@cloud-copilot/iam-lens 0.1.14 → 0.1.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +28 -138
- package/dist/cjs/resources.d.ts.map +1 -1
- package/dist/cjs/resources.js +2 -3
- package/dist/cjs/resources.js.map +1 -1
- package/dist/esm/resources.d.ts.map +1 -1
- package/dist/esm/resources.js +2 -3
- package/dist/esm/resources.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -2,10 +2,21 @@
|
|
|
2
2
|
|
|
3
3
|
[](https://www.npmjs.com/package/@cloud-copilot/iam-lens) [](LICENSE.txt) [](https://github.com/cloud-copilot/iam-lens/actions/workflows/guarddog.yml) [](https://snyk.io/test/github/cloud-copilot/iam-lens?targetFile=package.json)
|
|
4
4
|
|
|
5
|
-
## iam-lens
|
|
6
|
-
|
|
7
5
|
Get visibility into the IAM permissions in your AWS organizations and accounts. Use your actual AWS IAM policies (downloaded via [iam-collect](https://github.com/cloud-copilot/iam-collect)) and evaluate the effective permissions.
|
|
8
6
|
|
|
7
|
+
## Table of Contents
|
|
8
|
+
|
|
9
|
+
1. [Quick Start](#quick-start)
|
|
10
|
+
2. [What is iam-lens?](#what-is-iam-lens)
|
|
11
|
+
3. [Why use it?](#why-use-it)
|
|
12
|
+
4. [Getting Started](#getting-started)
|
|
13
|
+
5. [Commands](#commands)
|
|
14
|
+
- [simulate - Simulate a request](docs/Simulate.md)
|
|
15
|
+
- [who-can - Find who can perform an action on a resource](docs/WhoCan.md)
|
|
16
|
+
- [Global CLI Options](docs/GlobalCliOptions.md)
|
|
17
|
+
6. [Contributing & Support](#contributing--support)
|
|
18
|
+
7. [Acknowledgements](#acknowledgements)
|
|
19
|
+
|
|
9
20
|
## Quick Start
|
|
10
21
|
|
|
11
22
|
```bash
|
|
@@ -28,15 +39,15 @@ iam-lens who-can --resource arn:aws:s3:::example-bucket
|
|
|
28
39
|
|
|
29
40
|
## What is iam-lens?
|
|
30
41
|
|
|
31
|
-
iam-lens
|
|
42
|
+
**iam-lens** lets you **simulate** and **audit** real IAM requests against your collected IAM data from your AWS accounts (collected via [iam-collect](https://github.com/cloud-copilot/iam-collect)) and understand the effective permissions that apply to a principal or resource.
|
|
32
43
|
|
|
33
44
|
## Why use it?
|
|
34
45
|
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
46
|
+
- **Understand** the permissions that are actually in place.
|
|
47
|
+
- **Verify** allowed and denied outcomes after all policies are deployed.
|
|
48
|
+
- **Discover** every principal that can access a given resource.
|
|
49
|
+
- **Audit** complex policy combinations across all your AWS accounts and orgs.
|
|
50
|
+
- **Debug** complex conditions locally without deployment or network calls.
|
|
40
51
|
|
|
41
52
|
## Getting Started
|
|
42
53
|
|
|
@@ -81,27 +92,11 @@ iam-lens who-can \
|
|
|
81
92
|
|
|
82
93
|
## Commands
|
|
83
94
|
|
|
84
|
-
### `simulate` - Simulate
|
|
85
|
-
|
|
86
|
-
```bash
|
|
87
|
-
iam-lens simulate [options]
|
|
88
|
-
```
|
|
89
|
-
|
|
90
|
-
Evaluates whether a principal can perform a specified action on a resource (or account for wildcard only actions). Returns a decision: `Allowed`, `ImplicitlyDenied`, or `ExplicitlyDenied`.
|
|
95
|
+
### `simulate` - Simulate a request
|
|
91
96
|
|
|
92
|
-
|
|
97
|
+
Evaluates whether a principal can perform a specified action on a resource (or account for wildcard only actions). Returns a decision: `Allowed`, `ImplicitlyDenied`, or `ExplicitlyDenied`. All [condition keys](docs/Simulate.md#context-keys) are supported and [many context keys are set automatically](docs/Simulate.md#default-context-keys).
|
|
93
98
|
|
|
94
|
-
|
|
95
|
-
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
96
|
-
| `--principal <arn>` | The principal the request is from. Can be a user, role, session, or AWS service. |
|
|
97
|
-
| `--resource <arn>` | The ARN of the resource to simulate access to. Ignore for wildcard-only actions such as `s3:ListAllMyBuckets`. |
|
|
98
|
-
| `--resource-account <id>` | The account ID of the resource. Only required if it cannot be determined from the resource ARN or the principal ARN for wildcard only actions. |
|
|
99
|
-
| `--action <service:action>` | The action to simulate; must be a valid IAM service and action such as `s3:ListBucket`. |
|
|
100
|
-
| `--context <key=value>` | One or more context keys to use for the simulation. Keys are formatted as `keyA=value1,value2 keyB=value1,value2`. Multiple keys are separated by spaces. Multiple values separated by commas. See [Context Keys](#context-keys) for what keys are set automatically |
|
|
101
|
-
| `-v, --verbose` | Enable verbose output for the simulation to see exactly what statements applied or not and why. |
|
|
102
|
-
| `--expect <result>` | Optional expected outcome of the simulation. Valid values are `Allowed`, `ImplicitlyDenied`, `ExplicitlyDenied`, `AnyDeny`. If the result does not match the expected value, a non-zero exit code is returned |
|
|
103
|
-
|
|
104
|
-
**Examples:**
|
|
99
|
+
[Full simulate documentation](docs/Simulate.md)
|
|
105
100
|
|
|
106
101
|
```bash
|
|
107
102
|
# Simple simulate: can this role list objects in the bucket?
|
|
@@ -131,6 +126,8 @@ iam-lens simulate \
|
|
|
131
126
|
--expect Allowed
|
|
132
127
|
```
|
|
133
128
|
|
|
129
|
+
[Full simulate documentation](docs/Simulate.md)
|
|
130
|
+
|
|
134
131
|
### `who-can` - Find who can perform an action on a resource
|
|
135
132
|
|
|
136
133
|
```bash
|
|
@@ -139,13 +136,7 @@ iam-lens who-can [options]
|
|
|
139
136
|
|
|
140
137
|
Lists all principals in your IAM data who are allowed to perform one or more specified actions on a resource (or account for wildcard only actions). If applicable it will check the resource policy to find cross-account permissions and AWS service principals.
|
|
141
138
|
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
| Flag | Description |
|
|
145
|
-
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
146
|
-
| `--resource <arn>` | The ARN of the resource to check permissions for. Ignore for wildcard-only actions such as `iam:ListRoles` |
|
|
147
|
-
| `--resource-account <id>` | The account ID of the resource, only required if it cannot be determined from the resource ARN. Required for wildcard actions such as `ec2:DescribeInstances` |
|
|
148
|
-
| `--actions <service:action>` | One or more actions to check such as `s3:GetObject`. Specify as many actions as you want. If omitted it will analyze all valid actions for the resource. If no `--resource` is specified then actions must be entered. |
|
|
139
|
+
[Full who-can documentation](docs/WhoCan.md)
|
|
149
140
|
|
|
150
141
|
**Examples:**
|
|
151
142
|
|
|
@@ -170,112 +161,11 @@ iam-lens who-can \
|
|
|
170
161
|
--resource arn:aws:s3:::my-bucket
|
|
171
162
|
```
|
|
172
163
|
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
These options are available for all commands:
|
|
176
|
-
|
|
177
|
-
| Flag | Description | Default |
|
|
178
|
-
| -------------------------- | --------------------------------------------------------------------- | ------------------- |
|
|
179
|
-
| `--collectConfigs <files>` | One or more `iam-collect` config files to use for fetching IAM data. | `iam-collect.jsonc` |
|
|
180
|
-
| `--partition <partition>` | The AWS partition (`aws`, `aws-cn`, `aws-us-gov`). Defaults to `aws`. | `aws` |
|
|
181
|
-
|
|
182
|
-
## Context Keys
|
|
183
|
-
|
|
184
|
-
iam-lens automatically populates the context keys below when simulating requests. These keys are set based on your principal, resource, and organization data. Any keys provided via `--context` will override the defaults.
|
|
185
|
-
|
|
186
|
-
### Default Context Keys
|
|
187
|
-
|
|
188
|
-
- **`aws:SecureTransport`**
|
|
189
|
-
Always set to `true` to indicate the request is using a secure channel.
|
|
190
|
-
|
|
191
|
-
- **`aws:CurrentTime`**
|
|
192
|
-
ISO 8601 timestamp of when the simulation is run (e.g., `2025-06-01T12:34:56.789Z`).
|
|
193
|
-
|
|
194
|
-
- **`aws:EpochTime`**
|
|
195
|
-
Unix epoch time in seconds (e.g., `1717290896`).
|
|
196
|
-
|
|
197
|
-
#### IAM Principal Context
|
|
198
|
-
|
|
199
|
-
- **`aws:PrincipalArn`**
|
|
200
|
-
The full ARN of the principal (user, role, role session, or federated user) being simulated.
|
|
201
|
-
|
|
202
|
-
- **`aws:PrincipalAccount`**
|
|
203
|
-
The AWS account ID extracted from the principal ARN.
|
|
204
|
-
|
|
205
|
-
- **`aws:PrincipalOrgId`** _(if the account is in an organization)_
|
|
206
|
-
The Organization ID that owns the principal’s account.
|
|
207
|
-
|
|
208
|
-
- **`aws:PrincipalOrgPaths`** _(if the account is in an organization)_
|
|
209
|
-
A list containing a single string of the form `<OrgId>/<OU1>/<OU2>/…/` indicating the account’s path in the OU hierarchy.
|
|
210
|
-
|
|
211
|
-
- **`aws:PrincipalTag/<TagKey>`**
|
|
212
|
-
For each tag on the IAM principal, a context key of the form `aws:PrincipalTag/<TagKey>` with its tag value.
|
|
164
|
+
[Full who-can documentation](docs/WhoCan.md)
|
|
213
165
|
|
|
214
|
-
|
|
215
|
-
Set to `false` for all IAM principals (users, roles, federated users).
|
|
216
|
-
|
|
217
|
-
- **`aws:PrincipalType`**
|
|
218
|
-
One of: `Account`, `User`, `FederatedUser`, `AssumedRole`, indicating the type of principal.
|
|
219
|
-
|
|
220
|
-
- **`aws:userid`**
|
|
221
|
-
The unique identifier for the principal session:
|
|
222
|
-
|
|
223
|
-
- For a root principal: the account ID
|
|
224
|
-
- For a user: the IAM user’s unique ID (or `UNKNOWN` if not found)
|
|
225
|
-
- For a federated user: `<AccountId>:<FederatedName>`
|
|
226
|
-
- For an assumed role: `<RoleUniqueId>:<SessionName>`
|
|
227
|
-
|
|
228
|
-
Setting `role-id:ec2-instance-id` for EC2 instances is not supported at this time.
|
|
229
|
-
|
|
230
|
-
- **`aws:username`** _(only for IAM users)_
|
|
231
|
-
The IAM username portion of the principal ARN (e.g. `Alice`).
|
|
232
|
-
|
|
233
|
-
#### Service Principal Context
|
|
234
|
-
|
|
235
|
-
The following context keys are set when the principal is an AWS service (e.g., `lambda.amazonaws.com`, `ec2.amazonaws.com`):
|
|
236
|
-
|
|
237
|
-
- **`aws:PrincipalServiceName`**
|
|
238
|
-
The service principal string (e.g. `lambda.amazonaws.com`).
|
|
239
|
-
|
|
240
|
-
- **`aws:SourceAccount`**
|
|
241
|
-
The account ID of the resource.
|
|
242
|
-
|
|
243
|
-
- **`aws:SourceOrgID`**
|
|
244
|
-
The organization ID of the resource’s account (if part of an organization).
|
|
245
|
-
|
|
246
|
-
- **`aws:SourceOrgPaths`**
|
|
247
|
-
The OU hierarchy path for the resource’s account (if part of an organization).
|
|
248
|
-
|
|
249
|
-
- **`aws:PrincipalIsAWSService`**
|
|
250
|
-
Set to `true` for all service principals.
|
|
251
|
-
|
|
252
|
-
#### Resource Context ([unless action is excluded](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceaccount))
|
|
253
|
-
|
|
254
|
-
- **`aws:ResourceAccount`**
|
|
255
|
-
The AWS account ID of the resource.
|
|
256
|
-
|
|
257
|
-
- **`aws:ResourceOrgID`**
|
|
258
|
-
The Organization ID for the resource’s account (if part of an organization).
|
|
259
|
-
|
|
260
|
-
- **`aws:ResourceOrgPaths`** _(if the resource account is in an organization)_
|
|
261
|
-
A list containing a single string of the form `<OrgId>/<OU1>/<OU2>/…/` for the resource’s account (if part of an organization).
|
|
262
|
-
|
|
263
|
-
- **`aws:ResourceTag/<TagKey>`**
|
|
264
|
-
For each tag on the resource ARN, a context key `aws:ResourceTag/TagKey` with its tag value. **This is only for resources that are stored in your `iam-collect` data**, such as Roles, S3 Buckets, DynamoDB Tables, etc. For resources not stored in `iam-collect`, this key should be set manually.
|
|
265
|
-
|
|
266
|
-
### Overriding Default Context Keys
|
|
267
|
-
|
|
268
|
-
Any context keys supplied via the `--context key=value[,value2,…]` argument will override the defaults described above. For example:
|
|
269
|
-
|
|
270
|
-
```bash
|
|
271
|
-
iam-lens simulate \
|
|
272
|
-
--principal arn:aws:iam::123456789012:user/Alice \
|
|
273
|
-
--resource arn:aws:s3:::my-bucket \
|
|
274
|
-
--action s3:GetObject \
|
|
275
|
-
--context aws:CurrentTime=2025-01-01T00:00:00Z aws:PrincipalTag/Env=staging
|
|
276
|
-
```
|
|
166
|
+
## Contributing & Support
|
|
277
167
|
|
|
278
|
-
|
|
168
|
+
The best way to support is to [open an issue](https://github.com/cloud-copilot/iam-lens/issues) and let us know of any bugs, feature requests, or questions you have. We're always looking for ways to improve the project and make it more useful for everyone.
|
|
279
169
|
|
|
280
170
|
## Acknowledgements
|
|
281
171
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,
|
|
1
|
+
{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAa7B;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAMhD;AAED,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAkB1B"}
|
package/dist/cjs/resources.js
CHANGED
|
@@ -14,7 +14,7 @@ const iam_utils_1 = require("@cloud-copilot/iam-utils");
|
|
|
14
14
|
async function getAccountIdForResource(collectClient, resourceArn) {
|
|
15
15
|
const arnParts = (0, iam_utils_1.splitArnParts)(resourceArn);
|
|
16
16
|
let accountId = arnParts.accountId;
|
|
17
|
-
if (accountId) {
|
|
17
|
+
if (accountId && accountId !== 'aws') {
|
|
18
18
|
return accountId;
|
|
19
19
|
}
|
|
20
20
|
if (arnParts.service === 's3' && arnParts.resourceType === '') {
|
|
@@ -22,8 +22,7 @@ async function getAccountIdForResource(collectClient, resourceArn) {
|
|
|
22
22
|
return collectClient.getAccountIdForBucket(bucketName);
|
|
23
23
|
}
|
|
24
24
|
else if (arnParts.service === 'apigateway' && arnParts.resourceType === 'restapis') {
|
|
25
|
-
|
|
26
|
-
return collectClient.getAccountIdForRestApi(apiId);
|
|
25
|
+
return collectClient.getAccountIdForRestApi(resourceArn);
|
|
27
26
|
}
|
|
28
27
|
return undefined;
|
|
29
28
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":";;AAWA,
|
|
1
|
+
{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":";;AAWA,0DAgBC;AASD,gDASC;AAED,oEAqBC;AAnED,wDAAwD;AAGxD;;;;;;GAMG;AACI,KAAK,UAAU,uBAAuB,CAC3C,aAA+B,EAC/B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;IAClC,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,OAAO,aAAa,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAA;IACxD,CAAC;SAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QACrF,OAAO,aAAa,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CACtC,aAA+B,EAC/B,WAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,WAAW,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;AAC3D,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAChD,aAA+B,EAC/B,WAAmB;IAEnB,2CAA2C;IAC3C,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,WAAW,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAC1F,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IACrF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,gEAAgE;IAChE,OAAO,SAAS,CAAA;AAClB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,
|
|
1
|
+
{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAa7B;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAMhD;AAED,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAkB1B"}
|
package/dist/esm/resources.js
CHANGED
|
@@ -9,7 +9,7 @@ import { splitArnParts } from '@cloud-copilot/iam-utils';
|
|
|
9
9
|
export async function getAccountIdForResource(collectClient, resourceArn) {
|
|
10
10
|
const arnParts = splitArnParts(resourceArn);
|
|
11
11
|
let accountId = arnParts.accountId;
|
|
12
|
-
if (accountId) {
|
|
12
|
+
if (accountId && accountId !== 'aws') {
|
|
13
13
|
return accountId;
|
|
14
14
|
}
|
|
15
15
|
if (arnParts.service === 's3' && arnParts.resourceType === '') {
|
|
@@ -17,8 +17,7 @@ export async function getAccountIdForResource(collectClient, resourceArn) {
|
|
|
17
17
|
return collectClient.getAccountIdForBucket(bucketName);
|
|
18
18
|
}
|
|
19
19
|
else if (arnParts.service === 'apigateway' && arnParts.resourceType === 'restapis') {
|
|
20
|
-
|
|
21
|
-
return collectClient.getAccountIdForRestApi(apiId);
|
|
20
|
+
return collectClient.getAccountIdForRestApi(resourceArn);
|
|
22
21
|
}
|
|
23
22
|
return undefined;
|
|
24
23
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAGxD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAA+B,EAC/B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;IAClC,IAAI,SAAS,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAGxD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAA+B,EAC/B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;IAClC,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,OAAO,aAAa,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAA;IACxD,CAAC;SAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QACrF,OAAO,aAAa,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAA+B,EAC/B,WAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,WAAW,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAA+B,EAC/B,WAAmB;IAEnB,2CAA2C;IAC3C,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,WAAW,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAC1F,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IACrF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,gEAAgE;IAChE,OAAO,SAAS,CAAA;AAClB,CAAC"}
|