@cloud-copilot/iam-expand 0.1.0 → 0.1.1

package/README.md

@@ -8,6 +8,11 @@ Use this to:
 2) Get an exhaustive list of actions that are included in a policy and quickly search it for interesting actions.
 3) Investigate where dangerous or dubious actions are being used in your policies.
 
+## Installation
+```bash
+npm install -g @cloud-copilot/iam-expand
+```
+
 ```typescript
 import { expandIamActions } from '@cloud-copilot/iam-expand';
 
@@ -36,13 +41,13 @@ expandIamActions(['s3:Get*Tagging', 's3:Put*Tagging'])
 ```
 
 ## API
-`expandIamActions` is the main function that will expand the actions of the IAM policy. Takes a string or array of strings and returns an array of strings that the input matches.
+`expandIamActions(actionStringOrStrings: string | string[], overrideOptions?: Partial<ExpandIamActionsOptions>)` is the main function that will expand the actions of the IAM policy. Takes a string or array of strings and returns an array of strings that the input matches.
 
 ## Only Valid Values
 `expandIamActions` intends to only return valid actual actions, if any invalid values are passed in such as an invalid format or a service/action that does not exist, they will be left out of the output. There are options to override this behavior.
 
 ## Options
-`expandIamActions` takes an optional second argument that is an object with the following options:
+`expandIamActions` an optional second argument that is an object with the following options:
 
 ### `expandAsterik`
 By default, a single `*` not be expanded. We assume that if you want a list of all IAM actions there are other sources you will check, such as [@cloud-copilot/iam-data](https://github.com/cloud-copilot/iam-data). If you want to expand a single `*` you can set this option to `true`.
@@ -189,18 +194,22 @@ expandIamActions('r2:Get*Tagging', { errorOnMissingService: true })
 ```
 
 ## CLI
-There is a CLI available to expand IAM Actions!
+There is a CLI!
 
-### Install
+### Install Globally
 ```bash
 npm install -g @cloud-copilot/iam-expand
 ```
-or
+yarn (yarn does not automatically add peer dependencies, so need to add the data package explicitly)
 ```
+yarn global add @cloud-copilot/iam-data
 yarn global add @cloud-copilot/iam-expand
 ```
 
-
+### Run the sciprt in a project that has the package installed
+```bash
+npx @cloud-copilot/iam-expand
+```
 
 ### Simple Usage
 The simplest usage is to pass in the actions you want to expand.

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@cloud-copilot/iam-expand",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Expand AWS IAM Actions with Wildcards",
-  "repository": "github:cloud-copilot/iam-expand",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cloud-copilot/iam-expand.git"
+  },
   "exports": {
     ".": {
       "import": "./dist/esm/index.js",
@@ -22,6 +25,10 @@
   ],
   "author": "David Kerber <dave@cloudcopilot.io>",
   "license": "GPL-3.0-or-later",
+  "bugs": {
+    "url": "https://github.com/cloud-copilot/iam-expand/issues"
+  },
+  "homepage": "https://github.com/cloud-copilot/iam-expand#readme",
   "devDependencies": {
     "@types/node": "^22.5.0",
     "typescript": "^5.5.4",

package/src/cli_utils.test.ts

@@ -14,6 +14,7 @@ const extractScenarios = [
   {input: '  "s3:Get*", "s3:Put*"',      expected: ['s3:Get*', 's3:Put*']},
   {input: '  `s3:Get*`, `s3:Put*`',      expected: ['s3:Get*', 's3:Put*']},
   {input: `  's3:Get*', 's3:Put*'`,      expected: ['s3:Get*', 's3:Put*']},
+  {input: `  'resource-Groups:Get*'`,    expected: ['resource-Groups:Get*']},
   {input: `s3:Get*, s3:Put*`,            expected: ['s3:Get*', 's3:Put*']},
   {input: "s3:Put*",                     expected: ['s3:Put*']},
   {input: ":s3:Put*",                    expected: []},

package/src/cli_utils.ts

@@ -50,7 +50,7 @@ export function convertOptions(optionArgs: string[]): Partial<CliOptions> {
   return options
 }
 
-const actionPattern = /\:?([a-zA-Z0-9]+:[a-zA-Z0-9*]+)/g;
+const actionPattern = /\:?([a-zA-Z0-9-]+:[a-zA-Z0-9*]+)/g;
 export function extractActionsFromLineOfInput(line: string): string[] {
   const matches = line.matchAll(actionPattern)
 

package/src/expand.test.ts

@@ -1,4 +1,4 @@
-import { iamActionExists, iamActionsForService, iamServiceExists, iamServiceKeys } from '@cloud-copilot/iam-data'
+import { iamActionDetails, iamActionExists, iamActionsForService, iamServiceExists, iamServiceKeys } from '@cloud-copilot/iam-data'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { expandIamActions, InvalidActionBehavior } from "./expand.js"
 
@@ -92,17 +92,18 @@ describe("expand", () => {
   describe("invalid action name", () => {
     it('should return an action without wildcards if it is a valid action', () => {
       //Given actionString contains a valid action
-      const actionString = 's3:GetObject'
+      const actionString = 's3:getobject'
       //And s3 the service exists
       vi.mocked(iamServiceExists).mockReturnValue(true)
       //And the action does not
       vi.mocked(iamActionExists).mockReturnValue(true)
+      vi.mocked(iamActionDetails).mockReturnValue({name: 'GetObject'} as any)
 
       //When expand is called with actionString
       const result = expandIamActions(actionString)
 
       //Then result should be an array with the actionString
-      expect(result).toEqual([actionString])
+      expect(result).toEqual(['s3:GetObject'])
     })
 
     it("should remove an invalid action if invalidActionBehavior is Remove", () => {
@@ -519,5 +520,4 @@ describe("expand", () => {
     })
   })
 
-
 })

package/src/expand.ts

@@ -1,4 +1,4 @@
-import { iamActionExists, iamActionsForService, iamServiceExists, iamServiceKeys } from '@cloud-copilot/iam-data'
+import { iamActionDetails, iamActionExists, iamActionsForService, iamServiceExists, iamServiceKeys } from '@cloud-copilot/iam-data'
 
 export enum InvalidActionBehavior {
   Remove = "Remove",
@@ -159,8 +159,9 @@ export function expandIamActions(actionStringOrStrings: string | string[], overr
   if(!actionString.includes('*')) {
     const actionExists = iamActionExists(service, wildcardActions)
     if(actionExists) {
-      return [actionString]
+      return [service + ":" + iamActionDetails(service, wildcardActions).name]
     }
+
     if(options.invalidActionBehavior === InvalidActionBehavior.Remove) {
       return []
     } else if(options.invalidActionBehavior === InvalidActionBehavior.Include) {