@actsecurity/iam-simulate 0.1.186 → 0.1.188

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/dist/cjs/context_keys/contextKeys.d.ts.map +1 -1
  2. package/dist/cjs/context_keys/contextKeys.js +24 -2
  3. package/dist/cjs/context_keys/contextKeys.js.map +1 -1
  4. package/dist/cjs/services/StsServiceAuthorizer.d.ts +1 -6
  5. package/dist/cjs/services/StsServiceAuthorizer.d.ts.map +1 -1
  6. package/dist/cjs/services/StsServiceAuthorizer.js +33 -15
  7. package/dist/cjs/services/StsServiceAuthorizer.js.map +1 -1
  8. package/dist/esm/context_keys/contextKeys.d.ts.map +1 -1
  9. package/dist/esm/context_keys/contextKeys.js +25 -3
  10. package/dist/esm/context_keys/contextKeys.js.map +1 -1
  11. package/dist/esm/services/StsServiceAuthorizer.d.ts +1 -6
  12. package/dist/esm/services/StsServiceAuthorizer.d.ts.map +1 -1
  13. package/dist/esm/services/StsServiceAuthorizer.js +34 -15
  14. package/dist/esm/services/StsServiceAuthorizer.js.map +1 -1
  15. package/package.json +1 -1
package/dist/cjs/context_keys/contextKeys.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AA0B5D;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOtE;AAYD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBjF;AAmBD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYrF"}
1
+ {"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AA0B5D;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOtE;AA2CD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBjF;AAmBD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYrF"}
package/dist/cjs/context_keys/contextKeys.js CHANGED
@@ -38,7 +38,7 @@ async function isActualContextKey(key) {
38
38
  if (isOidcConditionKey(key)) {
39
39
  return true;
40
40
  }
41
- const dataKey = await (0, iam_data_1.findConditionKey)(key);
41
+ const dataKey = await serviceContextKeyDetails(key);
42
42
  return !!dataKey;
43
43
  }
44
44
  /**
@@ -48,7 +48,29 @@ async function isActualContextKey(key) {
48
48
  * @returns The details for the context key if it exists. if the key has variables in it it will return the details for the variable key
49
49
  */
50
50
  async function serviceContextKeyDetails(contextKey) {
51
- return (0, iam_data_1.findConditionKey)(contextKey);
51
+ return ((await (0, iam_data_1.findConditionKey)(contextKey)) ?? (await placeholderVariableContextKeyDetails(contextKey)));
52
+ }
53
+ /**
54
+ * Finds the service condition key that shares a context key's text through its first `/`, for
55
+ * iam-data entries that spell the variable as a literal placeholder, such as
56
+ * `secretsmanager:ResourceTag/tag-key`.
57
+ *
58
+ * @param contextKey the context key to get the details for
59
+ * @returns the details for the service condition key with the same prefix, if one exists
60
+ */
61
+ async function placeholderVariableContextKeyDetails(contextKey) {
62
+ const colonIndex = contextKey.indexOf(':');
63
+ const slashIndex = contextKey.indexOf('/');
64
+ if (colonIndex === -1 || slashIndex < colonIndex || slashIndex === contextKey.length - 1) {
65
+ return undefined;
66
+ }
67
+ const service = contextKey.slice(0, colonIndex);
68
+ if (!(await (0, iam_data_1.iamServiceExists)(service))) {
69
+ return undefined;
70
+ }
71
+ const prefix = contextKey.slice(0, slashIndex + 1).toLowerCase();
72
+ const serviceKey = (await (0, iam_data_1.iamConditionKeysForService)(service)).find((key) => key.toLowerCase().startsWith(prefix));
73
+ return serviceKey ? (0, iam_data_1.iamConditionKeyDetails)(service, serviceKey) : undefined;
52
74
  }
53
75
  /**
54
76
  * Check the capitalization of a context key and return the correct capitalization
package/dist/cjs/context_keys/contextKeys.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":";;AAkCA,gDAOC;AAkBD,0DAgBC;AA0BD,8CAYC;AAjHD,oDAA2E;AAC3E,wFAAsG;AAGtG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,OAAO;IACP,UAAU;IACV,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,UAAU;IACV,KAAK;IACL,aAAa;IACb,eAAe;IACf,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,YAAY;IACZ,SAAS;IACT,4BAA4B;CAC7B,CAAC,CAAA;AACF,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAEjD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAgB,EAAC,GAAG,CAAC,CAAA;IAC3C,OAAO,CAAC,CAAC,OAAO,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IACxD,OAAO,IAAA,2BAAgB,EAAC,UAAU,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IAC9D,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,2BAA2B,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAA,iEAAwC,EAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,2BAA2B,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,YAAY,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B,CAAC,OAAe,EAAE,SAAiB;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,OAAO,MAAM,GAAG,MAAM,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,kBAAkB,GAAG,IAAA,iEAAwC,EAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC,IAAwB,CAAA;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,IAAwB,CAAA;IAC5C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,YAAY,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IAC/B,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAClE,CAAC"}
1
+ {"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":";;AAwCA,gDAOC;AAiDD,0DAgBC;AA0BD,8CAYC;AAtJD,oDAM8B;AAC9B,wFAAsG;AAGtG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,OAAO;IACP,UAAU;IACV,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,UAAU;IACV,KAAK;IACL,aAAa;IACb,eAAe;IACf,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,YAAY;IACZ,SAAS;IACT,4BAA4B;CAC7B,CAAC,CAAA;AACF,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAEjD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,CAAC,CAAC,OAAO,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IACxD,OAAO,CACL,CAAC,MAAM,IAAA,2BAAgB,EAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,oCAAoC,CAAC,UAAU,CAAC,CAAC,CACjG,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oCAAoC,CACjD,UAAkB;IAElB,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,UAAU,GAAG,UAAU,IAAI,UAAU,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzF,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC/C,IAAI,CAAC,CAAC,MAAM,IAAA,2BAAgB,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAChE,MAAM,UAAU,GAAG,CAAC,MAAM,IAAA,qCAA0B,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC1E,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CACrC,CAAA;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,IAAA,iCAAsB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7E,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IAC9D,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,2BAA2B,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAA,iEAAwC,EAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,2BAA2B,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,YAAY,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B,CAAC,OAAe,EAAE,SAAiB;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,OAAO,MAAM,GAAG,MAAM,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,kBAAkB,GAAG,IAAA,iEAAwC,EAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC,IAAwB,CAAA;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,IAAwB,CAAA;IAC5C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,YAAY,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IAC/B,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAClE,CAAC"}
package/dist/cjs/services/StsServiceAuthorizer.d.ts CHANGED
@@ -6,12 +6,7 @@ import { type ServiceAuthorizationRequest } from './ServiceAuthorizer.js';
6
6
  * Service authorizer for AWS Security Token Service requests.
7
7
  */
8
8
  export declare class StsServiceAuthorizer extends DefaultServiceAuthorizer {
9
- /**
10
- * Authorizes an STS request, accounting for STS actions that cannot be called anonymously.
11
- *
12
- * @param request the service authorization request containing the principal and policy analyses.
13
- * @returns the final STS authorization analysis.
14
- */
9
+ /** Authorizes an STS request, answering actions decided by the caller alone without policy evaluation. */
15
10
  authorize(request: ServiceAuthorizationRequest): RequestAnalysis;
16
11
  /**
17
12
  * Determines if the service trusts the principal's Account's IAM policies
package/dist/cjs/services/StsServiceAuthorizer.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAQzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChE;;;;;OAKG;IACa,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IA8BhF;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAkBzB"}
1
+ {"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEnG,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAQzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChE,0GAA0G;IAC1F,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IA8BhF;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAkBzB"}
package/dist/cjs/services/StsServiceAuthorizer.js CHANGED
@@ -1,36 +1,32 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
3
  exports.StsServiceAuthorizer = void 0;
4
+ const iam_utils_1 = require("@actsecurity/iam-utils");
4
5
  const DefaultServiceAuthorizer_js_1 = require("./DefaultServiceAuthorizer.js");
5
- const actionsRequiringAuthenticatedPrincipal = new Set([
6
- 'sts:assumerole',
7
- 'sts:getcalleridentity',
8
- 'sts:getsessiontoken'
9
- ]);
6
+ const actionsRequiringAuthenticatedPrincipal = [
7
+ 'sts:AssumeRole',
8
+ 'sts:GetCallerIdentity',
9
+ 'sts:GetSessionToken'
10
+ ];
10
11
  /**
11
12
  * Service authorizer for AWS Security Token Service requests.
12
13
  */
13
14
  class StsServiceAuthorizer extends DefaultServiceAuthorizer_js_1.DefaultServiceAuthorizer {
14
- /**
15
- * Authorizes an STS request, accounting for STS actions that cannot be called anonymously.
16
- *
17
- * @param request the service authorization request containing the principal and policy analyses.
18
- * @returns the final STS authorization analysis.
19
- */
15
+ /** Authorizes an STS request, answering actions decided by the caller alone without policy evaluation. */
20
16
  authorize(request) {
21
17
  const action = request.request.action.value();
22
18
  const principal = request.request.principal;
23
- if (action.localeCompare('sts:getcalleridentity', undefined, { sensitivity: 'accent' }) === 0 &&
24
- principal.isAuthenticated()) {
19
+ const policyFreeResult = resultWithoutPolicies({ action, principal });
20
+ if (policyFreeResult !== undefined) {
25
21
  return {
26
- result: 'Allowed',
22
+ result: policyFreeResult,
27
23
  sameAccount: true,
28
24
  conditions: undefined
29
25
  };
30
26
  }
31
27
  const baseResult = super.authorize(request);
32
28
  if (principal.isAnonymous() &&
33
- actionsRequiringAuthenticatedPrincipal.has(action.toLowerCase())) {
29
+ actionsRequiringAuthenticatedPrincipal.some((candidate) => isSameAction({ action, candidate }))) {
34
30
  return {
35
31
  ...baseResult,
36
32
  result: 'ImplicitlyDenied',
@@ -64,4 +60,26 @@ class StsServiceAuthorizer extends DefaultServiceAuthorizer_js_1.DefaultServiceA
64
60
  }
65
61
  }
66
62
  exports.StsServiceAuthorizer = StsServiceAuthorizer;
63
+ const rootArnRegex = /^arn:[a-zA-Z-]+:iam::\d{12}:root$/;
64
+ /** STS actions whose result depends only on the caller. */
65
+ const resultForCallerByAction = [
66
+ { action: 'sts:GetCallerIdentity', resultForCaller: () => 'Allowed' },
67
+ {
68
+ action: 'sts:GetSessionToken',
69
+ resultForCaller: (principalValue) => (0, iam_utils_1.isIamUserArn)(principalValue) || rootArnRegex.test(principalValue)
70
+ ? 'Allowed'
71
+ : 'ImplicitlyDenied'
72
+ }
73
+ ];
74
+ /** The result AWS gives an authenticated caller for an action decided by the caller alone, else undefined. */
75
+ function resultWithoutPolicies({ action, principal }) {
76
+ const entry = resultForCallerByAction.find((row) => isSameAction({ action, candidate: row.action }));
77
+ if (entry === undefined || !principal.isAuthenticated()) {
78
+ return undefined;
79
+ }
80
+ return entry.resultForCaller(principal.value());
81
+ }
82
+ function isSameAction({ action, candidate }) {
83
+ return action.localeCompare(candidate, undefined, { sensitivity: 'accent' }) === 0;
84
+ }
67
85
  //# sourceMappingURL=StsServiceAuthorizer.js.map
package/dist/cjs/services/StsServiceAuthorizer.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":";;;AAEA,+EAAoG;AAGpG,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAC;IACrD,gBAAgB;IAChB,uBAAuB;IACvB,qBAAqB;CACtB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAa,oBAAqB,SAAQ,sDAAwB;IAChE;;;;;OAKG;IACa,SAAS,CAAC,OAAoC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAE3C,IACE,MAAM,CAAC,aAAa,CAAC,uBAAuB,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC;YACzF,SAAS,CAAC,eAAe,EAAE,EAC3B,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3C,IACE,SAAS,CAAC,WAAW,EAAE;YACvB,sCAAsC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAChE,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,yFAAyF;QACzF,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED;;;;UAIE;QACF,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF;AAlED,oDAkEC"}
1
+ {"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":";;;AAAA,sDAAqD;AAIrD,+EAAoG;AAGpG,MAAM,sCAAsC,GAAsB;IAChE,gBAAgB;IAChB,uBAAuB;IACvB,qBAAqB;CACtB,CAAA;AAED;;GAEG;AACH,MAAa,oBAAqB,SAAQ,sDAAwB;IAChE,0GAA0G;IAC1F,SAAS,CAAC,OAAoC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAE3C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QACrE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3C,IACE,SAAS,CAAC,WAAW,EAAE;YACvB,sCAAsC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACxD,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACpC,EACD,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,yFAAyF;QACzF,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED;;;;UAIE;QACF,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF;AA7DD,oDA6DC;AAED,MAAM,YAAY,GAAG,mCAAmC,CAAA;AAExD,2DAA2D;AAC3D,MAAM,uBAAuB,GAGvB;IACJ,EAAE,MAAM,EAAE,uBAAuB,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE;IACrE;QACE,MAAM,EAAE,qBAAqB;QAC7B,eAAe,EAAE,CAAC,cAAc,EAAE,EAAE,CAClC,IAAA,wBAAY,EAAC,cAAc,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC;YAC/D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,kBAAkB;KACzB;CACF,CAAA;AAED,8GAA8G;AAC9G,SAAS,qBAAqB,CAAC,EAC7B,MAAM,EACN,SAAS,EAIV;IACC,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAChD,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;QACxD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAyC;IAChF,OAAO,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAA;AACpF,CAAC"}
package/dist/esm/context_keys/contextKeys.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AA0B5D;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOtE;AAYD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBjF;AAmBD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYrF"}
1
+ {"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AA0B5D;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOtE;AA2CD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBjF;AAmBD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYrF"}
package/dist/esm/context_keys/contextKeys.js CHANGED
@@ -1,4 +1,4 @@
1
- import { findConditionKey } from '@actsecurity/iam-data';
1
+ import { findConditionKey, iamConditionKeyDetails, iamConditionKeysForService, iamServiceExists } from '@actsecurity/iam-data';
2
2
  import { getGlobalConditionKeyWithOrWithoutPrefix } from '../global_conditions/globalConditionKeys.js';
3
3
  import {} from './contextKeyTypes.js';
4
4
  const oidcKeys = new Set([
@@ -34,7 +34,7 @@ export async function isActualContextKey(key) {
34
34
  if (isOidcConditionKey(key)) {
35
35
  return true;
36
36
  }
37
- const dataKey = await findConditionKey(key);
37
+ const dataKey = await serviceContextKeyDetails(key);
38
38
  return !!dataKey;
39
39
  }
40
40
  /**
@@ -44,7 +44,29 @@ export async function isActualContextKey(key) {
44
44
  * @returns The details for the context key if it exists. if the key has variables in it it will return the details for the variable key
45
45
  */
46
46
  async function serviceContextKeyDetails(contextKey) {
47
- return findConditionKey(contextKey);
47
+ return ((await findConditionKey(contextKey)) ?? (await placeholderVariableContextKeyDetails(contextKey)));
48
+ }
49
+ /**
50
+ * Finds the service condition key that shares a context key's text through its first `/`, for
51
+ * iam-data entries that spell the variable as a literal placeholder, such as
52
+ * `secretsmanager:ResourceTag/tag-key`.
53
+ *
54
+ * @param contextKey the context key to get the details for
55
+ * @returns the details for the service condition key with the same prefix, if one exists
56
+ */
57
+ async function placeholderVariableContextKeyDetails(contextKey) {
58
+ const colonIndex = contextKey.indexOf(':');
59
+ const slashIndex = contextKey.indexOf('/');
60
+ if (colonIndex === -1 || slashIndex < colonIndex || slashIndex === contextKey.length - 1) {
61
+ return undefined;
62
+ }
63
+ const service = contextKey.slice(0, colonIndex);
64
+ if (!(await iamServiceExists(service))) {
65
+ return undefined;
66
+ }
67
+ const prefix = contextKey.slice(0, slashIndex + 1).toLowerCase();
68
+ const serviceKey = (await iamConditionKeysForService(service)).find((key) => key.toLowerCase().startsWith(prefix));
69
+ return serviceKey ? iamConditionKeyDetails(service, serviceKey) : undefined;
48
70
  }
49
71
  /**
50
72
  * Check the capitalization of a context key and return the correct capitalization
package/dist/esm/context_keys/contextKeys.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC3E,OAAO,EAAE,wCAAwC,EAAE,MAAM,6CAA6C,CAAA;AACtG,OAAO,EAAyB,MAAM,sBAAsB,CAAA;AAE5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,OAAO;IACP,UAAU;IACV,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,UAAU;IACV,KAAK;IACL,aAAa;IACb,eAAe;IACf,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,YAAY;IACZ,SAAS;IACT,4BAA4B;CAC7B,CAAC,CAAA;AACF,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC3C,OAAO,CAAC,CAAC,OAAO,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IACxD,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IAC9D,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,2BAA2B,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,2BAA2B,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,YAAY,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B,CAAC,OAAe,EAAE,SAAiB;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,OAAO,MAAM,GAAG,MAAM,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC,IAAwB,CAAA;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,IAAwB,CAAA;IAC5C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,YAAY,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IAC/B,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAClE,CAAC"}
1
+ {"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,wCAAwC,EAAE,MAAM,6CAA6C,CAAA;AACtG,OAAO,EAAyB,MAAM,sBAAsB,CAAA;AAE5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,OAAO;IACP,UAAU;IACV,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,UAAU;IACV,KAAK;IACL,aAAa;IACb,eAAe;IACf,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,YAAY;IACZ,SAAS;IACT,4BAA4B;CAC7B,CAAC,CAAA;AACF,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,CAAC,CAAC,OAAO,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IACxD,OAAO,CACL,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,oCAAoC,CAAC,UAAU,CAAC,CAAC,CACjG,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oCAAoC,CACjD,UAAkB;IAElB,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,UAAU,GAAG,UAAU,IAAI,UAAU,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzF,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC/C,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAChE,MAAM,UAAU,GAAG,CAAC,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC1E,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CACrC,CAAA;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IAC9D,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,2BAA2B,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,2BAA2B,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,YAAY,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B,CAAC,OAAe,EAAE,SAAiB;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,OAAO,MAAM,GAAG,MAAM,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC,IAAwB,CAAA;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,IAAwB,CAAA;IAC5C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,YAAY,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IAC/B,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAClE,CAAC"}
package/dist/esm/services/StsServiceAuthorizer.d.ts CHANGED
@@ -6,12 +6,7 @@ import { type ServiceAuthorizationRequest } from './ServiceAuthorizer.js';
6
6
  * Service authorizer for AWS Security Token Service requests.
7
7
  */
8
8
  export declare class StsServiceAuthorizer extends DefaultServiceAuthorizer {
9
- /**
10
- * Authorizes an STS request, accounting for STS actions that cannot be called anonymously.
11
- *
12
- * @param request the service authorization request containing the principal and policy analyses.
13
- * @returns the final STS authorization analysis.
14
- */
9
+ /** Authorizes an STS request, answering actions decided by the caller alone without policy evaluation. */
15
10
  authorize(request: ServiceAuthorizationRequest): RequestAnalysis;
16
11
  /**
17
12
  * Determines if the service trusts the principal's Account's IAM policies
package/dist/esm/services/StsServiceAuthorizer.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAQzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChE;;;;;OAKG;IACa,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IA8BhF;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAkBzB"}
1
+ {"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEnG,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAQzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChE,0GAA0G;IAC1F,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IA8BhF;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAkBzB"}
package/dist/esm/services/StsServiceAuthorizer.js CHANGED
@@ -1,36 +1,33 @@
1
+ import { isIamUserArn } from '@actsecurity/iam-utils';
1
2
  import {} from '../evaluate.js';
3
+ import {} from '../request/requestPrincipal.js';
2
4
  import {} from '../request/requestResource.js';
3
5
  import { DefaultServiceAuthorizer } from './DefaultServiceAuthorizer.js';
4
6
  import {} from './ServiceAuthorizer.js';
5
- const actionsRequiringAuthenticatedPrincipal = new Set([
6
- 'sts:assumerole',
7
- 'sts:getcalleridentity',
8
- 'sts:getsessiontoken'
9
- ]);
7
+ const actionsRequiringAuthenticatedPrincipal = [
8
+ 'sts:AssumeRole',
9
+ 'sts:GetCallerIdentity',
10
+ 'sts:GetSessionToken'
11
+ ];
10
12
  /**
11
13
  * Service authorizer for AWS Security Token Service requests.
12
14
  */
13
15
  export class StsServiceAuthorizer extends DefaultServiceAuthorizer {
14
- /**
15
- * Authorizes an STS request, accounting for STS actions that cannot be called anonymously.
16
- *
17
- * @param request the service authorization request containing the principal and policy analyses.
18
- * @returns the final STS authorization analysis.
19
- */
16
+ /** Authorizes an STS request, answering actions decided by the caller alone without policy evaluation. */
20
17
  authorize(request) {
21
18
  const action = request.request.action.value();
22
19
  const principal = request.request.principal;
23
- if (action.localeCompare('sts:getcalleridentity', undefined, { sensitivity: 'accent' }) === 0 &&
24
- principal.isAuthenticated()) {
20
+ const policyFreeResult = resultWithoutPolicies({ action, principal });
21
+ if (policyFreeResult !== undefined) {
25
22
  return {
26
- result: 'Allowed',
23
+ result: policyFreeResult,
27
24
  sameAccount: true,
28
25
  conditions: undefined
29
26
  };
30
27
  }
31
28
  const baseResult = super.authorize(request);
32
29
  if (principal.isAnonymous() &&
33
- actionsRequiringAuthenticatedPrincipal.has(action.toLowerCase())) {
30
+ actionsRequiringAuthenticatedPrincipal.some((candidate) => isSameAction({ action, candidate }))) {
34
31
  return {
35
32
  ...baseResult,
36
33
  result: 'ImplicitlyDenied',
@@ -63,4 +60,26 @@ export class StsServiceAuthorizer extends DefaultServiceAuthorizer {
63
60
  return { trustType: 'None' };
64
61
  }
65
62
  }
63
+ const rootArnRegex = /^arn:[a-zA-Z-]+:iam::\d{12}:root$/;
64
+ /** STS actions whose result depends only on the caller. */
65
+ const resultForCallerByAction = [
66
+ { action: 'sts:GetCallerIdentity', resultForCaller: () => 'Allowed' },
67
+ {
68
+ action: 'sts:GetSessionToken',
69
+ resultForCaller: (principalValue) => isIamUserArn(principalValue) || rootArnRegex.test(principalValue)
70
+ ? 'Allowed'
71
+ : 'ImplicitlyDenied'
72
+ }
73
+ ];
74
+ /** The result AWS gives an authenticated caller for an action decided by the caller alone, else undefined. */
75
+ function resultWithoutPolicies({ action, principal }) {
76
+ const entry = resultForCallerByAction.find((row) => isSameAction({ action, candidate: row.action }));
77
+ if (entry === undefined || !principal.isAuthenticated()) {
78
+ return undefined;
79
+ }
80
+ return entry.resultForCaller(principal.value());
81
+ }
82
+ function isSameAction({ action, candidate }) {
83
+ return action.localeCompare(candidate, undefined, { sensitivity: 'accent' }) === 0;
84
+ }
66
85
  //# sourceMappingURL=StsServiceAuthorizer.js.map
package/dist/esm/services/StsServiceAuthorizer.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAwB,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAA8B,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAoC,MAAM,wBAAwB,CAAA;AAEzE,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAC;IACrD,gBAAgB;IAChB,uBAAuB;IACvB,qBAAqB;CACtB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,wBAAwB;IAChE;;;;;OAKG;IACa,SAAS,CAAC,OAAoC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAE3C,IACE,MAAM,CAAC,aAAa,CAAC,uBAAuB,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC;YACzF,SAAS,CAAC,eAAe,EAAE,EAC3B,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3C,IACE,SAAS,CAAC,WAAW,EAAE;YACvB,sCAAsC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAChE,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,yFAAyF;QACzF,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED;;;;UAIE;QACF,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF"}
1
+ {"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAsE,MAAM,gBAAgB,CAAA;AACnG,OAAO,EAAyB,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAwB,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAA8B,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAoC,MAAM,wBAAwB,CAAA;AAEzE,MAAM,sCAAsC,GAAsB;IAChE,gBAAgB;IAChB,uBAAuB;IACvB,qBAAqB;CACtB,CAAA;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,wBAAwB;IAChE,0GAA0G;IAC1F,SAAS,CAAC,OAAoC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAE3C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QACrE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3C,IACE,SAAS,CAAC,WAAW,EAAE;YACvB,sCAAsC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACxD,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACpC,EACD,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,yFAAyF;QACzF,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED;;;;UAIE;QACF,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF;AAED,MAAM,YAAY,GAAG,mCAAmC,CAAA;AAExD,2DAA2D;AAC3D,MAAM,uBAAuB,GAGvB;IACJ,EAAE,MAAM,EAAE,uBAAuB,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE;IACrE;QACE,MAAM,EAAE,qBAAqB;QAC7B,eAAe,EAAE,CAAC,cAAc,EAAE,EAAE,CAClC,YAAY,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC;YAC/D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,kBAAkB;KACzB;CACF,CAAA;AAED,8GAA8G;AAC9G,SAAS,qBAAqB,CAAC,EAC7B,MAAM,EACN,SAAS,EAIV;IACC,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAChD,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;QACxD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAyC;IAChF,OAAO,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAA;AACpF,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@actsecurity/iam-simulate",
3
- "version": "0.1.186",
3
+ "version": "0.1.188",
4
4
  "description": "Simulate evaluation of AWS IAM policies",
5
5
  "repository": {
6
6
  "type": "git",