@beesolve/aws-accounts 1.0.7 → 1.2.0

package/dist/scanLogic.js

@@ -4,11 +4,15 @@ import {
   ListUsersCommand
 } from "@aws-sdk/client-identitystore";
 import {
+  DescribeOrganizationCommand,
+  DescribePolicyCommand,
   ListAccountsCommand,
   ListOrganizationalUnitsForParentCommand,
   ListParentsCommand,
+  ListPoliciesCommand,
   ListRootsCommand,
-  ListTagsForResourceCommand
+  ListTagsForResourceCommand,
+  ListTargetsForPolicyCommand
 } from "@aws-sdk/client-organizations";
 import {
   DescribePermissionSetCommand,
@@ -16,19 +20,27 @@ import {
   ListAccountAssignmentsCommand,
   ListAccountsForProvisionedPermissionSetCommand,
   ListCustomerManagedPolicyReferencesInPermissionSetCommand,
+  DescribeInstanceAccessControlAttributeConfigurationCommand,
   ListInstancesCommand,
   ListManagedPoliciesInPermissionSetCommand,
   ListPermissionSetsCommand
 } from "@aws-sdk/client-sso-admin";
+import {
+  GetAlternateContactCommand
+} from "@aws-sdk/client-account";
 import {
   createAccessRoleName
 } from "./state.js";
 async function scanOrganization(props) {
-  const roots = await props.organizationsClient.send(new ListRootsCommand({}));
-  const root = roots.Roots?.[0];
+  const [rootsResponse, orgResponse] = await Promise.all([
+    props.organizationsClient.send(new ListRootsCommand({})),
+    props.organizationsClient.send(new DescribeOrganizationCommand({}))
+  ]);
+  const root = rootsResponse.Roots?.[0];
   if (root?.Id == null) {
     throw new Error("No organization root found.");
   }
+  const managementAccountId = orgResponse.Organization?.MasterAccountId;
   const organizationalUnits = await collectOrganizationalUnits({
     organizationsClient: props.organizationsClient,
     parentId: root.Id
@@ -52,6 +64,11 @@ async function scanOrganization(props) {
           ResourceId: account.Id
         })
       );
+      const alternateContacts = await scanAlternateContacts({
+        accountClient: props.accountClient,
+        accountId: account.Id,
+        isManagementAccount: account.Id === managementAccountId
+      });
       accounts.push({
         id: account.Id,
         arn: account.Arn,
@@ -69,17 +86,95 @@ async function scanOrganization(props) {
               value: tag.Value ?? ""
             }
           ];
-        })
+        }),
+        alternateContacts: alternateContacts.length > 0 ? alternateContacts : void 0
       });
     }
     nextToken = response.NextToken;
   } while (nextToken != null);
+  const { policies, policyAttachments } = await scanOrganizationPolicies({
+    organizationsClient: props.organizationsClient
+  });
   return {
     rootId: root.Id,
     organizationalUnits,
-    accounts
+    accounts,
+    policies,
+    policyAttachments
   };
 }
+const ORG_POLICY_TYPES = [
+  "SERVICE_CONTROL_POLICY",
+  "RESOURCE_CONTROL_POLICY",
+  "TAG_POLICY",
+  "AISERVICES_OPT_OUT_POLICY"
+];
+async function scanOrganizationPolicies(props) {
+  const policies = [];
+  const policyAttachments = [];
+  for (const policyType of ORG_POLICY_TYPES) {
+    let nextToken;
+    const policyIds = [];
+    do {
+      const response = await props.organizationsClient.send(
+        new ListPoliciesCommand({ Filter: policyType, NextToken: nextToken })
+      );
+      for (const summary of response.Policies ?? []) {
+        if (summary.Id == null || summary.AwsManaged === true) {
+          continue;
+        }
+        policyIds.push(summary.Id);
+      }
+      nextToken = response.NextToken;
+    } while (nextToken != null);
+    for (const policyId of policyIds) {
+      const describeResponse = await props.organizationsClient.send(
+        new DescribePolicyCommand({ PolicyId: policyId })
+      );
+      const policy = describeResponse.Policy;
+      if (policy?.PolicySummary?.Id == null || policy.PolicySummary.Arn == null || policy.PolicySummary.Name == null) {
+        continue;
+      }
+      const content = policy.Content;
+      if (content == null || content.length === 0) {
+        continue;
+      }
+      policies.push({
+        id: policy.PolicySummary.Id,
+        arn: policy.PolicySummary.Arn,
+        name: policy.PolicySummary.Name,
+        description: policy.PolicySummary.Description ?? "",
+        type: policyType,
+        content
+      });
+      let targetsNextToken;
+      do {
+        const targetsResponse = await props.organizationsClient.send(
+          new ListTargetsForPolicyCommand({
+            PolicyId: policyId,
+            NextToken: targetsNextToken
+          })
+        );
+        for (const target of targetsResponse.Targets ?? []) {
+          if (target.TargetId == null || target.Type == null) {
+            continue;
+          }
+          const targetType = target.Type;
+          if (targetType !== "ROOT" && targetType !== "ORGANIZATIONAL_UNIT" && targetType !== "ACCOUNT") {
+            continue;
+          }
+          policyAttachments.push({
+            policyId,
+            targetId: target.TargetId,
+            targetType
+          });
+        }
+        targetsNextToken = targetsResponse.NextToken;
+      } while (targetsNextToken != null);
+    }
+  }
+  return { policies, policyAttachments };
+}
 async function collectOrganizationalUnits(props) {
   const children = [];
   let nextToken;
@@ -122,7 +217,7 @@ async function scanIdentityCenter(props) {
     instances,
     requestedInstanceArn: props.requestedInstanceArn
   });
-  const [users, groups, permissionSets] = await Promise.all([
+  const [users, groups, permissionSets, accessControlAttributes] = await Promise.all([
     listIdentityStoreUsers({
       identityStoreClient: props.identityStoreClient,
       identityStoreId: instance.identityStoreId
@@ -134,6 +229,10 @@ async function scanIdentityCenter(props) {
     listPermissionSets({
       ssoAdminClient: props.ssoAdminClient,
       instanceArn: instance.instanceArn
+    }),
+    scanAccessControlAttributes({
+      ssoAdminClient: props.ssoAdminClient,
+      instanceArn: instance.instanceArn
     })
   ]);
   const groupMemberships = await listGroupMemberships({
@@ -158,9 +257,30 @@ async function scanIdentityCenter(props) {
     groupMemberships,
     permissionSets,
     accountAssignments,
-    accessRoles
+    accessRoles,
+    accessControlAttributes
   };
 }
+async function scanAccessControlAttributes(props) {
+  let response;
+  try {
+    response = await props.ssoAdminClient.send(
+      new DescribeInstanceAccessControlAttributeConfigurationCommand({
+        InstanceArn: props.instanceArn
+      })
+    );
+  } catch (err) {
+    if (err != null && typeof err === "object" && "name" in err && err.name === "ResourceNotFoundException") {
+      return [];
+    }
+    throw err;
+  }
+  const attributes = response.InstanceAccessControlAttributeConfiguration?.AccessControlAttributes ?? [];
+  return attributes.filter((attr) => attr.Key != null).map((attr) => ({
+    key: attr.Key,
+    source: attr.Value?.Source ?? []
+  }));
+}
 function selectIdentityCenterInstance(props) {
   if (props.requestedInstanceArn != null) {
     const selected2 = props.instances.find(
@@ -333,6 +453,7 @@ async function listPermissionSets(props) {
         permissionSetArn: permissionSet.PermissionSetArn,
         name: permissionSet.Name,
         description: permissionSet.Description ?? "",
+        sessionDuration: permissionSet.SessionDuration ?? null,
         inlinePolicy,
         awsManagedPolicies,
         customerManagedPolicies
@@ -450,6 +571,42 @@ async function listAccountsForPermissionSet(props) {
   } while (nextToken != null);
   return accountIds;
 }
+const ALTERNATE_CONTACT_TYPES = [
+  "BILLING",
+  "OPERATIONS",
+  "SECURITY"
+];
+async function scanAlternateContacts(props) {
+  const results = await Promise.all(
+    ALTERNATE_CONTACT_TYPES.map(async (contactType) => {
+      try {
+        const response = await props.accountClient.send(
+          new GetAlternateContactCommand({
+            AccountId: props.isManagementAccount ? void 0 : props.accountId,
+            AlternateContactType: contactType
+          })
+        );
+        const c = response.AlternateContact;
+        if (c == null || c.EmailAddress == null || c.Name == null) {
+          return null;
+        }
+        return {
+          contactType,
+          name: c.Name,
+          email: c.EmailAddress,
+          phone: c.PhoneNumber ?? "",
+          ...c.Title != null ? { title: c.Title } : {}
+        };
+      } catch (error) {
+        if (error != null && typeof error === "object" && "name" in error && error.name === "ResourceNotFoundException") {
+          return null;
+        }
+        throw error;
+      }
+    })
+  );
+  return results.filter((c) => c != null);
+}
 export {
   scanIdentityCenter,
   scanOrganization

package/dist/state.js

@@ -9,10 +9,36 @@ const organizationalUnitSchema = v.strictObject({
   arn: nonEmptyString,
   name: nonEmptyString
 });
+const orgPolicyTypeSchema = v.picklist([
+  "SERVICE_CONTROL_POLICY",
+  "RESOURCE_CONTROL_POLICY",
+  "TAG_POLICY",
+  "AISERVICES_OPT_OUT_POLICY"
+]);
+const orgPolicySchema = v.strictObject({
+  id: nonEmptyString,
+  arn: nonEmptyString,
+  name: nonEmptyString,
+  description: v.string(),
+  type: orgPolicyTypeSchema,
+  content: nonEmptyString
+});
+const orgPolicyAttachmentSchema = v.strictObject({
+  policyId: nonEmptyString,
+  targetId: nonEmptyString,
+  targetType: v.picklist(["ROOT", "ORGANIZATIONAL_UNIT", "ACCOUNT"])
+});
 const accountTagSchema = v.strictObject({
   key: nonEmptyString,
   value: v.string()
 });
+const alternateContactSchema = v.strictObject({
+  contactType: v.picklist(["BILLING", "OPERATIONS", "SECURITY"]),
+  name: v.string(),
+  email: v.string(),
+  phone: v.string(),
+  title: v.optional(v.string())
+});
 const accountSchema = v.strictObject({
   id: nonEmptyString,
   arn: nonEmptyString,
@@ -20,7 +46,8 @@ const accountSchema = v.strictObject({
   email: nonEmptyString,
   status: nonEmptyString,
   parentId: nonEmptyString,
-  tags: v.array(accountTagSchema)
+  tags: v.array(accountTagSchema),
+  alternateContacts: v.optional(v.array(alternateContactSchema))
 });
 const userSchema = v.strictObject({
   userId: nonEmptyString,
@@ -46,6 +73,7 @@ const permissionSetSchema = v.strictObject({
   permissionSetArn: nonEmptyString,
   name: nonEmptyString,
   description: v.string(),
+  sessionDuration: v.nullable(v.string()),
   inlinePolicy: v.nullable(nonEmptyString),
   awsManagedPolicies: v.array(nonEmptyString),
   customerManagedPolicies: v.array(customerManagedPolicyReferenceSchema)
@@ -63,13 +91,19 @@ const accessRoleSchema = v.strictObject({
   principalType: principalTypeSchema,
   roleName: nonEmptyString
 });
+const accessControlAttributeSchema = v.strictObject({
+  key: nonEmptyString,
+  source: v.array(nonEmptyString)
+});
 const stateSchema = v.strictObject({
   version: nonEmptyString,
   generatedAt: nonEmptyString,
   organization: v.strictObject({
     rootId: nonEmptyString,
     organizationalUnits: v.array(organizationalUnitSchema),
-    accounts: v.array(accountSchema)
+    accounts: v.array(accountSchema),
+    policies: v.optional(v.array(orgPolicySchema)),
+    policyAttachments: v.optional(v.array(orgPolicyAttachmentSchema))
   }),
   identityCenter: v.strictObject({
     instanceArn: nonEmptyString,
@@ -79,13 +113,16 @@ const stateSchema = v.strictObject({
     groupMemberships: v.array(groupMembershipSchema),
     permissionSets: v.array(permissionSetSchema),
     accountAssignments: v.array(accountAssignmentSchema),
-    accessRoles: v.array(accessRoleSchema)
+    accessRoles: v.array(accessRoleSchema),
+    accessControlAttributes: v.array(accessControlAttributeSchema)
   })
 });
 function validateState(value) {
   return v.parse(stateSchema, value);
 }
 function createWorkingState(props) {
+  const policies = props.state.organization.policies ?? [];
+  const policyAttachments = props.state.organization.policyAttachments ?? [];
   return {
     version: props.state.version,
     generatedAt: props.state.generatedAt,
@@ -99,6 +136,13 @@ function createWorkingState(props) {
       accountsByName: toRecordByProperty(
         props.state.organization.accounts,
         "name"
+      ),
+      policiesById: toRecordByProperty(policies, "id"),
+      policiesByName: toRecordByProperty(policies, "name"),
+      policyAttachments: structuredClone(policyAttachments),
+      policyAttachmentsByKey: toRecordByProperty(
+        policyAttachments,
+        createOrgPolicyAttachmentKey
       )
     },
     identityCenter: createWorkingIdentityCenterState({
@@ -115,7 +159,11 @@ function materializeWorkingState(props) {
       organizationalUnits: Object.values(
         props.workingState.organization.organizationalUnitsById
       ),
-      accounts: Object.values(props.workingState.organization.accountsById)
+      accounts: Object.values(props.workingState.organization.accountsById),
+      policies: Object.values(props.workingState.organization.policiesById),
+      policyAttachments: structuredClone(
+        props.workingState.organization.policyAttachments
+      )
     },
     identityCenter: {
       instanceArn: props.workingState.identityCenter.instanceArn,
@@ -133,6 +181,9 @@ function materializeWorkingState(props) {
       ),
       accessRoles: structuredClone(
         props.workingState.identityCenter.accessRoles
+      ),
+      accessControlAttributes: structuredClone(
+        props.workingState.identityCenter.accessControlAttributes
       )
     }
   };
@@ -345,7 +396,7 @@ function removeIdcGroupFromWorkingState(props) {
 }
 function upsertIdcPermissionSetInWorkingState(props) {
   const currentPermissionSet = props.workingState.identityCenter.permissionSetsByName[props.permissionSet.name];
-  if (currentPermissionSet != null && currentPermissionSet.permissionSetArn === props.permissionSet.permissionSetArn && currentPermissionSet.name === props.permissionSet.name && currentPermissionSet.description === props.permissionSet.description && currentPermissionSet.inlinePolicy === props.permissionSet.inlinePolicy && JSON.stringify(currentPermissionSet.awsManagedPolicies) === JSON.stringify(props.permissionSet.awsManagedPolicies) && JSON.stringify(currentPermissionSet.customerManagedPolicies) === JSON.stringify(props.permissionSet.customerManagedPolicies)) {
+  if (currentPermissionSet != null && currentPermissionSet.permissionSetArn === props.permissionSet.permissionSetArn && currentPermissionSet.name === props.permissionSet.name && currentPermissionSet.description === props.permissionSet.description && currentPermissionSet.sessionDuration === props.permissionSet.sessionDuration && currentPermissionSet.inlinePolicy === props.permissionSet.inlinePolicy && JSON.stringify(currentPermissionSet.awsManagedPolicies) === JSON.stringify(props.permissionSet.awsManagedPolicies) && JSON.stringify(currentPermissionSet.customerManagedPolicies) === JSON.stringify(props.permissionSet.customerManagedPolicies)) {
     return props.workingState;
   }
   const remainingPermissionSets = props.workingState.identityCenter.permissionSets.filter(
@@ -487,6 +538,101 @@ function removeAccountAssignmentFromWorkingState(props) {
     })
   };
 }
+function createOrgPolicyAttachmentKey(props) {
+  return [props.policyId, props.targetId].join("|");
+}
+function upsertOrgPolicyInWorkingState(props) {
+  const currentPolicy = props.workingState.organization.policiesById[props.policy.id];
+  if (currentPolicy != null && currentPolicy.id === props.policy.id && currentPolicy.arn === props.policy.arn && currentPolicy.name === props.policy.name && currentPolicy.description === props.policy.description && currentPolicy.type === props.policy.type && currentPolicy.content === props.policy.content) {
+    return props.workingState;
+  }
+  const remainingPolicies = Object.values(
+    props.workingState.organization.policiesById
+  ).filter((p) => p.id !== props.policy.id);
+  const nextPolicies = [...remainingPolicies, props.policy];
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      policiesById: toRecordByProperty(nextPolicies, "id"),
+      policiesByName: toRecordByProperty(nextPolicies, "name")
+    }
+  };
+}
+function removeOrgPolicyFromWorkingState(props) {
+  if (props.workingState.organization.policiesById[props.policyId] == null) {
+    return props.workingState;
+  }
+  const nextPolicies = Object.values(
+    props.workingState.organization.policiesById
+  ).filter((p) => p.id !== props.policyId);
+  const nextAttachments = props.workingState.organization.policyAttachments.filter(
+    (a) => a.policyId !== props.policyId
+  );
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      policiesById: toRecordByProperty(nextPolicies, "id"),
+      policiesByName: toRecordByProperty(nextPolicies, "name"),
+      policyAttachments: nextAttachments,
+      policyAttachmentsByKey: toRecordByProperty(
+        nextAttachments,
+        createOrgPolicyAttachmentKey
+      )
+    }
+  };
+}
+function addOrgPolicyAttachmentToWorkingState(props) {
+  const key = createOrgPolicyAttachmentKey({
+    policyId: props.attachment.policyId,
+    targetId: props.attachment.targetId
+  });
+  if (props.workingState.organization.policyAttachmentsByKey[key] != null) {
+    return props.workingState;
+  }
+  const nextAttachments = [
+    ...props.workingState.organization.policyAttachments,
+    props.attachment
+  ];
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      policyAttachments: nextAttachments,
+      policyAttachmentsByKey: toRecordByProperty(
+        nextAttachments,
+        createOrgPolicyAttachmentKey
+      )
+    }
+  };
+}
+function removeOrgPolicyAttachmentFromWorkingState(props) {
+  const key = createOrgPolicyAttachmentKey({
+    policyId: props.policyId,
+    targetId: props.targetId
+  });
+  if (props.workingState.organization.policyAttachmentsByKey[key] == null) {
+    return props.workingState;
+  }
+  const nextAttachments = props.workingState.organization.policyAttachments.filter(
+    (a) => createOrgPolicyAttachmentKey({
+      policyId: a.policyId,
+      targetId: a.targetId
+    }) !== key
+  );
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      policyAttachments: nextAttachments,
+      policyAttachmentsByKey: toRecordByProperty(
+        nextAttachments,
+        createOrgPolicyAttachmentKey
+      )
+    }
+  };
+}
 async function readStateFile(path) {
   const content = await readFile(path, "utf8");
   const parsed = JSON.parse(content);
@@ -526,7 +672,10 @@ function createWorkingIdentityCenterState(props) {
     ),
     accessRoles: createAccessRoles({
       accountAssignments
-    })
+    }),
+    accessControlAttributes: structuredClone(
+      props.identityCenter.accessControlAttributes ?? []
+    )
   };
 }
 function materializeWorkingIdentityCenterState(props) {
@@ -540,7 +689,10 @@ function materializeWorkingIdentityCenterState(props) {
     accountAssignments: structuredClone(
       props.identityCenter.accountAssignments
     ),
-    accessRoles: structuredClone(props.identityCenter.accessRoles)
+    accessRoles: structuredClone(props.identityCenter.accessRoles),
+    accessControlAttributes: structuredClone(
+      props.identityCenter.accessControlAttributes
+    )
   };
 }
 function createAccessRoles(props) {
@@ -595,8 +747,10 @@ function sortJsonValue(value) {
 export {
   addAccountAssignmentToWorkingState,
   addGroupMembershipToWorkingState,
+  addOrgPolicyAttachmentToWorkingState,
   createAccessRoleName,
   createGroupMembershipKey,
+  createOrgPolicyAttachmentKey,
   createWorkingState,
   materializeWorkingState,
   moveAccountInWorkingState,
@@ -606,6 +760,8 @@ export {
   removeIdcGroupFromWorkingState,
   removeIdcPermissionSetFromWorkingState,
   removeIdcUserFromWorkingState,
+  removeOrgPolicyAttachmentFromWorkingState,
+  removeOrgPolicyFromWorkingState,
   removeOrganizationalUnitFromWorkingState,
   renameOrganizationalUnitInWorkingState,
   stateSchema,
@@ -613,6 +769,7 @@ export {
   upsertIdcGroupInWorkingState,
   upsertIdcPermissionSetInWorkingState,
   upsertIdcUserInWorkingState,
+  upsertOrgPolicyInWorkingState,
   upsertOrganizationalUnitInWorkingState,
   validateState
 };