@beesolve/aws-accounts 1.0.7 → 1.2.0

package/dist/cli.js

@@ -11,8 +11,13 @@ import {
   resolveAwsRegion
 } from "./awsClientConfig.js";
 import { consoleLogger } from "./logger.js";
-import { runGraveyardCommand } from "./commands/graveyard.js";
+import {
+  runGraveyardCloseCommand,
+  runGraveyardCommand
+} from "./commands/graveyard.js";
+import { runProfileCommand } from "./commands/profile.js";
 import { runRegenerateCommand } from "./commands/regenerate.js";
+import { runValidateCommand } from "./commands/validate.js";
 import {
   runRemoteBootstrap,
   runRemoteScan,
@@ -26,12 +31,15 @@ import {
   exitCodeForCliErrorKind,
   toUsageError
 } from "./error.js";
+import { readAwsContextFromFile, readPackageVersion } from "./awsConfig.js";
 const commands = [
   "bootstrap",
   "scan",
   "init",
   "regenerate",
+  "validate",
   "graveyard",
+  "profile",
   "plan",
   "apply",
   "upgrade"
@@ -51,6 +59,9 @@ async function main() {
       "ignore-unsupported": { type: "boolean", default: false },
       "allow-destructive": { type: "boolean", default: false },
       refresh: { type: "boolean", default: false },
+      update: { type: "boolean", default: false },
+      "sso-start-url": { type: "string" },
+      "sso-session": { type: "string", default: "sso" },
       help: { type: "boolean", default: false }
     },
     allowPositionals: true
@@ -87,7 +98,29 @@ async function main() {
     }
     return;
   }
+  if (command === "validate") {
+    const valid = await runValidateCommand({ logger });
+    if (!valid) {
+      process.exitCode = 1;
+    }
+    return;
+  }
   if (command === "graveyard") {
+    const subcommand = args.positionals[1];
+    if (subcommand === "close") {
+      await runGraveyardCloseCommand({
+        logger,
+        cachePath: ".remote-state-cache.json",
+        contextPath
+      });
+      return;
+    }
+    if (subcommand != null) {
+      printHelp(logger);
+      throw toUsageError(
+        `Unknown graveyard subcommand: "${subcommand}". Valid subcommands: close`
+      );
+    }
     await runGraveyardCommand({
       logger,
       cachePath: ".remote-state-cache.json",
@@ -95,6 +128,24 @@ async function main() {
     });
     return;
   }
+  if (command === "profile") {
+    const ssoStartUrl = args.values["sso-start-url"] ?? process.env.AWS_SSO_START_URL;
+    if (ssoStartUrl == null) {
+      printHelp(logger);
+      throw toUsageError(
+        "--sso-start-url is required for the profile command (or set AWS_SSO_START_URL)."
+      );
+    }
+    await runProfileCommand({
+      logger,
+      cachePath: ".remote-state-cache.json",
+      contextPath,
+      ssoStartUrl,
+      ssoSession: args.values["sso-session"] ?? "sso",
+      isTty: process.stdin.isTTY
+    });
+    return;
+  }
   const overwriteConfirmation = buildOverwriteConfirmation({
     yes: args.values.yes ?? false,
     isTty: process.stdin.isTTY
@@ -107,7 +158,8 @@ async function main() {
       yes: args.values.yes ?? false,
       refresh: args.values.refresh ?? false,
       allowDestructive: args.values["allow-destructive"] ?? false,
-      ignoreUnsupported: args.values["ignore-unsupported"] ?? false
+      ignoreUnsupported: args.values["ignore-unsupported"] ?? false,
+      update: args.values.update ?? false
     },
     logger,
     overwriteConfirmation,
@@ -118,25 +170,23 @@ async function main() {
     ssoAdminClient: new SSOAdminClient(clientConfig)
   };
   if (command === "bootstrap") {
-    return runRemoteBootstrap(remoteInput);
-  }
-  if (command === "scan") {
-    return runRemoteScan(remoteInput);
-  }
-  if (command === "init") {
-    return runRemoteInit(remoteInput);
-  }
-  if (command === "plan") {
-    return runRemotePlan(remoteInput);
-  }
-  if (command === "apply") {
-    return runRemoteApply(remoteInput);
-  }
-  if (command === "upgrade") {
-    return runRemoteUpgrade(remoteInput);
+    await runRemoteBootstrap(remoteInput);
+  } else if (command === "scan") {
+    await runRemoteScan(remoteInput);
+  } else if (command === "init") {
+    await runRemoteInit(remoteInput);
+  } else if (command === "plan") {
+    await runRemotePlan(remoteInput);
+  } else if (command === "apply") {
+    await runRemoteApply(remoteInput);
+  } else if (command === "upgrade") {
+    await runRemoteUpgrade(remoteInput);
+  } else {
+    printHelp(logger);
+    process.exitCode = 1;
+    return;
   }
-  printHelp(logger);
-  process.exitCode = 1;
+  await printVersionBannerIfNeeded(logger);
 }
 function printHelp(logger) {
   logger.log("@beesolve/aws-accounts");
@@ -145,23 +195,27 @@ function printHelp(logger) {
   logger.log(
     "  npm run cli -- bootstrap [--profile <name>] [--region <region>] [--yes]"
   );
+  logger.log("  npm run cli -- scan [--profile <name>] [--region <region>]");
   logger.log(
-    "  npm run cli -- scan [--profile <name>] [--region <region>]"
+    "  npm run cli -- init [--profile <name>] [--region <region>] [--yes]"
   );
   logger.log(
-    "  npm run cli -- init [--profile <name>] [--region <region>] [--yes]"
+    "  npm run cli -- init --update [--profile <name>] [--region <region>] [--yes]"
   );
   logger.log("  npm run cli -- regenerate [--yes]");
+  logger.log("  npm run cli -- validate");
   logger.log("  npm run cli -- graveyard");
+  logger.log("  npm run cli -- graveyard close");
   logger.log(
-    "  npm run cli -- plan [--profile <name>] [--region <region>] [--refresh]"
+    "  npm run cli -- profile --sso-start-url <url> [--sso-session <name>]  (env: AWS_SSO_START_URL)"
   );
   logger.log(
-    "  npm run cli -- apply [--profile <name>] [--region <region>] [--yes] [--allow-destructive] [--ignore-unsupported]"
+    "  npm run cli -- plan [--profile <name>] [--region <region>] [--refresh]"
   );
   logger.log(
-    "  npm run cli -- upgrade [--profile <name>] [--region <region>]"
+    "  npm run cli -- apply [--profile <name>] [--region <region>] [--yes] [--allow-destructive] [--ignore-unsupported]"
   );
+  logger.log("  npm run cli -- upgrade [--profile <name>] [--region <region>]");
   logger.log("");
   logger.log("Environment fallback:");
   logger.log("  AWS_PROFILE, AWS_REGION, AWS_DEFAULT_REGION");
@@ -194,6 +248,22 @@ function buildOverwriteConfirmation(props) {
     }
   };
 }
+async function printVersionBannerIfNeeded(logger) {
+  try {
+    const [context, currentVersion] = await Promise.all([
+      readAwsContextFromFile(contextPath),
+      readPackageVersion()
+    ]);
+    const remoteVersion = context.deployment?.cliVersion;
+    if (remoteVersion != null && remoteVersion !== currentVersion) {
+      logger.log("");
+      logger.log(
+        `New version installed (local: ${currentVersion}, remote: ${remoteVersion}). Run upgrade then init --update to sync.`
+      );
+    }
+  } catch {
+  }
+}
 main().catch((error) => {
   const classified = classifyCliError(error);
   consoleLogger.error(`CLI ${classified.kind} error: ${classified.message}`);

package/dist/commands/graveyard.js

@@ -1,5 +1,31 @@
 import { readAwsContextFromFile } from "../awsConfig.js";
 import { readStateCache } from "../remoteStateCache.js";
+async function runGraveyardCloseCommand(props) {
+  const [cache, context] = await Promise.all([
+    readStateCache(props.cachePath),
+    readAwsContextFromFile(props.contextPath)
+  ]);
+  if (cache == null) {
+    throw new Error(
+      `No remote state cache found at "${props.cachePath}". Run a scan or apply command first to populate the cache.`
+    );
+  }
+  const graveyardOuId = context.organization.graveyardOuId;
+  const eligible = cache.state.organization.accounts.filter((a) => a.parentId === graveyardOuId && a.status === "ACTIVE").sort((a, b) => a.name.localeCompare(b.name));
+  if (eligible.length === 0) {
+    props.logger.log("No accounts eligible for closure in Graveyard.");
+    return;
+  }
+  props.logger.log(`${eligible.length} account(s) eligible for closure:
+`);
+  for (const account of eligible) {
+    props.logger.log(`# ${account.name} (${account.id})`);
+    props.logger.log(
+      `aws organizations close-account --account-id ${account.id}`
+    );
+    props.logger.log("");
+  }
+}
 async function runGraveyardCommand(props) {
   const [cache, context] = await Promise.all([
     readStateCache(props.cachePath),
@@ -42,5 +68,6 @@ async function runGraveyardCommand(props) {
   };
 }
 export {
+  runGraveyardCloseCommand,
   runGraveyardCommand
 };

package/dist/commands/profile.js

@@ -0,0 +1,116 @@
+import { createInterface } from "node:readline/promises";
+import { readAwsContextFromFile } from "../awsConfig.js";
+import { readStateCache } from "../remoteStateCache.js";
+async function runProfileCommand(input) {
+  const cache = await readStateCache(input.cachePath);
+  if (cache == null) {
+    throw new Error(
+      `No remote state cache found at "${input.cachePath}". Run scan or plan first.`
+    );
+  }
+  const context = await readAwsContextFromFile(input.contextPath);
+  const region = context.deployment?.region || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || "us-east-1";
+  const entries = buildProfileEntries(cache.state);
+  if (entries.length === 0) {
+    input.logger.log("No account assignments found in state cache.");
+    return;
+  }
+  const selected = await selectEntry({ entries, logger: input.logger, isTty: input.isTty });
+  if (selected == null) {
+    return;
+  }
+  const profileName = buildProfileName(selected);
+  const block = renderProfileBlock({
+    profileName,
+    ssoSession: input.ssoSession,
+    accountId: selected.accountId,
+    roleName: selected.permissionSetName,
+    ssoStartUrl: input.ssoStartUrl,
+    region,
+    ssoRegistrationScopes: "sso:account:access"
+  });
+  input.logger.log("");
+  input.logger.log(block);
+}
+async function selectEntry(props) {
+  if (props.isTty !== true) {
+    throw new Error(
+      "Profile command requires an interactive terminal. Use --account and --permission-set in non-interactive mode (not yet supported)."
+    );
+  }
+  props.logger.log("Select an account/permission-set combination:");
+  props.logger.log("");
+  for (const [index, entry] of props.entries.entries()) {
+    props.logger.log(
+      `  ${index + 1}. ${entry.accountName} / ${entry.permissionSetName} (${entry.accountId})`
+    );
+  }
+  props.logger.log("");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    let choice;
+    while (choice == null) {
+      const answer = await rl.question(`Enter number (1-${props.entries.length}): `);
+      const parsed = parseInt(answer.trim(), 10);
+      if (!Number.isNaN(parsed) && parsed >= 1 && parsed <= props.entries.length) {
+        choice = parsed;
+      } else {
+        props.logger.log(`Please enter a number between 1 and ${props.entries.length}.`);
+      }
+    }
+    return props.entries[choice - 1] ?? null;
+  } finally {
+    rl.close();
+  }
+}
+function buildProfileEntries(state) {
+  const accountById = Object.fromEntries(state.organization.accounts.map((a) => [a.id, a]));
+  const permissionSetByArn = Object.fromEntries(
+    state.identityCenter.permissionSets.map((ps) => [ps.permissionSetArn, ps])
+  );
+  const seen = /* @__PURE__ */ new Set();
+  const entries = [];
+  for (const assignment of state.identityCenter.accountAssignments) {
+    const key = `${assignment.accountId}|${assignment.permissionSetArn}`;
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    const account = accountById[assignment.accountId];
+    const permissionSet = permissionSetByArn[assignment.permissionSetArn];
+    if (account == null || permissionSet == null) {
+      continue;
+    }
+    entries.push({
+      accountId: account.id,
+      accountName: account.name,
+      permissionSetName: permissionSet.name
+    });
+  }
+  return entries.sort((a, b) => {
+    const accountCmp = a.accountName.localeCompare(b.accountName);
+    return accountCmp !== 0 ? accountCmp : a.permissionSetName.localeCompare(b.permissionSetName);
+  });
+}
+function buildProfileName(entry) {
+  return `${toKebabCase(entry.accountName)}-${toKebabCase(entry.permissionSetName)}`;
+}
+function toKebabCase(value) {
+  return value.replace(/([a-z])([A-Z])/g, "$1-$2").replace(/[\s_]+/g, "-").toLowerCase().replace(/[^a-z0-9-]/g, "");
+}
+function renderProfileBlock(props) {
+  return [
+    `[profile ${props.profileName}]`,
+    `sso_session = ${props.ssoSession}`,
+    `sso_account_id = ${props.accountId}`,
+    `sso_role_name = ${props.roleName}`,
+    ``,
+    `[sso-session ${props.ssoSession}]`,
+    `sso_start_url = ${props.ssoStartUrl}`,
+    `sso_region = ${props.region}`,
+    `sso_registration_scopes = ${props.ssoRegistrationScopes}`
+  ].join("\n");
+}
+export {
+  runProfileCommand
+};