@cloud-copilot/iam-lens 0.1.6 → 0.1.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (111) hide show
  1. package/README.md +251 -1
  2. package/dist/cjs/cli.js +57 -8
  3. package/dist/cjs/cli.js.map +1 -1
  4. package/dist/cjs/collect/client.d.ts +37 -2
  5. package/dist/cjs/collect/client.d.ts.map +1 -1
  6. package/dist/cjs/collect/client.js +126 -27
  7. package/dist/cjs/collect/client.js.map +1 -1
  8. package/dist/cjs/index.js +0 -1
  9. package/dist/cjs/index.js.map +1 -1
  10. package/dist/cjs/principals.d.ts +0 -5
  11. package/dist/cjs/principals.d.ts.map +1 -1
  12. package/dist/cjs/principals.js +0 -9
  13. package/dist/cjs/principals.js.map +1 -1
  14. package/dist/cjs/resources.js +1 -1
  15. package/dist/cjs/resources.js.map +1 -1
  16. package/dist/cjs/{contextKeys.d.ts → simulate/contextKeys.d.ts} +1 -1
  17. package/dist/cjs/simulate/contextKeys.d.ts.map +1 -0
  18. package/dist/cjs/{contextKeys.js → simulate/contextKeys.js} +1 -1
  19. package/dist/cjs/simulate/contextKeys.js.map +1 -0
  20. package/dist/cjs/{simulate.d.ts → simulate/simulate.d.ts} +4 -2
  21. package/dist/cjs/simulate/simulate.d.ts.map +1 -0
  22. package/dist/cjs/{simulate.js → simulate/simulate.js} +43 -22
  23. package/dist/cjs/simulate/simulate.js.map +1 -0
  24. package/dist/cjs/test-datasets/testClient.d.ts +9 -0
  25. package/dist/cjs/test-datasets/testClient.d.ts.map +1 -0
  26. package/dist/cjs/test-datasets/testClient.js +28 -0
  27. package/dist/cjs/test-datasets/testClient.js.map +1 -0
  28. package/dist/cjs/utils/arn.d.ts +22 -0
  29. package/dist/cjs/utils/arn.d.ts.map +1 -0
  30. package/dist/cjs/utils/arn.js +49 -0
  31. package/dist/cjs/utils/arn.js.map +1 -0
  32. package/dist/cjs/utils/packageVersion.d.ts +5 -0
  33. package/dist/cjs/utils/packageVersion.d.ts.map +1 -0
  34. package/dist/cjs/utils/packageVersion.js +25 -0
  35. package/dist/cjs/utils/packageVersion.js.map +1 -0
  36. package/dist/cjs/utils/readPackageFile.d.ts +2 -0
  37. package/dist/cjs/utils/readPackageFile.d.ts.map +1 -0
  38. package/dist/cjs/utils/readPackageFile.js +13 -0
  39. package/dist/cjs/utils/readPackageFile.js.map +1 -0
  40. package/dist/cjs/utils/sts.d.ts +2 -0
  41. package/dist/cjs/utils/sts.d.ts.map +1 -0
  42. package/dist/cjs/utils/sts.js +9 -0
  43. package/dist/cjs/utils/sts.js.map +1 -0
  44. package/dist/cjs/whoCan/whoCan.d.ts +54 -0
  45. package/dist/cjs/whoCan/whoCan.d.ts.map +1 -0
  46. package/dist/cjs/whoCan/whoCan.js +320 -0
  47. package/dist/cjs/whoCan/whoCan.js.map +1 -0
  48. package/dist/esm/cli.js +57 -8
  49. package/dist/esm/cli.js.map +1 -1
  50. package/dist/esm/collect/client.d.ts +37 -2
  51. package/dist/esm/collect/client.d.ts.map +1 -1
  52. package/dist/esm/collect/client.js +125 -27
  53. package/dist/esm/collect/client.js.map +1 -1
  54. package/dist/esm/index.js +0 -1
  55. package/dist/esm/index.js.map +1 -1
  56. package/dist/esm/principals.d.ts +0 -5
  57. package/dist/esm/principals.d.ts.map +1 -1
  58. package/dist/esm/principals.js +0 -8
  59. package/dist/esm/principals.js.map +1 -1
  60. package/dist/esm/resources.js +1 -1
  61. package/dist/esm/resources.js.map +1 -1
  62. package/dist/esm/{contextKeys.d.ts → simulate/contextKeys.d.ts} +1 -1
  63. package/dist/esm/simulate/contextKeys.d.ts.map +1 -0
  64. package/dist/esm/{contextKeys.js → simulate/contextKeys.js} +1 -1
  65. package/dist/esm/simulate/contextKeys.js.map +1 -0
  66. package/dist/esm/{simulate.d.ts → simulate/simulate.d.ts} +4 -2
  67. package/dist/esm/simulate/simulate.d.ts.map +1 -0
  68. package/dist/esm/{simulate.js → simulate/simulate.js} +44 -24
  69. package/dist/esm/simulate/simulate.js.map +1 -0
  70. package/dist/esm/test-datasets/testClient.d.ts +9 -0
  71. package/dist/esm/test-datasets/testClient.d.ts.map +1 -0
  72. package/dist/esm/test-datasets/testClient.js +25 -0
  73. package/dist/esm/test-datasets/testClient.js.map +1 -0
  74. package/dist/esm/utils/arn.d.ts +22 -0
  75. package/dist/esm/utils/arn.d.ts.map +1 -0
  76. package/dist/esm/utils/arn.js +43 -0
  77. package/dist/esm/utils/arn.js.map +1 -0
  78. package/dist/esm/utils/packageVersion.d.ts +5 -0
  79. package/dist/esm/utils/packageVersion.d.ts.map +1 -0
  80. package/dist/esm/utils/packageVersion.js +22 -0
  81. package/dist/esm/utils/packageVersion.js.map +1 -0
  82. package/dist/esm/utils/readPackageFile.d.ts +2 -0
  83. package/dist/esm/utils/readPackageFile.d.ts.map +1 -0
  84. package/dist/esm/utils/readPackageFile.js +12 -0
  85. package/dist/esm/utils/readPackageFile.js.map +1 -0
  86. package/dist/esm/utils/readPackageFileEsm.d.ts.map +1 -0
  87. package/dist/esm/utils/sts.d.ts +2 -0
  88. package/dist/esm/utils/sts.d.ts.map +1 -0
  89. package/dist/esm/utils/sts.js +6 -0
  90. package/dist/esm/utils/sts.js.map +1 -0
  91. package/dist/esm/whoCan/whoCan.d.ts +54 -0
  92. package/dist/esm/whoCan/whoCan.d.ts.map +1 -0
  93. package/dist/esm/whoCan/whoCan.js +311 -0
  94. package/dist/esm/whoCan/whoCan.js.map +1 -0
  95. package/package.json +1 -1
  96. package/dist/cjs/accounts.d.ts +0 -3
  97. package/dist/cjs/accounts.d.ts.map +0 -1
  98. package/dist/cjs/accounts.js +0 -8
  99. package/dist/cjs/accounts.js.map +0 -1
  100. package/dist/cjs/contextKeys.d.ts.map +0 -1
  101. package/dist/cjs/contextKeys.js.map +0 -1
  102. package/dist/cjs/simulate.d.ts.map +0 -1
  103. package/dist/cjs/simulate.js.map +0 -1
  104. package/dist/esm/accounts.d.ts +0 -3
  105. package/dist/esm/accounts.d.ts.map +0 -1
  106. package/dist/esm/accounts.js +0 -5
  107. package/dist/esm/accounts.js.map +0 -1
  108. package/dist/esm/contextKeys.d.ts.map +0 -1
  109. package/dist/esm/contextKeys.js.map +0 -1
  110. package/dist/esm/simulate.d.ts.map +0 -1
  111. package/dist/esm/simulate.js.map +0 -1
@@ -0,0 +1 @@
1
+ {"version":3,"file":"simulate.js","sourceRoot":"","sources":["../../../src/simulate/simulate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC7F,OAAO,EAAoB,aAAa,EAAc,MAAM,6BAA6B,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAEtE,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EAEpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC7B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAe,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAWjE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,iBAAoC,EACpC,aAA+B;IAE/B,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IACpC,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACrD,MAAM,YAAY,GAAG,aAAa,IAAI,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAA;IACrF,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,qCAAqC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAEpE,mFAAmF;IACnF,IAAI,aAAa,CAAC,cAAc,EAAE,CAAC;QACjC,iBAAiB,CAAC,eAAe,GAAG,aAAa,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,SAAU,CAAA;IAC3F,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,eAAe,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAA;IACH,CAAC;IACD,iBAAiB,CAAC,eAAe;QAC/B,iBAAiB,CAAC,eAAe;YACjC,CAAC,MAAM,uBAAuB,CAAC,aAAa,EAAE,iBAAiB,CAAC,WAAY,CAAC,CAAC,CAAA;IAEhF,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,0CAA0C,iBAAiB,CAAC,WAAW,EAAE,CAAC,CAAA;IAC5F,CAAC;IAED,+BAA+B;IAC/B,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CACxD,aAAa,EACb,iBAAiB,CAAC,SAAS,CAC5B,CAAA;IAED,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,MAAM,mBAAmB,CAChE,aAAa,EACb,iBAAiB,CAAC,WAAW,CAC9B,CAAA;IAED,MAAM,iBAAiB,GACrB,iBAAiB,CAAC,WAAW;QAC7B,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAA;IAEnF,IAAI,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CACb,uCAAuC,iBAAiB,CAAC,WAAW,mDAAmD,CACxH,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,aAAa,EACb,iBAAiB,EACjB,iBAAiB,CAAC,iBAAiB,CACpC,CAAA;IAED,MAAM,cAAc,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,SAAS,CAAC;QACrE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAA;IAE1B,MAAM,UAAU,GAAe;QAC7B,OAAO,EAAE;YACP,MAAM,EAAE,iBAAiB,CAAC,MAAM;YAChC,QAAQ,EAAE;gBACR,QAAQ,EAAE,iBAAiB,CAAC,WAAW,IAAI,GAAG;gBAC9C,SAAS,EAAE,iBAAiB,CAAC,eAAe;aAC7C;YACD,SAAS,EAAE,iBAAiB,CAAC,SAAS;YACtC,gBAAgB,EAAE,OAAO;SAC1B;QACD,gBAAgB,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC;QACzF,sBAAsB,EAAE,cAAc;QACtC,uBAAuB,EAAE,cAAc,CACrC,iBAAiB,CAAC,SAAS,EAC3B,aAAa,CAAC,cAAc,EAC5B,YAAY,EACZ,iBAAiB,CAAC,IAAI,CACvB;QACD,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QAC9D,0BAA0B,EAAE,yBAAyB,CAAC,iBAAiB,CAAC;KACzE,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAElD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,aAA+B,EAC/B,WAA+B;IAK/B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA;IACxD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,4BAA4B,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACrF,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAEzE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAA;AACzC,CAAC;AAED,SAAS,cAAc,CACrB,YAAoB,EACpB,gBAAyB,EACzB,YAAqC,EACrC,aAAsC;IAEtC,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,OAAO,GAAG,YAAY,CAAA;IAE1B,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,GAAG,aAAa,CAAA;IACzB,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,GAAG,CAAC,aAAa,CAAA;QACjB,OAAO;YACL,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;gBACvC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;YAChE,CAAC,CAAC;SACH,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,YAAoB,EACpB,iBAAoC;IAEpC,iCAAiC;IACjC,MAAM,sBAAsB,GAAkD,EAAE,CAAA;IAChF,iBAAiB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACnD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;gBACnC,IAAI,EAAE,MAAM,CAAC,GAAG;gBAChB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QACvD,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC7C,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;oBACnC,IAAI,EAAE,MAAM,CAAC,GAAG;oBAChB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAA;IAE9D,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAClD,gBAAgB,CAAC,IAAI,CAAC;YACpB,IAAI,EAAE,GAAG,YAAY,IAAI,MAAM,CAAC,IAAI,EAAE;YACtC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QACvD,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC5C,gBAAgB,CAAC,IAAI,CAAC;gBACpB,IAAI,EAAE,GAAG,WAAW,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE;gBAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED,SAAS,yBAAyB,CAChC,iBAAoC;IAEpC,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QACzC,OAAO;YACL;gBACE,IAAI,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,GAAG;gBAC9C,MAAM,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,MAAM;aACpD;SACF,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAkD,EAClD,MAAwB;IAExB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,QAAQ,KAAK,MAAM,CAAA;AAC5B,CAAC"}
@@ -0,0 +1,9 @@
1
+ import { IamCollectClient } from '../collect/client.js';
2
+ /**
3
+ * Get an IAMCollectClient for a test database
4
+ *
5
+ * @param dataSetId the ID of the test dataset to use
6
+ * @returns IamCollectClient instance configured for the specified dataset
7
+ */
8
+ export declare function getTestDatasetClient(dataSetId: string): IamCollectClient;
9
+ //# sourceMappingURL=testClient.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"testClient.d.ts","sourceRoot":"","sources":["../../../src/test-datasets/testClient.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAGvD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAoBxE"}
@@ -0,0 +1,25 @@
1
+ import { existsSync } from 'fs';
2
+ import { join, resolve } from 'path';
3
+ import { getCollectClient } from '../collect/collect.js';
4
+ /**
5
+ * Get an IAMCollectClient for a test database
6
+ *
7
+ * @param dataSetId the ID of the test dataset to use
8
+ * @returns IamCollectClient instance configured for the specified dataset
9
+ */
10
+ export function getTestDatasetClient(dataSetId) {
11
+ const path = resolve(join('./src', 'test-datasets', `iam-data-${dataSetId}`));
12
+ if (!existsSync(path)) {
13
+ throw new Error(`Test dataset with ID ${dataSetId} does not exist at path ${path}. Someone messed up.`);
14
+ }
15
+ return getCollectClient([
16
+ {
17
+ iamCollectVersion: '0.0.0',
18
+ storage: {
19
+ type: 'file',
20
+ path: resolve(join('./src', 'test-datasets', `iam-data-${dataSetId}`))
21
+ }
22
+ }
23
+ ], 'aws');
24
+ }
25
+ //# sourceMappingURL=testClient.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"testClient.js","sourceRoot":"","sources":["../../../src/test-datasets/testClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC,CAAA;IAC7E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,wBAAwB,SAAS,2BAA2B,IAAI,sBAAsB,CACvF,CAAA;IACH,CAAC;IAED,OAAO,gBAAgB,CACrB;QACE;YACE,iBAAiB,EAAE,OAAO;YAC1B,OAAO,EAAE;gBACP,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;aACvE;SACF;KACF,EACD,KAAK,CACN,CAAA;AACH,CAAC"}
@@ -0,0 +1,22 @@
1
+ import { ArnParts } from '@cloud-copilot/iam-utils';
2
+ export declare class Arn {
3
+ private readonly arn;
4
+ private readonly parts;
5
+ constructor(arn: string);
6
+ get service(): string;
7
+ get partition(): string;
8
+ get region(): string | undefined;
9
+ get accountId(): string | undefined;
10
+ get resourceType(): string | undefined;
11
+ get resourcePath(): string | undefined;
12
+ get resource(): string;
13
+ get value(): string;
14
+ /**
15
+ * Check
16
+ *
17
+ * @param parts
18
+ * @returns
19
+ */
20
+ matches(parts: Partial<ArnParts>): boolean;
21
+ }
22
+ //# sourceMappingURL=arn.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"arn.d.ts","sourceRoot":"","sources":["../../../src/utils/arn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAiB,MAAM,0BAA0B,CAAA;AAElE,qBAAa,GAAG;IAGF,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAU;gBAEH,GAAG,EAAE,MAAM;IAIxC,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAED,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAErC;IAED,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAErC;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,IAAI,KAAK,IAAI,MAAM,CAElB;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO;CAK3C"}
@@ -0,0 +1,43 @@
1
+ import { splitArnParts } from '@cloud-copilot/iam-utils';
2
+ export class Arn {
3
+ constructor(arn) {
4
+ this.arn = arn;
5
+ this.parts = splitArnParts(arn);
6
+ }
7
+ get service() {
8
+ return this.parts.service;
9
+ }
10
+ get partition() {
11
+ return this.parts.partition;
12
+ }
13
+ get region() {
14
+ return this.parts.region;
15
+ }
16
+ get accountId() {
17
+ return this.parts.accountId;
18
+ }
19
+ get resourceType() {
20
+ return this.parts.resourceType;
21
+ }
22
+ get resourcePath() {
23
+ return this.parts.resourcePath;
24
+ }
25
+ get resource() {
26
+ return this.parts.resource || '';
27
+ }
28
+ get value() {
29
+ return this.arn;
30
+ }
31
+ /**
32
+ * Check
33
+ *
34
+ * @param parts
35
+ * @returns
36
+ */
37
+ matches(parts) {
38
+ return Object.entries(parts).every(([key, value]) => {
39
+ return this.parts[key] === value;
40
+ });
41
+ }
42
+ }
43
+ //# sourceMappingURL=arn.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"arn.js","sourceRoot":"","sources":["../../../src/utils/arn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAElE,MAAM,OAAO,GAAG;IAGd,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;QACtC,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,OAAQ,CAAA;IAC5B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,SAAU,CAAA;IAC9B,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA;IAC1B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAA;IAC7B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAA;IAChC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAA;IAChC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAA;IAClC,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAwB;QAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAqB,CAAC,KAAK,KAAK,CAAA;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}
@@ -0,0 +1,5 @@
1
+ /**
2
+ * Get the version of the package
3
+ */
4
+ export declare function iamLensVersion(): Promise<string>;
5
+ //# sourceMappingURL=packageVersion.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"packageVersion.d.ts","sourceRoot":"","sources":["../../../src/utils/packageVersion.ts"],"names":[],"mappings":"AAqBA;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAGtD"}
@@ -0,0 +1,22 @@
1
+ import { readPackageFile } from './readPackageFile.js';
2
+ let packageCache = undefined;
3
+ /**
4
+ * Get the package data version
5
+ *
6
+ * @returns the package data version
7
+ */
8
+ async function getPackageData() {
9
+ if (!packageCache) {
10
+ const packageJson = await readPackageFile(['package.json']);
11
+ packageCache = JSON.parse(packageJson);
12
+ }
13
+ return packageCache;
14
+ }
15
+ /**
16
+ * Get the version of the package
17
+ */
18
+ export async function iamLensVersion() {
19
+ const data = await getPackageData();
20
+ return data.version;
21
+ }
22
+ //# sourceMappingURL=packageVersion.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"packageVersion.js","sourceRoot":"","sources":["../../../src/utils/packageVersion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAMtD,IAAI,YAAY,GAA4B,SAAS,CAAA;AAErD;;;;GAIG;AACH,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,CAAC,cAAc,CAAC,CAAC,CAAA;QAC3D,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,YAAa,CAAA;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAA;IACnC,OAAO,IAAI,CAAC,OAAO,CAAA;AACrB,CAAC"}
@@ -0,0 +1,2 @@
1
+ export declare function readPackageFile(pathParts: string[]): Promise<string>;
2
+ //# sourceMappingURL=readPackageFileEsm.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"readPackageFile.d.ts","sourceRoot":"","sources":["../../../src/utils/readPackageFile.ts"],"names":[],"mappings":"AAOA,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1E"}
@@ -0,0 +1,12 @@
1
+ import { readRelativeFile } from '@cloud-copilot/cli';
2
+ let levels = 3;
3
+ //@ts-ignore
4
+ if (import.meta.url.includes('src')) {
5
+ levels = 2;
6
+ }
7
+ export async function readPackageFile(pathParts) {
8
+ //@ts-ignore
9
+ const packageFile = await readRelativeFile(import.meta.url, levels, pathParts);
10
+ return packageFile;
11
+ }
12
+ //# sourceMappingURL=readPackageFileEsm.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"readPackageFileEsm.js","sourceRoot":"","sources":["../../../src/utils/readPackageFileEsm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAErD,IAAI,MAAM,GAAG,CAAC,CAAA;AACd,YAAY;AACZ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACpC,MAAM,GAAG,CAAC,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAmB;IACvD,YAAY;IACZ,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IAC9E,OAAO,WAAW,CAAA;AACpB,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"readPackageFileEsm.d.ts","sourceRoot":"","sources":["../../../src/utils/readPackageFileEsm.ts"],"names":[],"mappings":"AAQA,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1E"}
@@ -0,0 +1,2 @@
1
+ export declare const AssumeRoleActions: Set<string>;
2
+ //# sourceMappingURL=sts.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sts.d.ts","sourceRoot":"","sources":["../../../src/utils/sts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,aAI5B,CAAA"}
@@ -0,0 +1,6 @@
1
+ export const AssumeRoleActions = new Set([
2
+ 'sts:assumerole',
3
+ 'sts:assumerolewithwebidentity',
4
+ 'sts:assumerolewithsaml'
5
+ ]);
6
+ //# sourceMappingURL=sts.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sts.js","sourceRoot":"","sources":["../../../src/utils/sts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,gBAAgB;IAChB,+BAA+B;IAC/B,wBAAwB;CACzB,CAAC,CAAA"}
@@ -0,0 +1,54 @@
1
+ import { ResourceType } from '@cloud-copilot/iam-data';
2
+ import { IamCollectClient } from '../collect/client.js';
3
+ export interface ResourceAccessRequest {
4
+ resource?: string;
5
+ resourceAccount?: string;
6
+ actions: string[];
7
+ }
8
+ export interface WhoCanAllowed {
9
+ principal: string;
10
+ service: string;
11
+ action: string;
12
+ }
13
+ export interface WhoCanResponse {
14
+ allowed: WhoCanAllowed[];
15
+ allAccountsChecked: boolean;
16
+ accountsNotFound: string[];
17
+ organizationsNotFound: string[];
18
+ organizationalUnitsNotFound: string[];
19
+ principalsNotFound: string[];
20
+ }
21
+ export declare function whoCan(collectClient: IamCollectClient, request: ResourceAccessRequest): Promise<WhoCanResponse>;
22
+ export declare function uniqueAccountsToCheck(collectClient: IamCollectClient, accountsToCheck: AccountsToCheck): Promise<{
23
+ accountsNotFound: string[];
24
+ organizationsNotFound: string[];
25
+ organizationalUnitsNotFound: string[];
26
+ accounts: string[];
27
+ }>;
28
+ export interface AccountsToCheck {
29
+ allAccounts: boolean;
30
+ specificAccounts: string[];
31
+ specificPrincipals: string[];
32
+ specificOrganizations: string[];
33
+ specificOrganizationalUnits: string[];
34
+ }
35
+ export declare function accountsToCheckBasedOnResourcePolicy(resourcePolicy: any, resourceAccount: string | undefined): Promise<AccountsToCheck>;
36
+ export declare function actionsForWhoCan(request: ResourceAccessRequest): Promise<string[]>;
37
+ /**
38
+ * Get the the possible resource types for an action and resource
39
+ *
40
+ * @param service the service the action belongs to
41
+ * @param action the action to get the resource type for
42
+ * @param resourceArn the resource type matching the action, if any
43
+ * @throws an error if the service or action does not exist, or if the action is a wildcard only action
44
+ */
45
+ export declare function lookupActionsForResourceArn(resourceArn: string): Promise<string[]>;
46
+ export declare function findResourceTypeForArn(resourceArn: string): Promise<[string, ResourceType]>;
47
+ /**
48
+ * Convert a resource pattern from iam-data to a regex pattern
49
+ *
50
+ * @param pattern the pattern to convert to a regex
51
+ * @returns the regex pattern
52
+ */
53
+ export declare function convertResourcePatternToRegex(pattern: string): string;
54
+ //# sourceMappingURL=whoCan.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"whoCan.d.ts","sourceRoot":"","sources":["../../../src/whoCan/whoCan.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,YAAY,EACb,MAAM,yBAAyB,CAAA;AAShC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAMvD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,aAAa,EAAE,CAAA;IACxB,kBAAkB,EAAE,OAAO,CAAA;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrC,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAC7B;AAED,wBAAsB,MAAM,CAC1B,aAAa,EAAE,gBAAgB,EAC/B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CAmGzB;AAkCD,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC;IACT,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,CAAC,CAiDD;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;CACtC;AAED,wBAAsB,oCAAoC,CACxD,cAAc,EAAE,GAAG,EACnB,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC,CA2E1B;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA4BxF;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsBxF;AAED,wBAAsB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAqBjG;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOrE"}
@@ -0,0 +1,311 @@
1
+ import { iamActionDetails, iamActionExists, iamActionsForService, iamResourceTypeDetails, iamResourceTypesForService, iamServiceExists } from '@cloud-copilot/iam-data';
2
+ import { loadPolicy } from '@cloud-copilot/iam-policy';
3
+ import { isAssumedRoleArn, isIamRoleArn, isIamUserArn, isServicePrincipal, splitArnParts } from '@cloud-copilot/iam-utils';
4
+ import { getAccountIdForResource, getResourcePolicyForResource } from '../resources.js';
5
+ import { simulateRequest } from '../simulate/simulate.js';
6
+ import { Arn } from '../utils/arn.js';
7
+ import { AssumeRoleActions } from '../utils/sts.js';
8
+ export async function whoCan(collectClient, request) {
9
+ const { resource } = request;
10
+ if (!request.resourceAccount && !request.resource) {
11
+ throw new Error('Either resourceAccount or resource must be provided in the request.');
12
+ }
13
+ if (resource && !resource.startsWith('arn:')) {
14
+ throw new Error(`Invalid resource ARN: ${resource}. It must start with 'arn:'.`);
15
+ }
16
+ const resourceAccount = request.resourceAccount || (await getAccountIdForResource(collectClient, resource));
17
+ if (!resourceAccount) {
18
+ throw new Error(`Could not determine account ID for resource ${resource}`);
19
+ }
20
+ const actions = await actionsForWhoCan(request);
21
+ if (!actions || actions.length === 0) {
22
+ throw new Error('No valid actions provided or found for the resource.');
23
+ }
24
+ let resourcePolicy = undefined;
25
+ if (resource) {
26
+ resourcePolicy = await getResourcePolicyForResource(collectClient, resource);
27
+ const resourceArn = new Arn(resource);
28
+ if ((resourceArn.matches({ service: 'iam', resourceType: 'role' }) ||
29
+ resourceArn.matches({ service: 'kms', resourceType: 'key' })) &&
30
+ !resourcePolicy) {
31
+ throw new Error(`Unable to find resource policy for ${resource}. Cannot determine who can access the resource.`);
32
+ }
33
+ }
34
+ const accountsToCheck = await accountsToCheckBasedOnResourcePolicy(resourcePolicy, resourceAccount);
35
+ const uniqueAccounts = await uniqueAccountsToCheck(collectClient, accountsToCheck);
36
+ const whoCanResults = [];
37
+ for (const account of uniqueAccounts.accounts) {
38
+ const principals = await collectClient.getAllPrincipalsInAccount(account);
39
+ for (const principal of principals) {
40
+ const principalResults = await runPrincipalForActions(collectClient, principal, resource, resourceAccount, actions);
41
+ whoCanResults.push(...principalResults);
42
+ }
43
+ }
44
+ const principalsNotFound = [];
45
+ for (const principal of accountsToCheck.specificPrincipals) {
46
+ if (isServicePrincipal(principal)) {
47
+ const principalResults = await runPrincipalForActions(collectClient, principal, resource, resourceAccount, actions);
48
+ whoCanResults.push(...principalResults);
49
+ }
50
+ else if (isIamUserArn(principal) || isIamRoleArn(principal) || isAssumedRoleArn(principal)) {
51
+ const principalExists = await collectClient.principalExists(principal);
52
+ if (!principalExists) {
53
+ principalsNotFound.push(principal);
54
+ }
55
+ else {
56
+ const principalResults = await runPrincipalForActions(collectClient, principal, resource, resourceAccount, actions);
57
+ whoCanResults.push(...principalResults);
58
+ }
59
+ }
60
+ else {
61
+ principalsNotFound.push(principal);
62
+ }
63
+ }
64
+ return {
65
+ allowed: whoCanResults,
66
+ allAccountsChecked: accountsToCheck.allAccounts,
67
+ accountsNotFound: uniqueAccounts.accountsNotFound,
68
+ organizationsNotFound: uniqueAccounts.organizationsNotFound,
69
+ organizationalUnitsNotFound: uniqueAccounts.organizationalUnitsNotFound,
70
+ principalsNotFound: principalsNotFound
71
+ };
72
+ }
73
+ async function runPrincipalForActions(collectClient, principal, resource, resourceAccount, actions) {
74
+ const results = [];
75
+ for (const action of actions) {
76
+ const result = await simulateRequest({
77
+ principal: principal,
78
+ resourceArn: resource,
79
+ resourceAccount,
80
+ action,
81
+ customContextKeys: {}
82
+ }, collectClient);
83
+ if (result.analysis?.result === 'Allowed') {
84
+ const [service, serviceAction] = action.split(':');
85
+ results.push({
86
+ principal,
87
+ service: service,
88
+ action: serviceAction
89
+ });
90
+ }
91
+ }
92
+ return results;
93
+ }
94
+ export async function uniqueAccountsToCheck(collectClient, accountsToCheck) {
95
+ const returnValue = {
96
+ accountsNotFound: [],
97
+ organizationsNotFound: [],
98
+ organizationalUnitsNotFound: [],
99
+ accounts: []
100
+ };
101
+ if (accountsToCheck.allAccounts) {
102
+ returnValue.accounts = await collectClient.allAccounts();
103
+ return returnValue;
104
+ }
105
+ const uniqueAccounts = new Set();
106
+ for (const account of accountsToCheck.specificAccounts || []) {
107
+ const accountExists = await collectClient.accountExists(account);
108
+ if (accountExists) {
109
+ uniqueAccounts.add(account);
110
+ }
111
+ else {
112
+ returnValue.accountsNotFound.push(account);
113
+ }
114
+ }
115
+ for (const ouPath of accountsToCheck.specificOrganizationalUnits || []) {
116
+ const parts = ouPath.split('/');
117
+ const orgId = parts[0];
118
+ const pathParts = parts.slice(1);
119
+ const [found, accounts] = await collectClient.getAccountsForOrgPath(orgId, pathParts);
120
+ for (const account of accounts) {
121
+ uniqueAccounts.add(account);
122
+ }
123
+ if (!found) {
124
+ returnValue.organizationalUnitsNotFound.push(ouPath);
125
+ }
126
+ }
127
+ for (const orgId of accountsToCheck.specificOrganizations || []) {
128
+ const [found, accounts] = await collectClient.getAccountsForOrganization(orgId);
129
+ for (const account of accounts) {
130
+ uniqueAccounts.add(account);
131
+ }
132
+ if (!found) {
133
+ returnValue.organizationsNotFound.push(orgId);
134
+ }
135
+ }
136
+ returnValue.accounts = Array.from(uniqueAccounts);
137
+ return returnValue;
138
+ }
139
+ export async function accountsToCheckBasedOnResourcePolicy(resourcePolicy, resourceAccount) {
140
+ const accountsToCheck = {
141
+ allAccounts: false,
142
+ specificAccounts: [],
143
+ specificPrincipals: [],
144
+ specificOrganizations: [],
145
+ specificOrganizationalUnits: []
146
+ };
147
+ if (resourceAccount) {
148
+ accountsToCheck.specificAccounts.push(resourceAccount);
149
+ }
150
+ if (!resourcePolicy) {
151
+ return accountsToCheck;
152
+ }
153
+ const policy = loadPolicy(resourcePolicy);
154
+ for (const statement of policy.statements()) {
155
+ if (statement.isAllow() && statement.isNotPrincipalStatement()) {
156
+ accountsToCheck.allAccounts = true;
157
+ }
158
+ if (statement.isAllow() && statement.isPrincipalStatement()) {
159
+ const principals = statement.principals();
160
+ let hasWildcardPrincipal = false;
161
+ for (const principal of principals) {
162
+ if (principal.isWildcardPrincipal()) {
163
+ hasWildcardPrincipal = true;
164
+ }
165
+ else if (principal.isAccountPrincipal()) {
166
+ accountsToCheck.specificAccounts.push(principal.accountId());
167
+ }
168
+ else {
169
+ accountsToCheck.specificPrincipals.push(principal.value());
170
+ }
171
+ }
172
+ if (hasWildcardPrincipal) {
173
+ const specificOrgs = [];
174
+ const specificOus = [];
175
+ const specificAccounts = [];
176
+ const conditions = statement.conditions();
177
+ for (const cond of conditions) {
178
+ if (cond.conditionKey().toLowerCase() === 'aws:principalorgid' &&
179
+ cond.operation().value().toLowerCase().startsWith('stringequals') &&
180
+ !cond.conditionValues().some((v) => v.includes('$')) // Ignore dynamic values for now
181
+ ) {
182
+ specificOrgs.push(...cond.conditionValues());
183
+ }
184
+ if (cond.conditionKey().toLowerCase() === 'aws:principalorgpaths' &&
185
+ cond.operation().baseOperator().toLowerCase().startsWith('stringequals') &&
186
+ !cond.conditionValues().some((v) => v.includes('$')) // Ignore dynamic values for now
187
+ ) {
188
+ specificOus.push(...cond.conditionValues());
189
+ }
190
+ if (cond.conditionKey().toLowerCase() === 'aws:principalaccount' &&
191
+ cond.operation().value().toLowerCase().startsWith('stringequals') &&
192
+ !cond.conditionValues().some((v) => v.includes('$')) // Ignore dynamic values for now
193
+ ) {
194
+ specificAccounts.push(...cond.conditionValues());
195
+ }
196
+ }
197
+ if (specificAccounts.length > 0) {
198
+ accountsToCheck.specificAccounts.push(...specificAccounts);
199
+ }
200
+ else if (specificOus.length > 0) {
201
+ accountsToCheck.specificOrganizationalUnits.push(...specificOus);
202
+ }
203
+ else if (specificOrgs.length > 0) {
204
+ accountsToCheck.specificOrganizations.push(...specificOrgs);
205
+ }
206
+ else {
207
+ accountsToCheck.allAccounts = true;
208
+ }
209
+ }
210
+ }
211
+ }
212
+ return accountsToCheck;
213
+ }
214
+ export async function actionsForWhoCan(request) {
215
+ const { actions } = request;
216
+ if (actions && actions.length > 0) {
217
+ const validActions = [];
218
+ for (const action of actions) {
219
+ const parts = action.split(':');
220
+ if (parts.length !== 2) {
221
+ continue;
222
+ }
223
+ const [service, actionName] = parts;
224
+ const serviceExists = await iamServiceExists(service);
225
+ if (!serviceExists) {
226
+ continue;
227
+ }
228
+ const actionExists = await iamActionExists(service, actionName);
229
+ if (!actionExists) {
230
+ continue;
231
+ }
232
+ validActions.push(action);
233
+ }
234
+ return validActions;
235
+ }
236
+ if (!request.resource) {
237
+ return [];
238
+ }
239
+ return lookupActionsForResourceArn(request.resource);
240
+ }
241
+ /**
242
+ * Get the the possible resource types for an action and resource
243
+ *
244
+ * @param service the service the action belongs to
245
+ * @param action the action to get the resource type for
246
+ * @param resourceArn the resource type matching the action, if any
247
+ * @throws an error if the service or action does not exist, or if the action is a wildcard only action
248
+ */
249
+ export async function lookupActionsForResourceArn(resourceArn) {
250
+ const [service, resourceType] = await findResourceTypeForArn(resourceArn);
251
+ const resourceTypeKey = resourceType.key;
252
+ const selectedActions = [];
253
+ const serviceActions = await iamActionsForService(service);
254
+ for (const action of serviceActions) {
255
+ const actionDetails = await iamActionDetails(service, action);
256
+ for (const rt of actionDetails.resourceTypes) {
257
+ if (rt.name == resourceTypeKey) {
258
+ selectedActions.push(`${service}:${action}`);
259
+ break; // No need to check other resource types for this action
260
+ }
261
+ }
262
+ }
263
+ const isRole = new Arn(resourceArn).matches({ service: 'iam', resourceType: 'role' });
264
+ if (isRole) {
265
+ selectedActions.push(...AssumeRoleActions.values());
266
+ }
267
+ return selectedActions;
268
+ }
269
+ export async function findResourceTypeForArn(resourceArn) {
270
+ const arnParts = splitArnParts(resourceArn);
271
+ const service = arnParts.service.toLowerCase();
272
+ const serviceExists = await iamServiceExists(service);
273
+ if (!serviceExists) {
274
+ throw new Error(`Unable to find service ${service} for resource ${resourceArn}`);
275
+ }
276
+ const sortedResourceTypes = await allResourceTypesByArnLength(service);
277
+ for (const rt of sortedResourceTypes) {
278
+ const pattern = convertResourcePatternToRegex(rt.arn);
279
+ const match = resourceArn.match(new RegExp(pattern));
280
+ if (match) {
281
+ return [service, rt];
282
+ }
283
+ }
284
+ throw new Error(`Unable to find resource type for service ${service} and resource ${resourceArn}.`);
285
+ }
286
+ /**
287
+ * Convert a resource pattern from iam-data to a regex pattern
288
+ *
289
+ * @param pattern the pattern to convert to a regex
290
+ * @returns the regex pattern
291
+ */
292
+ export function convertResourcePatternToRegex(pattern) {
293
+ const regex = pattern.replace(/\$\{.*?\}/g, (match, position) => {
294
+ const name = match.substring(2, match.length - 1);
295
+ const camelName = name.at(0)?.toLowerCase() + name.substring(1);
296
+ return `(?<${camelName}>(.+?))`;
297
+ });
298
+ return `^${regex}$`;
299
+ }
300
+ async function allResourceTypesByArnLength(service) {
301
+ const resourceTypeKeys = await iamResourceTypesForService(service);
302
+ const sortedResourceTypes = [];
303
+ for (const key of resourceTypeKeys) {
304
+ const details = await iamResourceTypeDetails(service, key);
305
+ sortedResourceTypes.push(details);
306
+ }
307
+ return sortedResourceTypes.sort((a, b) => {
308
+ return b.arn.length - a.arn.length;
309
+ });
310
+ }
311
+ //# sourceMappingURL=whoCan.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"whoCan.js","sourceRoot":"","sources":["../../../src/whoCan/whoCan.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EAEjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACd,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAA;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAuBnD,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,aAA+B,EAC/B,OAA8B;IAE9B,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAE5B,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;IACxF,CAAC;IAED,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,8BAA8B,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,CAAC,MAAM,uBAAuB,CAAC,aAAa,EAAE,QAAS,CAAC,CAAC,CAAA;IAEtF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IAED,IAAI,cAAc,GAAQ,SAAS,CAAA;IACnC,IAAI,QAAQ,EAAE,CAAC;QACb,cAAc,GAAG,MAAM,4BAA4B,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAC5E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrC,IACE,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YAC5D,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,CAAC,cAAc,EACf,CAAC;YACD,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,iDAAiD,CAChG,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,oCAAoC,CAChE,cAAc,EACd,eAAe,CAChB,CAAA;IAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IAElF,MAAM,aAAa,GAAoB,EAAE,CAAA;IAEzC,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAA;QACzE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CACnD,aAAa,EACb,SAAS,EACT,QAAQ,EACR,eAAe,EACf,OAAO,CACR,CAAA;YACD,aAAa,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAa,EAAE,CAAA;IACvC,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,kBAAkB,EAAE,CAAC;QAC3D,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CACnD,aAAa,EACb,SAAS,EACT,QAAQ,EACR,eAAe,EACf,OAAO,CACR,CAAA;YACD,aAAa,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAA;QACzC,CAAC;aAAM,IAAI,YAAY,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7F,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;YACtE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CACnD,aAAa,EACb,SAAS,EACT,QAAQ,EACR,eAAe,EACf,OAAO,CACR,CAAA;gBACD,aAAa,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAA;YACzC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,aAAa;QACtB,kBAAkB,EAAE,eAAe,CAAC,WAAW;QAC/C,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;QACjD,qBAAqB,EAAE,cAAc,CAAC,qBAAqB;QAC3D,2BAA2B,EAAE,cAAc,CAAC,2BAA2B;QACvE,kBAAkB,EAAE,kBAAkB;KACvC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,aAA+B,EAC/B,SAAiB,EACjB,QAA4B,EAC5B,eAAuB,EACvB,OAAiB;IAEjB,MAAM,OAAO,GAAoB,EAAE,CAAA;IACnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,QAAQ;YACrB,eAAe;YACf,MAAM;YACN,iBAAiB,EAAE,EAAE;SACtB,EACD,aAAa,CACd,CAAA;QACD,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAClD,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS;gBACT,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAA+B,EAC/B,eAAgC;IAOhC,MAAM,WAAW,GAAG;QAClB,gBAAgB,EAAE,EAAc;QAChC,qBAAqB,EAAE,EAAc;QACrC,2BAA2B,EAAE,EAAc;QAC3C,QAAQ,EAAE,EAAc;KACzB,CAAA;IAED,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC;QAChC,WAAW,CAAC,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAA;QACxD,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IACxC,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAC7D,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QAChE,IAAI,aAAa,EAAE,CAAC;YAClB,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,eAAe,CAAC,2BAA2B,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAEhC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACrF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,WAAW,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAA;QAC/E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,WAAW,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACjD,OAAO,WAAW,CAAA;AACpB,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,cAAmB,EACnB,eAAmC;IAEnC,MAAM,eAAe,GAAoB;QACvC,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,EAAE;QACpB,kBAAkB,EAAE,EAAE;QACtB,qBAAqB,EAAE,EAAE;QACzB,2BAA2B,EAAE,EAAE;KAChC,CAAA;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,CAAA;IACzC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC;YAC/D,eAAe,CAAC,WAAW,GAAG,IAAI,CAAA;QACpC,CAAC;QACD,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,CAAA;YACzC,IAAI,oBAAoB,GAAG,KAAK,CAAA;YAChC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;oBACpC,oBAAoB,GAAG,IAAI,CAAA;gBAC7B,CAAC;qBAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC;oBAC1C,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAA;gBAC9D,CAAC;qBAAM,CAAC;oBACN,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA;gBAC5D,CAAC;YACH,CAAC;YAED,IAAI,oBAAoB,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,EAAE,CAAA;gBACvB,MAAM,WAAW,GAAG,EAAE,CAAA;gBACtB,MAAM,gBAAgB,GAAG,EAAE,CAAA;gBAE3B,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,CAAA;gBACzC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;oBAC9B,IACE,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,oBAAoB;wBAC1D,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;wBACjE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,gCAAgC;sBAC7F,CAAC;wBACD,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;oBAC9C,CAAC;oBACD,IACE,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,uBAAuB;wBAC7D,IAAI,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;wBACxE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,gCAAgC;sBAC7F,CAAC;wBACD,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;oBAC7C,CAAC;oBACD,IACE,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,sBAAsB;wBAC5D,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;wBACjE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,gCAAgC;sBAC7F,CAAC;wBACD,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;oBAClD,CAAC;gBACH,CAAC;gBACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAA;gBAC5D,CAAC;qBAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,eAAe,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAA;gBAClE,CAAC;qBAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACnC,eAAe,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAA;gBAC7D,CAAC;qBAAM,CAAC;oBACN,eAAe,CAAC,WAAW,GAAG,IAAI,CAAA;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAA8B;IACnE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAA;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,SAAQ;YACV,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,KAAK,CAAA;YACnC,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;YACrD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,SAAQ;YACV,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YAC/D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAQ;YACV,CAAC;YAED,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3B,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,2BAA2B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IACnE,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAA;IACzE,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAA;IAExC,MAAM,eAAe,GAAa,EAAE,CAAA;IACpC,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7D,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,aAAa,EAAE,CAAC;YAC7C,IAAI,EAAE,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;gBAC/B,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC,CAAA;gBAC5C,MAAK,CAAC,wDAAwD;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;IACrF,IAAI,MAAM,EAAE,CAAC;QACX,eAAe,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAQ,CAAC,WAAW,EAAE,CAAA;IAE/C,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACrD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,iBAAiB,WAAW,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAA;IACtE,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,6BAA6B,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;QACrD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;QACpD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,iBAAiB,WAAW,GAAG,CACnF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QAC/D,OAAO,MAAM,SAAS,SAAS,CAAA;IACjC,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,KAAK,GAAG,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,OAAe;IACxD,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAA;IAClE,MAAM,mBAAmB,GAAmB,EAAE,CAAA;IAC9C,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cloud-copilot/iam-lens",
3
- "version": "0.1.6",
3
+ "version": "0.1.8",
4
4
  "description": "Visibility in IAM in and across AWS accounts",
5
5
  "keywords": [
6
6
  "aws",
@@ -1,3 +0,0 @@
1
- import { AwsIamStore } from '@cloud-copilot/iam-collect';
2
- export declare function accountExists(storageClient: AwsIamStore, accountId: string): Promise<boolean>;
3
- //# sourceMappingURL=accounts.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../src/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD,wBAAsB,aAAa,CACjC,aAAa,EAAE,WAAW,EAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAGlB"}
@@ -1,8 +0,0 @@
1
- "use strict";
2
- Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.accountExists = accountExists;
4
- async function accountExists(storageClient, accountId) {
5
- const accounts = await storageClient.listAccountIds();
6
- return accounts.includes(accountId);
7
- }
8
- //# sourceMappingURL=accounts.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../src/accounts.ts"],"names":[],"mappings":";;AAEA,sCAMC;AANM,KAAK,UAAU,aAAa,CACjC,aAA0B,EAC1B,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,cAAc,EAAE,CAAA;IACrD,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;AACrC,CAAC"}