@aws-cdk/aws-bedrock-agentcore-alpha 2.253.0-alpha.0 → 2.254.0-alpha.0

package/lib/identity/perms.d.ts

@@ -0,0 +1,119 @@
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+/**
+ * Secrets Manager actions to read credential material stored for Token Vault providers.
+ *
+ * Outbound gateway targets apply the same actions on the secret ARN; principals that call
+ * `GetResourceApiKey` / `GetResourceOauth2Token` (or that mirror gateway behavior) typically need both
+ * `bedrock-agentcore` data-plane actions and read access to the backing secret.
+ *
+ * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-iam-awsmanpol.html
+ */
+export declare const TOKEN_VAULT_CREDENTIAL_SECRET_READ_PERMS: readonly ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"];
+/**
+ * Secrets Manager actions to write credential material for Token Vault providers.
+ *
+ * Create and Update control plane operations (e.g. CreateApiKeyCredentialProvider,
+ * UpdateApiKeyCredentialProvider) store/update the credential in Secrets Manager,
+ * requiring PutSecretValue on the backing secret.
+ */
+export declare const TOKEN_VAULT_CREDENTIAL_SECRET_WRITE_PERMS: readonly ["secretsmanager:PutSecretValue"];
+/**
+ * IAM actions for AgentCore API key credential providers (Token Vault).
+ *
+ * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html
+ */
+export declare class ApiKeyCredentialProviderIdentityPerms {
+    /**
+     * Read a single API key credential provider definition.
+     */
+    static readonly READ_PERMS: string[];
+    /**
+     * List API key credential providers (resource-scoped per IAM service authorization reference).
+     */
+    static readonly LIST_PERMS: string[];
+    /**
+     * Control plane permissions to create, read, update, and delete this provider.
+     */
+    static readonly ADMIN_PERMS: string[];
+    /**
+     * Data plane permissions to retrieve the API key material for outbound calls.
+     */
+    static readonly USE_PERMS: string[];
+    /**
+     * All API key credential provider actions used by the L2 grant helpers.
+     */
+    static readonly FULL_ACCESS_PERMS: string[];
+    private constructor();
+}
+/**
+ * IAM actions for AgentCore OAuth2 credential providers (Token Vault).
+ *
+ * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html
+ */
+export declare class OAuth2CredentialProviderIdentityPerms {
+    /**
+     * Read a single OAuth2 credential provider definition.
+     */
+    static readonly READ_PERMS: string[];
+    /**
+     * List OAuth2 credential providers (resource-scoped per IAM service authorization reference).
+     */
+    static readonly LIST_PERMS: string[];
+    /**
+     * Control plane permissions to create, read, update, and delete this provider.
+     */
+    static readonly ADMIN_PERMS: string[];
+    /**
+     * Data plane permissions to complete OAuth flows and retrieve tokens for outbound calls.
+     */
+    static readonly USE_PERMS: string[];
+    /**
+     * All OAuth2 credential provider actions used by the L2 grant helpers.
+     */
+    static readonly FULL_ACCESS_PERMS: string[];
+    private constructor();
+}
+/**
+ * IAM actions for AgentCore workload identities.
+ *
+ * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html
+ */
+export declare class WorkloadIdentityPerms {
+    /**
+     * Read a single workload identity.
+     */
+    static readonly READ_PERMS: string[];
+    /**
+     * List workload identities (resource-scoped per IAM service authorization reference).
+     */
+    static readonly LIST_PERMS: string[];
+    /**
+     * Control plane permissions to create, read, update, and delete this workload identity.
+     */
+    static readonly ADMIN_PERMS: string[];
+    /**
+     * Data plane permissions to mint workload access tokens.
+     *
+     * These actions require both the workload identity ARN and the
+     * workload-identity-directory ARN as resource scope.
+     *
+     * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html
+     */
+    static readonly USE_PERMS: string[];
+    /**
+     * All workload identity actions used by the L2 grant helpers.
+     */
+    static readonly FULL_ACCESS_PERMS: string[];
+    private constructor();
+}

package/lib/identity/perms.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadIdentityPerms = exports.OAuth2CredentialProviderIdentityPerms = exports.ApiKeyCredentialProviderIdentityPerms = exports.TOKEN_VAULT_CREDENTIAL_SECRET_WRITE_PERMS = exports.TOKEN_VAULT_CREDENTIAL_SECRET_READ_PERMS = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+/**
+ * Secrets Manager actions to read credential material stored for Token Vault providers.
+ *
+ * Outbound gateway targets apply the same actions on the secret ARN; principals that call
+ * `GetResourceApiKey` / `GetResourceOauth2Token` (or that mirror gateway behavior) typically need both
+ * `bedrock-agentcore` data-plane actions and read access to the backing secret.
+ *
+ * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-iam-awsmanpol.html
+ */
+exports.TOKEN_VAULT_CREDENTIAL_SECRET_READ_PERMS = [
+    'secretsmanager:GetSecretValue',
+    'secretsmanager:DescribeSecret',
+];
+/**
+ * Secrets Manager actions to write credential material for Token Vault providers.
+ *
+ * Create and Update control plane operations (e.g. CreateApiKeyCredentialProvider,
+ * UpdateApiKeyCredentialProvider) store/update the credential in Secrets Manager,
+ * requiring PutSecretValue on the backing secret.
+ */
+exports.TOKEN_VAULT_CREDENTIAL_SECRET_WRITE_PERMS = [
+    'secretsmanager:PutSecretValue',
+];
+/**
+ * IAM actions for AgentCore API key credential providers (Token Vault).
+ *
+ * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html
+ */
+class ApiKeyCredentialProviderIdentityPerms {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialProviderIdentityPerms", version: "2.254.0-alpha.0" };
+    /**
+     * Read a single API key credential provider definition.
+     */
+    static READ_PERMS = ['bedrock-agentcore:GetApiKeyCredentialProvider'];
+    /**
+     * List API key credential providers (resource-scoped per IAM service authorization reference).
+     */
+    static LIST_PERMS = ['bedrock-agentcore:ListApiKeyCredentialProviders'];
+    /**
+     * Control plane permissions to create, read, update, and delete this provider.
+     */
+    static ADMIN_PERMS = [
+        'bedrock-agentcore:CreateApiKeyCredentialProvider',
+        'bedrock-agentcore:GetApiKeyCredentialProvider',
+        'bedrock-agentcore:UpdateApiKeyCredentialProvider',
+        'bedrock-agentcore:DeleteApiKeyCredentialProvider',
+    ];
+    /**
+     * Data plane permissions to retrieve the API key material for outbound calls.
+     */
+    static USE_PERMS = ['bedrock-agentcore:GetResourceApiKey'];
+    /**
+     * All API key credential provider actions used by the L2 grant helpers.
+     */
+    static FULL_ACCESS_PERMS = [
+        ...new Set([
+            ...ApiKeyCredentialProviderIdentityPerms.READ_PERMS,
+            ...ApiKeyCredentialProviderIdentityPerms.LIST_PERMS,
+            ...ApiKeyCredentialProviderIdentityPerms.ADMIN_PERMS,
+            ...ApiKeyCredentialProviderIdentityPerms.USE_PERMS,
+        ]),
+    ];
+    constructor() { }
+}
+exports.ApiKeyCredentialProviderIdentityPerms = ApiKeyCredentialProviderIdentityPerms;
+/**
+ * IAM actions for AgentCore OAuth2 credential providers (Token Vault).
+ *
+ * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html
+ */
+class OAuth2CredentialProviderIdentityPerms {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.OAuth2CredentialProviderIdentityPerms", version: "2.254.0-alpha.0" };
+    /**
+     * Read a single OAuth2 credential provider definition.
+     */
+    static READ_PERMS = ['bedrock-agentcore:GetOauth2CredentialProvider'];
+    /**
+     * List OAuth2 credential providers (resource-scoped per IAM service authorization reference).
+     */
+    static LIST_PERMS = ['bedrock-agentcore:ListOauth2CredentialProviders'];
+    /**
+     * Control plane permissions to create, read, update, and delete this provider.
+     */
+    static ADMIN_PERMS = [
+        'bedrock-agentcore:CreateOauth2CredentialProvider',
+        'bedrock-agentcore:GetOauth2CredentialProvider',
+        'bedrock-agentcore:UpdateOauth2CredentialProvider',
+        'bedrock-agentcore:DeleteOauth2CredentialProvider',
+    ];
+    /**
+     * Data plane permissions to complete OAuth flows and retrieve tokens for outbound calls.
+     */
+    static USE_PERMS = [
+        'bedrock-agentcore:GetResourceOauth2Token',
+        'bedrock-agentcore:CompleteResourceTokenAuth',
+    ];
+    /**
+     * All OAuth2 credential provider actions used by the L2 grant helpers.
+     */
+    static FULL_ACCESS_PERMS = [
+        ...new Set([
+            ...OAuth2CredentialProviderIdentityPerms.READ_PERMS,
+            ...OAuth2CredentialProviderIdentityPerms.LIST_PERMS,
+            ...OAuth2CredentialProviderIdentityPerms.ADMIN_PERMS,
+            ...OAuth2CredentialProviderIdentityPerms.USE_PERMS,
+        ]),
+    ];
+    constructor() { }
+}
+exports.OAuth2CredentialProviderIdentityPerms = OAuth2CredentialProviderIdentityPerms;
+/**
+ * IAM actions for AgentCore workload identities.
+ *
+ * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html
+ */
+class WorkloadIdentityPerms {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.WorkloadIdentityPerms", version: "2.254.0-alpha.0" };
+    /**
+     * Read a single workload identity.
+     */
+    static READ_PERMS = ['bedrock-agentcore:GetWorkloadIdentity'];
+    /**
+     * List workload identities (resource-scoped per IAM service authorization reference).
+     */
+    static LIST_PERMS = ['bedrock-agentcore:ListWorkloadIdentities'];
+    /**
+     * Control plane permissions to create, read, update, and delete this workload identity.
+     */
+    static ADMIN_PERMS = [
+        'bedrock-agentcore:CreateWorkloadIdentity',
+        'bedrock-agentcore:GetWorkloadIdentity',
+        'bedrock-agentcore:UpdateWorkloadIdentity',
+        'bedrock-agentcore:DeleteWorkloadIdentity',
+    ];
+    /**
+     * Data plane permissions to mint workload access tokens.
+     *
+     * These actions require both the workload identity ARN and the
+     * workload-identity-directory ARN as resource scope.
+     *
+     * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html
+     */
+    static USE_PERMS = [
+        'bedrock-agentcore:GetWorkloadAccessToken',
+        'bedrock-agentcore:GetWorkloadAccessTokenForJWT',
+        'bedrock-agentcore:GetWorkloadAccessTokenForUserId',
+    ];
+    /**
+     * All workload identity actions used by the L2 grant helpers.
+     */
+    static FULL_ACCESS_PERMS = [
+        ...new Set([
+            ...WorkloadIdentityPerms.READ_PERMS,
+            ...WorkloadIdentityPerms.LIST_PERMS,
+            ...WorkloadIdentityPerms.ADMIN_PERMS,
+            ...WorkloadIdentityPerms.USE_PERMS,
+        ]),
+    ];
+    constructor() { }
+}
+exports.WorkloadIdentityPerms = WorkloadIdentityPerms;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJwZXJtcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7O0FBQUE7Ozs7Ozs7Ozs7O0dBV0c7QUFFSDs7Ozs7Ozs7R0FRRztBQUNVLFFBQUEsd0NBQXdDLEdBQUc7SUFDdEQsK0JBQStCO0lBQy9CLCtCQUErQjtDQUN2QixDQUFDO0FBRVg7Ozs7OztHQU1HO0FBQ1UsUUFBQSx5Q0FBeUMsR0FBRztJQUN2RCwrQkFBK0I7Q0FDdkIsQ0FBQztBQUVYOzs7O0dBSUc7QUFDSCxNQUFhLHFDQUFxQzs7SUFDaEQ7O09BRUc7SUFDSSxNQUFNLENBQVUsVUFBVSxHQUFhLENBQUMsK0NBQStDLENBQUMsQ0FBQztJQUVoRzs7T0FFRztJQUNJLE1BQU0sQ0FBVSxVQUFVLEdBQWEsQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO0lBRWxHOztPQUVHO0lBQ0ksTUFBTSxDQUFVLFdBQVcsR0FBYTtRQUM3QyxrREFBa0Q7UUFDbEQsK0NBQStDO1FBQy9DLGtEQUFrRDtRQUNsRCxrREFBa0Q7S0FDbkQsQ0FBQztJQUVGOztPQUVHO0lBQ0ksTUFBTSxDQUFVLFNBQVMsR0FBYSxDQUFDLHFDQUFxQyxDQUFDLENBQUM7SUFFckY7O09BRUc7SUFDSSxNQUFNLENBQVUsaUJBQWlCLEdBQWE7UUFDbkQsR0FBRyxJQUFJLEdBQUcsQ0FBQztZQUNULEdBQUcscUNBQXFDLENBQUMsVUFBVTtZQUNuRCxHQUFHLHFDQUFxQyxDQUFDLFVBQVU7WUFDbkQsR0FBRyxxQ0FBcUMsQ0FBQyxXQUFXO1lBQ3BELEdBQUcscUNBQXFDLENBQUMsU0FBUztTQUNuRCxDQUFDO0tBQ0gsQ0FBQztJQUVGLGlCQUF3Qjs7QUF0QzFCLHNGQXVDQztBQUVEOzs7O0dBSUc7QUFDSCxNQUFhLHFDQUFxQzs7SUFDaEQ7O09BRUc7SUFDSSxNQUFNLENBQVUsVUFBVSxHQUFhLENBQUMsK0NBQStDLENBQUMsQ0FBQztJQUVoRzs7T0FFRztJQUNJLE1BQU0sQ0FBVSxVQUFVLEdBQWEsQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO0lBRWxHOztPQUVHO0lBQ0ksTUFBTSxDQUFVLFdBQVcsR0FBYTtRQUM3QyxrREFBa0Q7UUFDbEQsK0NBQStDO1FBQy9DLGtEQUFrRDtRQUNsRCxrREFBa0Q7S0FDbkQsQ0FBQztJQUVGOztPQUVHO0lBQ0ksTUFBTSxDQUFVLFNBQVMsR0FBYTtRQUMzQywwQ0FBMEM7UUFDMUMsNkNBQTZDO0tBQzlDLENBQUM7SUFFRjs7T0FFRztJQUNJLE1BQU0sQ0FBVSxpQkFBaUIsR0FBYTtRQUNuRCxHQUFHLElBQUksR0FBRyxDQUFDO1lBQ1QsR0FBRyxxQ0FBcUMsQ0FBQyxVQUFVO1lBQ25ELEdBQUcscUNBQXFDLENBQUMsVUFBVTtZQUNuRCxHQUFHLHFDQUFxQyxDQUFDLFdBQVc7WUFDcEQsR0FBRyxxQ0FBcUMsQ0FBQyxTQUFTO1NBQ25ELENBQUM7S0FDSCxDQUFDO0lBRUYsaUJBQXdCOztBQXpDMUIsc0ZBMENDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQWEscUJBQXFCOztJQUNoQzs7T0FFRztJQUNJLE1BQU0sQ0FBVSxVQUFVLEdBQWEsQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO0lBRXhGOztPQUVHO0lBQ0ksTUFBTSxDQUFVLFVBQVUsR0FBYSxDQUFDLDBDQUEwQyxDQUFDLENBQUM7SUFFM0Y7O09BRUc7SUFDSSxNQUFNLENBQVUsV0FBVyxHQUFhO1FBQzdDLDBDQUEwQztRQUMxQyx1Q0FBdUM7UUFDdkMsMENBQTBDO1FBQzFDLDBDQUEwQztLQUMzQyxDQUFDO0lBRUY7Ozs7Ozs7T0FPRztJQUNJLE1BQU0sQ0FBVSxTQUFTLEdBQWE7UUFDM0MsMENBQTBDO1FBQzFDLGdEQUFnRDtRQUNoRCxtREFBbUQ7S0FDcEQsQ0FBQztJQUVGOztPQUVHO0lBQ0ksTUFBTSxDQUFVLGlCQUFpQixHQUFhO1FBQ25ELEdBQUcsSUFBSSxHQUFHLENBQUM7WUFDVCxHQUFHLHFCQUFxQixDQUFDLFVBQVU7WUFDbkMsR0FBRyxxQkFBcUIsQ0FBQyxVQUFVO1lBQ25DLEdBQUcscUJBQXFCLENBQUMsV0FBVztZQUNwQyxHQUFHLHFCQUFxQixDQUFDLFNBQVM7U0FDbkMsQ0FBQztLQUNILENBQUM7SUFFRixpQkFBd0I7O0FBL0MxQixzREFnREMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqICBDb3B5cmlnaHQgQW1hem9uLmNvbSwgSW5jLiBvciBpdHMgYWZmaWxpYXRlcy4gQWxsIFJpZ2h0cyBSZXNlcnZlZC5cbiAqXG4gKiAgTGljZW5zZWQgdW5kZXIgdGhlIEFwYWNoZSBMaWNlbnNlLCBWZXJzaW9uIDIuMCAodGhlIFwiTGljZW5zZVwiKS4gWW91IG1heSBub3QgdXNlIHRoaXMgZmlsZSBleGNlcHQgaW4gY29tcGxpYW5jZVxuICogIHdpdGggdGhlIExpY2Vuc2UuIEEgY29weSBvZiB0aGUgTGljZW5zZSBpcyBsb2NhdGVkIGF0XG4gKlxuICogICAgICBodHRwOi8vd3d3LmFwYWNoZS5vcmcvbGljZW5zZXMvTElDRU5TRS0yLjBcbiAqXG4gKiAgb3IgaW4gdGhlICdsaWNlbnNlJyBmaWxlIGFjY29tcGFueWluZyB0aGlzIGZpbGUuIFRoaXMgZmlsZSBpcyBkaXN0cmlidXRlZCBvbiBhbiAnQVMgSVMnIEJBU0lTLCBXSVRIT1VUIFdBUlJBTlRJRVNcbiAqICBPUiBDT05ESVRJT05TIE9GIEFOWSBLSU5ELCBleHByZXNzIG9yIGltcGxpZWQuIFNlZSB0aGUgTGljZW5zZSBmb3IgdGhlIHNwZWNpZmljIGxhbmd1YWdlIGdvdmVybmluZyBwZXJtaXNzaW9uc1xuICogIGFuZCBsaW1pdGF0aW9ucyB1bmRlciB0aGUgTGljZW5zZS5cbiAqL1xuXG4vKipcbiAqIFNlY3JldHMgTWFuYWdlciBhY3Rpb25zIHRvIHJlYWQgY3JlZGVudGlhbCBtYXRlcmlhbCBzdG9yZWQgZm9yIFRva2VuIFZhdWx0IHByb3ZpZGVycy5cbiAqXG4gKiBPdXRib3VuZCBnYXRld2F5IHRhcmdldHMgYXBwbHkgdGhlIHNhbWUgYWN0aW9ucyBvbiB0aGUgc2VjcmV0IEFSTjsgcHJpbmNpcGFscyB0aGF0IGNhbGxcbiAqIGBHZXRSZXNvdXJjZUFwaUtleWAgLyBgR2V0UmVzb3VyY2VPYXV0aDJUb2tlbmAgKG9yIHRoYXQgbWlycm9yIGdhdGV3YXkgYmVoYXZpb3IpIHR5cGljYWxseSBuZWVkIGJvdGhcbiAqIGBiZWRyb2NrLWFnZW50Y29yZWAgZGF0YS1wbGFuZSBhY3Rpb25zIGFuZCByZWFkIGFjY2VzcyB0byB0aGUgYmFja2luZyBzZWNyZXQuXG4gKlxuICogQHNlZSBodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vYmVkcm9jay1hZ2VudGNvcmUvbGF0ZXN0L2Rldmd1aWRlL3NlY3VyaXR5LWlhbS1hd3NtYW5wb2wuaHRtbFxuICovXG5leHBvcnQgY29uc3QgVE9LRU5fVkFVTFRfQ1JFREVOVElBTF9TRUNSRVRfUkVBRF9QRVJNUyA9IFtcbiAgJ3NlY3JldHNtYW5hZ2VyOkdldFNlY3JldFZhbHVlJyxcbiAgJ3NlY3JldHNtYW5hZ2VyOkRlc2NyaWJlU2VjcmV0Jyxcbl0gYXMgY29uc3Q7XG5cbi8qKlxuICogU2VjcmV0cyBNYW5hZ2VyIGFjdGlvbnMgdG8gd3JpdGUgY3JlZGVudGlhbCBtYXRlcmlhbCBmb3IgVG9rZW4gVmF1bHQgcHJvdmlkZXJzLlxuICpcbiAqIENyZWF0ZSBhbmQgVXBkYXRlIGNvbnRyb2wgcGxhbmUgb3BlcmF0aW9ucyAoZS5nLiBDcmVhdGVBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXIsXG4gKiBVcGRhdGVBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXIpIHN0b3JlL3VwZGF0ZSB0aGUgY3JlZGVudGlhbCBpbiBTZWNyZXRzIE1hbmFnZXIsXG4gKiByZXF1aXJpbmcgUHV0U2VjcmV0VmFsdWUgb24gdGhlIGJhY2tpbmcgc2VjcmV0LlxuICovXG5leHBvcnQgY29uc3QgVE9LRU5fVkFVTFRfQ1JFREVOVElBTF9TRUNSRVRfV1JJVEVfUEVSTVMgPSBbXG4gICdzZWNyZXRzbWFuYWdlcjpQdXRTZWNyZXRWYWx1ZScsXG5dIGFzIGNvbnN0O1xuXG4vKipcbiAqIElBTSBhY3Rpb25zIGZvciBBZ2VudENvcmUgQVBJIGtleSBjcmVkZW50aWFsIHByb3ZpZGVycyAoVG9rZW4gVmF1bHQpLlxuICpcbiAqIEBzZWUgaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL3NlcnZpY2UtYXV0aG9yaXphdGlvbi9sYXRlc3QvcmVmZXJlbmNlL2xpc3RfYW1hem9uYmVkcm9ja2FnZW50Y29yZS5odG1sXG4gKi9cbmV4cG9ydCBjbGFzcyBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJJZGVudGl0eVBlcm1zIHtcbiAgLyoqXG4gICAqIFJlYWQgYSBzaW5nbGUgQVBJIGtleSBjcmVkZW50aWFsIHByb3ZpZGVyIGRlZmluaXRpb24uXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHJlYWRvbmx5IFJFQURfUEVSTVM6IHN0cmluZ1tdID0gWydiZWRyb2NrLWFnZW50Y29yZTpHZXRBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXInXTtcblxuICAvKipcbiAgICogTGlzdCBBUEkga2V5IGNyZWRlbnRpYWwgcHJvdmlkZXJzIChyZXNvdXJjZS1zY29wZWQgcGVyIElBTSBzZXJ2aWNlIGF1dGhvcml6YXRpb24gcmVmZXJlbmNlKS5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgTElTVF9QRVJNUzogc3RyaW5nW10gPSBbJ2JlZHJvY2stYWdlbnRjb3JlOkxpc3RBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJzJ107XG5cbiAgLyoqXG4gICAqIENvbnRyb2wgcGxhbmUgcGVybWlzc2lvbnMgdG8gY3JlYXRlLCByZWFkLCB1cGRhdGUsIGFuZCBkZWxldGUgdGhpcyBwcm92aWRlci5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgQURNSU5fUEVSTVM6IHN0cmluZ1tdID0gW1xuICAgICdiZWRyb2NrLWFnZW50Y29yZTpDcmVhdGVBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXInLFxuICAgICdiZWRyb2NrLWFnZW50Y29yZTpHZXRBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXInLFxuICAgICdiZWRyb2NrLWFnZW50Y29yZTpVcGRhdGVBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXInLFxuICAgICdiZWRyb2NrLWFnZW50Y29yZTpEZWxldGVBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXInLFxuICBdO1xuXG4gIC8qKlxuICAgKiBEYXRhIHBsYW5lIHBlcm1pc3Npb25zIHRvIHJldHJpZXZlIHRoZSBBUEkga2V5IG1hdGVyaWFsIGZvciBvdXRib3VuZCBjYWxscy5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgVVNFX1BFUk1TOiBzdHJpbmdbXSA9IFsnYmVkcm9jay1hZ2VudGNvcmU6R2V0UmVzb3VyY2VBcGlLZXknXTtcblxuICAvKipcbiAgICogQWxsIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlciBhY3Rpb25zIHVzZWQgYnkgdGhlIEwyIGdyYW50IGhlbHBlcnMuXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHJlYWRvbmx5IEZVTExfQUNDRVNTX1BFUk1TOiBzdHJpbmdbXSA9IFtcbiAgICAuLi5uZXcgU2V0KFtcbiAgICAgIC4uLkFwaUtleUNyZWRlbnRpYWxQcm92aWRlcklkZW50aXR5UGVybXMuUkVBRF9QRVJNUyxcbiAgICAgIC4uLkFwaUtleUNyZWRlbnRpYWxQcm92aWRlcklkZW50aXR5UGVybXMuTElTVF9QRVJNUyxcbiAgICAgIC4uLkFwaUtleUNyZWRlbnRpYWxQcm92aWRlcklkZW50aXR5UGVybXMuQURNSU5fUEVSTVMsXG4gICAgICAuLi5BcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJJZGVudGl0eVBlcm1zLlVTRV9QRVJNUyxcbiAgICBdKSxcbiAgXTtcblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKCkge31cbn1cblxuLyoqXG4gKiBJQU0gYWN0aW9ucyBmb3IgQWdlbnRDb3JlIE9BdXRoMiBjcmVkZW50aWFsIHByb3ZpZGVycyAoVG9rZW4gVmF1bHQpLlxuICpcbiAqIEBzZWUgaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL3NlcnZpY2UtYXV0aG9yaXphdGlvbi9sYXRlc3QvcmVmZXJlbmNlL2xpc3RfYW1hem9uYmVkcm9ja2FnZW50Y29yZS5odG1sXG4gKi9cbmV4cG9ydCBjbGFzcyBPQXV0aDJDcmVkZW50aWFsUHJvdmlkZXJJZGVudGl0eVBlcm1zIHtcbiAgLyoqXG4gICAqIFJlYWQgYSBzaW5nbGUgT0F1dGgyIGNyZWRlbnRpYWwgcHJvdmlkZXIgZGVmaW5pdGlvbi5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgUkVBRF9QRVJNUzogc3RyaW5nW10gPSBbJ2JlZHJvY2stYWdlbnRjb3JlOkdldE9hdXRoMkNyZWRlbnRpYWxQcm92aWRlciddO1xuXG4gIC8qKlxuICAgKiBMaXN0IE9BdXRoMiBjcmVkZW50aWFsIHByb3ZpZGVycyAocmVzb3VyY2Utc2NvcGVkIHBlciBJQU0gc2VydmljZSBhdXRob3JpemF0aW9uIHJlZmVyZW5jZSkuXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHJlYWRvbmx5IExJU1RfUEVSTVM6IHN0cmluZ1tdID0gWydiZWRyb2NrLWFnZW50Y29yZTpMaXN0T2F1dGgyQ3JlZGVudGlhbFByb3ZpZGVycyddO1xuXG4gIC8qKlxuICAgKiBDb250cm9sIHBsYW5lIHBlcm1pc3Npb25zIHRvIGNyZWF0ZSwgcmVhZCwgdXBkYXRlLCBhbmQgZGVsZXRlIHRoaXMgcHJvdmlkZXIuXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHJlYWRvbmx5IEFETUlOX1BFUk1TOiBzdHJpbmdbXSA9IFtcbiAgICAnYmVkcm9jay1hZ2VudGNvcmU6Q3JlYXRlT2F1dGgyQ3JlZGVudGlhbFByb3ZpZGVyJyxcbiAgICAnYmVkcm9jay1hZ2VudGNvcmU6R2V0T2F1dGgyQ3JlZGVudGlhbFByb3ZpZGVyJyxcbiAgICAnYmVkcm9jay1hZ2VudGNvcmU6VXBkYXRlT2F1dGgyQ3JlZGVudGlhbFByb3ZpZGVyJyxcbiAgICAnYmVkcm9jay1hZ2VudGNvcmU6RGVsZXRlT2F1dGgyQ3JlZGVudGlhbFByb3ZpZGVyJyxcbiAgXTtcblxuICAvKipcbiAgICogRGF0YSBwbGFuZSBwZXJtaXNzaW9ucyB0byBjb21wbGV0ZSBPQXV0aCBmbG93cyBhbmQgcmV0cmlldmUgdG9rZW5zIGZvciBvdXRib3VuZCBjYWxscy5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgVVNFX1BFUk1TOiBzdHJpbmdbXSA9IFtcbiAgICAnYmVkcm9jay1hZ2VudGNvcmU6R2V0UmVzb3VyY2VPYXV0aDJUb2tlbicsXG4gICAgJ2JlZHJvY2stYWdlbnRjb3JlOkNvbXBsZXRlUmVzb3VyY2VUb2tlbkF1dGgnLFxuICBdO1xuXG4gIC8qKlxuICAgKiBBbGwgT0F1dGgyIGNyZWRlbnRpYWwgcHJvdmlkZXIgYWN0aW9ucyB1c2VkIGJ5IHRoZSBMMiBncmFudCBoZWxwZXJzLlxuICAgKi9cbiAgcHVibGljIHN0YXRpYyByZWFkb25seSBGVUxMX0FDQ0VTU19QRVJNUzogc3RyaW5nW10gPSBbXG4gICAgLi4ubmV3IFNldChbXG4gICAgICAuLi5PQXV0aDJDcmVkZW50aWFsUHJvdmlkZXJJZGVudGl0eVBlcm1zLlJFQURfUEVSTVMsXG4gICAgICAuLi5PQXV0aDJDcmVkZW50aWFsUHJvdmlkZXJJZGVudGl0eVBlcm1zLkxJU1RfUEVSTVMsXG4gICAgICAuLi5PQXV0aDJDcmVkZW50aWFsUHJvdmlkZXJJZGVudGl0eVBlcm1zLkFETUlOX1BFUk1TLFxuICAgICAgLi4uT0F1dGgyQ3JlZGVudGlhbFByb3ZpZGVySWRlbnRpdHlQZXJtcy5VU0VfUEVSTVMsXG4gICAgXSksXG4gIF07XG5cbiAgcHJpdmF0ZSBjb25zdHJ1Y3RvcigpIHt9XG59XG5cbi8qKlxuICogSUFNIGFjdGlvbnMgZm9yIEFnZW50Q29yZSB3b3JrbG9hZCBpZGVudGl0aWVzLlxuICpcbiAqIEBzZWUgaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL3NlcnZpY2UtYXV0aG9yaXphdGlvbi9sYXRlc3QvcmVmZXJlbmNlL2xpc3RfYW1hem9uYmVkcm9ja2FnZW50Y29yZS5odG1sXG4gKi9cbmV4cG9ydCBjbGFzcyBXb3JrbG9hZElkZW50aXR5UGVybXMge1xuICAvKipcbiAgICogUmVhZCBhIHNpbmdsZSB3b3JrbG9hZCBpZGVudGl0eS5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgUkVBRF9QRVJNUzogc3RyaW5nW10gPSBbJ2JlZHJvY2stYWdlbnRjb3JlOkdldFdvcmtsb2FkSWRlbnRpdHknXTtcblxuICAvKipcbiAgICogTGlzdCB3b3JrbG9hZCBpZGVudGl0aWVzIChyZXNvdXJjZS1zY29wZWQgcGVyIElBTSBzZXJ2aWNlIGF1dGhvcml6YXRpb24gcmVmZXJlbmNlKS5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgTElTVF9QRVJNUzogc3RyaW5nW10gPSBbJ2JlZHJvY2stYWdlbnRjb3JlOkxpc3RXb3JrbG9hZElkZW50aXRpZXMnXTtcblxuICAvKipcbiAgICogQ29udHJvbCBwbGFuZSBwZXJtaXNzaW9ucyB0byBjcmVhdGUsIHJlYWQsIHVwZGF0ZSwgYW5kIGRlbGV0ZSB0aGlzIHdvcmtsb2FkIGlkZW50aXR5LlxuICAgKi9cbiAgcHVibGljIHN0YXRpYyByZWFkb25seSBBRE1JTl9QRVJNUzogc3RyaW5nW10gPSBbXG4gICAgJ2JlZHJvY2stYWdlbnRjb3JlOkNyZWF0ZVdvcmtsb2FkSWRlbnRpdHknLFxuICAgICdiZWRyb2NrLWFnZW50Y29yZTpHZXRXb3JrbG9hZElkZW50aXR5JyxcbiAgICAnYmVkcm9jay1hZ2VudGNvcmU6VXBkYXRlV29ya2xvYWRJZGVudGl0eScsXG4gICAgJ2JlZHJvY2stYWdlbnRjb3JlOkRlbGV0ZVdvcmtsb2FkSWRlbnRpdHknLFxuICBdO1xuXG4gIC8qKlxuICAgKiBEYXRhIHBsYW5lIHBlcm1pc3Npb25zIHRvIG1pbnQgd29ya2xvYWQgYWNjZXNzIHRva2Vucy5cbiAgICpcbiAgICogVGhlc2UgYWN0aW9ucyByZXF1aXJlIGJvdGggdGhlIHdvcmtsb2FkIGlkZW50aXR5IEFSTiBhbmQgdGhlXG4gICAqIHdvcmtsb2FkLWlkZW50aXR5LWRpcmVjdG9yeSBBUk4gYXMgcmVzb3VyY2Ugc2NvcGUuXG4gICAqXG4gICAqIEBzZWUgaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL3NlcnZpY2UtYXV0aG9yaXphdGlvbi9sYXRlc3QvcmVmZXJlbmNlL2xpc3RfYW1hem9uYmVkcm9ja2FnZW50Y29yZS5odG1sXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHJlYWRvbmx5IFVTRV9QRVJNUzogc3RyaW5nW10gPSBbXG4gICAgJ2JlZHJvY2stYWdlbnRjb3JlOkdldFdvcmtsb2FkQWNjZXNzVG9rZW4nLFxuICAgICdiZWRyb2NrLWFnZW50Y29yZTpHZXRXb3JrbG9hZEFjY2Vzc1Rva2VuRm9ySldUJyxcbiAgICAnYmVkcm9jay1hZ2VudGNvcmU6R2V0V29ya2xvYWRBY2Nlc3NUb2tlbkZvclVzZXJJZCcsXG4gIF07XG5cbiAgLyoqXG4gICAqIEFsbCB3b3JrbG9hZCBpZGVudGl0eSBhY3Rpb25zIHVzZWQgYnkgdGhlIEwyIGdyYW50IGhlbHBlcnMuXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHJlYWRvbmx5IEZVTExfQUNDRVNTX1BFUk1TOiBzdHJpbmdbXSA9IFtcbiAgICAuLi5uZXcgU2V0KFtcbiAgICAgIC4uLldvcmtsb2FkSWRlbnRpdHlQZXJtcy5SRUFEX1BFUk1TLFxuICAgICAgLi4uV29ya2xvYWRJZGVudGl0eVBlcm1zLkxJU1RfUEVSTVMsXG4gICAgICAuLi5Xb3JrbG9hZElkZW50aXR5UGVybXMuQURNSU5fUEVSTVMsXG4gICAgICAuLi5Xb3JrbG9hZElkZW50aXR5UGVybXMuVVNFX1BFUk1TLFxuICAgIF0pLFxuICBdO1xuXG4gIHByaXZhdGUgY29uc3RydWN0b3IoKSB7fVxufVxuIl19

package/lib/identity/validation-helpers.d.ts

@@ -0,0 +1,61 @@
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+import type { IConstruct } from 'constructs';
+import { throwIfInvalid } from '../memory/validation-helpers';
+/** @internal */
+export declare const CREDENTIAL_PROVIDER_NAME_MIN = 1;
+/** @internal */
+export declare const CREDENTIAL_PROVIDER_NAME_MAX = 128;
+/** @internal */
+export declare const CREDENTIAL_PROVIDER_NAME_PATTERN: RegExp;
+/** @internal */
+export declare const API_KEY_VALUE_MIN = 1;
+/** @internal */
+export declare const API_KEY_VALUE_MAX = 65536;
+/** @internal */
+export declare const CREDENTIAL_PROVIDER_TAG_MIN = 1;
+/** @internal */
+export declare const CREDENTIAL_PROVIDER_TAG_MAX = 256;
+/** @internal */
+export declare const WORKLOAD_IDENTITY_NAME_MIN = 3;
+/** @internal */
+export declare const WORKLOAD_IDENTITY_NAME_MAX = 255;
+/** @internal */
+export declare const WORKLOAD_IDENTITY_NAME_PATTERN: RegExp;
+/** @internal */
+export declare const ALLOWED_OAUTH2_RETURN_URL_MIN = 1;
+/** @internal */
+export declare const ALLOWED_OAUTH2_RETURN_URL_MAX = 2048;
+/**
+ * @internal
+ */
+export declare function validateWorkloadIdentityName(name: string, scope?: IConstruct): string[];
+/**
+ * @internal
+ */
+export declare function validateAllowedResourceOauth2ReturnUrls(urls: string[] | undefined, scope?: IConstruct): string[];
+/**
+ * @internal
+ */
+export declare function validateCredentialProviderName(name: string, scope?: IConstruct): string[];
+/**
+ * @internal
+ */
+export declare function validateApiKeyValue(apiKey: string | undefined, scope?: IConstruct): string[];
+/**
+ * @internal
+ */
+export declare function validateCredentialProviderTags(tags?: {
+    [key: string]: string;
+}, scope?: IConstruct): string[];
+export { throwIfInvalid };

package/lib/identity/validation-helpers.js

@@ -0,0 +1,156 @@
+"use strict";
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.throwIfInvalid = exports.ALLOWED_OAUTH2_RETURN_URL_MAX = exports.ALLOWED_OAUTH2_RETURN_URL_MIN = exports.WORKLOAD_IDENTITY_NAME_PATTERN = exports.WORKLOAD_IDENTITY_NAME_MAX = exports.WORKLOAD_IDENTITY_NAME_MIN = exports.CREDENTIAL_PROVIDER_TAG_MAX = exports.CREDENTIAL_PROVIDER_TAG_MIN = exports.API_KEY_VALUE_MAX = exports.API_KEY_VALUE_MIN = exports.CREDENTIAL_PROVIDER_NAME_PATTERN = exports.CREDENTIAL_PROVIDER_NAME_MAX = exports.CREDENTIAL_PROVIDER_NAME_MIN = void 0;
+exports.validateWorkloadIdentityName = validateWorkloadIdentityName;
+exports.validateAllowedResourceOauth2ReturnUrls = validateAllowedResourceOauth2ReturnUrls;
+exports.validateCredentialProviderName = validateCredentialProviderName;
+exports.validateApiKeyValue = validateApiKeyValue;
+exports.validateCredentialProviderTags = validateCredentialProviderTags;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const validation_helpers_1 = require("../memory/validation-helpers");
+Object.defineProperty(exports, "throwIfInvalid", { enumerable: true, get: function () { return validation_helpers_1.throwIfInvalid; } });
+/** @internal */
+exports.CREDENTIAL_PROVIDER_NAME_MIN = 1;
+/** @internal */
+exports.CREDENTIAL_PROVIDER_NAME_MAX = 128;
+/** @internal */
+exports.CREDENTIAL_PROVIDER_NAME_PATTERN = /^[a-zA-Z0-9\-_]+$/;
+/** @internal */
+exports.API_KEY_VALUE_MIN = 1;
+/** @internal */
+exports.API_KEY_VALUE_MAX = 65536;
+/** @internal */
+exports.CREDENTIAL_PROVIDER_TAG_MIN = 1;
+/** @internal */
+exports.CREDENTIAL_PROVIDER_TAG_MAX = 256;
+/** @internal */
+exports.WORKLOAD_IDENTITY_NAME_MIN = 3;
+/** @internal */
+exports.WORKLOAD_IDENTITY_NAME_MAX = 255;
+/** @internal */
+exports.WORKLOAD_IDENTITY_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
+/** @internal */
+exports.ALLOWED_OAUTH2_RETURN_URL_MIN = 1;
+/** @internal */
+exports.ALLOWED_OAUTH2_RETURN_URL_MAX = 2048;
+/**
+ * @internal
+ */
+function validateWorkloadIdentityName(name, scope) {
+    const errors = [];
+    errors.push(...(0, validation_helpers_1.validateStringFieldLength)({
+        value: name,
+        fieldName: 'Workload identity name',
+        minLength: exports.WORKLOAD_IDENTITY_NAME_MIN,
+        maxLength: exports.WORKLOAD_IDENTITY_NAME_MAX,
+    }, scope));
+    errors.push(...(0, validation_helpers_1.validateFieldPattern)(name, 'Workload identity name', exports.WORKLOAD_IDENTITY_NAME_PATTERN, 'Workload identity name may only contain letters, numbers, dots, underscores, and hyphens.', scope));
+    return errors;
+}
+/**
+ * @internal
+ */
+function validateAllowedResourceOauth2ReturnUrls(urls, scope) {
+    if (urls == null) {
+        return [];
+    }
+    if (aws_cdk_lib_1.Token.isUnresolved(urls)) {
+        return [];
+    }
+    const errors = [];
+    if (urls.length === 0) {
+        errors.push('Allowed OAuth2 return URLs must contain at least one URL when specified.');
+        return errors;
+    }
+    for (const url of urls) {
+        if (aws_cdk_lib_1.Token.isUnresolved(url)) {
+            continue;
+        }
+        errors.push(...(0, validation_helpers_1.validateStringFieldLength)({
+            value: url,
+            fieldName: 'Allowed OAuth2 return URL',
+            minLength: exports.ALLOWED_OAUTH2_RETURN_URL_MIN,
+            maxLength: exports.ALLOWED_OAUTH2_RETURN_URL_MAX,
+        }, scope));
+    }
+    return errors;
+}
+/**
+ * @internal
+ */
+function validateCredentialProviderName(name, scope) {
+    const errors = [];
+    errors.push(...(0, validation_helpers_1.validateStringFieldLength)({
+        value: name,
+        fieldName: 'Credential provider name',
+        minLength: exports.CREDENTIAL_PROVIDER_NAME_MIN,
+        maxLength: exports.CREDENTIAL_PROVIDER_NAME_MAX,
+    }, scope));
+    errors.push(...(0, validation_helpers_1.validateFieldPattern)(name, 'Credential provider name', exports.CREDENTIAL_PROVIDER_NAME_PATTERN, 'Credential provider name may only contain letters, numbers, hyphens, and underscores.', scope));
+    return errors;
+}
+/**
+ * @internal
+ */
+function validateApiKeyValue(apiKey, scope) {
+    if (apiKey == null || apiKey === '') {
+        return [];
+    }
+    if (aws_cdk_lib_1.Token.isUnresolved(apiKey)) {
+        return [];
+    }
+    return (0, validation_helpers_1.validateStringFieldLength)({
+        value: apiKey,
+        fieldName: 'API key',
+        minLength: exports.API_KEY_VALUE_MIN,
+        maxLength: exports.API_KEY_VALUE_MAX,
+    }, scope);
+}
+/**
+ * @internal
+ */
+function validateCredentialProviderTags(tags, scope) {
+    let errors = [];
+    if (tags === undefined) {
+        return errors;
+    }
+    if (aws_cdk_lib_1.Token.isUnresolved(tags)) {
+        return errors;
+    }
+    const validKeyPattern = /^[a-zA-Z0-9\s._:/=+@-]*$/;
+    const validValuePattern = /^[a-zA-Z0-9\s._:/=+@-]*$/;
+    for (const [key, value] of Object.entries(tags)) {
+        if (!aws_cdk_lib_1.Token.isUnresolved(key)) {
+            errors.push(...(0, validation_helpers_1.validateStringFieldLength)({
+                value: key,
+                fieldName: 'Tag key',
+                minLength: exports.CREDENTIAL_PROVIDER_TAG_MIN,
+                maxLength: exports.CREDENTIAL_PROVIDER_TAG_MAX,
+            }, scope));
+            errors.push(...(0, validation_helpers_1.validateFieldPattern)(key, 'Tag key', validKeyPattern, undefined, scope));
+        }
+        if (!aws_cdk_lib_1.Token.isUnresolved(value)) {
+            errors.push(...(0, validation_helpers_1.validateStringFieldLength)({
+                value,
+                fieldName: 'Tag value',
+                minLength: exports.CREDENTIAL_PROVIDER_TAG_MIN,
+                maxLength: exports.CREDENTIAL_PROVIDER_TAG_MAX,
+            }, scope));
+            errors.push(...(0, validation_helpers_1.validateFieldPattern)(value, 'Tag value', validValuePattern, undefined, scope));
+        }
+    }
+    return errors;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdGlvbi1oZWxwZXJzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsidmFsaWRhdGlvbi1oZWxwZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQTs7Ozs7Ozs7Ozs7R0FXRzs7O0FBNkNILG9FQWdCQztBQUtELDBGQXdCQztBQUtELHdFQWdCQztBQUtELGtEQWFDO0FBS0Qsd0VBbUNDO0FBdktELDZDQUFvQztBQUVwQyxxRUFBK0c7QUF1S3RHLCtGQXZLaUQsbUNBQWMsT0F1S2pEO0FBckt2QixnQkFBZ0I7QUFDSCxRQUFBLDRCQUE0QixHQUFHLENBQUMsQ0FBQztBQUU5QyxnQkFBZ0I7QUFDSCxRQUFBLDRCQUE0QixHQUFHLEdBQUcsQ0FBQztBQUVoRCxnQkFBZ0I7QUFDSCxRQUFBLGdDQUFnQyxHQUFHLG1CQUFtQixDQUFDO0FBRXBFLGdCQUFnQjtBQUNILFFBQUEsaUJBQWlCLEdBQUcsQ0FBQyxDQUFDO0FBRW5DLGdCQUFnQjtBQUNILFFBQUEsaUJBQWlCLEdBQUcsS0FBSyxDQUFDO0FBRXZDLGdCQUFnQjtBQUNILFFBQUEsMkJBQTJCLEdBQUcsQ0FBQyxDQUFDO0FBRTdDLGdCQUFnQjtBQUNILFFBQUEsMkJBQTJCLEdBQUcsR0FBRyxDQUFDO0FBRS9DLGdCQUFnQjtBQUNILFFBQUEsMEJBQTBCLEdBQUcsQ0FBQyxDQUFDO0FBRTVDLGdCQUFnQjtBQUNILFFBQUEsMEJBQTBCLEdBQUcsR0FBRyxDQUFDO0FBRTlDLGdCQUFnQjtBQUNILFFBQUEsOEJBQThCLEdBQUcsbUJBQW1CLENBQUM7QUFFbEUsZ0JBQWdCO0FBQ0gsUUFBQSw2QkFBNkIsR0FBRyxDQUFDLENBQUM7QUFFL0MsZ0JBQWdCO0FBQ0gsUUFBQSw2QkFBNkIsR0FBRyxJQUFJLENBQUM7QUFFbEQ7O0dBRUc7QUFDSCxTQUFnQiw0QkFBNEIsQ0FBQyxJQUFZLEVBQUUsS0FBa0I7SUFDM0UsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFBLDhDQUF5QixFQUFDO1FBQ3ZDLEtBQUssRUFBRSxJQUFJO1FBQ1gsU0FBUyxFQUFFLHdCQUF3QjtRQUNuQyxTQUFTLEVBQUUsa0NBQTBCO1FBQ3JDLFNBQVMsRUFBRSxrQ0FBMEI7S0FDdEMsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ1gsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUEseUNBQW9CLEVBQ2pDLElBQUksRUFDSix3QkFBd0IsRUFDeEIsc0NBQThCLEVBQzlCLDJGQUEyRixFQUMzRixLQUFLLENBQ04sQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVEOztHQUVHO0FBQ0gsU0FBZ0IsdUNBQXVDLENBQUMsSUFBMEIsRUFBRSxLQUFrQjtJQUNwRyxJQUFJLElBQUksSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUNqQixPQUFPLEVBQUUsQ0FBQztJQUNaLENBQUM7SUFDRCxJQUFJLG1CQUFLLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDN0IsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUN0QixNQUFNLENBQUMsSUFBSSxDQUFDLDBFQUEwRSxDQUFDLENBQUM7UUFDeEYsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7UUFDdkIsSUFBSSxtQkFBSyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzVCLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUEsOENBQXlCLEVBQUM7WUFDdkMsS0FBSyxFQUFFLEdBQUc7WUFDVixTQUFTLEVBQUUsMkJBQTJCO1lBQ3RDLFNBQVMsRUFBRSxxQ0FBNkI7WUFDeEMsU0FBUyxFQUFFLHFDQUE2QjtTQUN6QyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDYixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVEOztHQUVHO0FBQ0gsU0FBZ0IsOEJBQThCLENBQUMsSUFBWSxFQUFFLEtBQWtCO0lBQzdFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBQSw4Q0FBeUIsRUFBQztRQUN2QyxLQUFLLEVBQUUsSUFBSTtRQUNYLFNBQVMsRUFBRSwwQkFBMEI7UUFDckMsU0FBUyxFQUFFLG9DQUE0QjtRQUN2QyxTQUFTLEVBQUUsb0NBQTRCO0tBQ3hDLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNYLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFBLHlDQUFvQixFQUNqQyxJQUFJLEVBQ0osMEJBQTBCLEVBQzFCLHdDQUFnQyxFQUNoQyx1RkFBdUYsRUFDdkYsS0FBSyxDQUNOLENBQUMsQ0FBQztJQUNILE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUM7QUFFRDs7R0FFRztBQUNILFNBQWdCLG1CQUFtQixDQUFDLE1BQTBCLEVBQUUsS0FBa0I7SUFDaEYsSUFBSSxNQUFNLElBQUksSUFBSSxJQUFJLE1BQU0sS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUNwQyxPQUFPLEVBQUUsQ0FBQztJQUNaLENBQUM7SUFDRCxJQUFJLG1CQUFLLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDL0IsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQ0QsT0FBTyxJQUFBLDhDQUF5QixFQUFDO1FBQy9CLEtBQUssRUFBRSxNQUFNO1FBQ2IsU0FBUyxFQUFFLFNBQVM7UUFDcEIsU0FBUyxFQUFFLHlCQUFpQjtRQUM1QixTQUFTLEVBQUUseUJBQWlCO0tBQzdCLEVBQUUsS0FBSyxDQUFDLENBQUM7QUFDWixDQUFDO0FBRUQ7O0dBRUc7QUFDSCxTQUFnQiw4QkFBOEIsQ0FBQyxJQUFnQyxFQUFFLEtBQWtCO0lBQ2pHLElBQUksTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUMxQixJQUFJLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN2QixPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxtQkFBSyxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzdCLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFFRCxNQUFNLGVBQWUsR0FBRywwQkFBMEIsQ0FBQztJQUNuRCxNQUFNLGlCQUFpQixHQUFHLDBCQUEwQixDQUFDO0lBRXJELEtBQUssTUFBTSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDaEQsSUFBSSxDQUFDLG1CQUFLLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDN0IsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUEsOENBQXlCLEVBQUM7Z0JBQ3ZDLEtBQUssRUFBRSxHQUFHO2dCQUNWLFNBQVMsRUFBRSxTQUFTO2dCQUNwQixTQUFTLEVBQUUsbUNBQTJCO2dCQUN0QyxTQUFTLEVBQUUsbUNBQTJCO2FBQ3ZDLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQztZQUNYLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFBLHlDQUFvQixFQUFDLEdBQUcsRUFBRSxTQUFTLEVBQUUsZUFBZSxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQzFGLENBQUM7UUFFRCxJQUFJLENBQUMsbUJBQUssQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMvQixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBQSw4Q0FBeUIsRUFBQztnQkFDdkMsS0FBSztnQkFDTCxTQUFTLEVBQUUsV0FBVztnQkFDdEIsU0FBUyxFQUFFLG1DQUEyQjtnQkFDdEMsU0FBUyxFQUFFLG1DQUEyQjthQUN2QyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUM7WUFDWCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBQSx5Q0FBb0IsRUFBQyxLQUFLLEVBQUUsV0FBVyxFQUFFLGlCQUFpQixFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ2hHLENBQUM7SUFDSCxDQUFDO0lBRUQsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogIENvcHlyaWdodCBBbWF6b24uY29tLCBJbmMuIG9yIGl0cyBhZmZpbGlhdGVzLiBBbGwgUmlnaHRzIFJlc2VydmVkLlxuICpcbiAqICBMaWNlbnNlZCB1bmRlciB0aGUgQXBhY2hlIExpY2Vuc2UsIFZlcnNpb24gMi4wICh0aGUgXCJMaWNlbnNlXCIpLiBZb3UgbWF5IG5vdCB1c2UgdGhpcyBmaWxlIGV4Y2VwdCBpbiBjb21wbGlhbmNlXG4gKiAgd2l0aCB0aGUgTGljZW5zZS4gQSBjb3B5IG9mIHRoZSBMaWNlbnNlIGlzIGxvY2F0ZWQgYXRcbiAqXG4gKiAgICAgIGh0dHA6Ly93d3cuYXBhY2hlLm9yZy9saWNlbnNlcy9MSUNFTlNFLTIuMFxuICpcbiAqICBvciBpbiB0aGUgJ2xpY2Vuc2UnIGZpbGUgYWNjb21wYW55aW5nIHRoaXMgZmlsZS4gVGhpcyBmaWxlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICdBUyBJUycgQkFTSVMsIFdJVEhPVVQgV0FSUkFOVElFU1xuICogIE9SIENPTkRJVElPTlMgT0YgQU5ZIEtJTkQsIGV4cHJlc3Mgb3IgaW1wbGllZC4gU2VlIHRoZSBMaWNlbnNlIGZvciB0aGUgc3BlY2lmaWMgbGFuZ3VhZ2UgZ292ZXJuaW5nIHBlcm1pc3Npb25zXG4gKiAgYW5kIGxpbWl0YXRpb25zIHVuZGVyIHRoZSBMaWNlbnNlLlxuICovXG5cbmltcG9ydCB7IFRva2VuIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHR5cGUgeyBJQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyB2YWxpZGF0ZUZpZWxkUGF0dGVybiwgdmFsaWRhdGVTdHJpbmdGaWVsZExlbmd0aCwgdGhyb3dJZkludmFsaWQgfSBmcm9tICcuLi9tZW1vcnkvdmFsaWRhdGlvbi1oZWxwZXJzJztcblxuLyoqIEBpbnRlcm5hbCAqL1xuZXhwb3J0IGNvbnN0IENSRURFTlRJQUxfUFJPVklERVJfTkFNRV9NSU4gPSAxO1xuXG4vKiogQGludGVybmFsICovXG5leHBvcnQgY29uc3QgQ1JFREVOVElBTF9QUk9WSURFUl9OQU1FX01BWCA9IDEyODtcblxuLyoqIEBpbnRlcm5hbCAqL1xuZXhwb3J0IGNvbnN0IENSRURFTlRJQUxfUFJPVklERVJfTkFNRV9QQVRURVJOID0gL15bYS16QS1aMC05XFwtX10rJC87XG5cbi8qKiBAaW50ZXJuYWwgKi9cbmV4cG9ydCBjb25zdCBBUElfS0VZX1ZBTFVFX01JTiA9IDE7XG5cbi8qKiBAaW50ZXJuYWwgKi9cbmV4cG9ydCBjb25zdCBBUElfS0VZX1ZBTFVFX01BWCA9IDY1NTM2O1xuXG4vKiogQGludGVybmFsICovXG5leHBvcnQgY29uc3QgQ1JFREVOVElBTF9QUk9WSURFUl9UQUdfTUlOID0gMTtcblxuLyoqIEBpbnRlcm5hbCAqL1xuZXhwb3J0IGNvbnN0IENSRURFTlRJQUxfUFJPVklERVJfVEFHX01BWCA9IDI1NjtcblxuLyoqIEBpbnRlcm5hbCAqL1xuZXhwb3J0IGNvbnN0IFdPUktMT0FEX0lERU5USVRZX05BTUVfTUlOID0gMztcblxuLyoqIEBpbnRlcm5hbCAqL1xuZXhwb3J0IGNvbnN0IFdPUktMT0FEX0lERU5USVRZX05BTUVfTUFYID0gMjU1O1xuXG4vKiogQGludGVybmFsICovXG5leHBvcnQgY29uc3QgV09SS0xPQURfSURFTlRJVFlfTkFNRV9QQVRURVJOID0gL15bQS1aYS16MC05Xy4tXSskLztcblxuLyoqIEBpbnRlcm5hbCAqL1xuZXhwb3J0IGNvbnN0IEFMTE9XRURfT0FVVEgyX1JFVFVSTl9VUkxfTUlOID0gMTtcblxuLyoqIEBpbnRlcm5hbCAqL1xuZXhwb3J0IGNvbnN0IEFMTE9XRURfT0FVVEgyX1JFVFVSTl9VUkxfTUFYID0gMjA0ODtcblxuLyoqXG4gKiBAaW50ZXJuYWxcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHZhbGlkYXRlV29ya2xvYWRJZGVudGl0eU5hbWUobmFtZTogc3RyaW5nLCBzY29wZT86IElDb25zdHJ1Y3QpOiBzdHJpbmdbXSB7XG4gIGNvbnN0IGVycm9yczogc3RyaW5nW10gPSBbXTtcbiAgZXJyb3JzLnB1c2goLi4udmFsaWRhdGVTdHJpbmdGaWVsZExlbmd0aCh7XG4gICAgdmFsdWU6IG5hbWUsXG4gICAgZmllbGROYW1lOiAnV29ya2xvYWQgaWRlbnRpdHkgbmFtZScsXG4gICAgbWluTGVuZ3RoOiBXT1JLTE9BRF9JREVOVElUWV9OQU1FX01JTixcbiAgICBtYXhMZW5ndGg6IFdPUktMT0FEX0lERU5USVRZX05BTUVfTUFYLFxuICB9LCBzY29wZSkpO1xuICBlcnJvcnMucHVzaCguLi52YWxpZGF0ZUZpZWxkUGF0dGVybihcbiAgICBuYW1lLFxuICAgICdXb3JrbG9hZCBpZGVudGl0eSBuYW1lJyxcbiAgICBXT1JLTE9BRF9JREVOVElUWV9OQU1FX1BBVFRFUk4sXG4gICAgJ1dvcmtsb2FkIGlkZW50aXR5IG5hbWUgbWF5IG9ubHkgY29udGFpbiBsZXR0ZXJzLCBudW1iZXJzLCBkb3RzLCB1bmRlcnNjb3JlcywgYW5kIGh5cGhlbnMuJyxcbiAgICBzY29wZSxcbiAgKSk7XG4gIHJldHVybiBlcnJvcnM7XG59XG5cbi8qKlxuICogQGludGVybmFsXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiB2YWxpZGF0ZUFsbG93ZWRSZXNvdXJjZU9hdXRoMlJldHVyblVybHModXJsczogc3RyaW5nW10gfCB1bmRlZmluZWQsIHNjb3BlPzogSUNvbnN0cnVjdCk6IHN0cmluZ1tdIHtcbiAgaWYgKHVybHMgPT0gbnVsbCkge1xuICAgIHJldHVybiBbXTtcbiAgfVxuICBpZiAoVG9rZW4uaXNVbnJlc29sdmVkKHVybHMpKSB7XG4gICAgcmV0dXJuIFtdO1xuICB9XG4gIGNvbnN0IGVycm9yczogc3RyaW5nW10gPSBbXTtcbiAgaWYgKHVybHMubGVuZ3RoID09PSAwKSB7XG4gICAgZXJyb3JzLnB1c2goJ0FsbG93ZWQgT0F1dGgyIHJldHVybiBVUkxzIG11c3QgY29udGFpbiBhdCBsZWFzdCBvbmUgVVJMIHdoZW4gc3BlY2lmaWVkLicpO1xuICAgIHJldHVybiBlcnJvcnM7XG4gIH1cbiAgZm9yIChjb25zdCB1cmwgb2YgdXJscykge1xuICAgIGlmIChUb2tlbi5pc1VucmVzb2x2ZWQodXJsKSkge1xuICAgICAgY29udGludWU7XG4gICAgfVxuICAgIGVycm9ycy5wdXNoKC4uLnZhbGlkYXRlU3RyaW5nRmllbGRMZW5ndGgoe1xuICAgICAgdmFsdWU6IHVybCxcbiAgICAgIGZpZWxkTmFtZTogJ0FsbG93ZWQgT0F1dGgyIHJldHVybiBVUkwnLFxuICAgICAgbWluTGVuZ3RoOiBBTExPV0VEX09BVVRIMl9SRVRVUk5fVVJMX01JTixcbiAgICAgIG1heExlbmd0aDogQUxMT1dFRF9PQVVUSDJfUkVUVVJOX1VSTF9NQVgsXG4gICAgfSwgc2NvcGUpKTtcbiAgfVxuICByZXR1cm4gZXJyb3JzO1xufVxuXG4vKipcbiAqIEBpbnRlcm5hbFxuICovXG5leHBvcnQgZnVuY3Rpb24gdmFsaWRhdGVDcmVkZW50aWFsUHJvdmlkZXJOYW1lKG5hbWU6IHN0cmluZywgc2NvcGU/OiBJQ29uc3RydWN0KTogc3RyaW5nW10ge1xuICBjb25zdCBlcnJvcnM6IHN0cmluZ1tdID0gW107XG4gIGVycm9ycy5wdXNoKC4uLnZhbGlkYXRlU3RyaW5nRmllbGRMZW5ndGgoe1xuICAgIHZhbHVlOiBuYW1lLFxuICAgIGZpZWxkTmFtZTogJ0NyZWRlbnRpYWwgcHJvdmlkZXIgbmFtZScsXG4gICAgbWluTGVuZ3RoOiBDUkVERU5USUFMX1BST1ZJREVSX05BTUVfTUlOLFxuICAgIG1heExlbmd0aDogQ1JFREVOVElBTF9QUk9WSURFUl9OQU1FX01BWCxcbiAgfSwgc2NvcGUpKTtcbiAgZXJyb3JzLnB1c2goLi4udmFsaWRhdGVGaWVsZFBhdHRlcm4oXG4gICAgbmFtZSxcbiAgICAnQ3JlZGVudGlhbCBwcm92aWRlciBuYW1lJyxcbiAgICBDUkVERU5USUFMX1BST1ZJREVSX05BTUVfUEFUVEVSTixcbiAgICAnQ3JlZGVudGlhbCBwcm92aWRlciBuYW1lIG1heSBvbmx5IGNvbnRhaW4gbGV0dGVycywgbnVtYmVycywgaHlwaGVucywgYW5kIHVuZGVyc2NvcmVzLicsXG4gICAgc2NvcGUsXG4gICkpO1xuICByZXR1cm4gZXJyb3JzO1xufVxuXG4vKipcbiAqIEBpbnRlcm5hbFxuICovXG5leHBvcnQgZnVuY3Rpb24gdmFsaWRhdGVBcGlLZXlWYWx1ZShhcGlLZXk6IHN0cmluZyB8IHVuZGVmaW5lZCwgc2NvcGU/OiBJQ29uc3RydWN0KTogc3RyaW5nW10ge1xuICBpZiAoYXBpS2V5ID09IG51bGwgfHwgYXBpS2V5ID09PSAnJykge1xuICAgIHJldHVybiBbXTtcbiAgfVxuICBpZiAoVG9rZW4uaXNVbnJlc29sdmVkKGFwaUtleSkpIHtcbiAgICByZXR1cm4gW107XG4gIH1cbiAgcmV0dXJuIHZhbGlkYXRlU3RyaW5nRmllbGRMZW5ndGgoe1xuICAgIHZhbHVlOiBhcGlLZXksXG4gICAgZmllbGROYW1lOiAnQVBJIGtleScsXG4gICAgbWluTGVuZ3RoOiBBUElfS0VZX1ZBTFVFX01JTixcbiAgICBtYXhMZW5ndGg6IEFQSV9LRVlfVkFMVUVfTUFYLFxuICB9LCBzY29wZSk7XG59XG5cbi8qKlxuICogQGludGVybmFsXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiB2YWxpZGF0ZUNyZWRlbnRpYWxQcm92aWRlclRhZ3ModGFncz86IHsgW2tleTogc3RyaW5nXTogc3RyaW5nIH0sIHNjb3BlPzogSUNvbnN0cnVjdCk6IHN0cmluZ1tdIHtcbiAgbGV0IGVycm9yczogc3RyaW5nW10gPSBbXTtcbiAgaWYgKHRhZ3MgPT09IHVuZGVmaW5lZCkge1xuICAgIHJldHVybiBlcnJvcnM7XG4gIH1cbiAgaWYgKFRva2VuLmlzVW5yZXNvbHZlZCh0YWdzKSkge1xuICAgIHJldHVybiBlcnJvcnM7XG4gIH1cblxuICBjb25zdCB2YWxpZEtleVBhdHRlcm4gPSAvXlthLXpBLVowLTlcXHMuXzovPStALV0qJC87XG4gIGNvbnN0IHZhbGlkVmFsdWVQYXR0ZXJuID0gL15bYS16QS1aMC05XFxzLl86Lz0rQC1dKiQvO1xuXG4gIGZvciAoY29uc3QgW2tleSwgdmFsdWVdIG9mIE9iamVjdC5lbnRyaWVzKHRhZ3MpKSB7XG4gICAgaWYgKCFUb2tlbi5pc1VucmVzb2x2ZWQoa2V5KSkge1xuICAgICAgZXJyb3JzLnB1c2goLi4udmFsaWRhdGVTdHJpbmdGaWVsZExlbmd0aCh7XG4gICAgICAgIHZhbHVlOiBrZXksXG4gICAgICAgIGZpZWxkTmFtZTogJ1RhZyBrZXknLFxuICAgICAgICBtaW5MZW5ndGg6IENSRURFTlRJQUxfUFJPVklERVJfVEFHX01JTixcbiAgICAgICAgbWF4TGVuZ3RoOiBDUkVERU5USUFMX1BST1ZJREVSX1RBR19NQVgsXG4gICAgICB9LCBzY29wZSkpO1xuICAgICAgZXJyb3JzLnB1c2goLi4udmFsaWRhdGVGaWVsZFBhdHRlcm4oa2V5LCAnVGFnIGtleScsIHZhbGlkS2V5UGF0dGVybiwgdW5kZWZpbmVkLCBzY29wZSkpO1xuICAgIH1cblxuICAgIGlmICghVG9rZW4uaXNVbnJlc29sdmVkKHZhbHVlKSkge1xuICAgICAgZXJyb3JzLnB1c2goLi4udmFsaWRhdGVTdHJpbmdGaWVsZExlbmd0aCh7XG4gICAgICAgIHZhbHVlLFxuICAgICAgICBmaWVsZE5hbWU6ICdUYWcgdmFsdWUnLFxuICAgICAgICBtaW5MZW5ndGg6IENSRURFTlRJQUxfUFJPVklERVJfVEFHX01JTixcbiAgICAgICAgbWF4TGVuZ3RoOiBDUkVERU5USUFMX1BST1ZJREVSX1RBR19NQVgsXG4gICAgICB9LCBzY29wZSkpO1xuICAgICAgZXJyb3JzLnB1c2goLi4udmFsaWRhdGVGaWVsZFBhdHRlcm4odmFsdWUsICdUYWcgdmFsdWUnLCB2YWxpZFZhbHVlUGF0dGVybiwgdW5kZWZpbmVkLCBzY29wZSkpO1xuICAgIH1cbiAgfVxuXG4gIHJldHVybiBlcnJvcnM7XG59XG5cbmV4cG9ydCB7IHRocm93SWZJbnZhbGlkIH07XG4iXX0=