@cdkd/cli 0.0.1 → 0.323.0

package/dist/iam-role-provider-Bp4osNrj.js

@@ -0,0 +1,698 @@
+import { r as getAwsClients } from "./aws-clients-DWpHZk2l.js";
+import { $ as safeMsg, N as recordedGeneratedNameKept, T as generateResourceNameWithFallback, a as safeStringify, n as describeAwsFailure, s as getLogger } from "./aws-failure-text-DiHodi76.js";
+import { Ar as isThrottlingError, B as normalizeAwsTagsToCfn, Er as isTransientServerError, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, It as withDerivedNameMasks, Kt as markCreatedBeforeFailure, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, P as markNotGone, Ut as isAuxiliaryFailure, W as resolveExplicitPhysicalId, a as reportedCreatedResource, b as withRemovalDefaults, dt as pasteableAwsCommand, fn as ambientClientDefaults, hr as relayedNameCollision, i as reportCreatedResource, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, o as retractCreatedResource } from "./created-resource-sink-CmrPwGge.js";
+import { Qi as definedAttributes, Wi as markDeleteStarted, Yi as refuseMalformedDesiredTags, Zi as tagPlanWarning, qi as planTagDiff } from "./deploy-engine-dYZ0v6Kz.js";
+import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
+
+// src/provisioning/providers/iam-create-client.ts
+var IamCreateClientCache = class {
+	client;
+	shared;
+	constructor(shared) {
+		this.shared = shared;
+	}
+	get() {
+		const shared = this.shared();
+		if (!(shared instanceof IAMClient)) return Promise.resolve(shared);
+		this.client ??= shared.config.region().then((region) => withoutServerErrorRetries(new IAMClient({
+			...ambientClientDefaults(),
+			region,
+			maxAttempts: 8
+		})), (error) => {
+			this.client = void 0;
+			throw error;
+		});
+		return this.client;
+	}
+};
+
+// src/provisioning/providers/iam-replay-adopt.ts
+function isEntityAlreadyExists(error) {
+	return error?.name === "EntityAlreadyExistsException";
+}
+async function iamEntityLeftByThisCreate(query) {
+	const { logicalId, resourceType, noun, displayName, createError, log } = query;
+	if (!isEntityAlreadyExists(createError)) return void 0;
+	const report = reportedCreatedResource(logicalId, resourceType);
+	if (report?.createdResourceIdentity === void 0 || !query.namesThisEntity(report.physicalId)) return;
+	const { value: v } = log;
+	let entity;
+	try {
+		entity = await query.read(report.physicalId);
+	} catch (probeError) {
+		if (isThrottlingError(probeError) || isTransientServerError(probeError)) throw probeError;
+		log.debug(`IAM ${noun} ${logicalId}: could not read ${v(displayName)} to identify it: ${v(describeAwsFailure(probeError).detail)}`);
+		return;
+	}
+	if (query.identityOf(entity) !== report.createdResourceIdentity) {
+		log.warn(`IAM ${noun} ${logicalId}: ${v(displayName)} is not the ${noun} an earlier attempt of this create made, so it is left untouched. Do not delete it unless you know it is yours, whatever the failure below suggests.`);
+		return;
+	}
+	log.warn(`IAM ${noun} ${logicalId}: finishing ${v(displayName)}, the ${noun} an earlier attempt of this create made and could not delete. No manual deletion is needed if this create succeeds.`);
+	return entity;
+}
+
+// src/provisioning/providers/iam-role-provider.ts
+function isRoleName(id) {
+	return /^[\w+=,.@-]{1,64}$/.test(id);
+}
+function roleIdentityToken(roleId) {
+	return typeof roleId === "string" && roleId !== "" ? roleId : void 0;
+}
+var IAMRoleProvider = class {
+	iamClient;
+	createClient = new IamCreateClientCache(() => this.iamClient);
+	logger = getLogger().child("IAMRoleProvider");
+	wrapMaskedError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(mask(failure.detail)).message));
+		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
+		return markRedactedCause(build(`${mask(failure.summary)}${relay}`));
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::Role", /* @__PURE__ */ new Set([
+		"RoleName",
+		"AssumeRolePolicyDocument",
+		"Description",
+		"MaxSessionDuration",
+		"Path",
+		"PermissionsBoundary",
+		"ManagedPolicyArns",
+		"Policies",
+		"Tags"
+	])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::IAM::Role", /* @__PURE__ */ new Map([["Description", ""]])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::IAM::Role", /* @__PURE__ */ new Set([
+		"RoleName",
+		"Path",
+		"AssumeRolePolicyDocument",
+		"PermissionsBoundary",
+		"ManagedPolicyArns",
+		"Policies",
+		"Tags",
+		"MaxSessionDuration"
+	])]]);
+	constructor() {
+		const awsClients = getAwsClients();
+		this.iamClient = awsClients.iam;
+	}
+	async create(logicalId, resourceType, properties, context) {
+		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const roleName = generateResourceNameWithFallback(properties["RoleName"], logicalId, { maxLength: 64 });
+		const log = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[properties["RoleName"], roleName]]);
+		const { value: v } = log;
+		log.debug(`Creating IAM role ${logicalId}`);
+		const assumeRolePolicyDocument = properties["AssumeRolePolicyDocument"];
+		if (!assumeRolePolicyDocument) throw new ProvisioningError(`AssumeRolePolicyDocument is required for IAM role ${logicalId}`, resourceType, logicalId);
+		let leftBehind = false;
+		let createdRoleIdentity;
+		try {
+			const createParams = {
+				RoleName: roleName,
+				AssumeRolePolicyDocument: typeof assumeRolePolicyDocument === "string" ? assumeRolePolicyDocument : JSON.stringify(assumeRolePolicyDocument)
+			};
+			if (properties["Description"]) createParams.Description = properties["Description"];
+			if (properties["MaxSessionDuration"]) createParams.MaxSessionDuration = properties["MaxSessionDuration"];
+			if (properties["Path"]) createParams.Path = properties["Path"];
+			if (properties["PermissionsBoundary"]) createParams.PermissionsBoundary = properties["PermissionsBoundary"];
+			if (tags.length > 0) createParams.Tags = tags;
+			const createClient = await this.createClient.get();
+			let role;
+			let adopted = false;
+			try {
+				role = (await createClient.send(new CreateRoleCommand(createParams))).Role;
+			} catch (createError) {
+				role = await iamEntityLeftByThisCreate({
+					logicalId,
+					resourceType,
+					noun: "role",
+					displayName: roleName,
+					createError,
+					namesThisEntity: (reported) => reported === roleName,
+					read: async () => (await this.iamClient.send(new GetRoleCommand({ RoleName: roleName }))).Role,
+					identityOf: (live) => roleIdentityToken(live?.RoleId),
+					log
+				});
+				if (role === void 0) throw createError;
+				adopted = true;
+			}
+			leftBehind = true;
+			createdRoleIdentity = roleIdentityToken(role?.RoleId);
+			if (!adopted) {
+				reportCreatedResource(logicalId, resourceType, roleName, createdRoleIdentity);
+				log.debug(`Created IAM role: ${v(roleName)}`);
+			}
+			try {
+				const managedPolicyArns = properties["ManagedPolicyArns"];
+				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
+					await this.iamClient.send(new AttachRolePolicyCommand({
+						RoleName: roleName,
+						PolicyArn: policyArn
+					}));
+					log.debug(`Attached managed policy ${v(policyArn)} to role ${v(roleName)}`);
+				}
+				const policies = properties["Policies"];
+				if (policies && Array.isArray(policies)) for (const policy of policies) {
+					const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
+					await this.iamClient.send(new PutRolePolicyCommand({
+						RoleName: roleName,
+						PolicyName: policy.PolicyName,
+						PolicyDocument: policyDoc
+					}));
+					log.debug(`Added inline policy ${v(policy.PolicyName)} to role ${v(roleName)}`);
+				}
+			} catch (innerError) {
+				if (!adopted) try {
+					await this.detachAllManagedPolicies(roleName, log);
+					await this.deleteAllInlinePolicies(roleName, log);
+					await this.iamClient.send(new DeleteRoleCommand({ RoleName: roleName }));
+					retractCreatedResource(logicalId, resourceType, roleName);
+					leftBehind = false;
+					log.debug(`Cleaned up partially-created IAM role ${logicalId} (${v(roleName)}) after wiring failure`);
+				} catch (cleanupError) {
+					const aws = pasteableAwsCommand(log.mask);
+					const cleanupFailure = describeAwsFailure(cleanupError);
+					const cleanupHead = `Failed to clean up partially-created IAM role ${logicalId} (${v(roleName)}): `;
+					if (cleanupFailure.redacted) log.debug(`${cleanupHead}${v(cleanupFailure.detail)}`);
+					log.warn(`${cleanupHead}${cleanupFailure.redacted ? `${v(cleanupFailure.summary)} ` : `${v(cleanupFailure.detail)}. `}Manual deletion may be required before the next deploy: detach managed policies (${aws`aws iam list-attached-role-policies --role-name ${roleName}`.render()} then ${aws`aws iam detach-role-policy --role-name ${roleName} --policy-arn '<arn>'`.render()}), delete inline policies (${aws`aws iam list-role-policies --role-name ${roleName}`.render()} then ${aws`aws iam delete-role-policy --role-name ${roleName} --policy-name '<name>'`.render()}), then ${aws`aws iam delete-role --role-name ${roleName}`.render()}`);
+				}
+				throw markAuxiliaryFailure(innerError, logicalId);
+			}
+			log.debug(`Successfully created IAM role ${logicalId}: ${v(roleName)}`);
+			return {
+				physicalId: roleName,
+				attributes: {
+					Arn: role?.Arn,
+					RoleId: role?.RoleId
+				}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapMaskedError(log.mask, error, (text) => {
+				const built = new ProvisioningError(`Failed to create IAM role ${logicalId}: ${text}`, resourceType, logicalId, roleName, cause);
+				return leftBehind ? markCreatedBeforeFailure(built, logicalId, resourceType, roleName, createdRoleIdentity) : built;
+			});
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const templateProperties = { ...properties };
+		for (const key of context?.removedProperties ?? []) if (this.removalDefaults.get(resourceType)?.has(key) === true) delete templateProperties[key];
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const derivedRoleName = generateResourceNameWithFallback(properties["RoleName"], logicalId, { maxLength: 64 });
+		const log = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [
+			[properties["RoleName"], derivedRoleName],
+			[previousProperties["RoleName"], physicalId],
+			...context?.desiredFromAwsReadback === true ? [[properties["RoleName"], physicalId]] : []
+		]);
+		const { value: v } = log;
+		log.debug(`Updating IAM role ${logicalId}: ${v(physicalId)}`);
+		const revertKeepsName = context?.desiredFromAwsReadback === true && derivedRoleName !== physicalId;
+		if (revertKeepsName) log.warn(`IAM role ${logicalId}: RoleName is not reverted — the role ${v(physicalId)} keeps its name (the reverted properties derive ${v(derivedRoleName)}), since a drift revert never replaces a role. 'cdkd drift' keeps reporting the name until 'cdkd drift --accept' records the live one; only a deploy renames the role.`);
+		const generatedNameKept = recordedGeneratedNameKept({
+			recorded: physicalId,
+			derived: derivedRoleName,
+			declaredName: properties["RoleName"],
+			previousDeclaredName: previousProperties["RoleName"],
+			logicalId,
+			options: { maxLength: 64 }
+		});
+		if (generatedNameKept) log.debug(`IAM role ${logicalId}: keeping its generated name ${v(physicalId)} (the template names no role)`);
+		const newRoleName = revertKeepsName || generatedNameKept ? physicalId : derivedRoleName;
+		const newPath = properties["Path"] || "/";
+		const oldPath = previousProperties["Path"] || "/";
+		const pathBehindSecret = newRoleName === physicalId && newPath !== oldPath && isSecretDerivedValue(previousProperties["Path"], maskerOrIdentity(void 0));
+		let livePath;
+		if (pathBehindSecret) try {
+			livePath = (await this.iamClient.send(new GetRoleCommand({ RoleName: physicalId }))).Role?.Path;
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to read the path of IAM role ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+		if (pathBehindSecret) {
+			if (livePath === void 0 || livePath === "") throw markNonRetryable(new ProvisioningError(`IAM role ${logicalId}: its Path comes from a secret reference, and IAM returned no path for ${v(physicalId)} to confirm it against. Nothing was changed.`, resourceType, logicalId, physicalId));
+			if (livePath !== newPath) log.warn(`IAM role ${logicalId}: the secret its Path comes from now resolves to a different path than the role ${v(physicalId)} has. A role cannot move in place, so it keeps its path; the new value takes effect when the template changes the reference, which replaces the role.`);
+		}
+		const needsReplacement = newRoleName !== physicalId || newPath !== oldPath && !pathBehindSecret;
+		if (needsReplacement && context?.desiredFromAwsReadback === true) throw markNonRetryable(new ProvisioningError(`IAM role ${logicalId}: Path cannot be reverted to ${v(newPath)} — a role's Path cannot change in place, and a drift revert never replaces the role ${v(physicalId)}. Nothing was changed; deploy the stack to replace it.`, resourceType, logicalId, physicalId));
+		if (needsReplacement && newRoleName === physicalId) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, log.mask(`Path changed from ${v(oldPath)} to ${v(newPath)}, and an IAM role cannot move to another path; a replacement under the same name ${v(physicalId)} must delete the role first — re-deploy with --replace, or give the role a new name`));
+		if (needsReplacement) {
+			log.debug(`RoleName changed, replacing role: ${v(physicalId)} (RoleName: from ${v(physicalId)} to ${v(newRoleName)})`);
+			properties = templateProperties;
+			const createResult = await this.create(logicalId, resourceType, properties, { maskSecrets: log.mask });
+			let orphanReason;
+			try {
+				const deleteResult = await this.delete(logicalId, physicalId, resourceType, void 0, { maskSecrets: log.mask });
+				if (deleteResult?.outcome === "skipped") {
+					orphanReason = log.mask(`old role ${v(physicalId)} was not deleted: ${deleteResult.reason}`);
+					log.warn(`Skipped deleting old role ${v(physicalId)} during replacement: ${deleteResult.reason}. The old role may be orphaned and require manual cleanup.`);
+				}
+			} catch (error) {
+				orphanReason = log.mask(`old role ${v(physicalId)} could not be deleted: ${safeStringify(error)}`);
+				log.warn(`Failed to delete old role ${v(physicalId)} during replacement: ${v(safeStringify(error))}. The old role may be orphaned and require manual cleanup.`);
+			}
+			const base = {
+				physicalId: createResult.physicalId,
+				wasReplaced: true,
+				...createResult.attributes ? { attributes: createResult.attributes } : {}
+			};
+			return orphanReason !== void 0 ? {
+				...base,
+				outcome: "partial",
+				reason: orphanReason
+			} : base;
+		}
+		try {
+			const updateParams = { RoleName: physicalId };
+			const descriptionInput = properties["Description"];
+			if (descriptionInput !== void 0) updateParams.Description = descriptionInput;
+			const maxSessionDurationInput = properties["MaxSessionDuration"];
+			if (maxSessionDurationInput !== void 0) updateParams.MaxSessionDuration = maxSessionDurationInput;
+			await this.iamClient.send(new UpdateRoleCommand(updateParams));
+			const newAssumePolicy = properties["AssumeRolePolicyDocument"];
+			const oldAssumePolicy = previousProperties["AssumeRolePolicyDocument"];
+			if (newAssumePolicy) {
+				const newPolicyStr = typeof newAssumePolicy === "string" ? newAssumePolicy : JSON.stringify(newAssumePolicy);
+				if (newPolicyStr !== (oldAssumePolicy ? typeof oldAssumePolicy === "string" ? oldAssumePolicy : JSON.stringify(oldAssumePolicy) : "")) {
+					await this.iamClient.send(new UpdateAssumeRolePolicyCommand({
+						RoleName: physicalId,
+						PolicyDocument: newPolicyStr
+					}));
+					log.debug(`Updated assume role policy for ${v(physicalId)}`);
+				}
+			}
+			const newBoundary = properties["PermissionsBoundary"];
+			const oldBoundary = previousProperties["PermissionsBoundary"];
+			if (newBoundary !== oldBoundary) {
+				if (newBoundary) {
+					await this.iamClient.send(new PutRolePermissionsBoundaryCommand({
+						RoleName: physicalId,
+						PermissionsBoundary: newBoundary
+					}));
+					log.debug(`Set permissions boundary for ${v(physicalId)}: ${v(newBoundary)}`);
+				} else if (oldBoundary) {
+					await this.iamClient.send(new DeleteRolePermissionsBoundaryCommand({ RoleName: physicalId }));
+					log.debug(`Removed permissions boundary from ${v(physicalId)}`);
+				}
+			}
+			await this.updateManagedPolicies(physicalId, properties["ManagedPolicyArns"], previousProperties["ManagedPolicyArns"], log);
+			await this.updateInlinePolicies(physicalId, properties["Policies"], previousProperties["Policies"], log, context?.inlinePolicyClaimed);
+			await this.updateTags(physicalId, resourceType, logicalId, properties["Tags"], previousProperties["Tags"], log);
+			log.debug(`Successfully updated IAM role ${logicalId}`);
+			const getRoleResponse = await this.iamClient.send(new GetRoleCommand({ RoleName: physicalId }));
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: {
+					Arn: getRoleResponse.Role?.Arn,
+					RoleId: getRoleResponse.Role?.RoleId
+				}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update IAM role ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		const { value: v } = log;
+		log.debug(`Deleting IAM role ${logicalId}: ${v(physicalId)}`);
+		const progress = { stripped: false };
+		try {
+			try {
+				await this.iamClient.send(new GetRoleCommand({ RoleName: physicalId }));
+			} catch (error) {
+				if (error instanceof NoSuchEntityException) {
+					const clientRegion = await this.iamClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
+					if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  IAM role ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+					else log.debug(`Role ${v(physicalId)} does not exist, skipping deletion`);
+					return;
+				}
+				throw error;
+			}
+			await this.detachAllManagedPolicies(physicalId, log, progress);
+			await this.deleteAllInlinePolicies(physicalId, log, progress);
+			await this.removeFromAllInstanceProfiles(physicalId, log, progress);
+			await this.iamClient.send(new DeleteRoleCommand({ RoleName: physicalId }));
+			log.debug(`Successfully deleted IAM role ${logicalId}`);
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			const failure = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(log.mask(`Failed to delete IAM role ${logicalId}: ${text}`), resourceType, logicalId, physicalId, cause));
+			const marked = error instanceof Error && error.name.includes("NotFound") ? markNotGone(failure) : failure;
+			throw progress.stripped ? markDeleteStarted(marked) : marked;
+		}
+	}
+	async detachAllManagedPolicies(roleName, log, progress) {
+		const { value: v } = log;
+		log.debug(`Detaching all managed policies from role ${v(roleName)}`);
+		try {
+			const policies = (await this.iamClient.send(new ListAttachedRolePoliciesCommand({ RoleName: roleName }))).AttachedPolicies || [];
+			if (policies.length === 0) {
+				log.debug(`No managed policies attached to role ${v(roleName)}`);
+				return;
+			}
+			for (const policy of policies) if (policy.PolicyArn) try {
+				await this.iamClient.send(new DetachRolePolicyCommand({
+					RoleName: roleName,
+					PolicyArn: policy.PolicyArn
+				}));
+				if (progress) progress.stripped = true;
+				log.debug(`Detached managed policy ${v(policy.PolicyArn)} from role ${v(roleName)}`);
+			} catch (error) {
+				if (error instanceof NoSuchEntityException) log.debug(`Managed policy ${v(policy.PolicyArn)} already detached from role ${v(roleName)}`);
+				else throw error;
+			}
+			log.debug(`Detached ${policies.length} managed policies from role ${v(roleName)}`);
+		} catch (error) {
+			if (error instanceof NoSuchEntityException) {
+				log.debug(`Role ${v(roleName)} not found when detaching managed policies`);
+				return;
+			}
+			throw error;
+		}
+	}
+	async deleteAllInlinePolicies(roleName, log, progress) {
+		const { value: v } = log;
+		log.debug(`Deleting all inline policies from role ${v(roleName)}`);
+		try {
+			const policyNames = (await this.iamClient.send(new ListRolePoliciesCommand({ RoleName: roleName }))).PolicyNames || [];
+			if (policyNames.length === 0) {
+				log.debug(`No inline policies on role ${v(roleName)}`);
+				return;
+			}
+			for (const policyName of policyNames) try {
+				await this.iamClient.send(new DeleteRolePolicyCommand({
+					RoleName: roleName,
+					PolicyName: policyName
+				}));
+				if (progress) progress.stripped = true;
+				log.debug(`Deleted inline policy ${v(policyName)} from role ${v(roleName)}`);
+			} catch (error) {
+				if (error instanceof NoSuchEntityException) log.debug(`Inline policy ${v(policyName)} already deleted from role ${v(roleName)}`);
+				else throw error;
+			}
+			log.debug(`Deleted ${policyNames.length} inline policies from role ${v(roleName)}`);
+		} catch (error) {
+			if (error instanceof NoSuchEntityException) {
+				log.debug(`Role ${v(roleName)} not found when deleting inline policies`);
+				return;
+			}
+			throw error;
+		}
+	}
+	async removeFromAllInstanceProfiles(roleName, log, progress) {
+		const { value: v } = log;
+		log.debug(`Removing role ${v(roleName)} from all instance profiles`);
+		try {
+			const profiles = (await this.iamClient.send(new ListInstanceProfilesForRoleCommand({ RoleName: roleName }))).InstanceProfiles || [];
+			if (profiles.length === 0) {
+				log.debug(`No instance profiles associated with role ${v(roleName)}`);
+				return;
+			}
+			for (const profile of profiles) if (profile.InstanceProfileName) try {
+				await this.iamClient.send(new RemoveRoleFromInstanceProfileCommand({
+					RoleName: roleName,
+					InstanceProfileName: profile.InstanceProfileName
+				}));
+				if (progress) progress.stripped = true;
+				log.debug(`Removed role ${v(roleName)} from instance profile ${v(profile.InstanceProfileName)}`);
+			} catch (error) {
+				if (error instanceof NoSuchEntityException) log.debug(`Role ${v(roleName)} already removed from instance profile ${v(profile.InstanceProfileName)}`);
+				else throw error;
+			}
+			log.debug(`Removed role ${v(roleName)} from ${profiles.length} instance profiles`);
+		} catch (error) {
+			if (error instanceof NoSuchEntityException) {
+				log.debug(`Role ${v(roleName)} not found when removing from instance profiles`);
+				return;
+			}
+			throw error;
+		}
+	}
+	async updateManagedPolicies(roleName, newPolicies, oldPolicies, log) {
+		const { value: v } = log;
+		const newSet = new Set(newPolicies || []);
+		const oldSet = new Set(oldPolicies || []);
+		for (const policyArn of newSet) if (!oldSet.has(policyArn)) {
+			await this.iamClient.send(new AttachRolePolicyCommand({
+				RoleName: roleName,
+				PolicyArn: policyArn
+			}));
+			log.debug(`Attached managed policy ${v(policyArn)}`);
+		}
+		for (const policyArn of oldSet) if (!newSet.has(policyArn)) {
+			await this.iamClient.send(new DetachRolePolicyCommand({
+				RoleName: roleName,
+				PolicyArn: policyArn
+			}));
+			log.debug(`Detached managed policy ${v(policyArn)}`);
+		}
+	}
+	async updateInlinePolicies(roleName, newPolicies, oldPolicies, log, claimed) {
+		const { value: v } = log;
+		const newMap = new Map((newPolicies || []).map((p) => [p.PolicyName, p.PolicyDocument]));
+		const oldMap = new Map((oldPolicies || []).map((p) => [p.PolicyName, p.PolicyDocument]));
+		for (const [policyName, policyDoc] of newMap) {
+			const policyDocument = typeof policyDoc === "string" ? policyDoc : JSON.stringify(policyDoc);
+			await this.iamClient.send(new PutRolePolicyCommand({
+				RoleName: roleName,
+				PolicyName: policyName,
+				PolicyDocument: policyDocument
+			}));
+			log.debug(`Updated inline policy ${v(policyName)}`);
+		}
+		for (const policyName of oldMap.keys()) if (!newMap.has(policyName)) {
+			if (claimed?.("role", roleName, policyName) === true) {
+				log.debug(`Kept inline policy ${v(policyName)} on role ${v(roleName)}: another resource of this deploy or rollback wrote it`);
+				continue;
+			}
+			await this.iamClient.send(new DeleteRolePolicyCommand({
+				RoleName: roleName,
+				PolicyName: policyName
+			}));
+			log.debug(`Deleted inline policy ${v(policyName)}`);
+		}
+	}
+	async updateTags(roleName, resourceType, logicalId, newTags, oldTags, log) {
+		const { value: v } = log;
+		const plan = planTagDiff(oldTags, newTags);
+		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
+		if (tagWarning !== void 0) log.warn(tagWarning);
+		const tagsToRemove = plan.remove;
+		const tagsToAdd = [...plan.set].map(([Key, Value]) => ({
+			Key,
+			Value
+		}));
+		if (tagsToRemove.length > 0) {
+			await this.iamClient.send(new UntagRoleCommand({
+				RoleName: roleName,
+				TagKeys: tagsToRemove
+			}));
+			log.debug(`Removed ${tagsToRemove.length} tags from role ${v(roleName)}`);
+		}
+		if (tagsToAdd.length > 0) {
+			await this.iamClient.send(new TagRoleCommand({
+				RoleName: roleName,
+				Tags: tagsToAdd
+			}));
+			log.debug(`Added/updated ${tagsToAdd.length} tags on role ${v(roleName)}`);
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		try {
+			const resp = await this.iamClient.send(new GetRoleCommand({ RoleName: physicalId }));
+			switch (attributeName) {
+				case "Arn": return resp.Role?.Arn;
+				case "RoleId": return resp.Role?.RoleId;
+				default: return;
+			}
+		} catch (err) {
+			if (err instanceof NoSuchEntityException) return void 0;
+			throw err;
+		}
+	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::IAM::Role") return "unknown";
+		if (!isRoleName(journaledPhysicalId) || !isRoleName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (journaledPhysicalId.toLowerCase() === record.physicalId.toLowerCase()) return "unknown";
+		if (await this.iamClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordRoleId = await this.readRoleIdIfExists(record.physicalId);
+		if (recordRoleId === void 0) return "unknown";
+		const journaledRoleId = await this.readRoleIdIfExists(journaledPhysicalId);
+		if (journaledRoleId === void 0) return "different";
+		return journaledRoleId === recordRoleId ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== "AWS::IAM::Role" || !isRoleName(physicalId)) return void 0;
+		if (await this.iamClient.config.region() !== context.expectedRegion) return void 0;
+		const roleId = await this.readRoleIdIfExists(physicalId);
+		return roleId === void 0 ? RESOURCE_NOT_FOUND : roleId;
+	}
+	async readRoleIdIfExists(roleName) {
+		let response;
+		try {
+			response = await this.iamClient.send(new GetRoleCommand({ RoleName: roleName }));
+		} catch (error) {
+			if (error instanceof NoSuchEntityException) return void 0;
+			throw error;
+		}
+		if (response.Role?.RoleName !== roleName) throw new Error("GetRole answered for another role than the one asked for");
+		const roleId = roleIdentityToken(response.Role.RoleId);
+		if (roleId === void 0) throw new Error("GetRole returned no RoleId");
+		return roleId;
+	}
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
+		let role;
+		try {
+			role = (await this.iamClient.send(new GetRoleCommand({ RoleName: physicalId }))).Role;
+		} catch (err) {
+			if (err instanceof NoSuchEntityException) return RESOURCE_NOT_FOUND;
+			throw err;
+		}
+		if (!role) return void 0;
+		const result = {};
+		if (role.RoleName !== void 0) result["RoleName"] = role.RoleName;
+		result["Description"] = role.Description ?? "";
+		if (role.MaxSessionDuration !== void 0) result["MaxSessionDuration"] = role.MaxSessionDuration;
+		if (role.Path !== void 0) result["Path"] = role.Path;
+		result["PermissionsBoundary"] = role.PermissionsBoundary?.PermissionsBoundaryArn ?? "";
+		if (role.AssumeRolePolicyDocument) try {
+			result["AssumeRolePolicyDocument"] = JSON.parse(decodeURIComponent(role.AssumeRolePolicyDocument));
+		} catch {
+			result["AssumeRolePolicyDocument"] = role.AssumeRolePolicyDocument;
+		}
+		try {
+			result["ManagedPolicyArns"] = ((await this.iamClient.send(new ListAttachedRolePoliciesCommand({ RoleName: physicalId }))).AttachedPolicies ?? []).map((p) => p.PolicyArn).filter((arn) => !!arn);
+		} catch (err) {
+			if (!(err instanceof NoSuchEntityException)) throw err;
+		}
+		try {
+			const policyNames = [];
+			let policyMarker;
+			while (true) {
+				const listResp = await this.iamClient.send(new ListRolePoliciesCommand({
+					RoleName: physicalId,
+					...policyMarker ? { Marker: policyMarker } : {}
+				}));
+				for (const name of listResp.PolicyNames ?? []) policyNames.push(name);
+				if (!listResp.IsTruncated) break;
+				policyMarker = listResp.Marker;
+			}
+			const managedByOtherResource = collectInlinePolicyNamesManagedBySiblings(physicalId, context, "Roles");
+			const filteredNames = policyNames.filter((n) => !managedByOtherResource.has(n));
+			const bodies = /* @__PURE__ */ new Map();
+			await Promise.all(filteredNames.map(async (name) => {
+				const resp = await this.iamClient.send(new GetRolePolicyCommand({
+					RoleName: physicalId,
+					PolicyName: name
+				}));
+				if (!resp.PolicyDocument) return;
+				let parsed;
+				try {
+					parsed = JSON.parse(decodeURIComponent(resp.PolicyDocument));
+				} catch {
+					parsed = resp.PolicyDocument;
+				}
+				bodies.set(name, parsed);
+			}));
+			const statePolicies = properties?.["Policies"] ?? [];
+			const remaining = new Set(bodies.keys());
+			const inline = [];
+			for (const sp of statePolicies) {
+				const name = sp?.PolicyName;
+				if (typeof name !== "string") continue;
+				if (bodies.has(name)) {
+					inline.push({
+						PolicyName: name,
+						PolicyDocument: bodies.get(name)
+					});
+					remaining.delete(name);
+				}
+			}
+			for (const name of [...remaining].sort()) inline.push({
+				PolicyName: name,
+				PolicyDocument: bodies.get(name)
+			});
+			result["Policies"] = inline;
+		} catch (err) {
+			if (!(err instanceof NoSuchEntityException)) throw err;
+		}
+		try {
+			const collected = [];
+			let marker;
+			while (true) {
+				const tagsResp = await this.iamClient.send(new ListRoleTagsCommand({
+					RoleName: physicalId,
+					...marker ? { Marker: marker } : {}
+				}));
+				if (tagsResp.Tags) for (const t of tagsResp.Tags) collected.push({
+					Key: t.Key,
+					Value: t.Value
+				});
+				if (!tagsResp.IsTruncated) break;
+				marker = tagsResp.Marker;
+			}
+			result["Tags"] = normalizeAwsTagsToCfn(collected);
+		} catch (err) {
+			if (!(err instanceof NoSuchEntityException)) throw err;
+		}
+		return result;
+	}
+	async import(input) {
+		const explicit = resolveExplicitPhysicalId(input, "RoleName");
+		if (explicit) try {
+			const resp = await this.iamClient.send(new GetRoleCommand({ RoleName: explicit }));
+			return {
+				physicalId: explicit,
+				attributes: definedAttributes({
+					Arn: resp.Role?.Arn,
+					RoleId: resp.Role?.RoleId
+				})
+			};
+		} catch (err) {
+			if (err instanceof NoSuchEntityException) return null;
+			throw err;
+		}
+		return null;
+	}
+};
+const STANDALONE_POLICY_SIBLINGS = {
+	Roles: {
+		type: "AWS::IAM::RolePolicy",
+		field: "RoleName"
+	},
+	Users: {
+		type: "AWS::IAM::UserPolicy",
+		field: "UserName"
+	},
+	Groups: {
+		type: "AWS::IAM::GroupPolicy",
+		field: "GroupName"
+	}
+};
+function collectInlinePolicyNamesManagedBySiblings(targetPhysicalId, context, attachmentField) {
+	const result = /* @__PURE__ */ new Set();
+	const siblings = context?.siblings;
+	if (!siblings) return result;
+	const standalone = STANDALONE_POLICY_SIBLINGS[attachmentField];
+	for (const sibling of Object.values(siblings)) {
+		if (sibling.resourceType === standalone.type) {
+			const name = sibling.properties["PolicyName"];
+			if (sibling.properties[standalone.field] === targetPhysicalId && typeof name === "string") result.add(name);
+			continue;
+		}
+		if (sibling.resourceType !== "AWS::IAM::Policy") continue;
+		const attachments = sibling.properties[attachmentField];
+		if (!Array.isArray(attachments)) continue;
+		if (!attachments.some((a) => a === targetPhysicalId)) continue;
+		const name = sibling.properties["PolicyName"];
+		if (typeof name === "string") result.add(name);
+	}
+	return result;
+}
+
+export { IamCreateClientCache as a, isEntityAlreadyExists as i, collectInlinePolicyNamesManagedBySiblings as n, iamEntityLeftByThisCreate as r, IAMRoleProvider as t };
+//# sourceMappingURL=iam-role-provider-Bp4osNrj.js.map