@cloud-copilot/iam-collect 0.1.131 → 0.1.133

package/dist/cjs/awsConfigClients/clients/AwsConfigEventBridgeClient.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsConfigEventBridgeClient = void 0;
+const client_eventbridge_1 = require("@aws-sdk/client-eventbridge");
+const AbstractClient_js_1 = require("../../customClients/AbstractClient.js");
+const AwsConfigClientContext_js_1 = require("../AwsConfigClientContext.js");
+const awsConfigUtils_js_1 = require("../awsConfigUtils.js");
+/**
+ * AWS Config-based EventBridge client implementation
+ *
+ */
+class AwsConfigEventBridgeClient extends AbstractClient_js_1.AbstractClient {
+    static clientName = client_eventbridge_1.EventBridgeClient.name;
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    /**
+     * Register all EventBridge command implementations
+     */
+    registerCommands() {
+        this.registerCommand(AwsConfigDescribeEventBusCommand);
+        this.registerCommand(AwsConfigListEventBusesCommand);
+        this.registerCommand(AwsConfigListTagsForResourceCommand);
+    }
+}
+exports.AwsConfigEventBridgeClient = AwsConfigEventBridgeClient;
+/**
+ * Config-based implementation of EventBridge DescribeEventBusCommand
+ *
+ * Maps Events::EventBus Config data to EventBridge DescribeEventBusCommand output format.
+ * Returns event bus policy from configuration.Policy field for IAM analysis.
+ */
+const AwsConfigDescribeEventBusCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_eventbridge_1.DescribeEventBusCommand,
+    execute: async (input, context) => {
+        const eventBusName = input.Name || 'default';
+        const configuration = context.getCache(eventBusName, 'configuration');
+        return {
+            Name: configuration.Name || eventBusName,
+            Arn: configuration.Arn,
+            Policy: configuration.Policy,
+            // Note: KmsKeyIdentifier is not available in Config schema
+            KmsKeyIdentifier: undefined
+        };
+    }
+});
+/**
+ * Config-based implementation of EventBridge ListEventBusesCommand
+ *
+ * Maps Events::EventBus Config data to EventBridge ListEventBusesCommand output format.
+ * Returns event bus listing for IAM analysis and resource discovery.
+ */
+const AwsConfigListEventBusesCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_eventbridge_1.ListEventBusesCommand,
+    execute: async (input, context) => {
+        const query = `
+      SELECT
+        arn,
+        resourceId,
+        resourceName,
+        configuration.Name,
+        configuration.Arn,
+        configuration.EventSourceName,
+        configuration.Policy,
+        tags
+      WHERE
+        resourceType = 'AWS::Events::EventBus'
+        AND awsRegion = '${context.region}'
+        AND accountId = '${context.accountId}'
+        AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+    `;
+        const results = await (0, awsConfigUtils_js_1.executeConfigQuery)(query, context);
+        const eventBuses = results.map((result) => {
+            const { configItem, configuration, tags } = (0, awsConfigUtils_js_1.parseConfigItem)(result);
+            // Cache data that will be needed by other commands
+            const eventBusName = configuration.Name || configItem.resourceName;
+            context.putCache(eventBusName, 'configuration', configuration);
+            context.putCache(configItem.arn, 'tags', tags);
+            return {
+                Name: configuration.Name,
+                Arn: configuration.Arn,
+                EventSourceName: configuration.EventSourceName
+            };
+        });
+        return {
+            EventBuses: eventBuses
+        };
+    }
+});
+/**
+ * Config-based implementation of EventBridge ListTagsForResourceCommand
+ *
+ * Maps Events::EventBus Config tag data to EventBridge ListTagsForResourceCommand output format.
+ * Returns event bus tags for resource identification and compliance analysis.
+ */
+const AwsConfigListTagsForResourceCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_eventbridge_1.ListTagsForResourceCommand,
+    execute: async (input, context) => {
+        // Extract event bus name from ARN or use the ARN directly for resourceName lookup
+        const resourceArn = input.ResourceARN;
+        const tags = context.getCache(resourceArn, 'tags');
+        return {
+            Tags: tags
+        };
+    }
+});
+//# sourceMappingURL=AwsConfigEventBridgeClient.js.map

package/dist/cjs/awsConfigClients/clients/AwsConfigEventBridgeClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigEventBridgeClient.js","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigEventBridgeClient.ts"],"names":[],"mappings":";;;AAAA,oEAKoC;AAEpC,6EAAsE;AACtE,4EAAuF;AACvF,4DAI6B;AAE7B;;;GAGG;AACH,MAAa,0BAA2B,SAAQ,kCAAsC;IACpF,MAAM,CAAU,UAAU,GAAG,sCAAiB,CAAC,IAAI,CAAA;IAEnD,YACE,OAGC,EACD,aAAqC;QAErC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACO,gBAAgB;QACxB,IAAI,CAAC,eAAe,CAAC,gCAAgC,CAAC,CAAA;QACtD,IAAI,CAAC,eAAe,CAAC,8BAA8B,CAAC,CAAA;QACpD,IAAI,CAAC,eAAe,CAAC,mCAAmC,CAAC,CAAA;IAC3D,CAAC;;AApBH,gEAqBC;AAED;;;;;GAKG;AACH,MAAM,gCAAgC,GAAG,IAAA,4CAAgB,EAAC;IACxD,OAAO,EAAE,4CAAuB;IAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,IAAI,SAAS,CAAA;QAE5C,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;QAErE,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,IAAI,IAAI,YAAY;YACxC,GAAG,EAAE,aAAa,CAAC,GAAG;YACtB,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,2DAA2D;YAC3D,gBAAgB,EAAE,SAAS;SAC5B,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,8BAA8B,GAAG,IAAA,4CAAgB,EAAC;IACtD,OAAO,EAAE,0CAAqB;IAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG;;;;;;;;;;;;2BAYS,OAAO,CAAC,MAAM;2BACd,OAAO,CAAC,SAAS;cAC9B,6CAAyB;KAClC,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAkB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAExD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACxC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,IAAA,mCAAe,EAAC,MAAM,CAAC,CAAA;YAEnE,mDAAmD;YACnD,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,IAAI,UAAU,CAAC,YAAY,CAAA;YAClE,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;YAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;YAE9C,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,IAAI;gBACxB,GAAG,EAAE,aAAa,CAAC,GAAG;gBACtB,eAAe,EAAE,aAAa,CAAC,eAAe;aAC/C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,UAAU,EAAE,UAAU;SACvB,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,mCAAmC,GAAG,IAAA,4CAAgB,EAAC;IAC3D,OAAO,EAAE,+CAA0B;IACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,kFAAkF;QAClF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAA;QAEtC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAElD,OAAO;YACL,IAAI,EAAE,IAAI;SACX,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cjs/awsConfigClients/clients/AwsConfigGlueClient.d.ts

@@ -0,0 +1,21 @@
+import { AwsCredentialIdentityWithMetaData } from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { AwsConfigClientContext } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config-based Glue client implementation
+ *
+ * Since policies are not available in AWS Config, this client provides limited functionality
+ * and returns empty results for all operations.
+ */
+export declare class AwsConfigGlueClient extends AbstractClient<AwsConfigClientContext> {
+    static readonly clientName: string;
+    constructor(options: {
+        credentials: AwsCredentialIdentityWithMetaData;
+        region: string | undefined;
+    }, customContext: AwsConfigClientContext);
+    /**
+     * Register all Glue command implementations
+     */
+    protected registerCommands(): void;
+}
+//# sourceMappingURL=AwsConfigGlueClient.d.ts.map

package/dist/cjs/awsConfigClients/clients/AwsConfigGlueClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigGlueClient.d.ts","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigGlueClient.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAoB,MAAM,8BAA8B,CAAA;AAEvF;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,cAAc,CAAC,sBAAsB,CAAC;IAC7E,MAAM,CAAC,QAAQ,CAAC,UAAU,SAAkB;gBAG1C,OAAO,EAAE;QACP,WAAW,EAAE,iCAAiC,CAAA;QAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,EACD,aAAa,EAAE,sBAAsB;IAKvC;;OAEG;IACH,SAAS,CAAC,gBAAgB,IAAI,IAAI;CAGnC"}

package/dist/cjs/awsConfigClients/clients/AwsConfigGlueClient.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsConfigGlueClient = void 0;
+const client_glue_1 = require("@aws-sdk/client-glue");
+const AbstractClient_js_1 = require("../../customClients/AbstractClient.js");
+const AwsConfigClientContext_js_1 = require("../AwsConfigClientContext.js");
+/**
+ * AWS Config-based Glue client implementation
+ *
+ * Since policies are not available in AWS Config, this client provides limited functionality
+ * and returns empty results for all operations.
+ */
+class AwsConfigGlueClient extends AbstractClient_js_1.AbstractClient {
+    static clientName = client_glue_1.GlueClient.name;
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    /**
+     * Register all Glue command implementations
+     */
+    registerCommands() {
+        this.registerCommand(AwsConfigGetResourcePolicyCommand);
+    }
+}
+exports.AwsConfigGlueClient = AwsConfigGlueClient;
+/**
+ * Config-based implementation of Glue GetResourcePolicyCommand
+ *
+ * Note: The Glue data catalog resource and its policies are not tracked by AWS Config.
+ * AWS Config only tracks individual Glue jobs, transforms, and classifiers - not the catalog itself.
+ * Therefore, no catalog policy analysis is possible from Config data.
+ */
+const AwsConfigGetResourcePolicyCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_glue_1.GetResourcePolicyCommand,
+    execute: async (input, context) => {
+        // Note: The Glue data catalog resource and its policies are not tracked by AWS Config.
+        // AWS Config only tracks individual Glue jobs, transforms, and classifiers - not the catalog itself.
+        // Therefore, no catalog policy analysis is possible from Config data.
+        return {
+            PolicyInJson: undefined // Empty - no catalog policy data available in Config
+        };
+    }
+});
+//# sourceMappingURL=AwsConfigGlueClient.js.map

package/dist/cjs/awsConfigClients/clients/AwsConfigGlueClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigGlueClient.js","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigGlueClient.ts"],"names":[],"mappings":";;;AAAA,sDAA2E;AAE3E,6EAAsE;AACtE,4EAAuF;AAEvF;;;;;GAKG;AACH,MAAa,mBAAoB,SAAQ,kCAAsC;IAC7E,MAAM,CAAU,UAAU,GAAG,wBAAU,CAAC,IAAI,CAAA;IAE5C,YACE,OAGC,EACD,aAAqC;QAErC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACO,gBAAgB;QACxB,IAAI,CAAC,eAAe,CAAC,iCAAiC,CAAC,CAAA;IACzD,CAAC;;AAlBH,kDAmBC;AAED;;;;;;GAMG;AACH,MAAM,iCAAiC,GAAG,IAAA,4CAAgB,EAAC;IACzD,OAAO,EAAE,sCAAwB;IACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,uFAAuF;QACvF,qGAAqG;QACrG,sEAAsE;QACtE,OAAO;YACL,YAAY,EAAE,SAAS,CAAC,qDAAqD;SAC9E,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cjs/awsConfigClients/clients/AwsConfigIamClient.d.ts

@@ -0,0 +1,18 @@
+import { AwsCredentialIdentityWithMetaData } from '../../aws/coreAuth.js';
+import { AbstractClient } from '../../customClients/AbstractClient.js';
+import { AwsConfigClientContext } from '../AwsConfigClientContext.js';
+/**
+ * AWS Config-based IAM client implementation
+ */
+export declare class AwsConfigIamClient extends AbstractClient<AwsConfigClientContext> {
+    static readonly clientName: string;
+    constructor(options: {
+        credentials: AwsCredentialIdentityWithMetaData;
+        region: string | undefined;
+    }, customContext: AwsConfigClientContext);
+    /**
+     * Register all IAM command implementations
+     */
+    protected registerCommands(): void;
+}
+//# sourceMappingURL=AwsConfigIamClient.d.ts.map

package/dist/cjs/awsConfigClients/clients/AwsConfigIamClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsConfigIamClient.d.ts","sourceRoot":"","sources":["../../../../src/awsConfigClients/clients/AwsConfigIamClient.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAoB,MAAM,8BAA8B,CAAA;AAOvF;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,sBAAsB,CAAC;IAC5E,MAAM,CAAC,QAAQ,CAAC,UAAU,SAAiB;gBAGzC,OAAO,EAAE;QACP,WAAW,EAAE,iCAAiC,CAAA;QAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,EACD,aAAa,EAAE,sBAAsB;IAKvC;;OAEG;IACH,SAAS,CAAC,gBAAgB,IAAI,IAAI;CASnC"}

package/dist/cjs/awsConfigClients/clients/AwsConfigIamClient.js

@@ -0,0 +1,439 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsConfigIamClient = void 0;
+const client_iam_1 = require("@aws-sdk/client-iam");
+const iam_utils_1 = require("@cloud-copilot/iam-utils");
+const ClientPool_js_1 = require("../../aws/ClientPool.js");
+const AbstractClient_js_1 = require("../../customClients/AbstractClient.js");
+const AwsConfigClientContext_js_1 = require("../AwsConfigClientContext.js");
+const awsConfigUtils_js_1 = require("../awsConfigUtils.js");
+/**
+ * AWS Config-based IAM client implementation
+ */
+class AwsConfigIamClient extends AbstractClient_js_1.AbstractClient {
+    static clientName = client_iam_1.IAMClient.name;
+    constructor(options, customContext) {
+        super(options, customContext);
+    }
+    /**
+     * Register all IAM command implementations
+     */
+    registerCommands() {
+        this.registerCommand(AwsConfigGetAccountAuthorizationDetailsCommand);
+        this.registerCommand(AwsConfigGetOpenIDConnectProviderCommand);
+        this.registerCommand(AwsConfigGetSAMLProviderCommand);
+        this.registerCommand(AwsConfigListInstanceProfilesCommand);
+        this.registerCommand(AwsConfigListOpenIDConnectProvidersCommand);
+        this.registerCommand(AwsConfigListSAMLProvidersCommand);
+        this.registerCommand(AwsConfigListPolicyTagsCommand);
+    }
+}
+exports.AwsConfigIamClient = AwsConfigIamClient;
+/**
+ * Config-based implementation of IAM GetAccountAuthorizationDetailsCommand
+ *
+ * Aggregates IAM data from multiple Config resource types:
+ * - AWS::IAM::Role for roles
+ * - AWS::IAM::User for users
+ * - AWS::IAM::Group for groups
+ * - AWS::IAM::Policy for managed policies
+ */
+const AwsConfigGetAccountAuthorizationDetailsCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_iam_1.GetAccountAuthorizationDetailsCommand,
+    execute: async (input, context) => {
+        const nativeIamClient = ClientPool_js_1.AwsClientPool.defaultInstance.client(client_iam_1.IAMClient, context.configCredentials, context.region, undefined);
+        const awsManagedPoliciesToFetch = new Set();
+        // Query roles from Config
+        const rolesQuery = `
+      SELECT
+        configuration.arn,
+        configuration.roleName,
+        configuration.path,
+        configuration.roleId,
+        configuration.createDate,
+        configuration.assumeRolePolicyDocument,
+        configuration.attachedManagedPolicies,
+        configuration.instanceProfileList,
+        configuration.rolePolicyList,
+        configuration.permissionsBoundary,
+        configuration.roleLastUsed,
+        tags
+      WHERE
+        resourceType = 'AWS::IAM::Role'
+        AND accountId = '${context.accountId}'
+        AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+    `;
+        // Query users from Config
+        const usersQuery = `
+      SELECT
+        configuration.arn,
+        configuration.userName,
+        configuration.path,
+        configuration.userId,
+        configuration.createDate,
+        configuration.attachedManagedPolicies,
+        configuration.groupList,
+        configuration.userPolicyList,
+        configuration.permissionsBoundary,
+        tags
+      WHERE
+        resourceType = 'AWS::IAM::User'
+        AND accountId = '${context.accountId}'
+        AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+    `;
+        // Query groups from Config
+        const groupsQuery = `
+      SELECT
+        configuration.arn,
+        configuration.groupName,
+        configuration.path,
+        configuration.groupId,
+        configuration.createDate,
+        configuration.attachedManagedPolicies,
+        configuration.groupPolicyList,
+        tags
+      WHERE
+        resourceType = 'AWS::IAM::Group'
+        AND accountId = '${context.accountId}'
+        AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+    `;
+        // Query policies from Config
+        const policiesQuery = `
+      SELECT
+        configuration.policyName,
+        configuration.policyId,
+        configuration.arn,
+        configuration.path,
+        configuration.createDate,
+        configuration.updateDate,
+        configuration.policyVersionList,
+        configuration.attachmentCount,
+        configuration.permissionsBoundaryUsageCount,
+        configuration.isAttachable,
+        configuration.description,
+        tags
+      WHERE
+        resourceType = 'AWS::IAM::Policy'
+        AND accountId = '${context.accountId}'
+        AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+    `;
+        // Execute all queries
+        const [rolesResults, usersResults, groupsResults, policiesResults] = await Promise.all([
+            (0, awsConfigUtils_js_1.executeConfigQuery)(rolesQuery, context),
+            (0, awsConfigUtils_js_1.executeConfigQuery)(usersQuery, context),
+            (0, awsConfigUtils_js_1.executeConfigQuery)(groupsQuery, context),
+            (0, awsConfigUtils_js_1.executeConfigQuery)(policiesQuery, context)
+        ]);
+        // Transform Config data to IAM format and collect AWS managed policies
+        const roles = rolesResults.map((resultString) => {
+            const { configuration, tags } = (0, awsConfigUtils_js_1.parseConfigItem)(resultString);
+            // Collect AWS managed policies from this role
+            const attachedPolicies = configuration.attachedManagedPolicies || [];
+            attachedPolicies.forEach((policy) => {
+                if (policy.policyArn && isAwsManagedPolicy(policy.policyArn)) {
+                    awsManagedPoliciesToFetch.add(policy.policyArn);
+                }
+            });
+            return {
+                Arn: configuration.arn,
+                RoleName: configuration.roleName,
+                Path: configuration.path,
+                RoleId: configuration.roleId,
+                CreateDate: configuration.createDate ? new Date(configuration.createDate) : undefined,
+                AssumeRolePolicyDocument: configuration.assumeRolePolicyDocument,
+                AttachedManagedPolicies: configuration.attachedManagedPolicies?.map((ap) => ({
+                    PolicyName: ap.policyName,
+                    PolicyArn: ap.policyArn
+                })),
+                InstanceProfileList: configuration.instanceProfileList,
+                RolePolicyList: configuration.rolePolicyList.map((rp) => ({
+                    PolicyName: rp.policyName,
+                    PolicyDocument: rp.policyDocument
+                })),
+                Tags: tags,
+                PermissionsBoundary: configuration.permissionsBoundary,
+                RoleLastUsed: configuration.roleLastUsed
+            };
+        });
+        const users = usersResults.map((resultString) => {
+            const { configuration, tags } = (0, awsConfigUtils_js_1.parseConfigItem)(resultString);
+            // Collect AWS managed policies from this user
+            const attachedPolicies = configuration.attachedManagedPolicies || [];
+            attachedPolicies.forEach((policy) => {
+                if (policy.policyArn && isAwsManagedPolicy(policy.policyArn)) {
+                    awsManagedPoliciesToFetch.add(policy.policyArn);
+                }
+            });
+            return {
+                Arn: configuration.arn,
+                UserName: configuration.userName,
+                Path: configuration.path,
+                UserId: configuration.userId,
+                CreateDate: configuration.createDate ? new Date(configuration.createDate) : undefined,
+                AttachedManagedPolicies: configuration.attachedManagedPolicies.map((ap) => ({
+                    PolicyName: ap.policyName,
+                    PolicyArn: ap.policyArn
+                })),
+                GroupList: configuration.groupList,
+                UserPolicyList: configuration.userPolicyList.map((up) => ({
+                    PolicyName: up.policyName,
+                    PolicyDocument: up.policyDocument
+                })),
+                Tags: tags,
+                PermissionsBoundary: configuration.permissionsBoundary
+            };
+        });
+        const groups = groupsResults.map((resultString) => {
+            const { configuration, tags } = (0, awsConfigUtils_js_1.parseConfigItem)(resultString);
+            // Collect AWS managed policies from this group
+            const attachedPolicies = configuration.attachedManagedPolicies || [];
+            attachedPolicies.forEach((policy) => {
+                if (policy.policyArn && isAwsManagedPolicy(policy.policyArn)) {
+                    awsManagedPoliciesToFetch.add(policy.policyArn);
+                }
+            });
+            return {
+                Arn: configuration.arn,
+                GroupName: configuration.groupName,
+                Path: configuration.path,
+                GroupId: configuration.groupId,
+                CreateDate: configuration.createDate ? new Date(configuration.createDate) : undefined,
+                AttachedManagedPolicies: putInArray(configuration.attachedManagedPolicies).map((ap) => ({
+                    PolicyName: ap.policyName,
+                    PolicyArn: ap.policyArn
+                })),
+                Tags: tags ? Object.entries(tags).map(([key, value]) => ({ Key: key, Value: value })) : [],
+                GroupPolicyList: putInArray(configuration.groupPolicyList).map((gp) => ({
+                    PolicyName: gp.policyName,
+                    PolicyDocument: gp.policyDocument
+                }))
+            };
+        });
+        const policies = policiesResults.map((resultString) => {
+            const { configuration, tags } = (0, awsConfigUtils_js_1.parseConfigItem)(resultString);
+            return {
+                PolicyName: configuration.policyName,
+                PolicyId: configuration.policyId,
+                Arn: configuration.arn,
+                Path: configuration.path,
+                CreateDate: configuration.createDate ? new Date(configuration.createDate) : undefined,
+                UpdateDate: configuration.updateDate ? new Date(configuration.updateDate) : undefined,
+                PolicyVersionList: putInArray(configuration.policyVersionList).map((pv) => ({
+                    Document: pv.document,
+                    VersionId: pv.versionId,
+                    IsDefaultVersion: pv.isDefaultVersion
+                })),
+                AttachmentCount: configuration.attachmentCount,
+                PermissionsBoundaryUsageCount: configuration.permissionsBoundaryUsageCount,
+                IsAttachable: configuration.isAttachable,
+                Description: configuration.description,
+                Tags: tags
+            };
+        });
+        // Fetch AWS managed policy details using native IAM client
+        const awsManagedPolicies = [];
+        for (const policyArn of awsManagedPoliciesToFetch) {
+            const policyDetails = await nativeIamClient.send(new client_iam_1.GetPolicyCommand({ PolicyArn: policyArn }));
+            const policyDocument = await nativeIamClient.send(new client_iam_1.GetPolicyVersionCommand({
+                PolicyArn: policyArn,
+                VersionId: policyDetails.Policy?.DefaultVersionId
+            }));
+            if (policyDocument.PolicyVersion) {
+                awsManagedPolicies.push({
+                    ...policyDetails.Policy,
+                    PolicyVersionList: [
+                        {
+                            Document: policyDocument.PolicyVersion.Document,
+                            VersionId: policyDocument.PolicyVersion.VersionId,
+                            IsDefaultVersion: policyDocument.PolicyVersion.IsDefaultVersion
+                        }
+                    ]
+                });
+            }
+        }
+        // Combine customer-managed policies from Config with AWS managed policies from native IAM
+        const allPolicies = [...policies, ...awsManagedPolicies];
+        return {
+            UserDetailList: users,
+            GroupDetailList: groups,
+            RoleDetailList: roles,
+            Policies: allPolicies,
+            IsTruncated: false
+        };
+    }
+});
+/**
+ * Config-based implementation of IAM ListInstanceProfilesCommand
+ *
+ * Note: AWS Config doesn't track InstanceProfile as a separate resource type.
+ * Instance profiles are extracted from Role configuration data.
+ */
+const AwsConfigListInstanceProfilesCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_iam_1.ListInstanceProfilesCommand,
+    execute: async (input, context) => {
+        // Get roles from Config and extract instance profiles
+        const query = `
+      SELECT
+        configuration.instanceProfileList
+      WHERE
+        resourceType = 'AWS::IAM::Role'
+        AND accountId = '${context.accountId}'
+        AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+    `;
+        const results = await (0, awsConfigUtils_js_1.executeConfigQuery)(query, context);
+        // Extract unique instance profiles from all roles
+        const instanceProfilesMap = new Map();
+        results.forEach((resultString) => {
+            const { configuration } = (0, awsConfigUtils_js_1.parseConfigItem)(resultString);
+            const instanceProfiles = configuration.instanceProfileList || [];
+            instanceProfiles.forEach((profile) => {
+                if (profile.arn && !instanceProfilesMap.has(profile.arn)) {
+                    instanceProfilesMap.set(profile.arn, {
+                        Path: profile.path,
+                        InstanceProfileName: profile.instanceProfileName,
+                        InstanceProfileId: profile.instanceProfileId,
+                        Arn: profile.arn,
+                        CreateDate: profile.createDate ? new Date(profile.createDate) : undefined,
+                        Roles: profile.roles?.map((r) => ({ Arn: r.arn })) || [],
+                        Tags: [] // Tags not available in role's instance profile data
+                    });
+                }
+            });
+        });
+        return {
+            InstanceProfiles: Array.from(instanceProfilesMap.values()),
+            IsTruncated: false // TODO: Handle pagination properly
+        };
+    }
+});
+/**
+ * Config-based implementation of IAM ListOpenIDConnectProvidersCommand
+ */
+const AwsConfigListOpenIDConnectProvidersCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_iam_1.ListOpenIDConnectProvidersCommand,
+    execute: async (input, context) => {
+        const query = `
+      SELECT
+        configuration.Arn,
+        configuration.Url,
+        configuration.ClientIdList,
+        configuration.ThumbprintList,
+        tags
+      WHERE
+        resourceType = 'AWS::IAM::OIDCProvider'
+        AND accountId = '${context.accountId}'
+        AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+    `;
+        const results = await (0, awsConfigUtils_js_1.executeConfigQuery)(query, context);
+        const providers = results.map((resultString) => {
+            const { configuration, tags } = (0, awsConfigUtils_js_1.parseConfigItem)(resultString);
+            context.putCache(configuration.Arn, 'configuration', { configuration, tags });
+            return {
+                Arn: configuration.Arn
+            };
+        });
+        return {
+            OpenIDConnectProviderList: providers
+        };
+    }
+});
+/**
+ * Config-based implementation of IAM GetOpenIDConnectProviderCommand
+ */
+const AwsConfigGetOpenIDConnectProviderCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_iam_1.GetOpenIDConnectProviderCommand,
+    execute: async (input, context) => {
+        const { configuration, tags } = context.getCache(input.OpenIDConnectProviderArn, 'configuration');
+        return {
+            Url: configuration.Url,
+            ClientIDList: configuration.ClientIdList,
+            ThumbprintList: configuration.ThumbprintList,
+            Tags: tags
+        };
+    }
+});
+/**
+ * Config-based implementation of IAM ListSAMLProvidersCommand
+ */
+const AwsConfigListSAMLProvidersCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_iam_1.ListSAMLProvidersCommand,
+    execute: async (input, context) => {
+        const query = `
+      SELECT
+        arn,
+        configuration.SamlMetadataDocument,
+        tags
+      WHERE
+        resourceType = 'AWS::IAM::SAMLProvider'
+        AND accountId = '${context.accountId}'
+        AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+    `;
+        const results = await (0, awsConfigUtils_js_1.executeConfigQuery)(query, context);
+        const providers = results.map((resultString) => {
+            const { configItem, configuration, tags } = (0, awsConfigUtils_js_1.parseConfigItem)(resultString);
+            context.putCache(configItem.arn, 'configuration', { configuration, tags });
+            return {
+                Arn: configItem.arn
+            };
+        });
+        return {
+            SAMLProviderList: providers
+        };
+    }
+});
+/**
+ * Config-based implementation of IAM GetSAMLProviderCommand
+ */
+const AwsConfigGetSAMLProviderCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_iam_1.GetSAMLProviderCommand,
+    execute: async (input, context) => {
+        const { configuration, tags } = context.getCache(input.SAMLProviderArn, 'configuration');
+        return {
+            SAMLMetadataDocument: configuration.SamlMetadataDocument,
+            Tags: tags
+        };
+    }
+});
+/**
+ * Config-based implementation of IAM ListPolicyTagsCommand
+ */
+const AwsConfigListPolicyTagsCommand = (0, AwsConfigClientContext_js_1.awsConfigCommand)({
+    command: client_iam_1.ListPolicyTagsCommand,
+    execute: async (input, context) => {
+        const policyName = input.PolicyArn.split('/').pop();
+        const query = `
+      SELECT
+        tags
+      WHERE
+        resourceType = 'AWS::IAM::Policy'
+        AND accountId = '${context.accountId}'
+        AND resourceName = '${policyName}'
+        AND ${awsConfigUtils_js_1.resourceStatusWhereClause}
+    `;
+        const results = await (0, awsConfigUtils_js_1.executeConfigQuery)(query, context);
+        if (results.length === 0) {
+            throw new Error('Policy not found');
+        }
+        const { tags } = (0, awsConfigUtils_js_1.parseConfigItem)(results[0]);
+        return {
+            Tags: tags,
+            IsTruncated: false
+        };
+    }
+});
+/**
+ * Given an AWS IAM policy ARN, determine if it is an AWS-managed policy
+ *
+ * @param policyArn the ARN of the IAM policy
+ * @returns true if the policy is AWS-managed, false otherwise
+ */
+function isAwsManagedPolicy(policyArn) {
+    return (0, iam_utils_1.splitArnParts)(policyArn).accountId === 'aws';
+}
+function putInArray(item) {
+    if (item === undefined || item === null) {
+        return [];
+    }
+    return Array.isArray(item) ? item : [item];
+}
+//# sourceMappingURL=AwsConfigIamClient.js.map