@cloud-copilot/iam-simulate 0.1.5 → 0.1.7

package/dist/esm/global_conditions/globalConditionKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"globalConditionKeys.d.ts","sourceRoot":"","sources":["../../../src/global_conditions/globalConditionKeys.ts"],"names":[],"mappings":"AAAA,UAAU,kBAAkB;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AA0QD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEjF;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAEvF"}
+{"version":3,"file":"globalConditionKeys.d.ts","sourceRoot":"","sources":["../../../src/global_conditions/globalConditionKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,UAAU,kBAAkB;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,gBAAgB,CAAA;CAC3B;AAyRD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEjF;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD"}

package/dist/esm/global_conditions/globalConditionKeys.js

@@ -2,247 +2,262 @@ const globalConditionKeys = [
     {
         key: "aws:PrincipalArn",
         category: "principal",
-        dataType: ""
+        dataType: "ARN"
     },
     {
         key: "aws:PrincipalAccount",
         category: "principal",
-        dataType: ""
+        dataType: "String"
     },
     {
         key: "aws:PrincipalOrgPaths",
         category: "principal",
-        dataType: ""
+        dataType: "ArrayOfString"
     },
     {
         key: "aws:PrincipalOrgID",
         category: "principal",
-        dataType: ""
+        dataType: "String"
     },
     {
         key: "aws:PrincipalTag/tag-key",
         category: "principal",
-        dataType: ""
+        dataType: "String"
     },
     {
         key: "aws:PrincipalIsAWSService",
         category: "principal",
-        dataType: ""
+        dataType: "Bool"
     },
     {
         key: "aws:PrincipalServiceName",
         category: "principal",
-        dataType: ""
+        dataType: "String"
     },
     {
         key: "aws:PrincipalServiceNamesList",
         category: "principal",
-        dataType: ""
+        dataType: "ArrayOfString"
     },
     {
         key: "aws:PrincipalType",
         category: "principal",
-        dataType: ""
+        dataType: "String"
     },
     {
         key: "aws:userid",
         category: "principal",
-        dataType: ""
+        dataType: "String"
     },
     {
         key: "aws:username",
         category: "principal",
-        dataType: ""
+        dataType: "String"
+    },
+    {
+        key: "aws:AssumedRoot",
+        category: "session",
+        dataType: "String",
     },
     {
         key: "aws:FederatedProvider",
         category: "session",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:TokenIssueTime",
         category: "session",
-        dataType: "",
+        dataType: "Date",
     },
     {
         key: "aws:MultiFactorAuthAge",
         category: "session",
-        dataType: "",
+        dataType: "Numeric",
     },
     {
         key: "aws:MultiFactorAuthPresent",
         category: "session",
-        dataType: "",
+        dataType: "Bool",
+    },
+    {
+        key: "aws:ChatbotSourceArn",
+        category: "session",
+        dataType: "ARN",
     },
     {
         key: "aws:Ec2InstanceSourceVpc",
         category: "session",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:Ec2InstanceSourcePrivateIPv4",
         category: "session",
-        dataType: "",
+        dataType: "IPAddress",
     },
     {
         key: "aws:SourceIdentity",
         category: "session",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "ec2:RoleDelivery",
         category: "session",
-        dataType: "",
+        dataType: "Numeric",
     },
     {
         key: "ec2:SourceInstanceArn",
         category: "session",
-        dataType: "",
+        dataType: "ARN",
     },
     {
         key: "glue:RoleAssumedBy",
         category: "session",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "glue:CredentialIssuingService",
         category: "session",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "lambda:SourceFunctionArn",
         category: "session",
-        dataType: "",
+        dataType: "ARN",
     },
     {
         key: "ssm:SourceInstanceArn",
         category: "session",
-        dataType: "",
+        dataType: "ARN",
     },
     {
         key: "identitystore:UserId",
         category: "session",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:SourceIp",
         category: "network",
-        dataType: "",
+        dataType: "IPAddress",
     },
     {
         key: "aws:SourceVpc",
         category: "network",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:SourceVpce",
         category: "network",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:VpcSourceIp  ",
         category: "network",
-        dataType: "",
+        dataType: "IPAddress",
     },
     {
         key: "aws:ResourceAccount",
         category: "resource",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:ResourceOrgID",
         category: "resource",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:ResourceOrgPaths",
         category: "resource",
-        dataType: "",
+        dataType: "ArrayOfString",
     },
     {
         key: "aws:ResourceTag/tag-key",
         category: "resource",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:CalledVia",
         category: "request",
-        dataType: "",
+        dataType: "ArrayOfString",
     },
     {
         key: "aws:CalledViaFirst",
         category: "request",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:CalledViaLast",
         category: "request",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:ViaAWSService",
         category: "request",
-        dataType: "",
+        dataType: "Bool",
     },
     {
         key: "aws:CurrentTime",
         category: "request",
-        dataType: "",
+        dataType: "Date",
     },
     {
         key: "aws:EpochTime",
         category: "request",
-        dataType: "",
+        dataType: "Date", //Can Also be Numeric...
     },
     {
         key: "aws:referer",
         category: "request",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:RequestedRegion",
         category: "request",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:RequestTag/tag-key",
         category: "request",
-        dataType: "",
+        dataType: "String",
     },
     {
         key: "aws:TagKeys",
         category: "request",
-        dataType: "",
+        dataType: "ArrayOfString",
     },
     {
         key: "aws:SecureTransport",
         category: "request",
-        dataType: "",
+        dataType: "Bool",
     },
     {
         key: "aws:SourceArn",
         category: "request",
-        dataType: "",
+        dataType: "ARN",
     },
     {
         key: "aws:SourceAccount",
         category: "request",
-        dataType: "",
+        dataType: "String",
+    },
+    {
+        key: "aws:SourceOwner",
+        category: "request",
+        dataType: "String",
     },
     {
         key: "aws:SourceOrgPaths",
         category: "request",
-        dataType: "",
+        dataType: "ArrayOfString",
     },
     {
         key: "aws:SourceOrgID",
         category: "request",
-        dataType: "",
+        dataType: "String",
     },
     {
-        key: "aws:UserAgent  ",
+        key: "aws:UserAgent",
         category: "request",
-        dataType: "",
+        dataType: "String",
     }
 ];
 const keysByName = globalConditionKeys.reduce((acc, key) => {
@@ -258,7 +273,18 @@ const keysByCategory = globalConditionKeys.reduce((acc, key) => {
 export function getGlobalConditionKey(key) {
     return keysByName[key.toLowerCase()];
 }
+export function globalConditionKeyExists(key) {
+    return !!getGlobalConditionKey(key);
+}
 export function getGlobalConditionKeysByCategory(category) {
     return keysByCategory[category.toLowerCase()] || [];
 }
+/**
+ * Get all the global condition keys as lower case strings
+ *
+ * @returns a list of all the global condition keys
+ */
+export function allGlobalConditionKeys() {
+    return Object.keys(keysByCategory);
+}
 //# sourceMappingURL=globalConditionKeys.js.map

package/dist/esm/global_conditions/globalConditionKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"globalConditionKeys.js","sourceRoot":"","sources":["../../../src/global_conditions/globalConditionKeys.ts"],"names":[],"mappings":"AAMA,MAAM,mBAAmB,GAAyB;IAChD;QACE,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,2BAA2B;QAChC,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,+BAA+B;QACpC,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE;KACb;IAED;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,4BAA4B;QACjC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,kCAAkC;QACvC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,+BAA+B;QACpC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IAED;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IAED;QACE,GAAG,EAAE,qBAAqB;QAC1B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,yBAAyB;QAC9B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,EAAE;KACb;IAED;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,aAAa;QAClB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,aAAa;QAClB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;KACb;CACF,CAAA;AAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACzD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC,EAAE,EAAwC,CAAC,CAAC;AAE7C,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC7D,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjD,GAAG,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IAC9C,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC,EAAE,EAA0C,CAAC,CAAC;AAE/C,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,QAAgB;IAC/D,OAAO,cAAc,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"globalConditionKeys.js","sourceRoot":"","sources":["../../../src/global_conditions/globalConditionKeys.ts"],"names":[],"mappings":"AAQA,MAAM,mBAAmB,GAAyB;IAChD;QACE,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,eAAe;KAC1B;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,2BAA2B;QAChC,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,+BAA+B;QACpC,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,eAAe;KAC1B;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;KACnB;IAED;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,SAAS;KACpB;IACD;QACE,GAAG,EAAE,4BAA4B;QACjC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,kCAAkC;QACvC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,SAAS;KACpB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,+BAA+B;QACpC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IAED;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,WAAW;KACtB;IAED;QACE,GAAG,EAAE,qBAAqB;QAC1B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,eAAe;KAC1B;IACD;QACE,GAAG,EAAE,yBAAyB;QAC9B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,QAAQ;KACnB;IAED;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,eAAe;KAC1B;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM,EAAE,wBAAwB;KAC3C;IACD;QACE,GAAG,EAAE,aAAa;QAClB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,aAAa;QAClB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,eAAe;KAC1B;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,eAAe;KAC1B;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAA;AAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACzD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC,EAAE,EAAwC,CAAC,CAAC;AAE7C,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC7D,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjD,GAAG,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IAC9C,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC,EAAE,EAA0C,CAAC,CAAC;AAE/C,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,QAAgB;IAC/D,OAAO,cAAc,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACrC,CAAC"}

package/dist/esm/index.d.ts

@@ -1,6 +1,10 @@
+export { BaseConditionKeyType, isConditionKeyArray, type ConditionKeyType } from './ConditionKeys.js';
+export { findContextKeys } from './context_keys/findContextKeys.js';
 export { type EvaluationResult } from './evaluate.js';
+export { allowedContextKeysForRequest } from './simulation_engine/contextKeys.js';
 export { type Simulation } from './simulation_engine/simulation.js';
 export { runSimulation } from './simulation_engine/simulationEngine.js';
 export { type SimulationOptions } from './simulation_engine/simulationOptions.js';
 export { runUnsafeSimulation } from './simulation_engine/unsafeSimulationEngine.js';
+export { isWildcardOnlyAction, typeForContextKey } from './util.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC"}

package/dist/esm/index.js

@@ -1,3 +1,7 @@
+export { isConditionKeyArray } from './ConditionKeys.js';
+export { findContextKeys } from './context_keys/findContextKeys.js';
+export { allowedContextKeysForRequest } from './simulation_engine/contextKeys.js';
 export { runSimulation } from './simulation_engine/simulationEngine.js';
 export { runUnsafeSimulation } from './simulation_engine/unsafeSimulationEngine.js';
+export { isWildcardOnlyAction, typeForContextKey } from './util.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,mBAAmB,EAAyB,MAAM,oBAAoB,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAElF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC"}

package/dist/esm/principal/principal.d.ts

@@ -1,4 +1,4 @@
-import { Principal } from "@cloud-copilot/iam-policy";
+import { Principal, Statement } from "@cloud-copilot/iam-policy";
 import { AwsRequest } from "../request/request.js";
 export type PrincipalMatchResult = 'Match' | 'NoMatch' | 'AccountLevelMatch';
 /**
@@ -27,4 +27,12 @@ export declare function requestMatchesNotPrincipal(request: AwsRequest, notPrinc
 export declare function requestMatchesPrincipalStatement(request: AwsRequest, principalStatement: Principal): PrincipalMatchResult;
 export declare function isAssumedRoleArn(principal: string): boolean;
 export declare function roleArnFromAssumedRoleArn(assumedRoleArn: string): string;
+/**
+ * Check if a request matches the Resource or NotResource elements of a statement.
+ *
+ * @param request the request to check
+ * @param statement the statement to check against
+ * @returns true if the request matches the resources in the statement, false otherwise
+ */
+export declare function requestMatchesStatementPrincipals(request: AwsRequest, statement: Statement): PrincipalMatchResult;
 //# sourceMappingURL=principal.d.ts.map

package/dist/esm/principal/principal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../../src/principal/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AA4CnD,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,mBAAmB,CAAA;AAE5E;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAWzG;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAiB/G;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,GAAG,oBAAoB,CAgDzH;AAID,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAKxE"}
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../../src/principal/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AA4CnD,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,mBAAmB,CAAA;AAE5E;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAWzG;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAiB/G;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,GAAG,oBAAoB,CAgDzH;AAID,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAKxE;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,oBAAoB,CAOjH"}

package/dist/esm/principal/principal.js

@@ -97,4 +97,20 @@ export function roleArnFromAssumedRoleArn(assumedRoleArn) {
     const rolePathAndName = resourceParts.slice(1, -1).join('/');
     return `arn:aws:iam::${stsParts[4]}:role/${rolePathAndName}`;
 }
+/**
+ * Check if a request matches the Resource or NotResource elements of a statement.
+ *
+ * @param request the request to check
+ * @param statement the statement to check against
+ * @returns true if the request matches the resources in the statement, false otherwise
+ */
+export function requestMatchesStatementPrincipals(request, statement) {
+    if (statement.isPrincipalStatement()) {
+        return requestMatchesPrincipal(request, statement.principals());
+    }
+    else if (statement.isNotPrincipalStatement()) {
+        return requestMatchesNotPrincipal(request, statement.notPrincipals());
+    }
+    throw new Error('Statement should have Principal or NotPrincipal');
+}
 //# sourceMappingURL=principal.js.map

package/dist/esm/principal/principal.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../../src/principal/principal.ts"],"names":[],"mappings":"AA+CA;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAmB,EAAE,SAAsB;IACjF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAClH,IAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAG,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,OAAO,mBAAmB,CAAA;IAC5B,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAmB,EAAE,YAAyB;IACvF,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAA;IACrH,IAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;OAKG;IACH,IAAG,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAmB,EAAE,kBAA6B;IACjG,IAAG,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC3C,IAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,wBAAwB,EAAE,EAAE,CAAC;QACjD,IAAG,kBAAkB,CAAC,aAAa,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YACpE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC7C,IAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAChE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAG,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC3C,IAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YACpE,OAAO,mBAAmB,CAAA;QAC5B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,cAAc,EAAE,EAAE,CAAC;QACvC,IAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAA;YACrD,IAAG,kBAAkB,CAAC,GAAG,EAAE,KAAM,OAAO,IAAI,kBAAkB,CAAC,GAAG,EAAE,KAAK,UAAU,EAAE,CAAC;gBACpF,OAAO,OAAO,CAAA;YAChB,CAAC;QACH,CAAC;QAED,IAAG,kBAAkB,CAAC,GAAG,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,mBAAmB,GAAG,wCAAwC,CAAA;AAEpE,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,cAAsB;IAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjD,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5D,OAAO,gBAAgB,QAAQ,CAAC,CAAC,CAAC,SAAS,eAAe,EAAE,CAAA;AAC9D,CAAC"}
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../../src/principal/principal.ts"],"names":[],"mappings":"AA+CA;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAmB,EAAE,SAAsB;IACjF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAClH,IAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAG,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,OAAO,mBAAmB,CAAA;IAC5B,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAmB,EAAE,YAAyB;IACvF,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAA;IACrH,IAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;OAKG;IACH,IAAG,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAmB,EAAE,kBAA6B;IACjG,IAAG,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC3C,IAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,wBAAwB,EAAE,EAAE,CAAC;QACjD,IAAG,kBAAkB,CAAC,aAAa,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YACpE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC7C,IAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAChE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAG,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC3C,IAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YACpE,OAAO,mBAAmB,CAAA;QAC5B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,cAAc,EAAE,EAAE,CAAC;QACvC,IAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAA;YACrD,IAAG,kBAAkB,CAAC,GAAG,EAAE,KAAM,OAAO,IAAI,kBAAkB,CAAC,GAAG,EAAE,KAAK,UAAU,EAAE,CAAC;gBACpF,OAAO,OAAO,CAAA;YAChB,CAAC;QACH,CAAC;QAED,IAAG,kBAAkB,CAAC,GAAG,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,mBAAmB,GAAG,wCAAwC,CAAA;AAEpE,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,cAAsB;IAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjD,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5D,OAAO,gBAAgB,QAAQ,CAAC,CAAC,CAAC,SAAS,eAAe,EAAE,CAAA;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAAmB,EAAE,SAAoB;IACzF,IAAG,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACpC,OAAO,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAA;IACjE,CAAC;SAAM,IAAG,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC9C,OAAO,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;AACpE,CAAC"}

package/dist/esm/request/requestPrincipal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestPrincipal.d.ts","sourceRoot":"","sources":["../../../src/request/requestPrincipal.ts"],"names":[],"mappings":"AACA;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAE/B;;OAEG;IACH,KAAK,IAAI,MAAM,CAAC;IAEhB;;OAEG;IACH,SAAS,IAAI,MAAM,GAAG,SAAS,CAAC;CAEjC;AAED,qBAAa,oBAAqB,YAAW,gBAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAE7C,SAAS,IAAI,MAAM,GAAG,SAAS;IAIxB,KAAK,IAAI,MAAM;CAGvB"}
+{"version":3,"file":"requestPrincipal.d.ts","sourceRoot":"","sources":["../../../src/request/requestPrincipal.ts"],"names":[],"mappings":"AACA;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAE/B;;OAEG;IACH,KAAK,IAAI,MAAM,CAAC;IAEhB;;OAEG;IACH,SAAS,IAAI,MAAM,GAAG,SAAS,CAAC;CAEjC;AAED,qBAAa,oBAAqB,YAAW,gBAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAE7C,SAAS,IAAI,MAAM,GAAG,SAAS;IAIxB,KAAK,IAAI,MAAM;CAKvB"}

package/dist/esm/request/requestPrincipal.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestPrincipal.js","sourceRoot":"","sources":["../../../src/request/requestPrincipal.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,oBAAoB;IAC/B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"requestPrincipal.js","sourceRoot":"","sources":["../../../src/request/requestPrincipal.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,oBAAoB;IAC/B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CAGF"}

package/dist/esm/services/DefaultServiceAuthorizer.d.ts

@@ -1,9 +1,38 @@
-import { EvaluationResult } from "../evaluate.js";
+import { EvaluationResult, ResourceEvaluationResult } from "../evaluate.js";
 import { StatementAnalysis } from "../StatementAnalysis.js";
 import { ServiceAuthorizationRequest, ServiceAuthorizer } from "./ServiceAuthorizer.js";
+/**
+ * The default authorizer for services.
+ */
 export declare class DefaultServiceAuthorizer implements ServiceAuthorizer {
     authorize(request: ServiceAuthorizationRequest): EvaluationResult;
+    /**
+     * Determine the result of the SCP analysis.
+     *
+     * @param request The request to authorize.
+     * @returns The result of the SCP analysis.
+     */
+    serviceControlPolicyResult(request: ServiceAuthorizationRequest): EvaluationResult;
+    /**
+     * Evaluate the identity statements to determine the result.
+     *
+     * @param request The request to authorize.
+     * @returns The result of the identity statement analysis.
+     */
     identityStatementResult(request: ServiceAuthorizationRequest): EvaluationResult;
+    /**
+     * Evaluate the resource policy to determine the result.
+     *
+     * @param request the request to authorize
+     * @returns the result of the resource policy analysis
+     */
+    resourcePolicyResult(request: ServiceAuthorizationRequest): ResourceEvaluationResult;
+    /**
+     * Checks if a statement is an identity statement that allows the request.
+     *
+     * @param statement The statement to check.
+     * @returns Whether the statement is an identity statement that allows the request.
+     */
     identityStatementAllows(statement: StatementAnalysis): boolean;
     identityStatementUknownAllow(statement: StatementAnalysis): boolean;
     identityStatementUknownDeny(statement: StatementAnalysis): boolean;

package/dist/esm/services/DefaultServiceAuthorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/DefaultServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAExF,qBAAa,wBAAyB,YAAW,iBAAiB;IACzD,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,gBAAgB;IAqBjE,uBAAuB,CAAC,OAAO,EAAE,2BAA2B,GAAG,gBAAgB;IAoB/E,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO;IAU9D,4BAA4B,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO;IAUnE,2BAA2B,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO;IAUlE,6BAA6B,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO;CAS5E"}
+{"version":3,"file":"DefaultServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/DefaultServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAExF;;GAEG;AACH,qBAAa,wBAAyB,YAAW,iBAAiB;IACzD,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,gBAAgB;IAiDxE;;;;;OAKG;IACI,0BAA0B,CAAC,OAAO,EAAE,2BAA2B,GAAG,gBAAgB;IAwBzF;;;;;OAKG;IACI,uBAAuB,CAAC,OAAO,EAAE,2BAA2B,GAAG,gBAAgB;IAoBtF;;;;;OAKG;IACI,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,wBAAwB;IAyB3F;;;;;OAKG;IACI,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO;IAU9D,4BAA4B,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO;IAUnE,2BAA2B,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO;IAUlE,6BAA6B,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO;CAS5E"}

package/dist/esm/services/DefaultServiceAuthorizer.js

@@ -1,24 +1,78 @@
+/**
+ * The default authorizer for services.
+ */
 export class DefaultServiceAuthorizer {
     authorize(request) {
+        const scpResult = this.serviceControlPolicyResult(request);
         const identityStatementResult = this.identityStatementResult(request);
+        const resourcePolicyResult = this.resourcePolicyResult(request);
         const principalAccount = request.request.principal.accountId();
         const resourceAccount = request.request.resource?.accountId();
+        if (scpResult !== 'Allowed') {
+            return scpResult;
+        }
+        if (resourcePolicyResult === 'ExplicitlyDenied' || resourcePolicyResult === 'DeniedForAccount') {
+            return 'ExplicitlyDenied';
+        }
+        if (identityStatementResult === 'ExplicitlyDenied') {
+            return 'ExplicitlyDenied';
+        }
+        //Same Account
+        if (principalAccount === resourceAccount) {
+            if (resourcePolicyResult === 'Allowed' || resourcePolicyResult === 'AllowedForAccount' || identityStatementResult === 'Allowed') {
+                return 'Allowed';
+            }
+            return 'ImplicitlyDenied';
+        }
+        //Cross Account
+        if (resourcePolicyResult === 'Allowed' || resourcePolicyResult === 'AllowedForAccount') {
+            if (identityStatementResult === 'Allowed') {
+                return 'Allowed';
+            }
+            return 'ImplicitlyDenied';
+        }
+        return 'ImplicitlyDenied';
         /**
          * Add checks for:
-         * * resource policies
-         * * service control policies
+         * * root user
+         * * service linked roles
+         * * resource control policies
          * * boundary policies
          * * vpc endpoint policies
          * * session policies (maybe these are just part of identity policies?)
          */
-        if (identityStatementResult === 'Allowed') {
-            if (principalAccount === resourceAccount) {
-                return identityStatementResult;
-            }
+    }
+    /**
+     * Determine the result of the SCP analysis.
+     *
+     * @param request The request to authorize.
+     * @returns The result of the SCP analysis.
+     */
+    serviceControlPolicyResult(request) {
+        const orgAllows = request.scpAnalysis.map((scpAnalysis) => {
+            return scpAnalysis.statementAnalysis.some((statement) => {
+                return this.identityStatementAllows(statement);
+            });
+        });
+        if (orgAllows.includes(false)) {
             return 'ImplicitlyDenied';
         }
-        return identityStatementResult;
+        const anyScpDeny = request.scpAnalysis.some((scpAnalysis) => {
+            return scpAnalysis.statementAnalysis.some((statement) => {
+                return this.identityStatementExplicitDeny(statement);
+            });
+        });
+        if (anyScpDeny) {
+            return 'ExplicitlyDenied';
+        }
+        return 'Allowed';
     }
+    /**
+     * Evaluate the identity statements to determine the result.
+     *
+     * @param request The request to authorize.
+     * @returns The result of the identity statement analysis.
+     */
     identityStatementResult(request) {
         const explicitDeny = request.identityStatements.some(s => this.identityStatementExplicitDeny(s));
         if (explicitDeny) {
@@ -35,6 +89,38 @@ export class DefaultServiceAuthorizer {
         }
         return 'ImplicitlyDenied';
     }
+    /**
+     * Evaluate the resource policy to determine the result.
+     *
+     * @param request the request to authorize
+     * @returns the result of the resource policy analysis
+     */
+    resourcePolicyResult(request) {
+        if (!request.resourceAnalysis) {
+            return 'NotApplicable';
+        }
+        const denyStatements = request.resourceAnalysis.filter(s => this.identityStatementExplicitDeny(s));
+        if (denyStatements.some(s => s.principalMatch === 'Match')) {
+            return 'ExplicitlyDenied';
+        }
+        if (denyStatements.some(s => s.principalMatch === 'AccountLevelMatch')) {
+            return 'DeniedForAccount';
+        }
+        const allowStatements = request.resourceAnalysis.filter(s => this.identityStatementAllows(s));
+        if (allowStatements.some(s => s.principalMatch === 'Match')) {
+            return 'Allowed';
+        }
+        if (allowStatements.some(s => s.principalMatch === 'AccountLevelMatch')) {
+            return 'AllowedForAccount';
+        }
+        return 'ImplicityDenied';
+    }
+    /**
+     * Checks if a statement is an identity statement that allows the request.
+     *
+     * @param statement The statement to check.
+     * @returns Whether the statement is an identity statement that allows the request.
+     */
     identityStatementAllows(statement) {
         if (statement.resourceMatch &&
             statement.actionMatch &&