@cloud-copilot/iam-simulate 0.1.107 → 0.1.108

package/dist/esm/services/DefaultServiceAuthorizer.js

@@ -2,6 +2,69 @@ import { isAssumedRoleArn, isFederatedUserArn, isIamRoleArn, isIamUserArn, isSer
 import {} from '../evaluate.js';
 import {} from '../request/requestResource.js';
 import {} from './ServiceAuthorizer.js';
+/**
+ * This helper class keeps track of which factors are blocking a request and what the overall result is
+ * based on those blocks.
+ */
+class BlockedByLog {
+    /**
+     * Create the BlockedByLog
+     *
+     * @param coreResult the core result of the authorization. Is the request allowed or denied based on the core policies (identity, resource, session).
+     */
+    constructor(coreResult) {
+        this.coreResult = coreResult;
+        this.blockedBy = new Set();
+        this.result = coreResult;
+    }
+    /**
+     * Add a blocking factor to the log and update the overall result accordingly.
+     *
+     * @param reason the reason for the block.
+     * @param result the result of the block (ImplicitlyDenied, ExplicitlyDenied)
+     */
+    add(reason, result) {
+        if (this.coreResult === 'Allowed' && result !== 'Allowed') {
+            this.blockedBy.add(reason);
+        }
+        this.setResult(result);
+    }
+    /**
+     * Calculates and sets the new overall result based on the new block reason and the previous result.
+     *
+     * The result can only be modified down so Allowed -> ImplicitlyDenied -> ExplicitlyDenied.
+     *
+     * @param newResult the result of the new block reason being added.
+     */
+    setResult(newResult) {
+        // Explicit denies override everything
+        if (this.result === 'ExplicitlyDenied') {
+            return;
+        }
+        if (newResult === 'ExplicitlyDenied') {
+            this.result = 'ExplicitlyDenied';
+        }
+        else if (newResult === 'ImplicitlyDenied') {
+            this.result = 'ImplicitlyDenied';
+        }
+    }
+    /**
+     * Get the overall result after all blocks (if any) have been added.
+     *
+     * @returns the overall result after all blocks (if any) have been added.
+     */
+    getResult() {
+        return this.result;
+    }
+    /**
+     * Get the list of reasons that are blocking the request after the core result.
+     *
+     * @returns an array of reasons that are blocking the request after the core result.
+     */
+    getBlockedBy() {
+        return Array.from(this.blockedBy);
+    }
+}
 /**
  * The default authorizer for services.
  */
@@ -15,7 +78,6 @@ export class DefaultServiceAuthorizer {
     authorize(request) {
         const scpResult = request.scpAnalysis.result;
         const rcpResult = request.rcpAnalysis.result;
-        const sessionResult = request.sessionAnalysis?.result;
         const identityStatementResult = request.identityAnalysis.result;
         const resourcePolicyResult = request.resourceAnalysis?.result;
         const permissionBoundaryResult = request.permissionBoundaryAnalysis?.result;
@@ -33,66 +95,26 @@ export class DefaultServiceAuthorizer {
             permissionBoundaryAnalysis: request.permissionBoundaryAnalysis,
             endpointAnalysis: request.endpointAnalysis
         };
-        if (scpResult !== 'Allowed') {
-            return {
-                result: scpResult,
-                ...baseResult
-            };
-        }
-        if (rcpResult !== 'Allowed') {
-            return {
-                result: rcpResult,
-                ...baseResult
-            };
-        }
-        if (sessionResult && sessionResult !== 'Allowed') {
-            return {
-                result: sessionResult,
-                ...baseResult
-            };
-        }
+        const coreResult = this.initialEvaluationResult(request);
+        const blockedByLog = new BlockedByLog(coreResult);
+        blockedByLog.add('scp', scpResult);
+        blockedByLog.add('rcp', rcpResult);
         if (endpointPolicyResult === 'ExplicitlyDenied' ||
             endpointPolicyResult === 'ImplicitlyDenied') {
-            return {
-                result: endpointPolicyResult,
-                ...baseResult
-            };
+            blockedByLog.add('vpce', endpointPolicyResult);
         }
         if (resourcePolicyResult === 'ExplicitlyDenied' ||
             resourcePolicyResult === 'DeniedForAccount') {
-            return {
-                result: 'ExplicitlyDenied',
-                ...baseResult
-            };
+            blockedByLog.add('resource', 'ExplicitlyDenied');
         }
         if (identityStatementResult === 'ExplicitlyDenied') {
-            return {
-                result: 'ExplicitlyDenied',
-                ...baseResult
-            };
+            blockedByLog.add('identity', 'ExplicitlyDenied');
         }
         if (permissionBoundaryResult === 'ExplicitlyDenied') {
-            return {
-                result: 'ExplicitlyDenied',
-                ...baseResult
-            };
-        }
-        // Service Principals
-        if (isServicePrincipal(request.request.principal.value())) {
-            // Service principals are allowed if the resource policy allows them
-            if (resourcePolicyResult === 'Allowed') {
-                return {
-                    result: 'Allowed',
-                    ...baseResult
-                };
-            }
-            return {
-                result: 'ImplicitlyDenied',
-                ...baseResult
-            };
+            blockedByLog.add('pb', 'ExplicitlyDenied');
         }
         //Same Account
-        if (principalAccount === resourceAccount) {
+        if (sameAccount) {
             if (permissionBoundaryResult === 'ImplicitlyDenied') {
                 /**
                  * If the permission boundary is an implicit deny
@@ -106,80 +128,48 @@ export class DefaultServiceAuthorizer {
                     const principal = request.request.principal.value();
                     if (isIamRoleArn(principal) &&
                         request.simulationParameters.simulationMode === 'Discovery') {
-                        if (request.resourceAnalysis.allowStatements.some((statement) => statement.principalMatch === 'Match' && statement.ignoredRoleSessionName)) {
-                            return {
-                                result: 'Allowed',
-                                ...baseResult
-                            };
+                        // Principal is a role and may match a session. Check since we are in Discovery mode.
+                        if (!request.resourceAnalysis.allowStatements.some((statement) => statement.principalMatch === 'Match' && statement.ignoredRoleSessionName)) {
+                            blockedByLog.add('pb', 'ImplicitlyDenied');
                         }
                     }
-                    if (isAssumedRoleArn(principal) ||
+                    else if (isAssumedRoleArn(principal) ||
                         isIamUserArn(principal) ||
                         isFederatedUserArn(principal)) {
-                        if (request.resourceAnalysis.allowStatements.some((statement) => statement.principalMatch === 'Match')) {
-                            return {
-                                result: 'Allowed',
-                                ...baseResult
-                            };
+                        // If the principal is an assumed role, IAM user, or federated user ARN, check if the resource
+                        // policy allows the exact ARN.
+                        if (!request.resourceAnalysis.allowStatements.some((statement) => statement.principalMatch === 'Match')) {
+                            blockedByLog.add('pb', 'ImplicitlyDenied');
                         }
                     }
+                    else {
+                        // Not in discovery mode or doesn't match a session/user exactly, so the permission boundary implicit deny applies.
+                        blockedByLog.add('pb', 'ImplicitlyDenied');
+                    }
+                }
+                else {
+                    // Resource policy doesn't allow the principal, so the permission boundary implicit deny applies.
+                    blockedByLog.add('pb', 'ImplicitlyDenied');
                 }
-                return {
-                    result: 'ImplicitlyDenied',
-                    ...baseResult
-                };
-            }
-            /*
-              TODO: Implicit denies in identity policies
-              I think if the identity policy has an implicit deny for assumed roles or federated users,
-              then the resource policy must have the federated or assumed role ARN exactly.
-      
-              That doesn't seem right though. I know many cases where the resource policy has the role ARN and it works
-      
-              Need to add some tests for this.
-            */
-            const trustedAccount = this.serviceTrustsPrincipalAccount(sameAccount, request.resourceAnalysis, request.request.resource);
-            if (resourcePolicyResult === 'Allowed' ||
-                (trustedAccount && identityStatementResult === 'Allowed')) {
-                return {
-                    result: 'Allowed',
-                    ...baseResult
-                };
             }
-            return {
-                result: 'ImplicitlyDenied',
-                ...baseResult
-            };
         }
-        //Cross Account
-        if (permissionBoundaryResult === 'ImplicitlyDenied') {
-            return {
-                result: 'ImplicitlyDenied',
-                ...baseResult
-            };
-        }
-        if (resourcePolicyResult === 'Allowed' || resourcePolicyResult === 'AllowedForAccount') {
-            if (identityStatementResult === 'Allowed') {
-                return {
-                    result: 'Allowed',
-                    ...baseResult
-                };
+        else {
+            //Cross Account
+            if (permissionBoundaryResult === 'ImplicitlyDenied') {
+                blockedByLog.add('pb', 'ImplicitlyDenied');
             }
-            return {
-                result: 'ImplicitlyDenied',
-                ...baseResult
-            };
+        }
+        const blockedReasons = blockedByLog.getBlockedBy();
+        if (blockedReasons.length !== 0) {
+            baseResult.blockedBy = blockedReasons;
         }
         return {
-            result: 'ImplicitlyDenied',
+            result: blockedByLog.getResult(),
             ...baseResult
         };
         /**
          * Add checks for:
          * * root user - can override resource policies for most resource types
-         * * service linked roles - ignore SCPs and RCPs
-         * * session policies
-         * * vpc endpoint policies
          * * organization APIs and delegated admin policy
          */
     }
@@ -196,5 +186,55 @@ export class DefaultServiceAuthorizer {
         }
         return resourceAnalysis.allowStatements.some((statement) => statement.principalMatch === 'AccountLevelMatch');
     }
+    /**
+     * Evaluations whether the minimum requirements for the request to be allowed are met based on the core policies
+     *   - Identity
+     *   - Resource
+     *   - Session
+     *
+     * Depending on the service, and whether the principal and resources are in the same account, the requirements may differ.
+     * For same account requests, for most services an Allow in the resource policy or the identity policy is sufficient to
+     * allow the request, so this function will return 'Allowed'. If there is an explicit deny elsewhere, that is not considered.
+     * This function only determines if there are enough core policies to allow the request, and final determination of the
+     * request is done elsewhere.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns 'Allowed' if the core policies allow the request, otherwise may return 'ImplicitlyDenied' or 'ExplicitlyDenied' depending on the analyses
+     */
+    initialEvaluationResult(request) {
+        const sessionResult = request.sessionAnalysis?.result;
+        const identityStatementResult = request.identityAnalysis.result;
+        const resourcePolicyResult = request.resourceAnalysis?.result;
+        const principalAccount = request.request.principal.accountId();
+        const resourceAccount = request.request.resource?.accountId();
+        const sameAccount = principalAccount === resourceAccount;
+        if (sessionResult && sessionResult !== 'Allowed') {
+            return sessionResult;
+        }
+        // Service Principals
+        if (isServicePrincipal(request.request.principal.value())) {
+            // Service principals are allowed if the resource policy allows them
+            if (resourcePolicyResult === 'Allowed') {
+                return 'Allowed';
+            }
+            return 'ImplicitlyDenied';
+        }
+        //Same Account
+        if (sameAccount) {
+            const trustedAccount = this.serviceTrustsPrincipalAccount(sameAccount, request.resourceAnalysis, request.request.resource);
+            if (resourcePolicyResult === 'Allowed' ||
+                (trustedAccount && identityStatementResult === 'Allowed')) {
+                return 'Allowed';
+            }
+            return 'ImplicitlyDenied';
+        }
+        //Cross Account
+        if (resourcePolicyResult === 'Allowed' || resourcePolicyResult === 'AllowedForAccount') {
+            if (identityStatementResult === 'Allowed') {
+                return 'Allowed';
+            }
+        }
+        return 'ImplicitlyDenied';
+    }
 }
 //# sourceMappingURL=DefaultServiceAuthorizer.js.map

package/dist/esm/services/DefaultServiceAuthorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/DefaultServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EACnB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAA+C,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAwB,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAA4D,MAAM,wBAAwB,CAAA;AAEjG;;GAEG;AACH,MAAM,OAAO,wBAAwB;IACnC;;;;;OAKG;IACI,SAAS,CAAC,OAAoC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAA;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAA;QAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM,CAAA;QACrD,MAAM,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAA;QAC/D,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAA;QAC7D,MAAM,wBAAwB,GAAG,OAAO,CAAC,0BAA0B,EAAE,MAAM,CAAA;QAC3E,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAA;QAE7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,CAAA;QAC9D,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAA;QAC7D,MAAM,WAAW,GAAG,gBAAgB,KAAK,eAAe,CAAA;QAExD,MAAM,UAAU,GAUZ;YACF,WAAW;YACX,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAA;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,GAAG,UAAU;aACd,CAAA;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,GAAG,UAAU;aACd,CAAA;QACH,CAAC;QAED,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,GAAG,UAAU;aACd,CAAA;QACH,CAAC;QAED,IACE,oBAAoB,KAAK,kBAAkB;YAC3C,oBAAoB,KAAK,kBAAkB,EAC3C,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,oBAAoB;gBAC5B,GAAG,UAAU;aACd,CAAA;QACH,CAAC;QAED,IACE,oBAAoB,KAAK,kBAAkB;YAC3C,oBAAoB,KAAK,kBAAkB,EAC3C,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,UAAU;aACd,CAAA;QACH,CAAC;QAED,IAAI,uBAAuB,KAAK,kBAAkB,EAAE,CAAC;YACnD,OAAO;gBACL,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,UAAU;aACd,CAAA;QACH,CAAC;QAED,IAAI,wBAAwB,KAAK,kBAAkB,EAAE,CAAC;YACpD,OAAO;gBACL,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,UAAU;aACd,CAAA;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC1D,oEAAoE;YACpE,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,GAAG,UAAU;iBACd,CAAA;YACH,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,UAAU;aACd,CAAA;QACH,CAAC;QAED,cAAc;QACd,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;YACzC,IAAI,wBAAwB,KAAK,kBAAkB,EAAE,CAAC;gBACpD;;;;;;;mBAOG;gBACH,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;oBACvC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAA;oBACnD,IACE,YAAY,CAAC,SAAS,CAAC;wBACvB,OAAO,CAAC,oBAAoB,CAAC,cAAc,KAAK,WAAW,EAC3D,CAAC;wBACD,IACE,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAC3C,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,cAAc,KAAK,OAAO,IAAI,SAAS,CAAC,sBAAsB,CAC3E,EACD,CAAC;4BACD,OAAO;gCACL,MAAM,EAAE,SAAS;gCACjB,GAAG,UAAU;6BACd,CAAA;wBACH,CAAC;oBACH,CAAC;oBAED,IACE,gBAAgB,CAAC,SAAS,CAAC;wBAC3B,YAAY,CAAC,SAAS,CAAC;wBACvB,kBAAkB,CAAC,SAAS,CAAC,EAC7B,CAAC;wBACD,IACE,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAC3C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,KAAK,OAAO,CACpD,EACD,CAAC;4BACD,OAAO;gCACL,MAAM,EAAE,SAAS;gCACjB,GAAG,UAAU;6BACd,CAAA;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,kBAAkB;oBAC1B,GAAG,UAAU;iBACd,CAAA;YACH,CAAC;YAED;;;;;;;;cAQE;YAEF,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CACvD,WAAW,EACX,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,OAAO,CAAC,QAAQ,CACzB,CAAA;YACD,IACE,oBAAoB,KAAK,SAAS;gBAClC,CAAC,cAAc,IAAI,uBAAuB,KAAK,SAAS,CAAC,EACzD,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,GAAG,UAAU;iBACd,CAAA;YACH,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,UAAU;aACd,CAAA;QACH,CAAC;QAED,eAAe;QACf,IAAI,wBAAwB,KAAK,kBAAkB,EAAE,CAAC;YACpD,OAAO;gBACL,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,UAAU;aACd,CAAA;QACH,CAAC;QAED,IAAI,oBAAoB,KAAK,SAAS,IAAI,oBAAoB,KAAK,mBAAmB,EAAE,CAAC;YACvF,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAC1C,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,GAAG,UAAU;iBACd,CAAA;YACH,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,UAAU;aACd,CAAA;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,GAAG,UAAU;SACd,CAAA;QAED;;;;;;;WAOG;IACL,CAAC;IAED;;;;;;OAMG;IACH,6BAA6B,CAC3B,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,KAAK,mBAAmB,CAChE,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"DefaultServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/DefaultServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EACnB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAKN,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAwB,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAA4D,MAAM,wBAAwB,CAAA;AAEjG;;;GAGG;AACH,MAAM,YAAY;IAIhB;;;;OAIG;IACH,YAA6B,UAA4B;QAA5B,eAAU,GAAV,UAAU,CAAkB;QARjD,cAAS,GAAuB,IAAI,GAAG,EAAE,CAAA;QAS/C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAA;IAC1B,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,MAAqB,EAAE,MAAwB;QACjD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5B,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxB,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CAAC,SAA2B;QAC3C,sCAAsC;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YACvC,OAAM;QACR,CAAC;QACD,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAA;QAClC,CAAC;aAAM,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAA;QAClC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,wBAAwB;IACnC;;;;;OAKG;IACI,SAAS,CAAC,OAAoC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAA;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAA;QAC5C,MAAM,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAA;QAC/D,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAA;QAC7D,MAAM,wBAAwB,GAAG,OAAO,CAAC,0BAA0B,EAAE,MAAM,CAAA;QAC3E,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAA;QAE7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,CAAA;QAC9D,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAA;QAC7D,MAAM,WAAW,GAAG,gBAAgB,KAAK,eAAe,CAAA;QAExD,MAAM,UAAU,GAWZ;YACF,WAAW;YACX,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAA;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAA;QACxD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,UAAU,CAAC,CAAA;QAEjD,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAClC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAElC,IACE,oBAAoB,KAAK,kBAAkB;YAC3C,oBAAoB,KAAK,kBAAkB,EAC3C,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;QAChD,CAAC;QAED,IACE,oBAAoB,KAAK,kBAAkB;YAC3C,oBAAoB,KAAK,kBAAkB,EAC3C,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,uBAAuB,KAAK,kBAAkB,EAAE,CAAC;YACnD,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,wBAAwB,KAAK,kBAAkB,EAAE,CAAC;YACpD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;QAC5C,CAAC;QAED,cAAc;QACd,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,wBAAwB,KAAK,kBAAkB,EAAE,CAAC;gBACpD;;;;;;;mBAOG;gBACH,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;oBACvC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAA;oBACnD,IACE,YAAY,CAAC,SAAS,CAAC;wBACvB,OAAO,CAAC,oBAAoB,CAAC,cAAc,KAAK,WAAW,EAC3D,CAAC;wBACD,qFAAqF;wBACrF,IACE,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAC5C,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,cAAc,KAAK,OAAO,IAAI,SAAS,CAAC,sBAAsB,CAC3E,EACD,CAAC;4BACD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;wBAC5C,CAAC;oBACH,CAAC;yBAAM,IACL,gBAAgB,CAAC,SAAS,CAAC;wBAC3B,YAAY,CAAC,SAAS,CAAC;wBACvB,kBAAkB,CAAC,SAAS,CAAC,EAC7B,CAAC;wBACD,8FAA8F;wBAC9F,+BAA+B;wBAC/B,IACE,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAC5C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,KAAK,OAAO,CACpD,EACD,CAAC;4BACD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;wBAC5C,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,mHAAmH;wBACnH,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;oBAC5C,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,iGAAiG;oBACjG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,eAAe;YACf,IAAI,wBAAwB,KAAK,kBAAkB,EAAE,CAAC;gBACpD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,EAAE,CAAA;QAClD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,SAAS,GAAG,cAAc,CAAA;QACvC,CAAC;QAED,OAAO;YACL,MAAM,EAAE,YAAY,CAAC,SAAS,EAAE;YAChC,GAAG,UAAU;SACd,CAAA;QAED;;;;WAIG;IACL,CAAC;IAED;;;;;;OAMG;IACH,6BAA6B,CAC3B,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,KAAK,mBAAmB,CAChE,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,uBAAuB,CAAC,OAAoC;QAClE,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM,CAAA;QACrD,MAAM,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAA;QAC/D,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAA;QAE7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,CAAA;QAC9D,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAA;QAC7D,MAAM,WAAW,GAAG,gBAAgB,KAAK,eAAe,CAAA;QAExD,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,aAAa,CAAA;QACtB,CAAC;QAED,qBAAqB;QACrB,IAAI,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC1D,oEAAoE;YACpE,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,kBAAkB,CAAA;QAC3B,CAAC;QAED,cAAc;QACd,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CACvD,WAAW,EACX,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,OAAO,CAAC,QAAQ,CACzB,CAAA;YACD,IACE,oBAAoB,KAAK,SAAS;gBAClC,CAAC,cAAc,IAAI,uBAAuB,KAAK,SAAS,CAAC,EACzD,CAAC;gBACD,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,kBAAkB,CAAA;QAC3B,CAAC;QAED,eAAe;QACf,IAAI,oBAAoB,KAAK,SAAS,IAAI,oBAAoB,KAAK,mBAAmB,EAAE,CAAC;YACvF,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAC1C,OAAO,SAAS,CAAA;YAClB,CAAC;QACH,CAAC;QAED,OAAO,kBAAkB,CAAA;IAC3B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloud-copilot/iam-simulate",
-  "version": "0.1.107",
+  "version": "0.1.108",
   "description": "Simulate evaluation of AWS IAM policies",
   "repository": {
     "type": "git",