@aws-mdaa/dataops-job-l3-construct 1.2.0

package/node_modules/@aws-mdaa/s3-bucketpolicy-helper/lib/index.d.ts

@@ -0,0 +1,57 @@
+/*!
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { IPrincipal, PolicyStatement } from 'aws-cdk-lib/aws-iam';
+import { IBucket } from 'aws-cdk-lib/aws-s3';
+export interface IRestrictObjectPrefixToRoles {
+    readonly s3Bucket: IBucket;
+    readonly s3Prefix: string;
+    readonly readRoleIds?: string[];
+    readonly readWriteRoleIds?: string[];
+    readonly readWriteSuperRoleIds?: string[];
+    readonly readPrincipals?: IPrincipal[];
+    readonly readWritePrincipals?: IPrincipal[];
+    readonly readWriteSuperPrincipals?: IPrincipal[];
+}
+export interface IRestrictBucketToRoles {
+    readonly s3Bucket: IBucket;
+    readonly roleExcludeIds: string[];
+    readonly principalExcludes?: string[];
+    readonly prefixExcludes?: string[];
+    readonly prefixIncludes?: string[];
+}
+/** Helper class for generating S3 bucket policy statements which grant access to specific object prefixes */
+export declare class RestrictObjectPrefixToRoles {
+    static readonly READ_ACTIONS: string[];
+    static readonly READ_WRITE_ACTIONS: string[];
+    static readonly READ_WRITE_SUPER_ACTIONS: string[];
+    static readonly BUCKET_ALLOW_ACTIONS: string[];
+    static readonly BUCKET_DENY_ACTIONS: string[];
+    private _readStatements;
+    private _readWriteStatements;
+    private _readWriteSuperStatements;
+    private _formattedPrefix;
+    constructor(props: IRestrictObjectPrefixToRoles);
+    private _readStatementScaffold;
+    private _readWriteStatementScaffold;
+    private _readWriteSuperStatementScaffold;
+    readStatements(): PolicyStatement[];
+    readWriteStatements(): PolicyStatement[];
+    readWriteSuperStatements(): PolicyStatement[];
+    statements(): PolicyStatement[];
+    formatS3Prefix(prefix: string): string;
+}
+/** Helper class for generating bucket policy statements
+ * which allow or deny access to an entire bucket. Used to
+ * create bucket-level default deny statements to block accesses
+ * not granted in the bucket policy. */
+export declare class RestrictBucketToRoles {
+    readonly denyStatement: PolicyStatement;
+    readonly allowStatement: PolicyStatement;
+    private resource;
+    private notResource;
+    private denyConditionalNotEquals;
+    constructor(props: IRestrictBucketToRoles);
+    private formatS3Prefix;
+}

package/node_modules/@aws-mdaa/s3-bucketpolicy-helper/lib/index.js

@@ -0,0 +1,200 @@
+/*!
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RestrictBucketToRoles = exports.RestrictObjectPrefixToRoles = void 0;
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+/** Helper class for generating S3 bucket policy statements which grant access to specific object prefixes */
+class RestrictObjectPrefixToRoles {
+    constructor(props) {
+        this._readStatements = [];
+        this._readWriteStatements = [];
+        this._readWriteSuperStatements = [];
+        this._formattedPrefix = '/' + this.formatS3Prefix(props.s3Prefix) + '/*';
+        // Covers our case where two / get resolved because our prefix is actually /
+        this._formattedPrefix = this._formattedPrefix.replace(/\/\//, '/');
+        // FEDERATED / READ
+        if (props.readRoleIds != undefined && props.readRoleIds.length > 0) {
+            // Construct our User:Id roles for read
+            const statement = this._readStatementScaffold(props);
+            statement.addCondition('StringLike', { 'aws:userId': props.readRoleIds.map(x => `${x}:*`) });
+            statement.addAnyPrincipal();
+            this._readStatements.push(statement);
+        }
+        // FEDERATED / READWRITE
+        if (props.readWriteRoleIds != undefined && props.readWriteRoleIds.length > 0) {
+            const statement = this._readWriteStatementScaffold(props);
+            statement.addCondition('StringLike', { 'aws:userId': props.readWriteRoleIds.map(x => `${x}:*`) });
+            statement.addAnyPrincipal();
+            this._readWriteStatements.push(statement);
+        }
+        // FEDERATED / READWRITESUPER
+        if (props.readWriteSuperRoleIds != undefined && props.readWriteSuperRoleIds.length > 0) {
+            const statement = this._readWriteSuperStatementScaffold(props);
+            statement.addCondition('StringLike', { 'aws:userId': props.readWriteSuperRoleIds.map(x => `${x}:*`) });
+            statement.addAnyPrincipal();
+            this._readWriteSuperStatements.push(statement);
+        }
+        // NONFEDERATED / READ
+        if (props.readPrincipals != undefined && props.readPrincipals.length > 0) {
+            const statement = this._readStatementScaffold(props);
+            props.readPrincipals.forEach(principal => {
+                statement.addPrincipals(principal);
+            });
+            this._readStatements.push(statement);
+        }
+        // NONFEDERATED / READWRITE
+        if (props.readWritePrincipals != undefined && props.readWritePrincipals.length > 0) {
+            const statement = this._readWriteStatementScaffold(props);
+            props.readWritePrincipals.forEach(principal => {
+                statement.addPrincipals(principal);
+            });
+            this._readWriteStatements.push(statement);
+        }
+        // NONFEDERATED / READWRITESUPER
+        if (props.readWriteSuperPrincipals != undefined && props.readWriteSuperPrincipals.length > 0) {
+            const statement = this._readWriteSuperStatementScaffold(props);
+            props.readWriteSuperPrincipals.forEach(principal => {
+                statement.addPrincipals(principal);
+            });
+            this._readWriteSuperStatements.push(statement);
+        }
+    }
+    _readStatementScaffold(props) {
+        return new aws_iam_1.PolicyStatement({
+            sid: `${props.s3Prefix.replace(/\\W/g, '')}_Read`,
+            effect: aws_iam_1.Effect.ALLOW,
+            resources: [props.s3Bucket.bucketArn + this._formattedPrefix],
+            actions: RestrictObjectPrefixToRoles.READ_ACTIONS,
+        });
+    }
+    _readWriteStatementScaffold(props) {
+        return new aws_iam_1.PolicyStatement({
+            sid: `${props.s3Prefix.replace(/\\W/g, '')}_ReadWrite`,
+            effect: aws_iam_1.Effect.ALLOW,
+            resources: [props.s3Bucket.bucketArn + this._formattedPrefix],
+            actions: RestrictObjectPrefixToRoles.READ_WRITE_ACTIONS,
+        });
+    }
+    _readWriteSuperStatementScaffold(props) {
+        return new aws_iam_1.PolicyStatement({
+            sid: `${props.s3Prefix.replace(/\\W/g, '')}_ReadWriteSuper`,
+            effect: aws_iam_1.Effect.ALLOW,
+            resources: [props.s3Bucket.bucketArn + this._formattedPrefix],
+            actions: RestrictObjectPrefixToRoles.READ_WRITE_SUPER_ACTIONS,
+        });
+    }
+    readStatements() {
+        return this._readStatements;
+    }
+    readWriteStatements() {
+        return this._readWriteStatements;
+    }
+    readWriteSuperStatements() {
+        return this._readWriteSuperStatements;
+    }
+    statements() {
+        return [...this._readStatements, ...this._readWriteStatements, ...this._readWriteSuperStatements];
+    }
+    formatS3Prefix(prefix) {
+        let rawPrefix = prefix;
+        // Removes trailing slashes
+        rawPrefix = rawPrefix.endsWith('/') ? rawPrefix.slice(0, -1) : rawPrefix;
+        // Removes leading slashes
+        rawPrefix = rawPrefix.startsWith('/') ? rawPrefix.substring(1) : rawPrefix;
+        return rawPrefix;
+    }
+}
+exports.RestrictObjectPrefixToRoles = RestrictObjectPrefixToRoles;
+RestrictObjectPrefixToRoles.READ_ACTIONS = ['s3:GetObject*'];
+RestrictObjectPrefixToRoles.READ_WRITE_ACTIONS = [
+    ...RestrictObjectPrefixToRoles.READ_ACTIONS,
+    's3:PutObject',
+    's3:PutObjectTagging',
+    's3:DeleteObject',
+];
+RestrictObjectPrefixToRoles.READ_WRITE_SUPER_ACTIONS = [
+    ...RestrictObjectPrefixToRoles.READ_WRITE_ACTIONS,
+    's3:DeleteObjectVersion',
+];
+RestrictObjectPrefixToRoles.BUCKET_ALLOW_ACTIONS = ['s3:List*', 's3:GetBucket*'];
+RestrictObjectPrefixToRoles.BUCKET_DENY_ACTIONS = ['s3:PutObject*', 's3:GetObject*', 's3:DeleteObject*'];
+/** Helper class for generating bucket policy statements
+ * which allow or deny access to an entire bucket. Used to
+ * create bucket-level default deny statements to block accesses
+ * not granted in the bucket policy. */
+class RestrictBucketToRoles {
+    constructor(props) {
+        this.resource = [];
+        this.notResource = [];
+        this.denyConditionalNotEquals = {};
+        // Statement allowing access to the bucket for the AROAs
+        this.allowStatement = new aws_iam_1.PolicyStatement({
+            sid: `BucketAllow`,
+            effect: aws_iam_1.Effect.ALLOW,
+            resources: [props.s3Bucket.bucketArn + '/*', props.s3Bucket.bucketArn],
+            actions: RestrictObjectPrefixToRoles.BUCKET_ALLOW_ACTIONS,
+        });
+        this.allowStatement.addAnyPrincipal();
+        this.allowStatement.addCondition('StringLike', { 'aws:userId': props.roleExcludeIds.map(x => `${x}:*`) });
+        // Constuct our deny statement.
+        // prefixIncludes denotes we want to include a prefix in our deny meaning Resource
+        if (props.prefixIncludes) {
+            this.resource = props.prefixIncludes.map(prefix => {
+                return `${props.s3Bucket.bucketArn}/${this.formatS3Prefix(prefix)}`;
+            });
+        }
+        else {
+            this.resource = [props.s3Bucket.bucketArn + '/*'];
+        }
+        // prefixExcludes denote we want to exclude a prefix in our deny meaning notResource
+        if (props.prefixExcludes) {
+            this.notResource = props.prefixExcludes.map(prefix => {
+                return `${props.s3Bucket.bucketArn}/${this.formatS3Prefix(prefix)}`;
+            });
+        }
+        if (this.notResource.length > 0) {
+            this.denyStatement = new aws_iam_1.PolicyStatement({
+                sid: `BucketDeny`,
+                effect: aws_iam_1.Effect.DENY,
+                notResources: this.notResource,
+                actions: RestrictObjectPrefixToRoles.BUCKET_DENY_ACTIONS,
+            });
+        }
+        else {
+            this.denyStatement = new aws_iam_1.PolicyStatement({
+                sid: `BucketDeny`,
+                effect: aws_iam_1.Effect.DENY,
+                resources: this.resource,
+                actions: RestrictObjectPrefixToRoles.BUCKET_DENY_ACTIONS,
+            });
+        }
+        this.denyStatement.addAnyPrincipal();
+        // Build our conditionals.
+        this.denyConditionalNotEquals['aws:userId'] = props.roleExcludeIds.map(x => `${x}:*`);
+        if (props.principalExcludes && props.principalExcludes.length > 0) {
+            this.denyConditionalNotEquals['aws:PrincipalArn'] = [...new Set(props.principalExcludes)].sort((a, b) => a.localeCompare(b));
+        }
+        // Construct our conditional for our deny
+        if (Object.keys(this.denyConditionalNotEquals).length == 1) {
+            this.denyStatement.addCondition('StringNotLike', this.denyConditionalNotEquals);
+        }
+        else {
+            this.denyStatement.addCondition('ForAnyValue:StringNotLike', this.denyConditionalNotEquals);
+        }
+    }
+    formatS3Prefix(prefix) {
+        let rawPrefix = prefix;
+        // Removes trailing slashes
+        rawPrefix = rawPrefix.endsWith('/') ? rawPrefix.slice(0, -1) : rawPrefix;
+        // Removes leading slashes
+        rawPrefix = rawPrefix.startsWith('/') ? rawPrefix.substring(1) : rawPrefix;
+        return `${rawPrefix}/*`;
+    }
+}
+exports.RestrictBucketToRoles = RestrictBucketToRoles;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUE7OztHQUdHOzs7QUFFSCxpREFBMEU7QUFzQjFFLDZHQUE2RztBQUM3RyxNQUFhLDJCQUEyQjtJQW9CdEMsWUFBWSxLQUFtQztRQUx2QyxvQkFBZSxHQUFzQixFQUFFLENBQUM7UUFDeEMseUJBQW9CLEdBQXNCLEVBQUUsQ0FBQztRQUM3Qyw4QkFBeUIsR0FBc0IsRUFBRSxDQUFDO1FBSXhELElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxHQUFHLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLEdBQUcsSUFBSSxDQUFDO1FBQ3pFLDRFQUE0RTtRQUM1RSxJQUFJLENBQUMsZ0JBQWdCLEdBQUcsSUFBSSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFFbkUsbUJBQW1CO1FBQ25CLElBQUksS0FBSyxDQUFDLFdBQVcsSUFBSSxTQUFTLElBQUksS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFO1lBQ2xFLHVDQUF1QztZQUN2QyxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsc0JBQXNCLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDckQsU0FBUyxDQUFDLFlBQVksQ0FBQyxZQUFZLEVBQUUsRUFBRSxZQUFZLEVBQUUsS0FBSyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQzdGLFNBQVMsQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUM1QixJQUFJLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztTQUN0QztRQUNELHdCQUF3QjtRQUN4QixJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsSUFBSSxTQUFTLElBQUksS0FBSyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUU7WUFDNUUsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLDJCQUEyQixDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQzFELFNBQVMsQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFLEVBQUUsWUFBWSxFQUFFLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ2xHLFNBQVMsQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUM1QixJQUFJLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1NBQzNDO1FBRUQsNkJBQTZCO1FBQzdCLElBQUksS0FBSyxDQUFDLHFCQUFxQixJQUFJLFNBQVMsSUFBSSxLQUFLLENBQUMscUJBQXFCLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRTtZQUN0RixNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsZ0NBQWdDLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDL0QsU0FBUyxDQUFDLFlBQVksQ0FBQyxZQUFZLEVBQUUsRUFBRSxZQUFZLEVBQUUsS0FBSyxDQUFDLHFCQUFxQixDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDdkcsU0FBUyxDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQzVCLElBQUksQ0FBQyx5QkFBeUIsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7U0FDaEQ7UUFFRCxzQkFBc0I7UUFDdEIsSUFBSSxLQUFLLENBQUMsY0FBYyxJQUFJLFNBQVMsSUFBSSxLQUFLLENBQUMsY0FBYyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUU7WUFDeEUsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLHNCQUFzQixDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ3JELEtBQUssQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFO2dCQUN2QyxTQUFTLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ3JDLENBQUMsQ0FBQyxDQUFDO1lBQ0gsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7U0FDdEM7UUFDRCwyQkFBMkI7UUFDM0IsSUFBSSxLQUFLLENBQUMsbUJBQW1CLElBQUksU0FBUyxJQUFJLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFO1lBQ2xGLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQywyQkFBMkIsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMxRCxLQUFLLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFO2dCQUM1QyxTQUFTLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ3JDLENBQUMsQ0FBQyxDQUFDO1lBQ0gsSUFBSSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztTQUMzQztRQUNELGdDQUFnQztRQUNoQyxJQUFJLEtBQUssQ0FBQyx3QkFBd0IsSUFBSSxTQUFTLElBQUksS0FBSyxDQUFDLHdCQUF3QixDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUU7WUFDNUYsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLGdDQUFnQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQy9ELEtBQUssQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUU7Z0JBQ2pELFNBQVMsQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDckMsQ0FBQyxDQUFDLENBQUM7WUFDSCxJQUFJLENBQUMseUJBQXlCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1NBQ2hEO0lBQ0gsQ0FBQztJQUVPLHNCQUFzQixDQUFDLEtBQW1DO1FBQ2hFLE9BQU8sSUFBSSx5QkFBZSxDQUFDO1lBQ3pCLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsT0FBTztZQUNqRCxNQUFNLEVBQUUsZ0JBQU0sQ0FBQyxLQUFLO1lBQ3BCLFNBQVMsRUFBRSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQztZQUM3RCxPQUFPLEVBQUUsMkJBQTJCLENBQUMsWUFBWTtTQUNsRCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU8sMkJBQTJCLENBQUMsS0FBbUM7UUFDckUsT0FBTyxJQUFJLHlCQUFlLENBQUM7WUFDekIsR0FBRyxFQUFFLEdBQUcsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxZQUFZO1lBQ3RELE1BQU0sRUFBRSxnQkFBTSxDQUFDLEtBQUs7WUFDcEIsU0FBUyxFQUFFLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLGdCQUFnQixDQUFDO1lBQzdELE9BQU8sRUFBRSwyQkFBMkIsQ0FBQyxrQkFBa0I7U0FDeEQsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLGdDQUFnQyxDQUFDLEtBQW1DO1FBQzFFLE9BQU8sSUFBSSx5QkFBZSxDQUFDO1lBQ3pCLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsaUJBQWlCO1lBQzNELE1BQU0sRUFBRSxnQkFBTSxDQUFDLEtBQUs7WUFDcEIsU0FBUyxFQUFFLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLGdCQUFnQixDQUFDO1lBQzdELE9BQU8sRUFBRSwyQkFBMkIsQ0FBQyx3QkFBd0I7U0FDOUQsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLGNBQWM7UUFDbkIsT0FBTyxJQUFJLENBQUMsZUFBZSxDQUFDO0lBQzlCLENBQUM7SUFFTSxtQkFBbUI7UUFDeEIsT0FBTyxJQUFJLENBQUMsb0JBQW9CLENBQUM7SUFDbkMsQ0FBQztJQUVNLHdCQUF3QjtRQUM3QixPQUFPLElBQUksQ0FBQyx5QkFBeUIsQ0FBQztJQUN4QyxDQUFDO0lBRU0sVUFBVTtRQUNmLE9BQU8sQ0FBQyxHQUFHLElBQUksQ0FBQyxlQUFlLEVBQUUsR0FBRyxJQUFJLENBQUMsb0JBQW9CLEVBQUUsR0FBRyxJQUFJLENBQUMseUJBQXlCLENBQUMsQ0FBQztJQUNwRyxDQUFDO0lBRU0sY0FBYyxDQUFDLE1BQWM7UUFDbEMsSUFBSSxTQUFTLEdBQUcsTUFBTSxDQUFDO1FBRXZCLDJCQUEyQjtRQUMzQixTQUFTLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3pFLDBCQUEwQjtRQUMxQixTQUFTLEdBQUcsU0FBUyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQzNFLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7O0FBOUhILGtFQStIQztBQTlIaUIsd0NBQVksR0FBRyxDQUFDLGVBQWUsQ0FBQyxDQUFDO0FBQ2pDLDhDQUFrQixHQUFHO0lBQ25DLEdBQUcsMkJBQTJCLENBQUMsWUFBWTtJQUMzQyxjQUFjO0lBQ2QscUJBQXFCO0lBQ3JCLGlCQUFpQjtDQUNsQixDQUFDO0FBQ2Msb0RBQXdCLEdBQUc7SUFDekMsR0FBRywyQkFBMkIsQ0FBQyxrQkFBa0I7SUFDakQsd0JBQXdCO0NBQ3pCLENBQUM7QUFDYyxnREFBb0IsR0FBRyxDQUFDLFVBQVUsRUFBRSxlQUFlLENBQUMsQ0FBQztBQUNyRCwrQ0FBbUIsR0FBRyxDQUFDLGVBQWUsRUFBRSxlQUFlLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztBQW9IL0Y7Ozt1Q0FHdUM7QUFDdkMsTUFBYSxxQkFBcUI7SUFVaEMsWUFBWSxLQUE2QjtRQVBqQyxhQUFRLEdBQWEsRUFBRSxDQUFDO1FBQ3hCLGdCQUFXLEdBQWEsRUFBRSxDQUFDO1FBQzNCLDZCQUF3QixHQUc1QixFQUFFLENBQUM7UUFHTCx3REFBd0Q7UUFDeEQsSUFBSSxDQUFDLGNBQWMsR0FBRyxJQUFJLHlCQUFlLENBQUM7WUFDeEMsR0FBRyxFQUFFLGFBQWE7WUFDbEIsTUFBTSxFQUFFLGdCQUFNLENBQUMsS0FBSztZQUNwQixTQUFTLEVBQUUsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLFNBQVMsR0FBRyxJQUFJLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7WUFDdEUsT0FBTyxFQUFFLDJCQUEyQixDQUFDLG9CQUFvQjtTQUMxRCxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsY0FBYyxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQ3RDLElBQUksQ0FBQyxjQUFjLENBQUMsWUFBWSxDQUFDLFlBQVksRUFBRSxFQUFFLFlBQVksRUFBRSxLQUFLLENBQUMsY0FBYyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFFMUcsK0JBQStCO1FBQy9CLGtGQUFrRjtRQUNsRixJQUFJLEtBQUssQ0FBQyxjQUFjLEVBQUU7WUFDeEIsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUMsY0FBYyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRTtnQkFDaEQsT0FBTyxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUMsU0FBUyxJQUFJLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUN0RSxDQUFDLENBQUMsQ0FBQztTQUNKO2FBQU07WUFDTCxJQUFJLENBQUMsUUFBUSxHQUFHLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLENBQUM7U0FDbkQ7UUFDRCxvRkFBb0Y7UUFDcEYsSUFBSSxLQUFLLENBQUMsY0FBYyxFQUFFO1lBQ3hCLElBQUksQ0FBQyxXQUFXLEdBQUcsS0FBSyxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUU7Z0JBQ25ELE9BQU8sR0FBRyxLQUFLLENBQUMsUUFBUSxDQUFDLFNBQVMsSUFBSSxJQUFJLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDdEUsQ0FBQyxDQUFDLENBQUM7U0FDSjtRQUVELElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFO1lBQy9CLElBQUksQ0FBQyxhQUFhLEdBQUcsSUFBSSx5QkFBZSxDQUFDO2dCQUN2QyxHQUFHLEVBQUUsWUFBWTtnQkFDakIsTUFBTSxFQUFFLGdCQUFNLENBQUMsSUFBSTtnQkFDbkIsWUFBWSxFQUFFLElBQUksQ0FBQyxXQUFXO2dCQUM5QixPQUFPLEVBQUUsMkJBQTJCLENBQUMsbUJBQW1CO2FBQ3pELENBQUMsQ0FBQztTQUNKO2FBQU07WUFDTCxJQUFJLENBQUMsYUFBYSxHQUFHLElBQUkseUJBQWUsQ0FBQztnQkFDdkMsR0FBRyxFQUFFLFlBQVk7Z0JBQ2pCLE1BQU0sRUFBRSxnQkFBTSxDQUFDLElBQUk7Z0JBQ25CLFNBQVMsRUFBRSxJQUFJLENBQUMsUUFBUTtnQkFDeEIsT0FBTyxFQUFFLDJCQUEyQixDQUFDLG1CQUFtQjthQUN6RCxDQUFDLENBQUM7U0FDSjtRQUNELElBQUksQ0FBQyxhQUFhLENBQUMsZUFBZSxFQUFFLENBQUM7UUFFckMsMEJBQTBCO1FBQzFCLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxZQUFZLENBQUMsR0FBRyxLQUFLLENBQUMsY0FBYyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN0RixJQUFJLEtBQUssQ0FBQyxpQkFBaUIsSUFBSSxLQUFLLENBQUMsaUJBQWlCLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRTtZQUNqRSxJQUFJLENBQUMsd0JBQXdCLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FDdEcsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FDbkIsQ0FBQztTQUNIO1FBRUQseUNBQXlDO1FBQ3pDLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsd0JBQXdCLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxFQUFFO1lBQzFELElBQUksQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLGVBQWUsRUFBRSxJQUFJLENBQUMsd0JBQXdCLENBQUMsQ0FBQztTQUNqRjthQUFNO1lBQ0wsSUFBSSxDQUFDLGFBQWEsQ0FBQyxZQUFZLENBQUMsMkJBQTJCLEVBQUUsSUFBSSxDQUFDLHdCQUF3QixDQUFDLENBQUM7U0FDN0Y7SUFDSCxDQUFDO0lBRU8sY0FBYyxDQUFDLE1BQWM7UUFDbkMsSUFBSSxTQUFTLEdBQUcsTUFBTSxDQUFDO1FBRXZCLDJCQUEyQjtRQUMzQixTQUFTLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3pFLDBCQUEwQjtRQUMxQixTQUFTLEdBQUcsU0FBUyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQzNFLE9BQU8sR0FBRyxTQUFTLElBQUksQ0FBQztJQUMxQixDQUFDO0NBQ0Y7QUEvRUQsc0RBK0VDIiwic291cmNlc0NvbnRlbnQiOlsiLyohXG4gKiBDb3B5cmlnaHQgQW1hem9uLmNvbSwgSW5jLiBvciBpdHMgYWZmaWxpYXRlcy4gQWxsIFJpZ2h0cyBSZXNlcnZlZC5cbiAqIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG4gKi9cblxuaW1wb3J0IHsgSVByaW5jaXBhbCwgUG9saWN5U3RhdGVtZW50LCBFZmZlY3QgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IElCdWNrZXQgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtczMnO1xuXG5leHBvcnQgaW50ZXJmYWNlIElSZXN0cmljdE9iamVjdFByZWZpeFRvUm9sZXMge1xuICByZWFkb25seSBzM0J1Y2tldDogSUJ1Y2tldDtcbiAgcmVhZG9ubHkgczNQcmVmaXg6IHN0cmluZztcbiAgcmVhZG9ubHkgcmVhZFJvbGVJZHM/OiBzdHJpbmdbXTtcbiAgcmVhZG9ubHkgcmVhZFdyaXRlUm9sZUlkcz86IHN0cmluZ1tdO1xuICByZWFkb25seSByZWFkV3JpdGVTdXBlclJvbGVJZHM/OiBzdHJpbmdbXTtcbiAgcmVhZG9ubHkgcmVhZFByaW5jaXBhbHM/OiBJUHJpbmNpcGFsW107XG4gIHJlYWRvbmx5IHJlYWRXcml0ZVByaW5jaXBhbHM/OiBJUHJpbmNpcGFsW107XG4gIHJlYWRvbmx5IHJlYWRXcml0ZVN1cGVyUHJpbmNpcGFscz86IElQcmluY2lwYWxbXTtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBJUmVzdHJpY3RCdWNrZXRUb1JvbGVzIHtcbiAgcmVhZG9ubHkgczNCdWNrZXQ6IElCdWNrZXQ7XG4gIHJlYWRvbmx5IHJvbGVFeGNsdWRlSWRzOiBzdHJpbmdbXTtcbiAgcmVhZG9ubHkgcHJpbmNpcGFsRXhjbHVkZXM/OiBzdHJpbmdbXTtcbiAgcmVhZG9ubHkgcHJlZml4RXhjbHVkZXM/OiBzdHJpbmdbXTtcbiAgcmVhZG9ubHkgcHJlZml4SW5jbHVkZXM/OiBzdHJpbmdbXTtcbn1cblxuLyoqIEhlbHBlciBjbGFzcyBmb3IgZ2VuZXJhdGluZyBTMyBidWNrZXQgcG9saWN5IHN0YXRlbWVudHMgd2hpY2ggZ3JhbnQgYWNjZXNzIHRvIHNwZWNpZmljIG9iamVjdCBwcmVmaXhlcyAqL1xuZXhwb3J0IGNsYXNzIFJlc3RyaWN0T2JqZWN0UHJlZml4VG9Sb2xlcyB7XG4gIHN0YXRpYyByZWFkb25seSBSRUFEX0FDVElPTlMgPSBbJ3MzOkdldE9iamVjdConXTtcbiAgc3RhdGljIHJlYWRvbmx5IFJFQURfV1JJVEVfQUNUSU9OUyA9IFtcbiAgICAuLi5SZXN0cmljdE9iamVjdFByZWZpeFRvUm9sZXMuUkVBRF9BQ1RJT05TLFxuICAgICdzMzpQdXRPYmplY3QnLFxuICAgICdzMzpQdXRPYmplY3RUYWdnaW5nJyxcbiAgICAnczM6RGVsZXRlT2JqZWN0JyxcbiAgXTtcbiAgc3RhdGljIHJlYWRvbmx5IFJFQURfV1JJVEVfU1VQRVJfQUNUSU9OUyA9IFtcbiAgICAuLi5SZXN0cmljdE9iamVjdFByZWZpeFRvUm9sZXMuUkVBRF9XUklURV9BQ1RJT05TLFxuICAgICdzMzpEZWxldGVPYmplY3RWZXJzaW9uJyxcbiAgXTtcbiAgc3RhdGljIHJlYWRvbmx5IEJVQ0tFVF9BTExPV19BQ1RJT05TID0gWydzMzpMaXN0KicsICdzMzpHZXRCdWNrZXQqJ107XG4gIHN0YXRpYyByZWFkb25seSBCVUNLRVRfREVOWV9BQ1RJT05TID0gWydzMzpQdXRPYmplY3QqJywgJ3MzOkdldE9iamVjdConLCAnczM6RGVsZXRlT2JqZWN0KiddO1xuXG4gIHByaXZhdGUgX3JlYWRTdGF0ZW1lbnRzOiBQb2xpY3lTdGF0ZW1lbnRbXSA9IFtdO1xuICBwcml2YXRlIF9yZWFkV3JpdGVTdGF0ZW1lbnRzOiBQb2xpY3lTdGF0ZW1lbnRbXSA9IFtdO1xuICBwcml2YXRlIF9yZWFkV3JpdGVTdXBlclN0YXRlbWVudHM6IFBvbGljeVN0YXRlbWVudFtdID0gW107XG4gIHByaXZhdGUgX2Zvcm1hdHRlZFByZWZpeDogc3RyaW5nO1xuXG4gIGNvbnN0cnVjdG9yKHByb3BzOiBJUmVzdHJpY3RPYmplY3RQcmVmaXhUb1JvbGVzKSB7XG4gICAgdGhpcy5fZm9ybWF0dGVkUHJlZml4ID0gJy8nICsgdGhpcy5mb3JtYXRTM1ByZWZpeChwcm9wcy5zM1ByZWZpeCkgKyAnLyonO1xuICAgIC8vIENvdmVycyBvdXIgY2FzZSB3aGVyZSB0d28gLyBnZXQgcmVzb2x2ZWQgYmVjYXVzZSBvdXIgcHJlZml4IGlzIGFjdHVhbGx5IC9cbiAgICB0aGlzLl9mb3JtYXR0ZWRQcmVmaXggPSB0aGlzLl9mb3JtYXR0ZWRQcmVmaXgucmVwbGFjZSgvXFwvXFwvLywgJy8nKTtcblxuICAgIC8vIEZFREVSQVRFRCAvIFJFQURcbiAgICBpZiAocHJvcHMucmVhZFJvbGVJZHMgIT0gdW5kZWZpbmVkICYmIHByb3BzLnJlYWRSb2xlSWRzLmxlbmd0aCA+IDApIHtcbiAgICAgIC8vIENvbnN0cnVjdCBvdXIgVXNlcjpJZCByb2xlcyBmb3IgcmVhZFxuICAgICAgY29uc3Qgc3RhdGVtZW50ID0gdGhpcy5fcmVhZFN0YXRlbWVudFNjYWZmb2xkKHByb3BzKTtcbiAgICAgIHN0YXRlbWVudC5hZGRDb25kaXRpb24oJ1N0cmluZ0xpa2UnLCB7ICdhd3M6dXNlcklkJzogcHJvcHMucmVhZFJvbGVJZHMubWFwKHggPT4gYCR7eH06KmApIH0pO1xuICAgICAgc3RhdGVtZW50LmFkZEFueVByaW5jaXBhbCgpO1xuICAgICAgdGhpcy5fcmVhZFN0YXRlbWVudHMucHVzaChzdGF0ZW1lbnQpO1xuICAgIH1cbiAgICAvLyBGRURFUkFURUQgLyBSRUFEV1JJVEVcbiAgICBpZiAocHJvcHMucmVhZFdyaXRlUm9sZUlkcyAhPSB1bmRlZmluZWQgJiYgcHJvcHMucmVhZFdyaXRlUm9sZUlkcy5sZW5ndGggPiAwKSB7XG4gICAgICBjb25zdCBzdGF0ZW1lbnQgPSB0aGlzLl9yZWFkV3JpdGVTdGF0ZW1lbnRTY2FmZm9sZChwcm9wcyk7XG4gICAgICBzdGF0ZW1lbnQuYWRkQ29uZGl0aW9uKCdTdHJpbmdMaWtlJywgeyAnYXdzOnVzZXJJZCc6IHByb3BzLnJlYWRXcml0ZVJvbGVJZHMubWFwKHggPT4gYCR7eH06KmApIH0pO1xuICAgICAgc3RhdGVtZW50LmFkZEFueVByaW5jaXBhbCgpO1xuICAgICAgdGhpcy5fcmVhZFdyaXRlU3RhdGVtZW50cy5wdXNoKHN0YXRlbWVudCk7XG4gICAgfVxuXG4gICAgLy8gRkVERVJBVEVEIC8gUkVBRFdSSVRFU1VQRVJcbiAgICBpZiAocHJvcHMucmVhZFdyaXRlU3VwZXJSb2xlSWRzICE9IHVuZGVmaW5lZCAmJiBwcm9wcy5yZWFkV3JpdGVTdXBlclJvbGVJZHMubGVuZ3RoID4gMCkge1xuICAgICAgY29uc3Qgc3RhdGVtZW50ID0gdGhpcy5fcmVhZFdyaXRlU3VwZXJTdGF0ZW1lbnRTY2FmZm9sZChwcm9wcyk7XG4gICAgICBzdGF0ZW1lbnQuYWRkQ29uZGl0aW9uKCdTdHJpbmdMaWtlJywgeyAnYXdzOnVzZXJJZCc6IHByb3BzLnJlYWRXcml0ZVN1cGVyUm9sZUlkcy5tYXAoeCA9PiBgJHt4fToqYCkgfSk7XG4gICAgICBzdGF0ZW1lbnQuYWRkQW55UHJpbmNpcGFsKCk7XG4gICAgICB0aGlzLl9yZWFkV3JpdGVTdXBlclN0YXRlbWVudHMucHVzaChzdGF0ZW1lbnQpO1xuICAgIH1cblxuICAgIC8vIE5PTkZFREVSQVRFRCAvIFJFQURcbiAgICBpZiAocHJvcHMucmVhZFByaW5jaXBhbHMgIT0gdW5kZWZpbmVkICYmIHByb3BzLnJlYWRQcmluY2lwYWxzLmxlbmd0aCA+IDApIHtcbiAgICAgIGNvbnN0IHN0YXRlbWVudCA9IHRoaXMuX3JlYWRTdGF0ZW1lbnRTY2FmZm9sZChwcm9wcyk7XG4gICAgICBwcm9wcy5yZWFkUHJpbmNpcGFscy5mb3JFYWNoKHByaW5jaXBhbCA9PiB7XG4gICAgICAgIHN0YXRlbWVudC5hZGRQcmluY2lwYWxzKHByaW5jaXBhbCk7XG4gICAgICB9KTtcbiAgICAgIHRoaXMuX3JlYWRTdGF0ZW1lbnRzLnB1c2goc3RhdGVtZW50KTtcbiAgICB9XG4gICAgLy8gTk9ORkVERVJBVEVEIC8gUkVBRFdSSVRFXG4gICAgaWYgKHByb3BzLnJlYWRXcml0ZVByaW5jaXBhbHMgIT0gdW5kZWZpbmVkICYmIHByb3BzLnJlYWRXcml0ZVByaW5jaXBhbHMubGVuZ3RoID4gMCkge1xuICAgICAgY29uc3Qgc3RhdGVtZW50ID0gdGhpcy5fcmVhZFdyaXRlU3RhdGVtZW50U2NhZmZvbGQocHJvcHMpO1xuICAgICAgcHJvcHMucmVhZFdyaXRlUHJpbmNpcGFscy5mb3JFYWNoKHByaW5jaXBhbCA9PiB7XG4gICAgICAgIHN0YXRlbWVudC5hZGRQcmluY2lwYWxzKHByaW5jaXBhbCk7XG4gICAgICB9KTtcbiAgICAgIHRoaXMuX3JlYWRXcml0ZVN0YXRlbWVudHMucHVzaChzdGF0ZW1lbnQpO1xuICAgIH1cbiAgICAvLyBOT05GRURFUkFURUQgLyBSRUFEV1JJVEVTVVBFUlxuICAgIGlmIChwcm9wcy5yZWFkV3JpdGVTdXBlclByaW5jaXBhbHMgIT0gdW5kZWZpbmVkICYmIHByb3BzLnJlYWRXcml0ZVN1cGVyUHJpbmNpcGFscy5sZW5ndGggPiAwKSB7XG4gICAgICBjb25zdCBzdGF0ZW1lbnQgPSB0aGlzLl9yZWFkV3JpdGVTdXBlclN0YXRlbWVudFNjYWZmb2xkKHByb3BzKTtcbiAgICAgIHByb3BzLnJlYWRXcml0ZVN1cGVyUHJpbmNpcGFscy5mb3JFYWNoKHByaW5jaXBhbCA9PiB7XG4gICAgICAgIHN0YXRlbWVudC5hZGRQcmluY2lwYWxzKHByaW5jaXBhbCk7XG4gICAgICB9KTtcbiAgICAgIHRoaXMuX3JlYWRXcml0ZVN1cGVyU3RhdGVtZW50cy5wdXNoKHN0YXRlbWVudCk7XG4gICAgfVxuICB9XG5cbiAgcHJpdmF0ZSBfcmVhZFN0YXRlbWVudFNjYWZmb2xkKHByb3BzOiBJUmVzdHJpY3RPYmplY3RQcmVmaXhUb1JvbGVzKTogUG9saWN5U3RhdGVtZW50IHtcbiAgICByZXR1cm4gbmV3IFBvbGljeVN0YXRlbWVudCh7XG4gICAgICBzaWQ6IGAke3Byb3BzLnMzUHJlZml4LnJlcGxhY2UoL1xcXFxXL2csICcnKX1fUmVhZGAsXG4gICAgICBlZmZlY3Q6IEVmZmVjdC5BTExPVyxcbiAgICAgIHJlc291cmNlczogW3Byb3BzLnMzQnVja2V0LmJ1Y2tldEFybiArIHRoaXMuX2Zvcm1hdHRlZFByZWZpeF0sXG4gICAgICBhY3Rpb25zOiBSZXN0cmljdE9iamVjdFByZWZpeFRvUm9sZXMuUkVBRF9BQ1RJT05TLFxuICAgIH0pO1xuICB9XG5cbiAgcHJpdmF0ZSBfcmVhZFdyaXRlU3RhdGVtZW50U2NhZmZvbGQocHJvcHM6IElSZXN0cmljdE9iamVjdFByZWZpeFRvUm9sZXMpOiBQb2xpY3lTdGF0ZW1lbnQge1xuICAgIHJldHVybiBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgIHNpZDogYCR7cHJvcHMuczNQcmVmaXgucmVwbGFjZSgvXFxcXFcvZywgJycpfV9SZWFkV3JpdGVgLFxuICAgICAgZWZmZWN0OiBFZmZlY3QuQUxMT1csXG4gICAgICByZXNvdXJjZXM6IFtwcm9wcy5zM0J1Y2tldC5idWNrZXRBcm4gKyB0aGlzLl9mb3JtYXR0ZWRQcmVmaXhdLFxuICAgICAgYWN0aW9uczogUmVzdHJpY3RPYmplY3RQcmVmaXhUb1JvbGVzLlJFQURfV1JJVEVfQUNUSU9OUyxcbiAgICB9KTtcbiAgfVxuXG4gIHByaXZhdGUgX3JlYWRXcml0ZVN1cGVyU3RhdGVtZW50U2NhZmZvbGQocHJvcHM6IElSZXN0cmljdE9iamVjdFByZWZpeFRvUm9sZXMpOiBQb2xpY3lTdGF0ZW1lbnQge1xuICAgIHJldHVybiBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgIHNpZDogYCR7cHJvcHMuczNQcmVmaXgucmVwbGFjZSgvXFxcXFcvZywgJycpfV9SZWFkV3JpdGVTdXBlcmAsXG4gICAgICBlZmZlY3Q6IEVmZmVjdC5BTExPVyxcbiAgICAgIHJlc291cmNlczogW3Byb3BzLnMzQnVja2V0LmJ1Y2tldEFybiArIHRoaXMuX2Zvcm1hdHRlZFByZWZpeF0sXG4gICAgICBhY3Rpb25zOiBSZXN0cmljdE9iamVjdFByZWZpeFRvUm9sZXMuUkVBRF9XUklURV9TVVBFUl9BQ1RJT05TLFxuICAgIH0pO1xuICB9XG5cbiAgcHVibGljIHJlYWRTdGF0ZW1lbnRzKCk6IFBvbGljeVN0YXRlbWVudFtdIHtcbiAgICByZXR1cm4gdGhpcy5fcmVhZFN0YXRlbWVudHM7XG4gIH1cblxuICBwdWJsaWMgcmVhZFdyaXRlU3RhdGVtZW50cygpOiBQb2xpY3lTdGF0ZW1lbnRbXSB7XG4gICAgcmV0dXJuIHRoaXMuX3JlYWRXcml0ZVN0YXRlbWVudHM7XG4gIH1cblxuICBwdWJsaWMgcmVhZFdyaXRlU3VwZXJTdGF0ZW1lbnRzKCk6IFBvbGljeVN0YXRlbWVudFtdIHtcbiAgICByZXR1cm4gdGhpcy5fcmVhZFdyaXRlU3VwZXJTdGF0ZW1lbnRzO1xuICB9XG5cbiAgcHVibGljIHN0YXRlbWVudHMoKTogUG9saWN5U3RhdGVtZW50W10ge1xuICAgIHJldHVybiBbLi4udGhpcy5fcmVhZFN0YXRlbWVudHMsIC4uLnRoaXMuX3JlYWRXcml0ZVN0YXRlbWVudHMsIC4uLnRoaXMuX3JlYWRXcml0ZVN1cGVyU3RhdGVtZW50c107XG4gIH1cblxuICBwdWJsaWMgZm9ybWF0UzNQcmVmaXgocHJlZml4OiBzdHJpbmcpOiBzdHJpbmcge1xuICAgIGxldCByYXdQcmVmaXggPSBwcmVmaXg7XG5cbiAgICAvLyBSZW1vdmVzIHRyYWlsaW5nIHNsYXNoZXNcbiAgICByYXdQcmVmaXggPSByYXdQcmVmaXguZW5kc1dpdGgoJy8nKSA/IHJhd1ByZWZpeC5zbGljZSgwLCAtMSkgOiByYXdQcmVmaXg7XG4gICAgLy8gUmVtb3ZlcyBsZWFkaW5nIHNsYXNoZXNcbiAgICByYXdQcmVmaXggPSByYXdQcmVmaXguc3RhcnRzV2l0aCgnLycpID8gcmF3UHJlZml4LnN1YnN0cmluZygxKSA6IHJhd1ByZWZpeDtcbiAgICByZXR1cm4gcmF3UHJlZml4O1xuICB9XG59XG5cbi8qKiBIZWxwZXIgY2xhc3MgZm9yIGdlbmVyYXRpbmcgYnVja2V0IHBvbGljeSBzdGF0ZW1lbnRzXG4gKiB3aGljaCBhbGxvdyBvciBkZW55IGFjY2VzcyB0byBhbiBlbnRpcmUgYnVja2V0LiBVc2VkIHRvXG4gKiBjcmVhdGUgYnVja2V0LWxldmVsIGRlZmF1bHQgZGVueSBzdGF0ZW1lbnRzIHRvIGJsb2NrIGFjY2Vzc2VzXG4gKiBub3QgZ3JhbnRlZCBpbiB0aGUgYnVja2V0IHBvbGljeS4gKi9cbmV4cG9ydCBjbGFzcyBSZXN0cmljdEJ1Y2tldFRvUm9sZXMge1xuICBwdWJsaWMgcmVhZG9ubHkgZGVueVN0YXRlbWVudDogUG9saWN5U3RhdGVtZW50O1xuICBwdWJsaWMgcmVhZG9ubHkgYWxsb3dTdGF0ZW1lbnQ6IFBvbGljeVN0YXRlbWVudDtcbiAgcHJpdmF0ZSByZXNvdXJjZTogc3RyaW5nW10gPSBbXTtcbiAgcHJpdmF0ZSBub3RSZXNvdXJjZTogc3RyaW5nW10gPSBbXTtcbiAgcHJpdmF0ZSBkZW55Q29uZGl0aW9uYWxOb3RFcXVhbHM6IHtcbiAgICAnYXdzOnVzZXJJZCc/OiBzdHJpbmdbXTtcbiAgICAnYXdzOlByaW5jaXBhbEFybic/OiBzdHJpbmdbXTtcbiAgfSA9IHt9O1xuXG4gIGNvbnN0cnVjdG9yKHByb3BzOiBJUmVzdHJpY3RCdWNrZXRUb1JvbGVzKSB7XG4gICAgLy8gU3RhdGVtZW50IGFsbG93aW5nIGFjY2VzcyB0byB0aGUgYnVja2V0IGZvciB0aGUgQVJPQXNcbiAgICB0aGlzLmFsbG93U3RhdGVtZW50ID0gbmV3IFBvbGljeVN0YXRlbWVudCh7XG4gICAgICBzaWQ6IGBCdWNrZXRBbGxvd2AsXG4gICAgICBlZmZlY3Q6IEVmZmVjdC5BTExPVyxcbiAgICAgIHJlc291cmNlczogW3Byb3BzLnMzQnVja2V0LmJ1Y2tldEFybiArICcvKicsIHByb3BzLnMzQnVja2V0LmJ1Y2tldEFybl0sXG4gICAgICBhY3Rpb25zOiBSZXN0cmljdE9iamVjdFByZWZpeFRvUm9sZXMuQlVDS0VUX0FMTE9XX0FDVElPTlMsXG4gICAgfSk7XG4gICAgdGhpcy5hbGxvd1N0YXRlbWVudC5hZGRBbnlQcmluY2lwYWwoKTtcbiAgICB0aGlzLmFsbG93U3RhdGVtZW50LmFkZENvbmRpdGlvbignU3RyaW5nTGlrZScsIHsgJ2F3czp1c2VySWQnOiBwcm9wcy5yb2xlRXhjbHVkZUlkcy5tYXAoeCA9PiBgJHt4fToqYCkgfSk7XG5cbiAgICAvLyBDb25zdHVjdCBvdXIgZGVueSBzdGF0ZW1lbnQuXG4gICAgLy8gcHJlZml4SW5jbHVkZXMgZGVub3RlcyB3ZSB3YW50IHRvIGluY2x1ZGUgYSBwcmVmaXggaW4gb3VyIGRlbnkgbWVhbmluZyBSZXNvdXJjZVxuICAgIGlmIChwcm9wcy5wcmVmaXhJbmNsdWRlcykge1xuICAgICAgdGhpcy5yZXNvdXJjZSA9IHByb3BzLnByZWZpeEluY2x1ZGVzLm1hcChwcmVmaXggPT4ge1xuICAgICAgICByZXR1cm4gYCR7cHJvcHMuczNCdWNrZXQuYnVja2V0QXJufS8ke3RoaXMuZm9ybWF0UzNQcmVmaXgocHJlZml4KX1gO1xuICAgICAgfSk7XG4gICAgfSBlbHNlIHtcbiAgICAgIHRoaXMucmVzb3VyY2UgPSBbcHJvcHMuczNCdWNrZXQuYnVja2V0QXJuICsgJy8qJ107XG4gICAgfVxuICAgIC8vIHByZWZpeEV4Y2x1ZGVzIGRlbm90ZSB3ZSB3YW50IHRvIGV4Y2x1ZGUgYSBwcmVmaXggaW4gb3VyIGRlbnkgbWVhbmluZyBub3RSZXNvdXJjZVxuICAgIGlmIChwcm9wcy5wcmVmaXhFeGNsdWRlcykge1xuICAgICAgdGhpcy5ub3RSZXNvdXJjZSA9IHByb3BzLnByZWZpeEV4Y2x1ZGVzLm1hcChwcmVmaXggPT4ge1xuICAgICAgICByZXR1cm4gYCR7cHJvcHMuczNCdWNrZXQuYnVja2V0QXJufS8ke3RoaXMuZm9ybWF0UzNQcmVmaXgocHJlZml4KX1gO1xuICAgICAgfSk7XG4gICAgfVxuXG4gICAgaWYgKHRoaXMubm90UmVzb3VyY2UubGVuZ3RoID4gMCkge1xuICAgICAgdGhpcy5kZW55U3RhdGVtZW50ID0gbmV3IFBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgIHNpZDogYEJ1Y2tldERlbnlgLFxuICAgICAgICBlZmZlY3Q6IEVmZmVjdC5ERU5ZLFxuICAgICAgICBub3RSZXNvdXJjZXM6IHRoaXMubm90UmVzb3VyY2UsXG4gICAgICAgIGFjdGlvbnM6IFJlc3RyaWN0T2JqZWN0UHJlZml4VG9Sb2xlcy5CVUNLRVRfREVOWV9BQ1RJT05TLFxuICAgICAgfSk7XG4gICAgfSBlbHNlIHtcbiAgICAgIHRoaXMuZGVueVN0YXRlbWVudCA9IG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBzaWQ6IGBCdWNrZXREZW55YCxcbiAgICAgICAgZWZmZWN0OiBFZmZlY3QuREVOWSxcbiAgICAgICAgcmVzb3VyY2VzOiB0aGlzLnJlc291cmNlLFxuICAgICAgICBhY3Rpb25zOiBSZXN0cmljdE9iamVjdFByZWZpeFRvUm9sZXMuQlVDS0VUX0RFTllfQUNUSU9OUyxcbiAgICAgIH0pO1xuICAgIH1cbiAgICB0aGlzLmRlbnlTdGF0ZW1lbnQuYWRkQW55UHJpbmNpcGFsKCk7XG5cbiAgICAvLyBCdWlsZCBvdXIgY29uZGl0aW9uYWxzLlxuICAgIHRoaXMuZGVueUNvbmRpdGlvbmFsTm90RXF1YWxzWydhd3M6dXNlcklkJ10gPSBwcm9wcy5yb2xlRXhjbHVkZUlkcy5tYXAoeCA9PiBgJHt4fToqYCk7XG4gICAgaWYgKHByb3BzLnByaW5jaXBhbEV4Y2x1ZGVzICYmIHByb3BzLnByaW5jaXBhbEV4Y2x1ZGVzLmxlbmd0aCA+IDApIHtcbiAgICAgIHRoaXMuZGVueUNvbmRpdGlvbmFsTm90RXF1YWxzWydhd3M6UHJpbmNpcGFsQXJuJ10gPSBbLi4ubmV3IFNldChwcm9wcy5wcmluY2lwYWxFeGNsdWRlcyldLnNvcnQoKGEsIGIpID0+XG4gICAgICAgIGEubG9jYWxlQ29tcGFyZShiKSxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgLy8gQ29uc3RydWN0IG91ciBjb25kaXRpb25hbCBmb3Igb3VyIGRlbnlcbiAgICBpZiAoT2JqZWN0LmtleXModGhpcy5kZW55Q29uZGl0aW9uYWxOb3RFcXVhbHMpLmxlbmd0aCA9PSAxKSB7XG4gICAgICB0aGlzLmRlbnlTdGF0ZW1lbnQuYWRkQ29uZGl0aW9uKCdTdHJpbmdOb3RMaWtlJywgdGhpcy5kZW55Q29uZGl0aW9uYWxOb3RFcXVhbHMpO1xuICAgIH0gZWxzZSB7XG4gICAgICB0aGlzLmRlbnlTdGF0ZW1lbnQuYWRkQ29uZGl0aW9uKCdGb3JBbnlWYWx1ZTpTdHJpbmdOb3RMaWtlJywgdGhpcy5kZW55Q29uZGl0aW9uYWxOb3RFcXVhbHMpO1xuICAgIH1cbiAgfVxuXG4gIHByaXZhdGUgZm9ybWF0UzNQcmVmaXgocHJlZml4OiBzdHJpbmcpOiBzdHJpbmcge1xuICAgIGxldCByYXdQcmVmaXggPSBwcmVmaXg7XG5cbiAgICAvLyBSZW1vdmVzIHRyYWlsaW5nIHNsYXNoZXNcbiAgICByYXdQcmVmaXggPSByYXdQcmVmaXguZW5kc1dpdGgoJy8nKSA/IHJhd1ByZWZpeC5zbGljZSgwLCAtMSkgOiByYXdQcmVmaXg7XG4gICAgLy8gUmVtb3ZlcyBsZWFkaW5nIHNsYXNoZXNcbiAgICByYXdQcmVmaXggPSByYXdQcmVmaXguc3RhcnRzV2l0aCgnLycpID8gcmF3UHJlZml4LnN1YnN0cmluZygxKSA6IHJhd1ByZWZpeDtcbiAgICByZXR1cm4gYCR7cmF3UHJlZml4fS8qYDtcbiAgfVxufVxuIl19

package/node_modules/@aws-mdaa/s3-bucketpolicy-helper/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@aws-mdaa/s3-bucketpolicy-helper",
+  "description": "MDAA s3-bucketpolicy-helper utility",
+  "author": {
+    "name": "Amazon Web Services",
+    "url": "https://aws.amazon.com/solutions"
+  },
+  "version": "1.2.0",
+  "license": "Apache-2.0",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "watch": "tsc -w",
+    "test": "jest --passWithNoTests --coverage",
+    "lint": "eslint --max-warnings 0 -c ../../../.eslintrc.json '**/*.{ts,tsx}' --ignore-pattern 'dist/*' --ignore-pattern 'node_modules/*' --ignore-pattern \"*.d.ts\" ",
+    "test-coverage": "jest --passWithNoTests --coverage"
+  },
+  "devDependencies": {
+    "@aws-mdaa/testing": "1.2.0",
+    "@types/jest": "29.5.0",
+    "@types/node": "17.0.23",
+    "@types/prettier": "2.6.0",
+    "jest": "29.5.0",
+    "ts-jest": "29.1.0",
+    "ts-node": "10.9.1",
+    "typescript": "4.6.3",
+    "typescript-json-schema": "0.63.0"
+  },
+  "overrides": {
+    "aws-cdk-lib": "2.201.0",
+    "@types/babel__traverse": "7.18.2"
+  },
+  "dependencies": {
+    "@aws-mdaa/iam-role-helper": "1.2.0",
+    "@aws-mdaa/naming": "1.2.0",
+    "aws-cdk-lib": "2.201.0",
+    "cdk-nag": "2.37.1",
+    "constructs": "10.0.96"
+  },
+  "gitHead": "8b49a2b371014baec046605ffdbfe38951099c31",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aws/modern-data-architecture-accelerator"
+  }
+}

package/node_modules/@aws-mdaa/s3-inventory-helper/README.md

@@ -0,0 +1,3 @@
+# S3 Inventory Helper
+
+This is a helper class that helps construct working S3 inventory configurations that can be added to a bucket construct.

package/node_modules/@aws-mdaa/s3-inventory-helper/lib/index.d.ts

@@ -0,0 +1,66 @@
+/*!
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Database } from '@aws-cdk/aws-glue-alpha';
+import { CfnTable } from 'aws-cdk-lib/aws-glue';
+import { PolicyStatement } from 'aws-cdk-lib/aws-iam';
+import { IBucket, Inventory } from 'aws-cdk-lib/aws-s3';
+import { Construct } from 'constructs';
+export interface BucketInventory {
+    /**
+     * Q-ENHANCED-PROPERTY
+     * Name of the S3 bucket for which inventory data has been generated. Identifies the source bucket in inventory data organization and enables bucket-specific inventory querying through Glue table partitions.
+     *
+     * Use cases: Source bucket identification; Inventory data organization; Multi-bucket inventory management
+     *
+     * AWS: AWS S3 bucket name for inventory source identification in Glue table partitions
+     *
+     * Validation: Must be valid S3 bucket name (3-63 characters, lowercase, no underscores)
+     **/
+    readonly bucketName: string;
+    /**
+     * Q-ENHANCED-PROPERTY
+     * Name of the S3 inventory configuration that generated the inventory data for the specified bucket. Enables multiple inventory configurations per bucket and organized inventory data management.
+     *
+     * Use cases: Inventory configuration identification; Multiple inventories per bucket; Inventory data organization
+     *
+     * AWS: AWS S3 inventory configuration name for inventory data identification in Glue table partitions
+     *
+     * Validation: Must be valid S3 inventory configuration name matching the inventory ID used in S3 inventory setup
+     **/
+    readonly inventoryName: string;
+}
+/** Helper class for creating S3 Inventories and associated Glue/Athena resources for querying these inventories. */
+export declare class InventoryHelper {
+    /**
+     * Helper method for creating an S3 inventory.
+     * @param destinationBucket The bucket where S3 inventory data will be written
+     * @param inventoryId The S3 inventory ID
+     * @param objectsPrefix The object prefix from which inventory will be produced (on the bucket to which the inventory config is applied)
+     * @param destinationPrefix The object prefix under which inventory will be written on the destination bucket.
+     * @returns An S3 Inventory Config which can be applied to a bucket in order to produce periodic inventory data.
+     */
+    static createInvConfig(destinationBucket: IBucket, inventoryId: string, objectsPrefix?: string, destinationPrefix?: string, destinationAccount?: string): Inventory;
+    /**
+     * Helper method for creating a Glue table which can be used to query inventory data generated by an S3 Inventory config
+     * @param scope Stack in which the table will be created
+     * @param tableNamePrefix Will be used to prefix the table name.
+     * @param locationBucketName The bucket where the inventory data is stored.
+     * @param inventoryBucket The bucket for which inventory data has been generated
+     * @param database The Glue database in which the table will be created
+     * @param inventoryName The name of the S3 Inventory config
+     * @param locationPrefix The S3 Prefix on the location bucket where the inventory is stored.
+     * @returns A Glue table which can be used to query S3 inventory data in an S3 bucket.
+     */
+    static createGlueInvTable(scope: Construct, catalogId: string, tableNamePrefix: string, database: Database, locationBucketName: string, bucketInventories: BucketInventory[], locationPrefix?: string): CfnTable;
+    /**
+     * Helper method to generate an S3 Bucket Policy Statement allowing S3 service to write inventories to a bucket.
+     * @param sourceBucketArn The bucket arn for which inventory data is being produced
+     * @param bucketArn  The bucket arn where inventory will be stored
+     * @param srcAccount The account which owns the source bucket from which inventory is being produced.
+     * @param inventoryPrefix The prefix on the destination bucket where inventory data will be stored.
+     * @returns A policy statement which permits the S3 service principal to write inventory for the source bucket/account to the destination bucket.
+     */
+    static createInventoryBucketPolicyStatement(bucketArn: string, srcAccount: string, sourceBucketArn?: string, inventoryPrefix?: string): PolicyStatement;
+}