CAAA;IAE/B;;;;;OAKG;IACH,OAAO,EAAE,gCAAgC,EAAE,CAAA;CAC5C;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC9B,qBAAqB,GAAG,8BAA8B,GAAG,iCAAiC,CAAA;AAE5F;;GAEG;AACH,MAAM,MAAM,8BAA8B,GACxC,8BAA8B,GAAG,iCAAiC,CAAA;AAEpE;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAA;AA2CrE;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAC5C,OAAO,CAAC,oBAAoB,CAAC,CAwW/B;AAED,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,UAAU,EACtB,qBAAqB,EAAE,YAAY,GAAG,SAAS,GAC9C,OAAO,CAAC;IACT,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;IACrD,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAC7B,CAAC,CA0CD"}