@actsecurity/iam-simulate 0.1.188 → 0.1.190
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/services/StsServiceAuthorizer.d.ts.map +1 -1
- package/dist/cjs/services/StsServiceAuthorizer.js +10 -4
- package/dist/cjs/services/StsServiceAuthorizer.js.map +1 -1
- package/dist/esm/services/StsServiceAuthorizer.d.ts.map +1 -1
- package/dist/esm/services/StsServiceAuthorizer.js +11 -5
- package/dist/esm/services/StsServiceAuthorizer.js.map +1 -1
- package/package.json +2 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEnG,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAQzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChE,0GAA0G;IAC1F,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;
|
|
1
|
+
{"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEnG,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAQzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChE,0GAA0G;IAC1F,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IA0ChF;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAkBzB"}
|
|
@@ -25,6 +25,15 @@ class StsServiceAuthorizer extends DefaultServiceAuthorizer_js_1.DefaultServiceA
|
|
|
25
25
|
};
|
|
26
26
|
}
|
|
27
27
|
const baseResult = super.authorize(request);
|
|
28
|
+
if (principal.isAuthenticated() &&
|
|
29
|
+
(0, iam_utils_1.isRootArn)(principal.value()) &&
|
|
30
|
+
isSameAction({ action, candidate: 'sts:AssumeRole' })) {
|
|
31
|
+
return {
|
|
32
|
+
...baseResult,
|
|
33
|
+
result: 'ImplicitlyDenied',
|
|
34
|
+
conditions: undefined
|
|
35
|
+
};
|
|
36
|
+
}
|
|
28
37
|
if (principal.isAnonymous() &&
|
|
29
38
|
actionsRequiringAuthenticatedPrincipal.some((candidate) => isSameAction({ action, candidate }))) {
|
|
30
39
|
return {
|
|
@@ -60,15 +69,12 @@ class StsServiceAuthorizer extends DefaultServiceAuthorizer_js_1.DefaultServiceA
|
|
|
60
69
|
}
|
|
61
70
|
}
|
|
62
71
|
exports.StsServiceAuthorizer = StsServiceAuthorizer;
|
|
63
|
-
const rootArnRegex = /^arn:[a-zA-Z-]+:iam::\d{12}:root$/;
|
|
64
72
|
/** STS actions whose result depends only on the caller. */
|
|
65
73
|
const resultForCallerByAction = [
|
|
66
74
|
{ action: 'sts:GetCallerIdentity', resultForCaller: () => 'Allowed' },
|
|
67
75
|
{
|
|
68
76
|
action: 'sts:GetSessionToken',
|
|
69
|
-
resultForCaller: (principalValue) => (0, iam_utils_1.isIamUserArn)(principalValue) ||
|
|
70
|
-
? 'Allowed'
|
|
71
|
-
: 'ImplicitlyDenied'
|
|
77
|
+
resultForCaller: (principalValue) => (0, iam_utils_1.isIamUserArn)(principalValue) || (0, iam_utils_1.isRootArn)(principalValue) ? 'Allowed' : 'ImplicitlyDenied'
|
|
72
78
|
}
|
|
73
79
|
];
|
|
74
80
|
/** The result AWS gives an authenticated caller for an action decided by the caller alone, else undefined. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":";;;AAAA,
|
|
1
|
+
{"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":";;;AAAA,sDAAgE;AAIhE,+EAAoG;AAGpG,MAAM,sCAAsC,GAAsB;IAChE,gBAAgB;IAChB,uBAAuB;IACvB,qBAAqB;CACtB,CAAA;AAED;;GAEG;AACH,MAAa,oBAAqB,SAAQ,sDAAwB;IAChE,0GAA0G;IAC1F,SAAS,CAAC,OAAoC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAE3C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QACrE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3C,IACE,SAAS,CAAC,eAAe,EAAE;YAC3B,IAAA,qBAAS,EAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC5B,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,EACrD,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,IACE,SAAS,CAAC,WAAW,EAAE;YACvB,sCAAsC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACxD,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACpC,EACD,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,yFAAyF;QACzF,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED;;;;UAIE;QACF,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF;AAzED,oDAyEC;AAED,2DAA2D;AAC3D,MAAM,uBAAuB,GAGvB;IACJ,EAAE,MAAM,EAAE,uBAAuB,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE;IACrE;QACE,MAAM,EAAE,qBAAqB;QAC7B,eAAe,EAAE,CAAC,cAAc,EAAE,EAAE,CAClC,IAAA,wBAAY,EAAC,cAAc,CAAC,IAAI,IAAA,qBAAS,EAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB;KAC7F;CACF,CAAA;AAED,8GAA8G;AAC9G,SAAS,qBAAqB,CAAC,EAC7B,MAAM,EACN,SAAS,EAIV;IACC,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAChD,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;QACxD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAyC;IAChF,OAAO,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAA;AACpF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEnG,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAQzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChE,0GAA0G;IAC1F,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;
|
|
1
|
+
{"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEnG,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAQzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChE,0GAA0G;IAC1F,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IA0ChF;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAkBzB"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { isIamUserArn } from '@actsecurity/iam-utils';
|
|
1
|
+
import { isIamUserArn, isRootArn } from '@actsecurity/iam-utils';
|
|
2
2
|
import {} from '../evaluate.js';
|
|
3
3
|
import {} from '../request/requestPrincipal.js';
|
|
4
4
|
import {} from '../request/requestResource.js';
|
|
@@ -26,6 +26,15 @@ export class StsServiceAuthorizer extends DefaultServiceAuthorizer {
|
|
|
26
26
|
};
|
|
27
27
|
}
|
|
28
28
|
const baseResult = super.authorize(request);
|
|
29
|
+
if (principal.isAuthenticated() &&
|
|
30
|
+
isRootArn(principal.value()) &&
|
|
31
|
+
isSameAction({ action, candidate: 'sts:AssumeRole' })) {
|
|
32
|
+
return {
|
|
33
|
+
...baseResult,
|
|
34
|
+
result: 'ImplicitlyDenied',
|
|
35
|
+
conditions: undefined
|
|
36
|
+
};
|
|
37
|
+
}
|
|
29
38
|
if (principal.isAnonymous() &&
|
|
30
39
|
actionsRequiringAuthenticatedPrincipal.some((candidate) => isSameAction({ action, candidate }))) {
|
|
31
40
|
return {
|
|
@@ -60,15 +69,12 @@ export class StsServiceAuthorizer extends DefaultServiceAuthorizer {
|
|
|
60
69
|
return { trustType: 'None' };
|
|
61
70
|
}
|
|
62
71
|
}
|
|
63
|
-
const rootArnRegex = /^arn:[a-zA-Z-]+:iam::\d{12}:root$/;
|
|
64
72
|
/** STS actions whose result depends only on the caller. */
|
|
65
73
|
const resultForCallerByAction = [
|
|
66
74
|
{ action: 'sts:GetCallerIdentity', resultForCaller: () => 'Allowed' },
|
|
67
75
|
{
|
|
68
76
|
action: 'sts:GetSessionToken',
|
|
69
|
-
resultForCaller: (principalValue) => isIamUserArn(principalValue) ||
|
|
70
|
-
? 'Allowed'
|
|
71
|
-
: 'ImplicitlyDenied'
|
|
77
|
+
resultForCaller: (principalValue) => isIamUserArn(principalValue) || isRootArn(principalValue) ? 'Allowed' : 'ImplicitlyDenied'
|
|
72
78
|
}
|
|
73
79
|
];
|
|
74
80
|
/** The result AWS gives an authenticated caller for an action decided by the caller alone, else undefined. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;
|
|
1
|
+
{"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAsE,MAAM,gBAAgB,CAAA;AACnG,OAAO,EAAyB,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAwB,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAA8B,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAoC,MAAM,wBAAwB,CAAA;AAEzE,MAAM,sCAAsC,GAAsB;IAChE,gBAAgB;IAChB,uBAAuB;IACvB,qBAAqB;CACtB,CAAA;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,wBAAwB;IAChE,0GAA0G;IAC1F,SAAS,CAAC,OAAoC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAE3C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QACrE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3C,IACE,SAAS,CAAC,eAAe,EAAE;YAC3B,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC5B,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,EACrD,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,IACE,SAAS,CAAC,WAAW,EAAE;YACvB,sCAAsC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACxD,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACpC,EACD,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,yFAAyF;QACzF,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED;;;;UAIE;QACF,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF;AAED,2DAA2D;AAC3D,MAAM,uBAAuB,GAGvB;IACJ,EAAE,MAAM,EAAE,uBAAuB,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE;IACrE;QACE,MAAM,EAAE,qBAAqB;QAC7B,eAAe,EAAE,CAAC,cAAc,EAAE,EAAE,CAClC,YAAY,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB;KAC7F;CACF,CAAA;AAED,8GAA8G;AAC9G,SAAS,qBAAqB,CAAC,EAC7B,MAAM,EACN,SAAS,EAIV;IACC,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAChD,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;QACxD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAyC;IAChF,OAAO,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAA;AACpF,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@actsecurity/iam-simulate",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.190",
|
|
4
4
|
"description": "Simulate evaluation of AWS IAM policies",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -52,7 +52,7 @@
|
|
|
52
52
|
"dependencies": {
|
|
53
53
|
"@actsecurity/iam-data": ">=0.15.202511222 <1.0.0",
|
|
54
54
|
"@actsecurity/iam-policy": "^0.1.89",
|
|
55
|
-
"@actsecurity/iam-utils": "^0.1.
|
|
55
|
+
"@actsecurity/iam-utils": "^0.1.90"
|
|
56
56
|
},
|
|
57
57
|
"prettier": "@actsecurity/prettier-config",
|
|
58
58
|
"release": {
|