@cloud-copilot/iam-collect 0.1.131 → 0.1.133

package/dist/esm/awsConfigClients/clients/AwsConfigOrganizationsClient.js

@@ -0,0 +1,170 @@
+import { DescribeOrganizationCommand, DescribePolicyCommand, DescribeResourcePolicyCommand, ListAccountsForParentCommand, ListDelegatedAdministratorsCommand, ListDelegatedServicesForAccountCommand, ListOrganizationalUnitsForParentCommand, ListPoliciesCommand, ListPoliciesForTargetCommand, ListRootsCommand, ListTagsForResourceCommand, OrganizationsClient } from '@aws-sdk/client-organizations';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { awsConfigCommand } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config-based Organizations client implementation
+ * Returns empty responses since organization data is not tracked in AWS Config
+ *
+ * Since policies are not available in AWS Config, this client provides limited functionality
+ * and returns empty results for all operations.
+ */
+export class AwsConfigOrganizationsClient extends AbstractClient {
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    /**
+     * Register all Organizations command implementations
+     */
+    registerCommands() {
+        this.registerCommand(AwsConfigDescribeOrganizationCommand);
+        this.registerCommand(AwsConfigDescribePolicyCommand);
+        this.registerCommand(AwsConfigDescribeResourcePolicyCommand);
+        this.registerCommand(AwsConfigListAccountsForParentCommand);
+        this.registerCommand(AwsConfigListDelegatedAdministratorsCommand);
+        this.registerCommand(AwsConfigListDelegatedServicesForAccountCommand);
+        this.registerCommand(AwsConfigListOrganizationalUnitsForParentCommand);
+        this.registerCommand(AwsConfigListPoliciesCommand);
+        this.registerCommand(AwsConfigListPoliciesForTargetCommand);
+        this.registerCommand(AwsConfigListRootsCommand);
+        this.registerCommand(AwsConfigListTagsForResourceCommand);
+    }
+}
+AwsConfigOrganizationsClient.clientName = OrganizationsClient.name;
+/**
+ * Config-based implementation of Organizations DescribeOrganizationCommand
+ * Returns empty result since organization data is not available in Config
+ */
+const AwsConfigDescribeOrganizationCommand = awsConfigCommand({
+    command: DescribeOrganizationCommand,
+    execute: async (input, context) => {
+        // Organization data is not available in AWS Config
+        return {};
+    }
+});
+/**
+ * Config-based implementation of Organizations DescribePolicyCommand
+ * Returns empty result since organization policies are not available in Config
+ */
+const AwsConfigDescribePolicyCommand = awsConfigCommand({
+    command: DescribePolicyCommand,
+    execute: async (input, context) => {
+        // Organization policies are not available in AWS Config
+        return {};
+    }
+});
+/**
+ * Config-based implementation of Organizations DescribeResourcePolicyCommand
+ * Returns empty result since organization resource policies are not available in Config
+ */
+const AwsConfigDescribeResourcePolicyCommand = awsConfigCommand({
+    command: DescribeResourcePolicyCommand,
+    execute: async (input, context) => {
+        // Organization resource policies are not available in AWS Config
+        return {};
+    }
+});
+/**
+ * Config-based implementation of Organizations ListAccountsForParentCommand
+ * Returns empty list since organization structure is not available in Config
+ */
+const AwsConfigListAccountsForParentCommand = awsConfigCommand({
+    command: ListAccountsForParentCommand,
+    execute: async (input, context) => {
+        // Organization structure is not available in AWS Config
+        return {
+            Accounts: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListDelegatedAdministratorsCommand
+ * Returns empty list since delegated administrators are not available in Config
+ */
+const AwsConfigListDelegatedAdministratorsCommand = awsConfigCommand({
+    command: ListDelegatedAdministratorsCommand,
+    execute: async (input, context) => {
+        // Delegated administrators are not available in AWS Config
+        return {
+            DelegatedAdministrators: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListDelegatedServicesForAccountCommand
+ * Returns empty list since delegated services are not available in Config
+ */
+const AwsConfigListDelegatedServicesForAccountCommand = awsConfigCommand({
+    command: ListDelegatedServicesForAccountCommand,
+    execute: async (input, context) => {
+        // Delegated services are not available in AWS Config
+        return {
+            DelegatedServices: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListOrganizationalUnitsForParentCommand
+ * Returns empty list since organizational units are not available in Config
+ */
+const AwsConfigListOrganizationalUnitsForParentCommand = awsConfigCommand({
+    command: ListOrganizationalUnitsForParentCommand,
+    execute: async (input, context) => {
+        // Organizational units are not available in AWS Config
+        return {
+            OrganizationalUnits: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListPoliciesCommand
+ * Returns empty list since organization policies are not available in Config
+ */
+const AwsConfigListPoliciesCommand = awsConfigCommand({
+    command: ListPoliciesCommand,
+    execute: async (input, context) => {
+        // Organization policies are not available in AWS Config
+        return {
+            Policies: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListPoliciesForTargetCommand
+ * Returns empty list since organization policies are not available in Config
+ */
+const AwsConfigListPoliciesForTargetCommand = awsConfigCommand({
+    command: ListPoliciesForTargetCommand,
+    execute: async (input, context) => {
+        // Organization policies are not available in AWS Config
+        return {
+            Policies: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListRootsCommand
+ * Returns empty list since organization structure is not available in Config
+ */
+const AwsConfigListRootsCommand = awsConfigCommand({
+    command: ListRootsCommand,
+    execute: async (input, context) => {
+        // Organization structure is not available in AWS Config
+        return {
+            Roots: []
+        };
+    }
+});
+/**
+ * Config-based implementation of Organizations ListTagsForResourceCommand
+ * Returns empty list since organization resource tags are not available in Config
+ */
+const AwsConfigListTagsForResourceCommand = awsConfigCommand({
+    command: ListTagsForResourceCommand,
+    execute: async (input, context) => {
+        // Organization resource tags are not available in AWS Config
+        return {
+            Tags: []
+        };
+    }
+});
+//# sourceMappingURL=AwsConfigOrganizationsClient.js.map

package/dist/esm/awsConfigClients/clients/AwsConfigOrganizationsClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigOrganizationsClient.js","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigOrganizationsClient.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,6BAA6B,EAC7B,4BAA4B,EAC5B,kCAAkC,EAClC,sCAAsC,EACtC,uCAAuC,EACvC,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,0BAA0B,EAC1B,mBAAmB,EACpB,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAA0B,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,cAAsC;IAGtF,YACE,OAGC,EACD,aAAqC;QAErC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACO,gBAAgB;QACxB,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,CAAA;QAC1D,IAAI,CAAC,eAAe,CAAC,8BAA8B,CAAC,CAAA;QACpD,IAAI,CAAC,eAAe,CAAC,sCAAsC,CAAC,CAAA;QAC5D,IAAI,CAAC,eAAe,CAAC,qCAAqC,CAAC,CAAA;QAC3D,IAAI,CAAC,eAAe,CAAC,2CAA2C,CAAC,CAAA;QACjE,IAAI,CAAC,eAAe,CAAC,+CAA+C,CAAC,CAAA;QACrE,IAAI,CAAC,eAAe,CAAC,gDAAgD,CAAC,CAAA;QACtE,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAA;QAClD,IAAI,CAAC,eAAe,CAAC,qCAAqC,CAAC,CAAA;QAC3D,IAAI,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAA;QAC/C,IAAI,CAAC,eAAe,CAAC,mCAAmC,CAAC,CAAA;IAC3D,CAAC;;AA3Be,uCAAU,GAAG,mBAAmB,CAAC,IAAI,CAAA;AA8BvD;;;GAGG;AACH,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IAC5D,OAAO,EAAE,2BAA2B;IACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,mDAAmD;QACnD,OAAO,EAAE,CAAA;IACX,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;IACtD,OAAO,EAAE,qBAAqB;IAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,wDAAwD;QACxD,OAAO,EAAE,CAAA;IACX,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,sCAAsC,GAAG,gBAAgB,CAAC;IAC9D,OAAO,EAAE,6BAA6B;IACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,iEAAiE;QACjE,OAAO,EAAE,CAAA;IACX,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,qCAAqC,GAAG,gBAAgB,CAAC;IAC7D,OAAO,EAAE,4BAA4B;IACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,wDAAwD;QACxD,OAAO;YACL,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,2CAA2C,GAAG,gBAAgB,CAAC;IACnE,OAAO,EAAE,kCAAkC;IAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,2DAA2D;QAC3D,OAAO;YACL,uBAAuB,EAAE,EAAE;SAC5B,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,+CAA+C,GAAG,gBAAgB,CAAC;IACvE,OAAO,EAAE,sCAAsC;IAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,qDAAqD;QACrD,OAAO;YACL,iBAAiB,EAAE,EAAE;SACtB,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,gDAAgD,GAAG,gBAAgB,CAAC;IACxE,OAAO,EAAE,uCAAuC;IAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,uDAAuD;QACvD,OAAO;YACL,mBAAmB,EAAE,EAAE;SACxB,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;IACpD,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,wDAAwD;QACxD,OAAO;YACL,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,qCAAqC,GAAG,gBAAgB,CAAC;IAC7D,OAAO,EAAE,4BAA4B;IACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,wDAAwD;QACxD,OAAO;YACL,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;IACjD,OAAO,EAAE,gBAAgB;IACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,wDAAwD;QACxD,OAAO;YACL,KAAK,EAAE,EAAE;SACV,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAC3D,OAAO,EAAE,0BAA0B;IACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,6DAA6D;QAC7D,OAAO;YACL,IAAI,EAAE,EAAE;SACT,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/esm/awsConfigClients/clients/AwsConfigS3Client.d.ts

@@ -0,0 +1,15 @@
+import { AwsCredentialIdentityWithMetaData } from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { AwsConfigClientContext } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config-based S3 client implementation
+ */
+export declare class AwsConfigS3Client extends AbstractClient<AwsConfigClientContext> {
+    static readonly clientName: string;
+    constructor(options: {
+        credentials: AwsCredentialIdentityWithMetaData;
+        region: string | undefined;
+    }, customContext: AwsConfigClientContext);
+    protected registerCommands(): void;
+}
+//# sourceMappingURL=AwsConfigS3Client.d.ts.map

package/dist/esm/awsConfigClients/clients/AwsConfigS3Client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigS3Client.d.ts","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigS3Client.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAGtE,OAAO,EAAE,sBAAsB,EAAoB,MAAM,8BAA8B,CAAA;AAOvF;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,sBAAsB,CAAC;IAC3E,MAAM,CAAC,QAAQ,CAAC,UAAU,SAAgB;gBAGxC,OAAO,EAAE;QACP,WAAW,EAAE,iCAAiC,CAAA;QAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,EACD,aAAa,EAAE,sBAAsB;IAKvC,SAAS,CAAC,gBAAgB,IAAI,IAAI;CAQnC"}

package/dist/esm/awsConfigClients/clients/AwsConfigS3Client.js

@@ -0,0 +1,235 @@
+import { GetBucketEncryptionCommand, GetBucketPolicyCommand, GetBucketTaggingCommand, GetPublicAccessBlockCommand, ListBucketsCommand, ListDirectoryBucketsCommand, S3Client } from '@aws-sdk/client-s3';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { ResourceNotFoundException } from '../../customClients/ResourceNotFoundException.js';
+import { stringifyIfPresent } from '../../utils/json.js';
+import { awsConfigCommand } from '../AwsConfigClientContext.js';
+import { executeConfigQuery, parseConfigItem, resourceStatusWhereClause } from '../awsConfigUtils.js';
+/**
+ * AWS Config-based S3 client implementation
+ */
+export class AwsConfigS3Client extends AbstractClient {
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    registerCommands() {
+        this.registerCommand(AwsConfigGetBucketPolicyCommand);
+        this.registerCommand(AwsConfigGetBucketEncryptionCommand);
+        this.registerCommand(AwsConfigGetBucketTaggingCommand);
+        this.registerCommand(AwsConfigGetPublicAccessBlockCommand);
+        this.registerCommand(AwsConfigListBucketsCommand);
+        this.registerCommand(AwsConfigListDirectoryBucketsCommand);
+    }
+}
+AwsConfigS3Client.clientName = S3Client.name;
+/**
+ * Config-based implementation of S3 ListBucketsCommand
+ * Returns bucket listing from AWS Config inventory data
+ */
+const AwsConfigListBucketsCommand = awsConfigCommand({
+    command: ListBucketsCommand,
+    execute: async (input, context) => {
+        // Query Config for S3 buckets
+        const query = `
+      SELECT
+        arn,
+        resourceName,
+        configuration.name,
+        configuration.creationDate,
+        supplementaryConfiguration.BucketPolicy,
+        supplementaryConfiguration.ServerSideEncryptionConfiguration,
+        supplementaryConfiguration.PublicAccessBlockConfiguration,
+        tags
+      WHERE
+        resourceType = 'AWS::S3::Bucket'
+        AND awsRegion = '${input.BucketRegion}'
+        AND accountId = '${context.accountId}'
+        AND ${resourceStatusWhereClause}
+    `;
+        const configResults = await executeConfigQuery(query, context);
+        const buckets = configResults.map((resultString) => {
+            const { configItem, configuration, supplementaryConfiguration, tags } = parseConfigItem(resultString);
+            context.putCache(configItem.resourceName, 'policy', supplementaryConfiguration?.BucketPolicy.policyText);
+            context.putCache(configItem.resourceName, 'encryption', supplementaryConfiguration?.ServerSideEncryptionConfiguration);
+            context.putCache(configItem.resourceName, 'tags', tags);
+            context.putCache(configItem.resourceName, 'publicAccessBlock', supplementaryConfiguration?.PublicAccessBlockConfiguration);
+            return {
+                Name: configuration?.name || configItem.resourceName,
+                CreationDate: configuration?.creationDate ? new Date(configuration.creationDate) : undefined
+            };
+        });
+        return {
+            Buckets: buckets
+        };
+    }
+});
+/**
+ * Config-based implementation of S3 ListDirectoryBucketsCommand
+ * Uses AWS::S3Express::DirectoryBucket resource type
+ */
+const AwsConfigListDirectoryBucketsCommand = awsConfigCommand({
+    command: ListDirectoryBucketsCommand,
+    execute: async (input, context) => {
+        const query = `
+      SELECT
+        arn,
+        resourceId,
+        resourceName,
+        configuration.BucketEncryption,
+        tags
+      WHERE
+        resourceType = 'AWS::S3Express::DirectoryBucket'
+        AND awsRegion = '${context.region}'
+        AND accountId = '${context.accountId}'
+        AND ${resourceStatusWhereClause}
+    `;
+        const results = await executeConfigQuery(query, context);
+        const buckets = results?.map((resultString) => {
+            const { configItem, configuration } = parseConfigItem(resultString);
+            context.putCache(configItem.resourceName, 'policy', configuration?.PolicyDocument);
+            context.putCache(configItem.resourceName, 'encryption', configuration?.BucketEncryption);
+            return {
+                Name: configItem.resourceName
+            };
+        }) || [];
+        return {
+            Buckets: buckets
+        };
+    }
+});
+/**
+ * Config-based implementation of S3 GetBucketPolicyCommand
+ * Returns bucket policy from AWS Config supplementary data
+ */
+const AwsConfigGetBucketPolicyCommand = awsConfigCommand({
+    command: GetBucketPolicyCommand,
+    execute: async (input, context) => {
+        const { Bucket } = input;
+        if (!Bucket) {
+            throw new Error('Bucket parameter is required');
+        }
+        if (isDirectoryBucket(Bucket)) {
+            const query = `
+        SELECT
+          resourceName,
+          configuration.PolicyDocument
+        WHERE
+          resourceType = 'AWS::S3Express::BucketPolicy'
+          AND resourceName = '${Bucket}'
+          AND accountId = '${context.accountId}'
+          AND awsRegion = '${context.region}'
+          AND ${resourceStatusWhereClause}
+      `;
+            const configResults = await executeConfigQuery(query, context);
+            if (configResults.length === 0) {
+                throw new ResourceNotFoundException(`Bucket '${Bucket}' not found`);
+            }
+            const { configuration } = parseConfigItem(configResults[0]);
+            return {
+                Policy: JSON.stringify(configuration?.PolicyDocument)
+            };
+        }
+        const cachedPolicy = context.getCache(Bucket, 'policy');
+        return {
+            Policy: stringifyIfPresent(cachedPolicy)
+        };
+    }
+});
+/**
+ * Config-based implementation of S3 GetBucketEncryptionCommand
+ * Returns bucket encryption configuration from AWS Config supplementary data
+ */
+const AwsConfigGetBucketEncryptionCommand = awsConfigCommand({
+    command: GetBucketEncryptionCommand,
+    execute: async (input, context) => {
+        const { Bucket } = input;
+        if (!Bucket) {
+            throw new Error('Bucket parameter is required');
+        }
+        if (isDirectoryBucket(Bucket)) {
+            const encryptionConfig = context.getCache(Bucket, 'encryption');
+            const seeConfig = encryptionConfig?.ServerSideEncryptionConfiguration?.at(0);
+            if (!seeConfig) {
+                // Return an empty result to indicate no encryption configuration is set
+                return {};
+            }
+            return {
+                ServerSideEncryptionConfiguration: {
+                    Rules: [
+                        {
+                            ApplyServerSideEncryptionByDefault: {
+                                SSEAlgorithm: seeConfig.ServerSideEncryptionByDefault?.SSEAlgorithm,
+                                KMSMasterKeyID: seeConfig.ServerSideEncryptionByDefault?.KMSMasterKeyID
+                            },
+                            BucketKeyEnabled: seeConfig.BucketKeyEnabled
+                        }
+                    ]
+                }
+            };
+        }
+        const serverSideEncryption = context.getCache(Bucket, 'encryption');
+        if (!serverSideEncryption) {
+            // Return undefined to indicate no encryption configuration is set
+            return undefined;
+        }
+        // Convert Config encryption format to S3 ServerSideEncryptionConfiguration format
+        const rules = serverSideEncryption.rules?.map((rule) => ({
+            ApplyServerSideEncryptionByDefault: {
+                SSEAlgorithm: rule.applyServerSideEncryptionByDefault?.sseAlgorithm,
+                KMSMasterKeyID: rule.applyServerSideEncryptionByDefault?.kmsMasterKeyID
+            },
+            BucketKeyEnabled: rule.bucketKeyEnabled
+        })) || [];
+        return {
+            ServerSideEncryptionConfiguration: {
+                Rules: rules
+            }
+        };
+    }
+});
+/**
+ * Config-based implementation of S3 GetBucketTaggingCommand
+ * Returns bucket tags from AWS Config tags data
+ */
+const AwsConfigGetBucketTaggingCommand = awsConfigCommand({
+    command: GetBucketTaggingCommand,
+    execute: async (input, context) => {
+        const { Bucket } = input;
+        if (!Bucket) {
+            throw new Error('Bucket parameter is required');
+        }
+        const tags = context.getCache(Bucket, 'tags');
+        return {
+            TagSet: tags
+        };
+    }
+});
+/**
+ * Config-based implementation of S3 GetPublicAccessBlockCommand
+ * Returns public access block configuration from AWS Config supplementary data
+ */
+const AwsConfigGetPublicAccessBlockCommand = awsConfigCommand({
+    command: GetPublicAccessBlockCommand,
+    execute: async (input, context) => {
+        const { Bucket } = input;
+        if (!Bucket) {
+            throw new Error('Bucket parameter is required');
+        }
+        const publicAccessBlock = context.getCache(Bucket, 'publicAccessBlock');
+        if (!publicAccessBlock) {
+            // Return undefined to indicate no public access block configuration is set
+            return undefined;
+        }
+        return {
+            PublicAccessBlockConfiguration: {
+                BlockPublicAcls: publicAccessBlock.blockPublicAcls,
+                BlockPublicPolicy: publicAccessBlock.blockPublicPolicy,
+                IgnorePublicAcls: publicAccessBlock.ignorePublicAcls,
+                RestrictPublicBuckets: publicAccessBlock.restrictPublicBuckets
+            }
+        };
+    }
+});
+function isDirectoryBucket(bucketName) {
+    return bucketName.endsWith('-x-s3');
+}
+//# sourceMappingURL=AwsConfigS3Client.js.map

package/dist/esm/awsConfigClients/clients/AwsConfigS3Client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigS3Client.js","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigS3Client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,kBAAkB,EAClB,2BAA2B,EAC3B,QAAQ,EACT,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAA0B,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACvF,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAE7B;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,cAAsC;IAG3E,YACE,OAGC,EACD,aAAqC;QAErC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAES,gBAAgB;QACxB,IAAI,CAAC,eAAe,CAAC,+BAA+B,CAAC,CAAA;QACrD,IAAI,CAAC,eAAe,CAAC,mCAAmC,CAAC,CAAA;QACzD,IAAI,CAAC,eAAe,CAAC,gCAAgC,CAAC,CAAA;QACtD,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,CAAA;QAC1D,IAAI,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAA;QACjD,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,CAAA;IAC5D,CAAC;;AAnBe,4BAAU,GAAG,QAAQ,CAAC,IAAI,CAAA;AAsB5C;;;GAGG;AACH,MAAM,2BAA2B,GAAG,gBAAgB,CAAC;IACnD,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,8BAA8B;QAC9B,MAAM,KAAK,GAAG;;;;;;;;;;;;2BAYS,KAAK,CAAC,YAAY;2BAClB,OAAO,CAAC,SAAS;cAC9B,yBAAyB;KAClC,CAAA;QAED,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAE9D,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;YACjD,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,0BAA0B,EAAE,IAAI,EAAE,GACnE,eAAe,CAAC,YAAY,CAAC,CAAA;YAE/B,OAAO,CAAC,QAAQ,CACd,UAAU,CAAC,YAAY,EACvB,QAAQ,EACR,0BAA0B,EAAE,YAAY,CAAC,UAAU,CACpD,CAAA;YACD,OAAO,CAAC,QAAQ,CACd,UAAU,CAAC,YAAY,EACvB,YAAY,EACZ,0BAA0B,EAAE,iCAAiC,CAC9D,CAAA;YACD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;YACvD,OAAO,CAAC,QAAQ,CACd,UAAU,CAAC,YAAY,EACvB,mBAAmB,EACnB,0BAA0B,EAAE,8BAA8B,CAC3D,CAAA;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,UAAU,CAAC,YAAY;gBACpD,YAAY,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;aAC7F,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,OAAO,EAAE,OAAO;SACjB,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IAC5D,OAAO,EAAE,2BAA2B;IACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG;;;;;;;;;2BASS,OAAO,CAAC,MAAM;2BACd,OAAO,CAAC,SAAS;cAC9B,yBAAyB;KAClC,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAExD,MAAM,OAAO,GACX,OAAO,EAAE,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;YAC5B,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;YACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,CAAA;YAClF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAA;YAExF,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,YAAY;aAC9B,CAAA;QACH,CAAC,CAAC,IAAI,EAAE,CAAA;QAEV,OAAO;YACL,OAAO,EAAE,OAAO;SACjB,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;IACvD,OAAO,EAAE,sBAAsB;IAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG;;;;;;gCAMY,MAAM;6BACT,OAAO,CAAC,SAAS;6BACjB,OAAO,CAAC,MAAM;gBAC3B,yBAAyB;OAClC,CAAA;YAED,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YAE9D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,yBAAyB,CAAC,WAAW,MAAM,aAAa,CAAC,CAAA;YACrE,CAAC;YAED,MAAM,EAAE,aAAa,EAAE,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;YAE3D,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,cAAc,CAAC;aACtD,CAAA;QACH,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACvD,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,YAAY,CAAC;SACzC,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAC3D,OAAO,EAAE,0BAA0B;IACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;QAExB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;YAE/D,MAAM,SAAS,GAAG,gBAAgB,EAAE,iCAAiC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;YAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,wEAAwE;gBACxE,OAAO,EAAE,CAAA;YACX,CAAC;YAED,OAAO;gBACL,iCAAiC,EAAE;oBACjC,KAAK,EAAE;wBACL;4BACE,kCAAkC,EAAE;gCAClC,YAAY,EAAE,SAAS,CAAC,6BAA6B,EAAE,YAAY;gCACnE,cAAc,EAAE,SAAS,CAAC,6BAA6B,EAAE,cAAc;6BACxE;4BACD,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;yBAC7C;qBACF;iBACF;aACF,CAAA;QACH,CAAC;QAED,MAAM,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAEnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,kEAAkE;YAClE,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,kFAAkF;QAClF,MAAM,KAAK,GACT,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,CAAC;YAC9C,kCAAkC,EAAE;gBAClC,YAAY,EAAE,IAAI,CAAC,kCAAkC,EAAE,YAAY;gBACnE,cAAc,EAAE,IAAI,CAAC,kCAAkC,EAAE,cAAc;aACxE;YACD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,CAAC,IAAI,EAAE,CAAA;QAEX,OAAO;YACL,iCAAiC,EAAE;gBACjC,KAAK,EAAE,KAAK;aACb;SACF,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,gCAAgC,GAAG,gBAAgB,CAAC;IACxD,OAAO,EAAE,uBAAuB;IAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC7C,OAAO;YACL,MAAM,EAAE,IAAI;SACb,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,oCAAoC,GAAG,gBAAgB,CAAC;IAC5D,OAAO,EAAE,2BAA2B;IACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QAEvE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,2EAA2E;YAC3E,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO;YACL,8BAA8B,EAAE;gBAC9B,eAAe,EAAE,iBAAiB,CAAC,eAAe;gBAClD,iBAAiB,EAAE,iBAAiB,CAAC,iBAAiB;gBACtD,gBAAgB,EAAE,iBAAiB,CAAC,gBAAgB;gBACpD,qBAAqB,EAAE,iBAAiB,CAAC,qBAAqB;aAC/D;SACF,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AACrC,CAAC"}

package/dist/esm/awsConfigClients/clients/AwsConfigS3ControlClient.d.ts

@@ -0,0 +1,25 @@
+import { AwsCredentialIdentityWithMetaData } from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { AwsConfigClientContext } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config client for S3 Control operations.
+ *
+ * Supported Commands:
+ * - ListAccessPointsCommand: Returns access point listing from Config using AWS::S3::AccessPoint
+ * - GetAccessPointCommand: Returns access point details from Config including alias, public access block config
+ * - GetPublicAccessBlockCommand: Returns account-level public access block configuration from Config
+ *
+ * Limitations:
+ * S3 access point policies, multi-region access point policies, and Object Lambda policies
+ * are not available in AWS Config. The Config service tracks access point configuration
+ * but not access policies. Most policy-related commands return undefined/empty responses.
+ */
+export declare class AwsConfigS3ControlClient extends AbstractClient<AwsConfigClientContext> {
+    static readonly clientName: string;
+    constructor(options: {
+        credentials: AwsCredentialIdentityWithMetaData;
+        region: string | undefined;
+    }, customContext: AwsConfigClientContext);
+    protected registerCommands(): void;
+}
+//# sourceMappingURL=AwsConfigS3ControlClient.d.ts.map

package/dist/esm/awsConfigClients/clients/AwsConfigS3ControlClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigS3ControlClient.d.ts","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigS3ControlClient.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAEtE,OAAO,EAAE,sBAAsB,EAAoB,MAAM,8BAA8B,CAAA;AAOvF;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAAC,sBAAsB,CAAC;IAClF,MAAM,CAAC,QAAQ,CAAC,UAAU,SAAuB;gBAG/C,OAAO,EAAE;QACP,WAAW,EAAE,iCAAiC,CAAA;QAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,EACD,aAAa,EAAE,sBAAsB;IAKvC,SAAS,CAAC,gBAAgB,IAAI,IAAI;CAgBnC"}