@cloud-copilot/iam-lens 0.1.8 → 0.1.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +61 -49
- package/dist/cjs/cli.js +3 -3
- package/dist/cjs/cli.js.map +1 -1
- package/dist/esm/cli.js +3 -3
- package/dist/esm/cli.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
|
|
5
5
|
## iam-lens
|
|
6
6
|
|
|
7
|
-
Get visibility into the actual IAM
|
|
7
|
+
Get visibility into the actual IAM permissions in your AWS organizations and accounts. Use your actual AWS IAM policies (downloaded via [iam-collect](https://github.com/cloud-copilot/iam-collect)) and evaluate the effective permissions.
|
|
8
8
|
|
|
9
9
|
## Quick Start
|
|
10
10
|
|
|
@@ -12,7 +12,7 @@ Get visibility into the actual IAM policies that apply in your AWS organizations
|
|
|
12
12
|
# Install
|
|
13
13
|
npm install -g @cloud-copilot/iam-collect @cloud-copilot/iam-lens
|
|
14
14
|
|
|
15
|
-
# Download all IAM policies in your
|
|
15
|
+
# Download all IAM policies in your account using default credentials, run download once per account
|
|
16
16
|
iam-collect init
|
|
17
17
|
iam-collect download
|
|
18
18
|
|
|
@@ -20,27 +20,27 @@ iam-collect download
|
|
|
20
20
|
iam-lens simulate --principal arn:aws:iam::123456789012:role/ExampleRole --resource arn:aws:s3:::example-bucket/secret-file.txt --action s3:GetObject
|
|
21
21
|
|
|
22
22
|
# Find out who can do something
|
|
23
|
-
iam-lens who-can --resource arn:aws:s3:::example-bucket --actions s3:
|
|
23
|
+
iam-lens who-can --resource arn:aws:s3:::example-bucket --actions s3:ListBucket
|
|
24
24
|
|
|
25
25
|
# Find out who can do all actions on a resource
|
|
26
|
-
iam-lens who-can --resource arn:aws:
|
|
26
|
+
iam-lens who-can --resource arn:aws:s3:::example-bucket
|
|
27
27
|
```
|
|
28
28
|
|
|
29
29
|
## What is iam-lens?
|
|
30
30
|
|
|
31
|
-
iam-lens uses real IAM data from your AWS accounts (collected via [iam-collect](https://github.com/cloud-copilot/iam-collect))
|
|
31
|
+
iam-lens uses real IAM data from your AWS accounts (collected via [iam-collect](https://github.com/cloud-copilot/iam-collect)) to quickly simulate requests and discover the real effective permissions that apply to a principal or resource.
|
|
32
32
|
|
|
33
33
|
## Why use it?
|
|
34
34
|
|
|
35
|
-
1. **Understand** what permissions are actually in place and why. See the policies that determine the outcome of a
|
|
36
|
-
2. **Verify**
|
|
35
|
+
1. **Understand** what permissions are actually in place and why. See the policies that determine the outcome of a request.
|
|
36
|
+
2. **Verify** what's allowed or not after everything is deployed.
|
|
37
37
|
3. **Discover** who can take action on a sensitive resource with a single command.
|
|
38
38
|
4. **Audit** your IAM policies and ensure they are configured correctly.
|
|
39
39
|
5. **Debug** permissions by simulating requests locally and iterate quickly without needing to deploy changes to your AWS environment.
|
|
40
40
|
|
|
41
41
|
## Getting Started
|
|
42
42
|
|
|
43
|
-
1. **Download Your Policies**
|
|
43
|
+
1. **Download Your Policies** with [iam-collect](https://github.com/cloud-copilot/iam-collect) to get all your policies from all your AWS accounts. iam-collect is highly configurable and can be customized to collect the policies you need. It only downloads information to your file system or an S3 bucket, so you're in full control of your data.
|
|
44
44
|
|
|
45
45
|
```bash
|
|
46
46
|
npm install -g @cloud-copilot/iam-collect
|
|
@@ -48,7 +48,9 @@ iam-collect init
|
|
|
48
48
|
iam-collect download
|
|
49
49
|
```
|
|
50
50
|
|
|
51
|
-
To see the effect of SCPs and RCPs, you should download data from your management account; or an account with permissions
|
|
51
|
+
To see the effect of SCPs and RCPs, you should download data from your management account; or an account with permissions to download organization information. Download data for member accounts you want to analyze. `iam-lens` will analyze cross-account and cross-organization requests if you have the data available.
|
|
52
|
+
|
|
53
|
+
You can download information for as many accounts, organizations, and regions as you like. The more data you have, the more accurate your simulations will be.
|
|
52
54
|
|
|
53
55
|
2. **Install iam-lens**
|
|
54
56
|
|
|
@@ -80,19 +82,19 @@ iam-lens who-can --resource arn:aws:iam::111111111111:role/ImportantRole --actio
|
|
|
80
82
|
iam-lens simulate [options]
|
|
81
83
|
```
|
|
82
84
|
|
|
83
|
-
Evaluates whether a
|
|
85
|
+
Evaluates whether a principal can perform a specified action on a resource (or wildcard). Returns a decision (Allowed/ImplicitlyDenied/ExplicitlyDenied), and exits nonzero if you provided an `--expect` that doesn’t match the result.
|
|
84
86
|
|
|
85
87
|
**Options:**
|
|
86
88
|
|
|
87
|
-
| Flag | Description
|
|
88
|
-
| --------------------------- |
|
|
89
|
-
| `--principal <arn>` | The principal the request is from. Can be a user, role, session, or AWS service.
|
|
90
|
-
| `--resource <arn>` | The ARN of the resource to simulate access to. Ignore for wildcard-only actions
|
|
91
|
-
| `--
|
|
92
|
-
| `--action <service:action>` | The action to simulate; must be a valid IAM service and action such as `s3:ListBucket`.
|
|
93
|
-
| `--context <key=value>` | One or more context keys to use for the simulation. Keys are formatted as `
|
|
94
|
-
| `-v, --verbose` | Enable verbose output for the simulation (
|
|
95
|
-
| `--expect <result>` |
|
|
89
|
+
| Flag | Description |
|
|
90
|
+
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
91
|
+
| `--principal <arn>` | The principal the request is from. Can be a user, role, session, or AWS service. |
|
|
92
|
+
| `--resource <arn>` | The ARN of the resource to simulate access to. Ignore for wildcard-only actions such as `s3:ListAllMyBuckets`. |
|
|
93
|
+
| `--resource-account <id>` | The account ID of the resource, only required if it cannot be determined from the resource ARN. |
|
|
94
|
+
| `--action <service:action>` | The action to simulate; must be a valid IAM service and action such as `s3:ListBucket`. |
|
|
95
|
+
| `--context <key=value>` | One or more context keys to use for the simulation. Keys are formatted as `keyA=value1,value2 keyB=value1,value2`. Multiple keys are separated by spaces. Multiple values separated by commas. See [Context Keys](#context-keys) for what keys are set automatically |
|
|
96
|
+
| `-v, --verbose` | Enable verbose output for the simulation (exactly what statements applied or not and why). |
|
|
97
|
+
| `--expect <result>` | Optional expected outcome of the simulation. Valid values are `Allowed`, `ImplicitlyDenied`, `ExplicitlyDenied`, `AnyDeny`. If the result does not match the expected value, a non-zero exit code is returned |
|
|
96
98
|
|
|
97
99
|
**Examples:**
|
|
98
100
|
|
|
@@ -103,19 +105,17 @@ iam-lens simulate \
|
|
|
103
105
|
--resource arn:aws:s3:::my-bucket \
|
|
104
106
|
--action s3:ListBucket
|
|
105
107
|
|
|
106
|
-
# Simulate a wildcard action (ListAllMyBuckets) –
|
|
108
|
+
# Simulate a wildcard action (ListAllMyBuckets) – this will assume the principals account
|
|
107
109
|
iam-lens simulate \
|
|
108
110
|
--principal arn:aws:iam::222222222222:user/Alice \
|
|
109
111
|
--action s3:ListAllMyBuckets \
|
|
110
|
-
--resourceAccountId 222222222222
|
|
111
112
|
|
|
112
|
-
# Include context keys
|
|
113
|
+
# Include custom context keys
|
|
113
114
|
iam-lens simulate \
|
|
114
115
|
--principal arn:aws:iam::333333333333:role/DevRole \
|
|
115
116
|
--resource arn:aws:sqs:us-east-1:333333333333:my-queue \
|
|
116
117
|
--action sqs:SendMessage \
|
|
117
|
-
--context aws:
|
|
118
|
-
--context aws:ResourceTag/Env=prod,staging \
|
|
118
|
+
--context aws:SourceVpc=vpc-1234567890abcdef0 \
|
|
119
119
|
--verbose
|
|
120
120
|
|
|
121
121
|
# Assert the result must be “Allowed”; exit code will be nonzero if not
|
|
@@ -136,31 +136,34 @@ Lists all principals in your IAM data who are allowed to perform one or more spe
|
|
|
136
136
|
|
|
137
137
|
**Options:**
|
|
138
138
|
|
|
139
|
-
| Flag | Description
|
|
140
|
-
| ---------------------------- |
|
|
141
|
-
| `--resource <arn>` | The ARN of the resource to check permissions for. Ignore for wildcard-only actions
|
|
142
|
-
| `--
|
|
143
|
-
| `--actions <service:action>` | One or more actions to check
|
|
139
|
+
| Flag | Description |
|
|
140
|
+
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
141
|
+
| `--resource <arn>` | The ARN of the resource to check permissions for. Ignore for wildcard-only actions such as `iam:ListRoles` |
|
|
142
|
+
| `--resource-account <id>` | The account ID of the resource, only required if it cannot be determined from the resource ARN. Required for wildcard actions such as `ec2:DescribeInstances` |
|
|
143
|
+
| `--actions <service:action>` | One or more actions to check such as `s3:GetObject`. Specify as many actions as you want. If omitted it will analyze all valid actions for the resource. If no `--resource` is specified then actions must be entered. |
|
|
144
144
|
|
|
145
145
|
**Examples:**
|
|
146
146
|
|
|
147
147
|
```bash
|
|
148
|
-
# Who can get
|
|
148
|
+
# Who can get this object?
|
|
149
149
|
iam-lens who-can \
|
|
150
|
-
--resource arn:aws:s3:::my-bucket \
|
|
150
|
+
--resource arn:aws:s3:::my-bucket/secret-file.txt \
|
|
151
151
|
--actions s3:GetObject
|
|
152
152
|
|
|
153
153
|
# Who can list all IAM roles in any account? (wildcard action – no resource)
|
|
154
154
|
iam-lens who-can \
|
|
155
|
+
--resource-account 555555555555 \
|
|
155
156
|
--actions iam:ListRoles
|
|
156
157
|
|
|
157
158
|
# Check multiple actions at once
|
|
158
159
|
iam-lens who-can \
|
|
159
160
|
--resource arn:aws:dynamodb:us-east-1:555555555555:table/Books \
|
|
160
|
-
--actions dynamodb:Query
|
|
161
|
+
--actions dynamodb:Query dynamodb:UpdateItem
|
|
161
162
|
```
|
|
162
163
|
|
|
163
|
-
|
|
164
|
+
### Global Options:
|
|
165
|
+
|
|
166
|
+
These options are available for all commands:
|
|
164
167
|
|
|
165
168
|
| Flag | Description | Default |
|
|
166
169
|
| -------------------------- | --------------------------------------------------------------------- | ------------------- |
|
|
@@ -182,10 +185,10 @@ Below are the context keys that iam-lens populates by default during simulation.
|
|
|
182
185
|
- **`aws:EpochTime`**
|
|
183
186
|
Unix epoch time in seconds (e.g., `1717290896`).
|
|
184
187
|
|
|
185
|
-
#### Principal Context
|
|
188
|
+
#### IAM Principal Context
|
|
186
189
|
|
|
187
190
|
- **`aws:PrincipalArn`**
|
|
188
|
-
The full ARN of the principal (user, role,
|
|
191
|
+
The full ARN of the principal (user, role, role session, or federated user) being simulated.
|
|
189
192
|
|
|
190
193
|
- **`aws:PrincipalAccount`**
|
|
191
194
|
The AWS account ID extracted from the principal ARN.
|
|
@@ -200,7 +203,7 @@ Below are the context keys that iam-lens populates by default during simulation.
|
|
|
200
203
|
For each tag on the IAM principal, a context key of the form `aws:PrincipalTag/<TagKey>` with its tag value.
|
|
201
204
|
|
|
202
205
|
- **`aws:PrincipalIsAWSService`**
|
|
203
|
-
Set to `
|
|
206
|
+
Set to `false` for all IAM principals (users, roles, federated users).
|
|
204
207
|
|
|
205
208
|
- **`aws:PrincipalType`**
|
|
206
209
|
One of: `Account`, `User`, `FederatedUser`, `AssumedRole`, indicating the type of principal.
|
|
@@ -213,34 +216,43 @@ Below are the context keys that iam-lens populates by default during simulation.
|
|
|
213
216
|
- For a federated user: `<AccountId>:<FederatedName>`
|
|
214
217
|
- For an assumed role: `<RoleUniqueId>:<SessionName>`
|
|
215
218
|
|
|
219
|
+
Setting `role-id:ec2-instance-id` for EC2 instances is not supported at this time.
|
|
220
|
+
|
|
216
221
|
- **`aws:username`** _(only for IAM users)_
|
|
217
222
|
The IAM username portion of the principal ARN (e.g. `Alice`).
|
|
218
223
|
|
|
219
|
-
|
|
224
|
+
#### Service Principal Context
|
|
225
|
+
|
|
226
|
+
The following context keys are set when the principal is an AWS service (e.g., `lambda.amazonaws.com`, `ec2.amazonaws.com`):
|
|
227
|
+
|
|
228
|
+
- **`aws:PrincipalServiceName`**
|
|
220
229
|
The service principal string (e.g. `lambda.amazonaws.com`).
|
|
221
230
|
|
|
222
|
-
- **`aws:SourceAccount`**
|
|
223
|
-
The account ID of the
|
|
231
|
+
- **`aws:SourceAccount`**
|
|
232
|
+
The account ID of the resource.
|
|
224
233
|
|
|
225
|
-
- **`aws:SourceOrgID`**
|
|
226
|
-
The organization ID of the
|
|
234
|
+
- **`aws:SourceOrgID`**
|
|
235
|
+
The organization ID of the resource’s account (if part of an organization).
|
|
227
236
|
|
|
228
|
-
- **`aws:SourceOrgPaths`**
|
|
229
|
-
The OU hierarchy path for the
|
|
237
|
+
- **`aws:SourceOrgPaths`**
|
|
238
|
+
The OU hierarchy path for the resource’s account (if part of an organization).
|
|
239
|
+
|
|
240
|
+
- **`aws:PrincipalIsAWSService`**
|
|
241
|
+
Set to `true` for all service principals. Set to `false` for all IAM principals (users, roles, federated users).
|
|
230
242
|
|
|
231
|
-
#### Resource Context (unless action is excluded)
|
|
243
|
+
#### Resource Context ([unless action is excluded](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceaccount))
|
|
232
244
|
|
|
233
245
|
- **`aws:ResourceAccount`**
|
|
234
|
-
The AWS account ID of the
|
|
246
|
+
The AWS account ID of the resource.
|
|
235
247
|
|
|
236
|
-
- **`aws:ResourceOrgID`**
|
|
237
|
-
The Organization ID for the resource’s account.
|
|
248
|
+
- **`aws:ResourceOrgID`**
|
|
249
|
+
The Organization ID for the resource’s account (if part of an organization).
|
|
238
250
|
|
|
239
251
|
- **`aws:ResourceOrgPaths`** _(if the resource account is in an organization)_
|
|
240
|
-
A list containing a single string of the form `<OrgId>/<OU1>/<OU2>/…/` for the resource’s account.
|
|
252
|
+
A list containing a single string of the form `<OrgId>/<OU1>/<OU2>/…/` for the resource’s account (if part of an organization).
|
|
241
253
|
|
|
242
254
|
- **`aws:ResourceTag/<TagKey>`**
|
|
243
|
-
For each tag on the resource ARN, a context key `aws:ResourceTag/TagKey` with its tag value. **This is only for resources that are stored in your `iam-collect` data**, such as Roles, S3 Buckets, DynamoDB Tables, etc. For resources not stored in `iam-collect`, this key
|
|
255
|
+
For each tag on the resource ARN, a context key `aws:ResourceTag/TagKey` with its tag value. **This is only for resources that are stored in your `iam-collect` data**, such as Roles, S3 Buckets, DynamoDB Tables, etc. For resources not stored in `iam-collect`, this key should be set manually.
|
|
244
256
|
|
|
245
257
|
### Overriding Default Context Keys
|
|
246
258
|
|
package/dist/cjs/cli.js
CHANGED
|
@@ -22,7 +22,7 @@ const main = async () => {
|
|
|
22
22
|
values: 'single',
|
|
23
23
|
description: 'The ARN of the resource to simulate access to. Ignore for wildcard actions'
|
|
24
24
|
},
|
|
25
|
-
|
|
25
|
+
resourceAccount: {
|
|
26
26
|
type: 'string',
|
|
27
27
|
values: 'single',
|
|
28
28
|
description: 'The account ID of the resource, only required if it cannot be determined from the resource ARN.'
|
|
@@ -94,12 +94,12 @@ const main = async () => {
|
|
|
94
94
|
const collectConfigs = await (0, collect_js_1.loadCollectConfigs)(cli.args.collectConfigs);
|
|
95
95
|
const collectClient = (0, collect_js_1.getCollectClient)(collectConfigs, thePartition);
|
|
96
96
|
if (cli.subcommand === 'simulate') {
|
|
97
|
-
const { principal, resource,
|
|
97
|
+
const { principal, resource, resourceAccount, action, context } = cli.args;
|
|
98
98
|
const contextKeys = convertContextKeysToMap(context);
|
|
99
99
|
const result = await (0, simulate_js_1.simulateRequest)({
|
|
100
100
|
principal: principal,
|
|
101
101
|
resourceArn: resource,
|
|
102
|
-
resourceAccount:
|
|
102
|
+
resourceAccount: resourceAccount,
|
|
103
103
|
action: action,
|
|
104
104
|
customContextKeys: contextKeys
|
|
105
105
|
}, collectClient);
|
package/dist/cjs/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;;AAEA,4CAAsD;AACtD,qDAA2E;AAE3E,wDAAkF;AAClF,iEAA0D;AAC1D,kDAA2C;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,IAAA,kCAAc,GAAE,CAAA;IACtC,MAAM,GAAG,GAAG,IAAA,uBAAiB,EAC3B,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE;gBACP,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,yEAAyE;iBACvF;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,4EAA4E;iBAC/E;gBACD,
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;;AAEA,4CAAsD;AACtD,qDAA2E;AAE3E,wDAAkF;AAClF,iEAA0D;AAC1D,kDAA2C;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,IAAA,kCAAc,GAAE,CAAA;IACtC,MAAM,GAAG,GAAG,IAAA,uBAAiB,EAC3B,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE;gBACP,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,yEAAyE;iBACvF;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,4EAA4E;iBAC/E;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,iGAAiG;iBACpG;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,wFAAwF;iBAC3F;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU;oBAClB,WAAW,EACT,oJAAoJ;iBACvJ;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,0CAA0C;oBACvD,SAAS,EAAE,GAAG;iBACf;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,CAAC;oBAC3E,WAAW,EACT,iIAAiI;iBACpI;aACF;SACF;QACD,SAAS,EAAE;YACT,WAAW,EAAE,8CAA8C;YAC3D,OAAO,EAAE;gBACP,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,+EAA+E;iBAClF;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,+HAA+H;iBAClI;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU;oBAClB,WAAW,EACT,oGAAoG;iBACvG;aACF;SACF;KACF,EACD;QACE,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,4CAA4C;YACzD,MAAM,EAAE,UAAU;SACnB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,sEAAsE;YACnF,MAAM,EAAE,QAAQ;SACjB;KACF,EACD;QACE,SAAS,EAAE,UAAU;QACrB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;QACvB,OAAO;KACR,CACF,CAAA;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IAChD,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAkB,EAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACxE,MAAM,aAAa,GAAG,IAAA,6BAAgB,EAAC,cAAc,EAAE,YAAY,CAAC,CAAA;IAEpE,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QAC1E,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;QAEpD,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAe,EAClC;YACE,SAAS,EAAE,SAAU;YACrB,WAAW,EAAE,QAAQ;YACrB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,MAAO;YACf,iBAAiB,EAAE,WAAW;SAC/B,EACD,aAAa,CACd,CAAA;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5D,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,CAAC,IAAA,sCAAwB,EAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAO,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACvD,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,KAAK,CACX,qGAAqG,CACtG,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAM,EAAC,aAAa,EAAE;YAC1C,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAS;YAC5B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAQ;YAC1B,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;SAC1C,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC,CAAA;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC;KACD,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;KACd,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AAEpB;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,WAAqB;IACpD,MAAM,UAAU,GAAsC,EAAE,CAAA;IACxD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,UAAU,CAAC,OAAO,CAAC,GAAG,MAAM,CAAA;YAC9B,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC"}
|
package/dist/esm/cli.js
CHANGED
|
@@ -20,7 +20,7 @@ const main = async () => {
|
|
|
20
20
|
values: 'single',
|
|
21
21
|
description: 'The ARN of the resource to simulate access to. Ignore for wildcard actions'
|
|
22
22
|
},
|
|
23
|
-
|
|
23
|
+
resourceAccount: {
|
|
24
24
|
type: 'string',
|
|
25
25
|
values: 'single',
|
|
26
26
|
description: 'The account ID of the resource, only required if it cannot be determined from the resource ARN.'
|
|
@@ -92,12 +92,12 @@ const main = async () => {
|
|
|
92
92
|
const collectConfigs = await loadCollectConfigs(cli.args.collectConfigs);
|
|
93
93
|
const collectClient = getCollectClient(collectConfigs, thePartition);
|
|
94
94
|
if (cli.subcommand === 'simulate') {
|
|
95
|
-
const { principal, resource,
|
|
95
|
+
const { principal, resource, resourceAccount, action, context } = cli.args;
|
|
96
96
|
const contextKeys = convertContextKeysToMap(context);
|
|
97
97
|
const result = await simulateRequest({
|
|
98
98
|
principal: principal,
|
|
99
99
|
resourceArn: resource,
|
|
100
|
-
resourceAccount:
|
|
100
|
+
resourceAccount: resourceAccount,
|
|
101
101
|
action: action,
|
|
102
102
|
customContextKeys: contextKeys
|
|
103
103
|
}, collectClient);
|
package/dist/esm/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAE3E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAA;IACtC,MAAM,GAAG,GAAG,iBAAiB,CAC3B,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE;gBACP,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,yEAAyE;iBACvF;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,4EAA4E;iBAC/E;gBACD,
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAE3E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAA;IACtC,MAAM,GAAG,GAAG,iBAAiB,CAC3B,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE;gBACP,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,yEAAyE;iBACvF;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,4EAA4E;iBAC/E;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,iGAAiG;iBACpG;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,wFAAwF;iBAC3F;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU;oBAClB,WAAW,EACT,oJAAoJ;iBACvJ;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,0CAA0C;oBACvD,SAAS,EAAE,GAAG;iBACf;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,CAAC;oBAC3E,WAAW,EACT,iIAAiI;iBACpI;aACF;SACF;QACD,SAAS,EAAE;YACT,WAAW,EAAE,8CAA8C;YAC3D,OAAO,EAAE;gBACP,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,+EAA+E;iBAClF;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,+HAA+H;iBAClI;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU;oBAClB,WAAW,EACT,oGAAoG;iBACvG;aACF;SACF;KACF,EACD;QACE,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,4CAA4C;YACzD,MAAM,EAAE,UAAU;SACnB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,sEAAsE;YACnF,MAAM,EAAE,QAAQ;SACjB;KACF,EACD;QACE,SAAS,EAAE,UAAU;QACrB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;QACvB,OAAO;KACR,CACF,CAAA;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IAChD,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACxE,MAAM,aAAa,GAAG,gBAAgB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAA;IAEpE,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QAC1E,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;QAEpD,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,SAAS,EAAE,SAAU;YACrB,WAAW,EAAE,QAAQ;YACrB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,MAAO;YACf,iBAAiB,EAAE,WAAW;SAC/B,EACD,aAAa,CACd,CAAA;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5D,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAO,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACvD,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,KAAK,CACX,qGAAqG,CACtG,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE;YAC1C,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAS;YAC5B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAQ;YAC1B,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;SAC1C,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC,CAAA;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC;KACD,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;KACd,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AAEpB;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,WAAqB;IACpD,MAAM,UAAU,GAAsC,EAAE,CAAA;IACxD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,UAAU,CAAC,OAAO,CAAC,GAAG,MAAM,CAAA;YAC9B,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC"}
|