@cloud-copilot/iam-lens 0.1.6 → 0.1.8

package/dist/cjs/utils/arn.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Arn = void 0;
+const iam_utils_1 = require("@cloud-copilot/iam-utils");
+class Arn {
+    arn;
+    parts;
+    constructor(arn) {
+        this.arn = arn;
+        this.parts = (0, iam_utils_1.splitArnParts)(arn);
+    }
+    get service() {
+        return this.parts.service;
+    }
+    get partition() {
+        return this.parts.partition;
+    }
+    get region() {
+        return this.parts.region;
+    }
+    get accountId() {
+        return this.parts.accountId;
+    }
+    get resourceType() {
+        return this.parts.resourceType;
+    }
+    get resourcePath() {
+        return this.parts.resourcePath;
+    }
+    get resource() {
+        return this.parts.resource || '';
+    }
+    get value() {
+        return this.arn;
+    }
+    /**
+     * Check
+     *
+     * @param parts
+     * @returns
+     */
+    matches(parts) {
+        return Object.entries(parts).every(([key, value]) => {
+            return this.parts[key] === value;
+        });
+    }
+}
+exports.Arn = Arn;
+//# sourceMappingURL=arn.js.map

package/dist/cjs/utils/arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.js","sourceRoot":"","sources":["../../../src/utils/arn.ts"],"names":[],"mappings":";;;AAAA,wDAAkE;AAElE,MAAa,GAAG;IAGe;IAFZ,KAAK,CAAU;IAEhC,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;QACtC,IAAI,CAAC,KAAK,GAAG,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,OAAQ,CAAA;IAC5B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,SAAU,CAAA;IAC9B,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA;IAC1B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAA;IAC7B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAA;IAChC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAA;IAChC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAA;IAClC,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAwB;QAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAqB,CAAC,KAAK,KAAK,CAAA;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAlDD,kBAkDC"}

package/dist/cjs/utils/packageVersion.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Get the version of the package
+ */
+export declare function iamLensVersion(): Promise<string>;
+//# sourceMappingURL=packageVersion.d.ts.map

package/dist/cjs/utils/packageVersion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageVersion.d.ts","sourceRoot":"","sources":["../../../src/utils/packageVersion.ts"],"names":[],"mappings":"AAqBA;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAGtD"}

package/dist/cjs/utils/packageVersion.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.iamLensVersion = iamLensVersion;
+const readPackageFile_js_1 = require("./readPackageFile.js");
+let packageCache = undefined;
+/**
+ * Get the package data version
+ *
+ * @returns the package data version
+ */
+async function getPackageData() {
+    if (!packageCache) {
+        const packageJson = await (0, readPackageFile_js_1.readPackageFile)(['package.json']);
+        packageCache = JSON.parse(packageJson);
+    }
+    return packageCache;
+}
+/**
+ * Get the version of the package
+ */
+async function iamLensVersion() {
+    const data = await getPackageData();
+    return data.version;
+}
+//# sourceMappingURL=packageVersion.js.map

package/dist/cjs/utils/packageVersion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageVersion.js","sourceRoot":"","sources":["../../../src/utils/packageVersion.ts"],"names":[],"mappings":";;AAwBA,wCAGC;AA3BD,6DAAsD;AAMtD,IAAI,YAAY,GAA4B,SAAS,CAAA;AAErD;;;;GAIG;AACH,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,MAAM,IAAA,oCAAe,EAAC,CAAC,cAAc,CAAC,CAAC,CAAA;QAC3D,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,YAAa,CAAA;AACtB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,cAAc;IAClC,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAA;IACnC,OAAO,IAAI,CAAC,OAAO,CAAA;AACrB,CAAC"}

package/dist/cjs/utils/readPackageFile.d.ts

@@ -0,0 +1,2 @@
+export declare function readPackageFile(pathParts: string[]): Promise<string>;
+//# sourceMappingURL=readPackageFile.d.ts.map

package/dist/cjs/utils/readPackageFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readPackageFile.d.ts","sourceRoot":"","sources":["../../../src/utils/readPackageFile.ts"],"names":[],"mappings":"AAOA,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1E"}

package/dist/cjs/utils/readPackageFile.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPackageFile = readPackageFile;
+const cli_1 = require("@cloud-copilot/cli");
+let levels = 3;
+if (__filename.includes('src')) {
+    levels = 2;
+}
+async function readPackageFile(pathParts) {
+    const packageFile = await (0, cli_1.readRelativeFile)(__filename, levels, pathParts);
+    return packageFile;
+}
+//# sourceMappingURL=readPackageFile.js.map

package/dist/cjs/utils/readPackageFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readPackageFile.js","sourceRoot":"","sources":["../../../src/utils/readPackageFile.ts"],"names":[],"mappings":";;AAOA,0CAGC;AAVD,4CAAqD;AAErD,IAAI,MAAM,GAAG,CAAC,CAAA;AACd,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/B,MAAM,GAAG,CAAC,CAAA;AACZ,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,SAAmB;IACvD,MAAM,WAAW,GAAG,MAAM,IAAA,sBAAgB,EAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IACzE,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/cjs/utils/sts.d.ts

@@ -0,0 +1,2 @@
+export declare const AssumeRoleActions: Set<string>;
+//# sourceMappingURL=sts.d.ts.map

package/dist/cjs/utils/sts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts.d.ts","sourceRoot":"","sources":["../../../src/utils/sts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,aAI5B,CAAA"}

package/dist/cjs/utils/sts.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AssumeRoleActions = void 0;
+exports.AssumeRoleActions = new Set([
+    'sts:assumerole',
+    'sts:assumerolewithwebidentity',
+    'sts:assumerolewithsaml'
+]);
+//# sourceMappingURL=sts.js.map

package/dist/cjs/utils/sts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts.js","sourceRoot":"","sources":["../../../src/utils/sts.ts"],"names":[],"mappings":";;;AAAa,QAAA,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,gBAAgB;IAChB,+BAA+B;IAC/B,wBAAwB;CACzB,CAAC,CAAA"}

package/dist/cjs/whoCan/whoCan.d.ts

@@ -0,0 +1,54 @@
+import { ResourceType } from '@cloud-copilot/iam-data';
+import { IamCollectClient } from '../collect/client.js';
+export interface ResourceAccessRequest {
+    resource?: string;
+    resourceAccount?: string;
+    actions: string[];
+}
+export interface WhoCanAllowed {
+    principal: string;
+    service: string;
+    action: string;
+}
+export interface WhoCanResponse {
+    allowed: WhoCanAllowed[];
+    allAccountsChecked: boolean;
+    accountsNotFound: string[];
+    organizationsNotFound: string[];
+    organizationalUnitsNotFound: string[];
+    principalsNotFound: string[];
+}
+export declare function whoCan(collectClient: IamCollectClient, request: ResourceAccessRequest): Promise<WhoCanResponse>;
+export declare function uniqueAccountsToCheck(collectClient: IamCollectClient, accountsToCheck: AccountsToCheck): Promise<{
+    accountsNotFound: string[];
+    organizationsNotFound: string[];
+    organizationalUnitsNotFound: string[];
+    accounts: string[];
+}>;
+export interface AccountsToCheck {
+    allAccounts: boolean;
+    specificAccounts: string[];
+    specificPrincipals: string[];
+    specificOrganizations: string[];
+    specificOrganizationalUnits: string[];
+}
+export declare function accountsToCheckBasedOnResourcePolicy(resourcePolicy: any, resourceAccount: string | undefined): Promise<AccountsToCheck>;
+export declare function actionsForWhoCan(request: ResourceAccessRequest): Promise<string[]>;
+/**
+ * Get the the possible resource types for an action and resource
+ *
+ * @param service the service the action belongs to
+ * @param action the action to get the resource type for
+ * @param resourceArn the resource type matching the action, if any
+ * @throws an error if the service or action does not exist, or if the action is a wildcard only action
+ */
+export declare function lookupActionsForResourceArn(resourceArn: string): Promise<string[]>;
+export declare function findResourceTypeForArn(resourceArn: string): Promise<[string, ResourceType]>;
+/**
+ * Convert a resource pattern from iam-data to a regex pattern
+ *
+ * @param pattern the pattern to convert to a regex
+ * @returns the regex pattern
+ */
+export declare function convertResourcePatternToRegex(pattern: string): string;
+//# sourceMappingURL=whoCan.d.ts.map

package/dist/cjs/whoCan/whoCan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoCan.d.ts","sourceRoot":"","sources":["../../../src/whoCan/whoCan.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,YAAY,EACb,MAAM,yBAAyB,CAAA;AAShC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAMvD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,aAAa,EAAE,CAAA;IACxB,kBAAkB,EAAE,OAAO,CAAA;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrC,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAC7B;AAED,wBAAsB,MAAM,CAC1B,aAAa,EAAE,gBAAgB,EAC/B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CAmGzB;AAkCD,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC;IACT,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,CAAC,CAiDD;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;CACtC;AAED,wBAAsB,oCAAoC,CACxD,cAAc,EAAE,GAAG,EACnB,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC,CA2E1B;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA4BxF;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsBxF;AAED,wBAAsB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAqBjG;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOrE"}

package/dist/cjs/whoCan/whoCan.js

@@ -0,0 +1,320 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.whoCan = whoCan;
+exports.uniqueAccountsToCheck = uniqueAccountsToCheck;
+exports.accountsToCheckBasedOnResourcePolicy = accountsToCheckBasedOnResourcePolicy;
+exports.actionsForWhoCan = actionsForWhoCan;
+exports.lookupActionsForResourceArn = lookupActionsForResourceArn;
+exports.findResourceTypeForArn = findResourceTypeForArn;
+exports.convertResourcePatternToRegex = convertResourcePatternToRegex;
+const iam_data_1 = require("@cloud-copilot/iam-data");
+const iam_policy_1 = require("@cloud-copilot/iam-policy");
+const iam_utils_1 = require("@cloud-copilot/iam-utils");
+const resources_js_1 = require("../resources.js");
+const simulate_js_1 = require("../simulate/simulate.js");
+const arn_js_1 = require("../utils/arn.js");
+const sts_js_1 = require("../utils/sts.js");
+async function whoCan(collectClient, request) {
+    const { resource } = request;
+    if (!request.resourceAccount && !request.resource) {
+        throw new Error('Either resourceAccount or resource must be provided in the request.');
+    }
+    if (resource && !resource.startsWith('arn:')) {
+        throw new Error(`Invalid resource ARN: ${resource}. It must start with 'arn:'.`);
+    }
+    const resourceAccount = request.resourceAccount || (await (0, resources_js_1.getAccountIdForResource)(collectClient, resource));
+    if (!resourceAccount) {
+        throw new Error(`Could not determine account ID for resource ${resource}`);
+    }
+    const actions = await actionsForWhoCan(request);
+    if (!actions || actions.length === 0) {
+        throw new Error('No valid actions provided or found for the resource.');
+    }
+    let resourcePolicy = undefined;
+    if (resource) {
+        resourcePolicy = await (0, resources_js_1.getResourcePolicyForResource)(collectClient, resource);
+        const resourceArn = new arn_js_1.Arn(resource);
+        if ((resourceArn.matches({ service: 'iam', resourceType: 'role' }) ||
+            resourceArn.matches({ service: 'kms', resourceType: 'key' })) &&
+            !resourcePolicy) {
+            throw new Error(`Unable to find resource policy for ${resource}. Cannot determine who can access the resource.`);
+        }
+    }
+    const accountsToCheck = await accountsToCheckBasedOnResourcePolicy(resourcePolicy, resourceAccount);
+    const uniqueAccounts = await uniqueAccountsToCheck(collectClient, accountsToCheck);
+    const whoCanResults = [];
+    for (const account of uniqueAccounts.accounts) {
+        const principals = await collectClient.getAllPrincipalsInAccount(account);
+        for (const principal of principals) {
+            const principalResults = await runPrincipalForActions(collectClient, principal, resource, resourceAccount, actions);
+            whoCanResults.push(...principalResults);
+        }
+    }
+    const principalsNotFound = [];
+    for (const principal of accountsToCheck.specificPrincipals) {
+        if ((0, iam_utils_1.isServicePrincipal)(principal)) {
+            const principalResults = await runPrincipalForActions(collectClient, principal, resource, resourceAccount, actions);
+            whoCanResults.push(...principalResults);
+        }
+        else if ((0, iam_utils_1.isIamUserArn)(principal) || (0, iam_utils_1.isIamRoleArn)(principal) || (0, iam_utils_1.isAssumedRoleArn)(principal)) {
+            const principalExists = await collectClient.principalExists(principal);
+            if (!principalExists) {
+                principalsNotFound.push(principal);
+            }
+            else {
+                const principalResults = await runPrincipalForActions(collectClient, principal, resource, resourceAccount, actions);
+                whoCanResults.push(...principalResults);
+            }
+        }
+        else {
+            principalsNotFound.push(principal);
+        }
+    }
+    return {
+        allowed: whoCanResults,
+        allAccountsChecked: accountsToCheck.allAccounts,
+        accountsNotFound: uniqueAccounts.accountsNotFound,
+        organizationsNotFound: uniqueAccounts.organizationsNotFound,
+        organizationalUnitsNotFound: uniqueAccounts.organizationalUnitsNotFound,
+        principalsNotFound: principalsNotFound
+    };
+}
+async function runPrincipalForActions(collectClient, principal, resource, resourceAccount, actions) {
+    const results = [];
+    for (const action of actions) {
+        const result = await (0, simulate_js_1.simulateRequest)({
+            principal: principal,
+            resourceArn: resource,
+            resourceAccount,
+            action,
+            customContextKeys: {}
+        }, collectClient);
+        if (result.analysis?.result === 'Allowed') {
+            const [service, serviceAction] = action.split(':');
+            results.push({
+                principal,
+                service: service,
+                action: serviceAction
+            });
+        }
+    }
+    return results;
+}
+async function uniqueAccountsToCheck(collectClient, accountsToCheck) {
+    const returnValue = {
+        accountsNotFound: [],
+        organizationsNotFound: [],
+        organizationalUnitsNotFound: [],
+        accounts: []
+    };
+    if (accountsToCheck.allAccounts) {
+        returnValue.accounts = await collectClient.allAccounts();
+        return returnValue;
+    }
+    const uniqueAccounts = new Set();
+    for (const account of accountsToCheck.specificAccounts || []) {
+        const accountExists = await collectClient.accountExists(account);
+        if (accountExists) {
+            uniqueAccounts.add(account);
+        }
+        else {
+            returnValue.accountsNotFound.push(account);
+        }
+    }
+    for (const ouPath of accountsToCheck.specificOrganizationalUnits || []) {
+        const parts = ouPath.split('/');
+        const orgId = parts[0];
+        const pathParts = parts.slice(1);
+        const [found, accounts] = await collectClient.getAccountsForOrgPath(orgId, pathParts);
+        for (const account of accounts) {
+            uniqueAccounts.add(account);
+        }
+        if (!found) {
+            returnValue.organizationalUnitsNotFound.push(ouPath);
+        }
+    }
+    for (const orgId of accountsToCheck.specificOrganizations || []) {
+        const [found, accounts] = await collectClient.getAccountsForOrganization(orgId);
+        for (const account of accounts) {
+            uniqueAccounts.add(account);
+        }
+        if (!found) {
+            returnValue.organizationsNotFound.push(orgId);
+        }
+    }
+    returnValue.accounts = Array.from(uniqueAccounts);
+    return returnValue;
+}
+async function accountsToCheckBasedOnResourcePolicy(resourcePolicy, resourceAccount) {
+    const accountsToCheck = {
+        allAccounts: false,
+        specificAccounts: [],
+        specificPrincipals: [],
+        specificOrganizations: [],
+        specificOrganizationalUnits: []
+    };
+    if (resourceAccount) {
+        accountsToCheck.specificAccounts.push(resourceAccount);
+    }
+    if (!resourcePolicy) {
+        return accountsToCheck;
+    }
+    const policy = (0, iam_policy_1.loadPolicy)(resourcePolicy);
+    for (const statement of policy.statements()) {
+        if (statement.isAllow() && statement.isNotPrincipalStatement()) {
+            accountsToCheck.allAccounts = true;
+        }
+        if (statement.isAllow() && statement.isPrincipalStatement()) {
+            const principals = statement.principals();
+            let hasWildcardPrincipal = false;
+            for (const principal of principals) {
+                if (principal.isWildcardPrincipal()) {
+                    hasWildcardPrincipal = true;
+                }
+                else if (principal.isAccountPrincipal()) {
+                    accountsToCheck.specificAccounts.push(principal.accountId());
+                }
+                else {
+                    accountsToCheck.specificPrincipals.push(principal.value());
+                }
+            }
+            if (hasWildcardPrincipal) {
+                const specificOrgs = [];
+                const specificOus = [];
+                const specificAccounts = [];
+                const conditions = statement.conditions();
+                for (const cond of conditions) {
+                    if (cond.conditionKey().toLowerCase() === 'aws:principalorgid' &&
+                        cond.operation().value().toLowerCase().startsWith('stringequals') &&
+                        !cond.conditionValues().some((v) => v.includes('$')) // Ignore dynamic values for now
+                    ) {
+                        specificOrgs.push(...cond.conditionValues());
+                    }
+                    if (cond.conditionKey().toLowerCase() === 'aws:principalorgpaths' &&
+                        cond.operation().baseOperator().toLowerCase().startsWith('stringequals') &&
+                        !cond.conditionValues().some((v) => v.includes('$')) // Ignore dynamic values for now
+                    ) {
+                        specificOus.push(...cond.conditionValues());
+                    }
+                    if (cond.conditionKey().toLowerCase() === 'aws:principalaccount' &&
+                        cond.operation().value().toLowerCase().startsWith('stringequals') &&
+                        !cond.conditionValues().some((v) => v.includes('$')) // Ignore dynamic values for now
+                    ) {
+                        specificAccounts.push(...cond.conditionValues());
+                    }
+                }
+                if (specificAccounts.length > 0) {
+                    accountsToCheck.specificAccounts.push(...specificAccounts);
+                }
+                else if (specificOus.length > 0) {
+                    accountsToCheck.specificOrganizationalUnits.push(...specificOus);
+                }
+                else if (specificOrgs.length > 0) {
+                    accountsToCheck.specificOrganizations.push(...specificOrgs);
+                }
+                else {
+                    accountsToCheck.allAccounts = true;
+                }
+            }
+        }
+    }
+    return accountsToCheck;
+}
+async function actionsForWhoCan(request) {
+    const { actions } = request;
+    if (actions && actions.length > 0) {
+        const validActions = [];
+        for (const action of actions) {
+            const parts = action.split(':');
+            if (parts.length !== 2) {
+                continue;
+            }
+            const [service, actionName] = parts;
+            const serviceExists = await (0, iam_data_1.iamServiceExists)(service);
+            if (!serviceExists) {
+                continue;
+            }
+            const actionExists = await (0, iam_data_1.iamActionExists)(service, actionName);
+            if (!actionExists) {
+                continue;
+            }
+            validActions.push(action);
+        }
+        return validActions;
+    }
+    if (!request.resource) {
+        return [];
+    }
+    return lookupActionsForResourceArn(request.resource);
+}
+/**
+ * Get the the possible resource types for an action and resource
+ *
+ * @param service the service the action belongs to
+ * @param action the action to get the resource type for
+ * @param resourceArn the resource type matching the action, if any
+ * @throws an error if the service or action does not exist, or if the action is a wildcard only action
+ */
+async function lookupActionsForResourceArn(resourceArn) {
+    const [service, resourceType] = await findResourceTypeForArn(resourceArn);
+    const resourceTypeKey = resourceType.key;
+    const selectedActions = [];
+    const serviceActions = await (0, iam_data_1.iamActionsForService)(service);
+    for (const action of serviceActions) {
+        const actionDetails = await (0, iam_data_1.iamActionDetails)(service, action);
+        for (const rt of actionDetails.resourceTypes) {
+            if (rt.name == resourceTypeKey) {
+                selectedActions.push(`${service}:${action}`);
+                break; // No need to check other resource types for this action
+            }
+        }
+    }
+    const isRole = new arn_js_1.Arn(resourceArn).matches({ service: 'iam', resourceType: 'role' });
+    if (isRole) {
+        selectedActions.push(...sts_js_1.AssumeRoleActions.values());
+    }
+    return selectedActions;
+}
+async function findResourceTypeForArn(resourceArn) {
+    const arnParts = (0, iam_utils_1.splitArnParts)(resourceArn);
+    const service = arnParts.service.toLowerCase();
+    const serviceExists = await (0, iam_data_1.iamServiceExists)(service);
+    if (!serviceExists) {
+        throw new Error(`Unable to find service ${service} for resource ${resourceArn}`);
+    }
+    const sortedResourceTypes = await allResourceTypesByArnLength(service);
+    for (const rt of sortedResourceTypes) {
+        const pattern = convertResourcePatternToRegex(rt.arn);
+        const match = resourceArn.match(new RegExp(pattern));
+        if (match) {
+            return [service, rt];
+        }
+    }
+    throw new Error(`Unable to find resource type for service ${service} and resource ${resourceArn}.`);
+}
+/**
+ * Convert a resource pattern from iam-data to a regex pattern
+ *
+ * @param pattern the pattern to convert to a regex
+ * @returns the regex pattern
+ */
+function convertResourcePatternToRegex(pattern) {
+    const regex = pattern.replace(/\$\{.*?\}/g, (match, position) => {
+        const name = match.substring(2, match.length - 1);
+        const camelName = name.at(0)?.toLowerCase() + name.substring(1);
+        return `(?<${camelName}>(.+?))`;
+    });
+    return `^${regex}$`;
+}
+async function allResourceTypesByArnLength(service) {
+    const resourceTypeKeys = await (0, iam_data_1.iamResourceTypesForService)(service);
+    const sortedResourceTypes = [];
+    for (const key of resourceTypeKeys) {
+        const details = await (0, iam_data_1.iamResourceTypeDetails)(service, key);
+        sortedResourceTypes.push(details);
+    }
+    return sortedResourceTypes.sort((a, b) => {
+        return b.arn.length - a.arn.length;
+    });
+}
+//# sourceMappingURL=whoCan.js.map

package/dist/cjs/whoCan/whoCan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoCan.js","sourceRoot":"","sources":["../../../src/whoCan/whoCan.ts"],"names":[],"mappings":";;AA4CA,wBAsGC;AAkCD,sDAyDC;AAUD,oFA8EC;AAED,4CA4BC;AAUD,kEAsBC;AAED,wDAqBC;AAQD,sEAOC;AAzaD,sDAQgC;AAChC,0DAAsD;AACtD,wDAMiC;AAEjC,kDAAuF;AACvF,yDAAyD;AACzD,4CAAqC;AACrC,4CAAmD;AAuB5C,KAAK,UAAU,MAAM,CAC1B,aAA+B,EAC/B,OAA8B;IAE9B,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAE5B,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;IACxF,CAAC;IAED,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,8BAA8B,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,CAAC,MAAM,IAAA,sCAAuB,EAAC,aAAa,EAAE,QAAS,CAAC,CAAC,CAAA;IAEtF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IAED,IAAI,cAAc,GAAQ,SAAS,CAAA;IACnC,IAAI,QAAQ,EAAE,CAAC;QACb,cAAc,GAAG,MAAM,IAAA,2CAA4B,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAC5E,MAAM,WAAW,GAAG,IAAI,YAAG,CAAC,QAAQ,CAAC,CAAA;QACrC,IACE,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YAC5D,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,CAAC,cAAc,EACf,CAAC;YACD,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,iDAAiD,CAChG,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,oCAAoC,CAChE,cAAc,EACd,eAAe,CAChB,CAAA;IAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IAElF,MAAM,aAAa,GAAoB,EAAE,CAAA;IAEzC,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAA;QACzE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CACnD,aAAa,EACb,SAAS,EACT,QAAQ,EACR,eAAe,EACf,OAAO,CACR,CAAA;YACD,aAAa,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAa,EAAE,CAAA;IACvC,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,kBAAkB,EAAE,CAAC;QAC3D,IAAI,IAAA,8BAAkB,EAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CACnD,aAAa,EACb,SAAS,EACT,QAAQ,EACR,eAAe,EACf,OAAO,CACR,CAAA;YACD,aAAa,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAA;QACzC,CAAC;aAAM,IAAI,IAAA,wBAAY,EAAC,SAAS,CAAC,IAAI,IAAA,wBAAY,EAAC,SAAS,CAAC,IAAI,IAAA,4BAAgB,EAAC,SAAS,CAAC,EAAE,CAAC;YAC7F,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;YACtE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CACnD,aAAa,EACb,SAAS,EACT,QAAQ,EACR,eAAe,EACf,OAAO,CACR,CAAA;gBACD,aAAa,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAA;YACzC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,aAAa;QACtB,kBAAkB,EAAE,eAAe,CAAC,WAAW;QAC/C,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;QACjD,qBAAqB,EAAE,cAAc,CAAC,qBAAqB;QAC3D,2BAA2B,EAAE,cAAc,CAAC,2BAA2B;QACvE,kBAAkB,EAAE,kBAAkB;KACvC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,aAA+B,EAC/B,SAAiB,EACjB,QAA4B,EAC5B,eAAuB,EACvB,OAAiB;IAEjB,MAAM,OAAO,GAAoB,EAAE,CAAA;IACnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAe,EAClC;YACE,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,QAAQ;YACrB,eAAe;YACf,MAAM;YACN,iBAAiB,EAAE,EAAE;SACtB,EACD,aAAa,CACd,CAAA;QACD,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAClD,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS;gBACT,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,aAA+B,EAC/B,eAAgC;IAOhC,MAAM,WAAW,GAAG;QAClB,gBAAgB,EAAE,EAAc;QAChC,qBAAqB,EAAE,EAAc;QACrC,2BAA2B,EAAE,EAAc;QAC3C,QAAQ,EAAE,EAAc;KACzB,CAAA;IAED,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC;QAChC,WAAW,CAAC,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAA;QACxD,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IACxC,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAC7D,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QAChE,IAAI,aAAa,EAAE,CAAC;YAClB,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,eAAe,CAAC,2BAA2B,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAEhC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACrF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,WAAW,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAA;QAC/E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,WAAW,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACjD,OAAO,WAAW,CAAA;AACpB,CAAC;AAUM,KAAK,UAAU,oCAAoC,CACxD,cAAmB,EACnB,eAAmC;IAEnC,MAAM,eAAe,GAAoB;QACvC,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,EAAE;QACpB,kBAAkB,EAAE,EAAE;QACtB,qBAAqB,EAAE,EAAE;QACzB,2BAA2B,EAAE,EAAE;KAChC,CAAA;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,uBAAU,EAAC,cAAc,CAAC,CAAA;IACzC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC;YAC/D,eAAe,CAAC,WAAW,GAAG,IAAI,CAAA;QACpC,CAAC;QACD,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,CAAA;YACzC,IAAI,oBAAoB,GAAG,KAAK,CAAA;YAChC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;oBACpC,oBAAoB,GAAG,IAAI,CAAA;gBAC7B,CAAC;qBAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC;oBAC1C,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAA;gBAC9D,CAAC;qBAAM,CAAC;oBACN,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA;gBAC5D,CAAC;YACH,CAAC;YAED,IAAI,oBAAoB,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,EAAE,CAAA;gBACvB,MAAM,WAAW,GAAG,EAAE,CAAA;gBACtB,MAAM,gBAAgB,GAAG,EAAE,CAAA;gBAE3B,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,CAAA;gBACzC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;oBAC9B,IACE,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,oBAAoB;wBAC1D,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;wBACjE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,gCAAgC;sBAC7F,CAAC;wBACD,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;oBAC9C,CAAC;oBACD,IACE,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,uBAAuB;wBAC7D,IAAI,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;wBACxE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,gCAAgC;sBAC7F,CAAC;wBACD,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;oBAC7C,CAAC;oBACD,IACE,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,sBAAsB;wBAC5D,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;wBACjE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,gCAAgC;sBAC7F,CAAC;wBACD,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;oBAClD,CAAC;gBACH,CAAC;gBACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAA;gBAC5D,CAAC;qBAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,eAAe,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAA;gBAClE,CAAC;qBAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACnC,eAAe,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAA;gBAC7D,CAAC;qBAAM,CAAC;oBACN,eAAe,CAAC,WAAW,GAAG,IAAI,CAAA;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAA;AACxB,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAA8B;IACnE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAA;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,SAAQ;YACV,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,KAAK,CAAA;YACnC,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,CAAC,CAAA;YACrD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,SAAQ;YACV,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,IAAA,0BAAe,EAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YAC/D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAQ;YACV,CAAC;YAED,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3B,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,2BAA2B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IACnE,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAA;IACzE,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAA;IAExC,MAAM,eAAe,GAAa,EAAE,CAAA;IACpC,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7D,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,aAAa,EAAE,CAAC;YAC7C,IAAI,EAAE,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;gBAC/B,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC,CAAA;gBAC5C,MAAK,CAAC,wDAAwD;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,YAAG,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;IACrF,IAAI,MAAM,EAAE,CAAC;QACX,eAAe,CAAC,IAAI,CAAC,GAAG,0BAAiB,CAAC,MAAM,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IAC9D,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAQ,CAAC,WAAW,EAAE,CAAA;IAE/C,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,CAAC,CAAA;IACrD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,iBAAiB,WAAW,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAA;IACtE,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,6BAA6B,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;QACrD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;QACpD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,iBAAiB,WAAW,GAAG,CACnF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,6BAA6B,CAAC,OAAe;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QAC/D,OAAO,MAAM,SAAS,SAAS,CAAA;IACjC,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,KAAK,GAAG,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,OAAe;IACxD,MAAM,gBAAgB,GAAG,MAAM,IAAA,qCAA0B,EAAC,OAAO,CAAC,CAAA;IAClE,MAAM,mBAAmB,GAAmB,EAAE,CAAA;IAC9C,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAsB,EAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/esm/cli.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 import { parseCliArguments } from '@cloud-copilot/cli';
 import { getCollectClient, loadCollectConfigs } from './collect/collect.js';
-import { simulateRequest } from './simulate.js';
+import { resultMatchesExpectation, simulateRequest } from './simulate/simulate.js';
+import { iamLensVersion } from './utils/packageVersion.js';
+import { whoCan } from './whoCan/whoCan.js';
 const main = async () => {
-    // const version = await iamLensVersion()
+    const version = await iamLensVersion();
     const cli = parseCliArguments('iam-lens', {
         simulate: {
             description: 'Simulate an IAM request',
@@ -21,12 +23,12 @@ const main = async () => {
                 resourceAccountId: {
                     type: 'string',
                     values: 'single',
-                    description: 'The account ID of the resource, only required if it cannot be determined from the resource ARN. Ignore for wildcard actions'
+                    description: 'The account ID of the resource, only required if it cannot be determined from the resource ARN.'
                 },
                 action: {
                     type: 'string',
                     values: 'single',
-                    description: 'The action to simulate; must be a valid IAM service and action such as `s3:GetObject`'
+                    description: 'The action to simulate; must be a valid IAM service and action such as `s3:ListBucket`'
                 },
                 context: {
                     type: 'string',
@@ -37,6 +39,32 @@ const main = async () => {
                     type: 'boolean',
                     description: 'Enable verbose output for the simulation',
                     character: 'v'
+                },
+                expect: {
+                    type: 'enum',
+                    values: 'single',
+                    validValues: ['Allowed', 'ImplicitlyDenied', 'ExplicitlyDenied', 'AnyDeny'],
+                    description: 'The expected result of the simulation, if the result does not match the expected response a non-zero exit code will be returned'
+                }
+            }
+        },
+        'who-can': {
+            description: 'Find who can perform an action on a resource',
+            options: {
+                resource: {
+                    type: 'string',
+                    values: 'single',
+                    description: 'The ARN of the resource to check permissions for. Ignore for wildcard actions'
+                },
+                resourceAccount: {
+                    type: 'string',
+                    values: 'single',
+                    description: 'The account ID of the resource, only required if it cannot be determined from the resource ARN. Required for wildcard actions'
+                },
+                actions: {
+                    type: 'string',
+                    values: 'multiple',
+                    description: 'The action to check permissions for; must be a valid IAM service and action such as `s3:GetObject`'
                 }
             }
         }
@@ -54,16 +82,16 @@ const main = async () => {
     }, {
         envPrefix: 'IAM_LENS',
         showHelpIfNoArgs: true,
-        requireSubcommand: true
-        // version: version
+        requireSubcommand: true,
+        version
     });
     if (cli.args.collectConfigs.length === 0) {
         cli.args.collectConfigs.push('./iam-collect.jsonc');
     }
     const thePartition = cli.args.partition || 'aws';
+    const collectConfigs = await loadCollectConfigs(cli.args.collectConfigs);
+    const collectClient = getCollectClient(collectConfigs, thePartition);
     if (cli.subcommand === 'simulate') {
-        const collectConfigs = await loadCollectConfigs(cli.args.collectConfigs);
-        const collectClient = getCollectClient(collectConfigs, thePartition);
         const { principal, resource, resourceAccountId, action, context } = cli.args;
         const contextKeys = convertContextKeysToMap(context);
         const result = await simulateRequest({
@@ -73,10 +101,31 @@ const main = async () => {
             action: action,
             customContextKeys: contextKeys
         }, collectClient);
+        if (result.errors) {
+            console.error('Simulation Errors:');
+            console.log(JSON.stringify(result.errors, null, 2));
+            process.exit(1);
+        }
         console.log(`Simulation Result: ${result.analysis?.result}`);
         if (cli.args.verbose) {
             console.log(JSON.stringify(result, null, 2));
         }
+        if (!resultMatchesExpectation(cli.args.expect, result.analysis?.result)) {
+            process.exit(1);
+        }
+    }
+    else if (cli.subcommand === 'who-can') {
+        const { resource, resourceAccount, actions } = cli.args;
+        if (!resourceAccount && !resource && actions.length === 0) {
+            console.error('Error: At least 1) resource or 2) resource-account and actions must be provided for who-can command');
+            process.exit(1);
+        }
+        const results = await whoCan(collectClient, {
+            resource: cli.args.resource,
+            actions: cli.args.actions,
+            resourceAccount: cli.args.resourceAccount
+        });
+        console.log(JSON.stringify(results, null, 2));
     }
 };
 main()