@cloud-copilot/iam-lens 0.1.8 → 0.1.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +78 -57
- package/dist/cjs/cli.js +3 -3
- package/dist/cjs/cli.js.map +1 -1
- package/dist/esm/cli.js +3 -3
- package/dist/esm/cli.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
|
|
5
5
|
## iam-lens
|
|
6
6
|
|
|
7
|
-
Get visibility into the
|
|
7
|
+
Get visibility into the IAM permissions in your AWS organizations and accounts. Use your actual AWS IAM policies (downloaded via [iam-collect](https://github.com/cloud-copilot/iam-collect)) and evaluate the effective permissions.
|
|
8
8
|
|
|
9
9
|
## Quick Start
|
|
10
10
|
|
|
@@ -12,7 +12,7 @@ Get visibility into the actual IAM policies that apply in your AWS organizations
|
|
|
12
12
|
# Install
|
|
13
13
|
npm install -g @cloud-copilot/iam-collect @cloud-copilot/iam-lens
|
|
14
14
|
|
|
15
|
-
# Download all IAM policies in your
|
|
15
|
+
# Download all IAM policies in your account using default credentials, run download once per account
|
|
16
16
|
iam-collect init
|
|
17
17
|
iam-collect download
|
|
18
18
|
|
|
@@ -20,27 +20,27 @@ iam-collect download
|
|
|
20
20
|
iam-lens simulate --principal arn:aws:iam::123456789012:role/ExampleRole --resource arn:aws:s3:::example-bucket/secret-file.txt --action s3:GetObject
|
|
21
21
|
|
|
22
22
|
# Find out who can do something
|
|
23
|
-
iam-lens who-can --resource arn:aws:s3:::example-bucket --actions s3:
|
|
23
|
+
iam-lens who-can --resource arn:aws:s3:::example-bucket --actions s3:ListBucket
|
|
24
24
|
|
|
25
25
|
# Find out who can do all actions on a resource
|
|
26
|
-
iam-lens who-can --resource arn:aws:
|
|
26
|
+
iam-lens who-can --resource arn:aws:s3:::example-bucket
|
|
27
27
|
```
|
|
28
28
|
|
|
29
29
|
## What is iam-lens?
|
|
30
30
|
|
|
31
|
-
iam-lens uses
|
|
31
|
+
iam-lens uses the IAM data from your AWS accounts (collected via [iam-collect](https://github.com/cloud-copilot/iam-collect)) to quickly simulate requests and understand the effective permissions that apply to a principal or resource.
|
|
32
32
|
|
|
33
33
|
## Why use it?
|
|
34
34
|
|
|
35
|
-
1. **Understand** what permissions are actually in place and why. See the policies that determine the outcome of a
|
|
36
|
-
2. **Verify**
|
|
37
|
-
3. **Discover** who can take action on a sensitive resource
|
|
35
|
+
1. **Understand** what permissions are actually in place and why. See the policies that determine the outcome of a request.
|
|
36
|
+
2. **Verify** what's allowed or not after everything is deployed.
|
|
37
|
+
3. **Discover** who can take action on a sensitive resource or account.
|
|
38
38
|
4. **Audit** your IAM policies and ensure they are configured correctly.
|
|
39
39
|
5. **Debug** permissions by simulating requests locally and iterate quickly without needing to deploy changes to your AWS environment.
|
|
40
40
|
|
|
41
41
|
## Getting Started
|
|
42
42
|
|
|
43
|
-
1. **Download Your Policies**
|
|
43
|
+
1. **Download Your Policies** with [iam-collect](https://github.com/cloud-copilot/iam-collect) to get all policies from your AWS accounts. iam-collect is highly configurable and can be customized to collect the policies you need. It only downloads information to your file system or an S3 bucket, so you're in full control of your data.
|
|
44
44
|
|
|
45
45
|
```bash
|
|
46
46
|
npm install -g @cloud-copilot/iam-collect
|
|
@@ -48,7 +48,9 @@ iam-collect init
|
|
|
48
48
|
iam-collect download
|
|
49
49
|
```
|
|
50
50
|
|
|
51
|
-
To see the effect of SCPs and RCPs, you should download data from your management account; or an account with
|
|
51
|
+
To see the effect of SCPs and RCPs, you should download data from your management account; or an account with permission to download organization information. Download data for member accounts you want to analyze. `iam-lens` will analyze cross-account and cross-organization requests if the data is available.
|
|
52
|
+
|
|
53
|
+
You can download information for as many accounts, organizations, and regions as you like. The more data you have, the more accurate your answers will be.
|
|
52
54
|
|
|
53
55
|
2. **Install iam-lens**
|
|
54
56
|
|
|
@@ -61,7 +63,10 @@ npm install -g @cloud-copilot/iam-lens
|
|
|
61
63
|
Simulate a request:
|
|
62
64
|
|
|
63
65
|
```bash
|
|
64
|
-
iam-lens simulate
|
|
66
|
+
iam-lens simulate \
|
|
67
|
+
--principal arn:aws:iam::123456789012:role/ExampleRole \
|
|
68
|
+
--resource arn:aws:s3:::example-bucket/secret-file.txt \
|
|
69
|
+
--action s3:GetObject
|
|
65
70
|
```
|
|
66
71
|
|
|
67
72
|
or
|
|
@@ -69,7 +74,9 @@ or
|
|
|
69
74
|
Discover who can perform an action on a resource:
|
|
70
75
|
|
|
71
76
|
```bash
|
|
72
|
-
iam-lens who-can
|
|
77
|
+
iam-lens who-can \
|
|
78
|
+
--resource arn:aws:iam::111111111111:role/ImportantRole \
|
|
79
|
+
--actions sts:AssumeRole iam:PassRole
|
|
73
80
|
```
|
|
74
81
|
|
|
75
82
|
## Commands
|
|
@@ -80,19 +87,19 @@ iam-lens who-can --resource arn:aws:iam::111111111111:role/ImportantRole --actio
|
|
|
80
87
|
iam-lens simulate [options]
|
|
81
88
|
```
|
|
82
89
|
|
|
83
|
-
Evaluates whether a
|
|
90
|
+
Evaluates whether a principal can perform a specified action on a resource (or account for wildcard only actions). Returns a decision: `Allowed`, `ImplicitlyDenied`, or `ExplicitlyDenied`.
|
|
84
91
|
|
|
85
92
|
**Options:**
|
|
86
93
|
|
|
87
|
-
| Flag | Description
|
|
88
|
-
| --------------------------- |
|
|
89
|
-
| `--principal <arn>` | The principal the request is from. Can be a user, role, session, or AWS service.
|
|
90
|
-
| `--resource <arn>` | The ARN of the resource to simulate access to. Ignore for wildcard-only actions
|
|
91
|
-
| `--
|
|
92
|
-
| `--action <service:action>` | The action to simulate; must be a valid IAM service and action such as `s3:ListBucket`.
|
|
93
|
-
| `--context <key=value>` | One or more context keys to use for the simulation. Keys are formatted as `
|
|
94
|
-
| `-v, --verbose` | Enable verbose output for the simulation
|
|
95
|
-
| `--expect <result>` |
|
|
94
|
+
| Flag | Description |
|
|
95
|
+
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
96
|
+
| `--principal <arn>` | The principal the request is from. Can be a user, role, session, or AWS service. |
|
|
97
|
+
| `--resource <arn>` | The ARN of the resource to simulate access to. Ignore for wildcard-only actions such as `s3:ListAllMyBuckets`. |
|
|
98
|
+
| `--resource-account <id>` | The account ID of the resource. Only required if it cannot be determined from the resource ARN or the principal ARN for wildcard only actions. |
|
|
99
|
+
| `--action <service:action>` | The action to simulate; must be a valid IAM service and action such as `s3:ListBucket`. |
|
|
100
|
+
| `--context <key=value>` | One or more context keys to use for the simulation. Keys are formatted as `keyA=value1,value2 keyB=value1,value2`. Multiple keys are separated by spaces. Multiple values separated by commas. See [Context Keys](#context-keys) for what keys are set automatically |
|
|
101
|
+
| `-v, --verbose` | Enable verbose output for the simulation to see exactly what statements applied or not and why. |
|
|
102
|
+
| `--expect <result>` | Optional expected outcome of the simulation. Valid values are `Allowed`, `ImplicitlyDenied`, `ExplicitlyDenied`, `AnyDeny`. If the result does not match the expected value, a non-zero exit code is returned |
|
|
96
103
|
|
|
97
104
|
**Examples:**
|
|
98
105
|
|
|
@@ -103,19 +110,17 @@ iam-lens simulate \
|
|
|
103
110
|
--resource arn:aws:s3:::my-bucket \
|
|
104
111
|
--action s3:ListBucket
|
|
105
112
|
|
|
106
|
-
# Simulate a wildcard action (ListAllMyBuckets) –
|
|
113
|
+
# Simulate a wildcard action (ListAllMyBuckets) – this will assume the principals account
|
|
107
114
|
iam-lens simulate \
|
|
108
115
|
--principal arn:aws:iam::222222222222:user/Alice \
|
|
109
|
-
--action s3:ListAllMyBuckets
|
|
110
|
-
--resourceAccountId 222222222222
|
|
116
|
+
--action s3:ListAllMyBuckets
|
|
111
117
|
|
|
112
|
-
# Include context keys
|
|
118
|
+
# Include custom context keys
|
|
113
119
|
iam-lens simulate \
|
|
114
120
|
--principal arn:aws:iam::333333333333:role/DevRole \
|
|
115
121
|
--resource arn:aws:sqs:us-east-1:333333333333:my-queue \
|
|
116
122
|
--action sqs:SendMessage \
|
|
117
|
-
--context aws:
|
|
118
|
-
--context aws:ResourceTag/Env=prod,staging \
|
|
123
|
+
--context aws:SourceVpc=vpc-1234567890abcdef0 \
|
|
119
124
|
--verbose
|
|
120
125
|
|
|
121
126
|
# Assert the result must be “Allowed”; exit code will be nonzero if not
|
|
@@ -132,35 +137,42 @@ iam-lens simulate \
|
|
|
132
137
|
iam-lens who-can [options]
|
|
133
138
|
```
|
|
134
139
|
|
|
135
|
-
Lists all principals in your IAM data who are allowed to perform one or more specified actions on a resource (or wildcard). If applicable it will check the resource policy to find cross-account permissions and AWS service principals.
|
|
140
|
+
Lists all principals in your IAM data who are allowed to perform one or more specified actions on a resource (or account for wildcard only actions). If applicable it will check the resource policy to find cross-account permissions and AWS service principals.
|
|
136
141
|
|
|
137
142
|
**Options:**
|
|
138
143
|
|
|
139
|
-
| Flag | Description
|
|
140
|
-
| ---------------------------- |
|
|
141
|
-
| `--resource <arn>` | The ARN of the resource to check permissions for. Ignore for wildcard-only actions
|
|
142
|
-
| `--
|
|
143
|
-
| `--actions <service:action>` | One or more actions to check
|
|
144
|
+
| Flag | Description |
|
|
145
|
+
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
146
|
+
| `--resource <arn>` | The ARN of the resource to check permissions for. Ignore for wildcard-only actions such as `iam:ListRoles` |
|
|
147
|
+
| `--resource-account <id>` | The account ID of the resource, only required if it cannot be determined from the resource ARN. Required for wildcard actions such as `ec2:DescribeInstances` |
|
|
148
|
+
| `--actions <service:action>` | One or more actions to check such as `s3:GetObject`. Specify as many actions as you want. If omitted it will analyze all valid actions for the resource. If no `--resource` is specified then actions must be entered. |
|
|
144
149
|
|
|
145
150
|
**Examples:**
|
|
146
151
|
|
|
147
152
|
```bash
|
|
148
|
-
# Who can get
|
|
153
|
+
# Who can get this object?
|
|
149
154
|
iam-lens who-can \
|
|
150
|
-
--resource arn:aws:s3:::my-bucket \
|
|
155
|
+
--resource arn:aws:s3:::my-bucket/secret-file.txt \
|
|
151
156
|
--actions s3:GetObject
|
|
152
157
|
|
|
153
|
-
# Who can list all IAM roles in
|
|
158
|
+
# Who can list all IAM roles in this account? (wildcard action – no resource)
|
|
154
159
|
iam-lens who-can \
|
|
160
|
+
--resource-account 555555555555 \
|
|
155
161
|
--actions iam:ListRoles
|
|
156
162
|
|
|
157
163
|
# Check multiple actions at once
|
|
158
164
|
iam-lens who-can \
|
|
159
165
|
--resource arn:aws:dynamodb:us-east-1:555555555555:table/Books \
|
|
160
|
-
--actions dynamodb:Query
|
|
166
|
+
--actions dynamodb:Query dynamodb:UpdateItem
|
|
167
|
+
|
|
168
|
+
# Check all actions for a bucket
|
|
169
|
+
iam-lens who-can \
|
|
170
|
+
--resource arn:aws:s3:::my-bucket
|
|
161
171
|
```
|
|
162
172
|
|
|
163
|
-
|
|
173
|
+
### Global Options:
|
|
174
|
+
|
|
175
|
+
These options are available for all commands:
|
|
164
176
|
|
|
165
177
|
| Flag | Description | Default |
|
|
166
178
|
| -------------------------- | --------------------------------------------------------------------- | ------------------- |
|
|
@@ -169,7 +181,7 @@ iam-lens who-can \
|
|
|
169
181
|
|
|
170
182
|
## Context Keys
|
|
171
183
|
|
|
172
|
-
|
|
184
|
+
iam-lens automatically populates the context keys below when simulating requests. These keys are set based on your principal, resource, and organization data. Any keys provided via `--context` will override the defaults.
|
|
173
185
|
|
|
174
186
|
### Default Context Keys
|
|
175
187
|
|
|
@@ -182,10 +194,10 @@ Below are the context keys that iam-lens populates by default during simulation.
|
|
|
182
194
|
- **`aws:EpochTime`**
|
|
183
195
|
Unix epoch time in seconds (e.g., `1717290896`).
|
|
184
196
|
|
|
185
|
-
#### Principal Context
|
|
197
|
+
#### IAM Principal Context
|
|
186
198
|
|
|
187
199
|
- **`aws:PrincipalArn`**
|
|
188
|
-
The full ARN of the principal (user, role,
|
|
200
|
+
The full ARN of the principal (user, role, role session, or federated user) being simulated.
|
|
189
201
|
|
|
190
202
|
- **`aws:PrincipalAccount`**
|
|
191
203
|
The AWS account ID extracted from the principal ARN.
|
|
@@ -200,7 +212,7 @@ Below are the context keys that iam-lens populates by default during simulation.
|
|
|
200
212
|
For each tag on the IAM principal, a context key of the form `aws:PrincipalTag/<TagKey>` with its tag value.
|
|
201
213
|
|
|
202
214
|
- **`aws:PrincipalIsAWSService`**
|
|
203
|
-
Set to `
|
|
215
|
+
Set to `false` for all IAM principals (users, roles, federated users).
|
|
204
216
|
|
|
205
217
|
- **`aws:PrincipalType`**
|
|
206
218
|
One of: `Account`, `User`, `FederatedUser`, `AssumedRole`, indicating the type of principal.
|
|
@@ -213,38 +225,47 @@ Below are the context keys that iam-lens populates by default during simulation.
|
|
|
213
225
|
- For a federated user: `<AccountId>:<FederatedName>`
|
|
214
226
|
- For an assumed role: `<RoleUniqueId>:<SessionName>`
|
|
215
227
|
|
|
228
|
+
Setting `role-id:ec2-instance-id` for EC2 instances is not supported at this time.
|
|
229
|
+
|
|
216
230
|
- **`aws:username`** _(only for IAM users)_
|
|
217
231
|
The IAM username portion of the principal ARN (e.g. `Alice`).
|
|
218
232
|
|
|
219
|
-
|
|
233
|
+
#### Service Principal Context
|
|
234
|
+
|
|
235
|
+
The following context keys are set when the principal is an AWS service (e.g., `lambda.amazonaws.com`, `ec2.amazonaws.com`):
|
|
236
|
+
|
|
237
|
+
- **`aws:PrincipalServiceName`**
|
|
220
238
|
The service principal string (e.g. `lambda.amazonaws.com`).
|
|
221
239
|
|
|
222
|
-
- **`aws:SourceAccount`**
|
|
223
|
-
The account ID of the
|
|
240
|
+
- **`aws:SourceAccount`**
|
|
241
|
+
The account ID of the resource.
|
|
242
|
+
|
|
243
|
+
- **`aws:SourceOrgID`**
|
|
244
|
+
The organization ID of the resource’s account (if part of an organization).
|
|
224
245
|
|
|
225
|
-
- **`aws:
|
|
226
|
-
The
|
|
246
|
+
- **`aws:SourceOrgPaths`**
|
|
247
|
+
The OU hierarchy path for the resource’s account (if part of an organization).
|
|
227
248
|
|
|
228
|
-
- **`aws:
|
|
229
|
-
|
|
249
|
+
- **`aws:PrincipalIsAWSService`**
|
|
250
|
+
Set to `true` for all service principals.
|
|
230
251
|
|
|
231
|
-
#### Resource Context (unless action is excluded)
|
|
252
|
+
#### Resource Context ([unless action is excluded](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceaccount))
|
|
232
253
|
|
|
233
254
|
- **`aws:ResourceAccount`**
|
|
234
|
-
The AWS account ID of the
|
|
255
|
+
The AWS account ID of the resource.
|
|
235
256
|
|
|
236
|
-
- **`aws:ResourceOrgID`**
|
|
237
|
-
The Organization ID for the resource’s account.
|
|
257
|
+
- **`aws:ResourceOrgID`**
|
|
258
|
+
The Organization ID for the resource’s account (if part of an organization).
|
|
238
259
|
|
|
239
260
|
- **`aws:ResourceOrgPaths`** _(if the resource account is in an organization)_
|
|
240
|
-
A list containing a single string of the form `<OrgId>/<OU1>/<OU2>/…/` for the resource’s account.
|
|
261
|
+
A list containing a single string of the form `<OrgId>/<OU1>/<OU2>/…/` for the resource’s account (if part of an organization).
|
|
241
262
|
|
|
242
263
|
- **`aws:ResourceTag/<TagKey>`**
|
|
243
|
-
For each tag on the resource ARN, a context key `aws:ResourceTag/TagKey` with its tag value. **This is only for resources that are stored in your `iam-collect` data**, such as Roles, S3 Buckets, DynamoDB Tables, etc. For resources not stored in `iam-collect`, this key
|
|
264
|
+
For each tag on the resource ARN, a context key `aws:ResourceTag/TagKey` with its tag value. **This is only for resources that are stored in your `iam-collect` data**, such as Roles, S3 Buckets, DynamoDB Tables, etc. For resources not stored in `iam-collect`, this key should be set manually.
|
|
244
265
|
|
|
245
266
|
### Overriding Default Context Keys
|
|
246
267
|
|
|
247
|
-
Any context keys supplied via the `--context key=value[,value2,…]`
|
|
268
|
+
Any context keys supplied via the `--context key=value[,value2,…]` argument will override the defaults described above. For example:
|
|
248
269
|
|
|
249
270
|
```bash
|
|
250
271
|
iam-lens simulate \
|
package/dist/cjs/cli.js
CHANGED
|
@@ -22,7 +22,7 @@ const main = async () => {
|
|
|
22
22
|
values: 'single',
|
|
23
23
|
description: 'The ARN of the resource to simulate access to. Ignore for wildcard actions'
|
|
24
24
|
},
|
|
25
|
-
|
|
25
|
+
resourceAccount: {
|
|
26
26
|
type: 'string',
|
|
27
27
|
values: 'single',
|
|
28
28
|
description: 'The account ID of the resource, only required if it cannot be determined from the resource ARN.'
|
|
@@ -94,12 +94,12 @@ const main = async () => {
|
|
|
94
94
|
const collectConfigs = await (0, collect_js_1.loadCollectConfigs)(cli.args.collectConfigs);
|
|
95
95
|
const collectClient = (0, collect_js_1.getCollectClient)(collectConfigs, thePartition);
|
|
96
96
|
if (cli.subcommand === 'simulate') {
|
|
97
|
-
const { principal, resource,
|
|
97
|
+
const { principal, resource, resourceAccount, action, context } = cli.args;
|
|
98
98
|
const contextKeys = convertContextKeysToMap(context);
|
|
99
99
|
const result = await (0, simulate_js_1.simulateRequest)({
|
|
100
100
|
principal: principal,
|
|
101
101
|
resourceArn: resource,
|
|
102
|
-
resourceAccount:
|
|
102
|
+
resourceAccount: resourceAccount,
|
|
103
103
|
action: action,
|
|
104
104
|
customContextKeys: contextKeys
|
|
105
105
|
}, collectClient);
|
package/dist/cjs/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;;AAEA,4CAAsD;AACtD,qDAA2E;AAE3E,wDAAkF;AAClF,iEAA0D;AAC1D,kDAA2C;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,IAAA,kCAAc,GAAE,CAAA;IACtC,MAAM,GAAG,GAAG,IAAA,uBAAiB,EAC3B,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE;gBACP,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,yEAAyE;iBACvF;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,4EAA4E;iBAC/E;gBACD,
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;;AAEA,4CAAsD;AACtD,qDAA2E;AAE3E,wDAAkF;AAClF,iEAA0D;AAC1D,kDAA2C;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,IAAA,kCAAc,GAAE,CAAA;IACtC,MAAM,GAAG,GAAG,IAAA,uBAAiB,EAC3B,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE;gBACP,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,yEAAyE;iBACvF;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,4EAA4E;iBAC/E;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,iGAAiG;iBACpG;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,wFAAwF;iBAC3F;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU;oBAClB,WAAW,EACT,oJAAoJ;iBACvJ;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,0CAA0C;oBACvD,SAAS,EAAE,GAAG;iBACf;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,CAAC;oBAC3E,WAAW,EACT,iIAAiI;iBACpI;aACF;SACF;QACD,SAAS,EAAE;YACT,WAAW,EAAE,8CAA8C;YAC3D,OAAO,EAAE;gBACP,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,+EAA+E;iBAClF;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,+HAA+H;iBAClI;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU;oBAClB,WAAW,EACT,oGAAoG;iBACvG;aACF;SACF;KACF,EACD;QACE,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,4CAA4C;YACzD,MAAM,EAAE,UAAU;SACnB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,sEAAsE;YACnF,MAAM,EAAE,QAAQ;SACjB;KACF,EACD;QACE,SAAS,EAAE,UAAU;QACrB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;QACvB,OAAO;KACR,CACF,CAAA;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IAChD,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAkB,EAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACxE,MAAM,aAAa,GAAG,IAAA,6BAAgB,EAAC,cAAc,EAAE,YAAY,CAAC,CAAA;IAEpE,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QAC1E,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;QAEpD,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAe,EAClC;YACE,SAAS,EAAE,SAAU;YACrB,WAAW,EAAE,QAAQ;YACrB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,MAAO;YACf,iBAAiB,EAAE,WAAW;SAC/B,EACD,aAAa,CACd,CAAA;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5D,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,CAAC,IAAA,sCAAwB,EAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAO,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACvD,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,KAAK,CACX,qGAAqG,CACtG,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAM,EAAC,aAAa,EAAE;YAC1C,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAS;YAC5B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAQ;YAC1B,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;SAC1C,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC,CAAA;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC;KACD,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;KACd,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AAEpB;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,WAAqB;IACpD,MAAM,UAAU,GAAsC,EAAE,CAAA;IACxD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,UAAU,CAAC,OAAO,CAAC,GAAG,MAAM,CAAA;YAC9B,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC"}
|
package/dist/esm/cli.js
CHANGED
|
@@ -20,7 +20,7 @@ const main = async () => {
|
|
|
20
20
|
values: 'single',
|
|
21
21
|
description: 'The ARN of the resource to simulate access to. Ignore for wildcard actions'
|
|
22
22
|
},
|
|
23
|
-
|
|
23
|
+
resourceAccount: {
|
|
24
24
|
type: 'string',
|
|
25
25
|
values: 'single',
|
|
26
26
|
description: 'The account ID of the resource, only required if it cannot be determined from the resource ARN.'
|
|
@@ -92,12 +92,12 @@ const main = async () => {
|
|
|
92
92
|
const collectConfigs = await loadCollectConfigs(cli.args.collectConfigs);
|
|
93
93
|
const collectClient = getCollectClient(collectConfigs, thePartition);
|
|
94
94
|
if (cli.subcommand === 'simulate') {
|
|
95
|
-
const { principal, resource,
|
|
95
|
+
const { principal, resource, resourceAccount, action, context } = cli.args;
|
|
96
96
|
const contextKeys = convertContextKeysToMap(context);
|
|
97
97
|
const result = await simulateRequest({
|
|
98
98
|
principal: principal,
|
|
99
99
|
resourceArn: resource,
|
|
100
|
-
resourceAccount:
|
|
100
|
+
resourceAccount: resourceAccount,
|
|
101
101
|
action: action,
|
|
102
102
|
customContextKeys: contextKeys
|
|
103
103
|
}, collectClient);
|
package/dist/esm/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAE3E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAA;IACtC,MAAM,GAAG,GAAG,iBAAiB,CAC3B,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE;gBACP,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,yEAAyE;iBACvF;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,4EAA4E;iBAC/E;gBACD,
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAE3E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAA;IACtC,MAAM,GAAG,GAAG,iBAAiB,CAC3B,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE;gBACP,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,yEAAyE;iBACvF;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,4EAA4E;iBAC/E;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,iGAAiG;iBACpG;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,wFAAwF;iBAC3F;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU;oBAClB,WAAW,EACT,oJAAoJ;iBACvJ;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,0CAA0C;oBACvD,SAAS,EAAE,GAAG;iBACf;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,CAAC;oBAC3E,WAAW,EACT,iIAAiI;iBACpI;aACF;SACF;QACD,SAAS,EAAE;YACT,WAAW,EAAE,8CAA8C;YAC3D,OAAO,EAAE;gBACP,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,+EAA+E;iBAClF;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,+HAA+H;iBAClI;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU;oBAClB,WAAW,EACT,oGAAoG;iBACvG;aACF;SACF;KACF,EACD;QACE,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,4CAA4C;YACzD,MAAM,EAAE,UAAU;SACnB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,sEAAsE;YACnF,MAAM,EAAE,QAAQ;SACjB;KACF,EACD;QACE,SAAS,EAAE,UAAU;QACrB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;QACvB,OAAO;KACR,CACF,CAAA;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IAChD,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACxE,MAAM,aAAa,GAAG,gBAAgB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAA;IAEpE,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QAC1E,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;QAEpD,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,SAAS,EAAE,SAAU;YACrB,WAAW,EAAE,QAAQ;YACrB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,MAAO;YACf,iBAAiB,EAAE,WAAW;SAC/B,EACD,aAAa,CACd,CAAA;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5D,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAO,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACvD,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,KAAK,CACX,qGAAqG,CACtG,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE;YAC1C,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAS;YAC5B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAQ;YAC1B,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;SAC1C,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC,CAAA;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC;KACD,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;KACd,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AAEpB;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,WAAqB;IACpD,MAAM,UAAU,GAAsC,EAAE,CAAA;IACxD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,UAAU,CAAC,OAAO,CAAC,GAAG,MAAM,CAAA;YAC9B,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC"}
|