@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/workload-roles/aws-s3-state.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsS3FixedWorkloadRoleStore = void 0;
+exports.createAwsSdkV3S3JsonControlPlane = createAwsSdkV3S3JsonControlPlane;
+const node_crypto_1 = require("node:crypto");
+const node_buffer_1 = require("node:buffer");
+const defaultS3Sdk = require("@aws-sdk/client-s3");
+const registration_js_1 = require("./registration.js");
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function noSuchKey(error) {
+    return (isRecord(error) &&
+        (error.name === 'NoSuchKey' ||
+            error.name === 'NotFound' ||
+            (isRecord(error.$metadata) && error.$metadata.httpStatusCode === 404)));
+}
+function requireConstructor(value, label) {
+    if (typeof value !== 'function') {
+        throw new Error(`AWS S3 SDK module is missing ${label}.`);
+    }
+    return value;
+}
+function requireS3Sdk(value) {
+    if (!isRecord(value)) {
+        throw new Error('AWS S3 SDK module is unavailable.');
+    }
+    return {
+        DeleteObjectCommand: requireConstructor(value.DeleteObjectCommand, 'DeleteObjectCommand'),
+        GetObjectCommand: requireConstructor(value.GetObjectCommand, 'GetObjectCommand'),
+        PutObjectCommand: requireConstructor(value.PutObjectCommand, 'PutObjectCommand'),
+        S3Client: requireConstructor(value.S3Client, 'S3Client'),
+    };
+}
+async function bodyText(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value instanceof Uint8Array) {
+        return node_buffer_1.Buffer.from(value).toString('utf8');
+    }
+    if (isRecord(value) && typeof value.transformToString === 'function') {
+        const transformed = await value.transformToString();
+        if (typeof transformed === 'string')
+            return transformed;
+    }
+    throw new Error('AWS S3 JSON object body is unavailable.');
+}
+/**
+ * Fixed AWS SDK v3 S3 JSON transport. The caller passes only bucket/key values
+ * already derived by the store; provisioner invocation input never reaches
+ * this layer.
+ */
+async function createAwsSdkV3S3JsonControlPlane(options = {}) {
+    const sdk = requireS3Sdk(options.loadModule ? await options.loadModule() : defaultS3Sdk);
+    const client = new sdk.S3Client(options.clientConfiguration ?? {});
+    return {
+        async deleteObject(input) {
+            await client.send(new sdk.DeleteObjectCommand({
+                Bucket: input.bucketName,
+                Key: input.key,
+            }));
+        },
+        async getJson(input) {
+            let response;
+            try {
+                response = await client.send(new sdk.GetObjectCommand({
+                    Bucket: input.bucketName,
+                    Key: input.key,
+                }));
+            }
+            catch (error) {
+                if (noSuchKey(error))
+                    return undefined;
+                throw error;
+            }
+            if (!isRecord(response)) {
+                throw new Error('AWS S3 JSON response is malformed.');
+            }
+            try {
+                return JSON.parse(await bodyText(response.Body));
+            }
+            catch {
+                throw new Error('AWS S3 JSON object is malformed.');
+            }
+        },
+        async putJson(input) {
+            const body = JSON.stringify(input.value);
+            await client.send(new sdk.PutObjectCommand({
+                Body: body,
+                Bucket: input.bucketName,
+                ChecksumSHA256: (0, node_crypto_1.createHash)('sha256')
+                    .update(body, 'utf8')
+                    .digest('base64'),
+                ContentType: 'application/json',
+                Key: input.key,
+                ServerSideEncryption: 'AES256',
+            }));
+        },
+    };
+}
+const bucketNamePattern = /^(?!\d{1,3}(?:\.\d{1,3}){3}$)[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
+/**
+ * S3-backed fixed provisioner source/state. S3 avoids Parameter Store's 4 KB
+ * standard and 8 KB advanced limits; candidate-digest keys make manifest and
+ * provisioned results exact and collision-resistant.
+ */
+class AwsS3FixedWorkloadRoleStore {
+    bucketName;
+    historyKey;
+    provisionedRegistrationKey;
+    registeredManifestKey;
+    #s3;
+    constructor(options) {
+        if (!bucketNamePattern.test(options.bucketName)) {
+            throw new Error('Workload-role state bucket name is invalid.');
+        }
+        this.bucketName = options.bucketName;
+        this.registeredManifestKey =
+            (0, registration_js_1.registeredWorkloadRoleManifestObjectKey)(options);
+        this.provisionedRegistrationKey =
+            (0, registration_js_1.provisionedWorkloadRoleRegistrationObjectKey)(options);
+        this.historyKey = (0, registration_js_1.workloadRoleHistoryObjectKey)(options.stage, options.project);
+        this.#s3 = options.client;
+    }
+    async load() {
+        const value = await this.#s3.getJson({
+            bucketName: this.bucketName,
+            key: this.registeredManifestKey,
+        });
+        if (value === undefined) {
+            throw new Error('Registered workload-role manifest is absent.');
+        }
+        return value;
+    }
+    async loadHistory() {
+        return this.#s3.getJson({
+            bucketName: this.bucketName,
+            key: this.historyKey,
+        });
+    }
+    async saveHistory(history) {
+        await this.#s3.putJson({
+            bucketName: this.bucketName,
+            key: this.historyKey,
+            value: history,
+        });
+    }
+    async saveProvisionedRegistration(document) {
+        if (!document) {
+            await this.#s3.deleteObject({
+                bucketName: this.bucketName,
+                key: this.provisionedRegistrationKey,
+            });
+            return;
+        }
+        await this.#s3.putJson({
+            bucketName: this.bucketName,
+            key: this.provisionedRegistrationKey,
+            value: document,
+        });
+    }
+}
+exports.AwsS3FixedWorkloadRoleStore = AwsS3FixedWorkloadRoleStore;
+//# sourceMappingURL=aws-s3-state.js.map

package/src/workload-roles/aws-s3-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-s3-state.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/aws-s3-state.ts"],"names":[],"mappings":";;;AA+GA,4EA0DC;AAzKD,6CAAyC;AACzC,6CAAqC;AAErC,mDAAmD;AAInD,uDAM2B;AAgC3B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;YACzB,KAAK,CAAC,IAAI,KAAK,UAAU;YACzB,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,cAAc,KAAK,GAAG,CAAC,CAAC,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAc,EACd,KAAa;IAEb,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAA8B,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,kBAAkB,CACrC,KAAK,CAAC,mBAAmB,EACzB,qBAAqB,CACtB;QACD,gBAAgB,EAAE,kBAAkB,CAClC,KAAK,CAAC,gBAAgB,EACtB,kBAAkB,CACnB;QACD,gBAAgB,EAAE,kBAAkB,CAClC,KAAK,CAAC,gBAAgB,EACtB,kBAAkB,CACnB;QACD,QAAQ,EAAE,kBAAkB,CAC1B,KAAK,CAAC,QAAQ,EACd,UAAU,CAC8B;KAC3C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,oBAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACrE,MAAM,WAAW,GAAG,MAClB,KAAK,CAAC,iBACP,EAAE,CAAC;QACJ,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC;IAC1D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,gCAAgC,CACpD,UAII,EAAE;IAEN,MAAM,GAAG,GAAG,YAAY,CACtB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,YAAY,CAC/D,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,KAAK;YACtB,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,GAAG,CAAC,mBAAmB,CAAC;gBAC1B,MAAM,EAAE,KAAK,CAAC,UAAU;gBACxB,GAAG,EAAE,KAAK,CAAC,GAAG;aACf,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,IAAI,QAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAC1B,IAAI,GAAG,CAAC,gBAAgB,CAAC;oBACvB,MAAM,EAAE,KAAK,CAAC,UAAU;oBACxB,GAAG,EAAE,KAAK,CAAC,GAAG;iBACf,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,CAAC,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAC;gBACvC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAY,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,GAAG,CAAC,gBAAgB,CAAC;gBACvB,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,KAAK,CAAC,UAAU;gBACxB,cAAc,EAAE,IAAA,wBAAU,EAAC,QAAQ,CAAC;qBACjC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;qBACpB,MAAM,CAAC,QAAQ,CAAC;gBACnB,WAAW,EAAE,kBAAkB;gBAC/B,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,oBAAoB,EAAE,QAAQ;aAC/B,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GACrB,gEAAgE,CAAC;AAEnE;;;;GAIG;AACH,MAAa,2BAA2B;IAK7B,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,0BAA0B,CAAS;IACnC,qBAAqB,CAAS;IAE9B,GAAG,CAAwB;IAEpC,YAAY,OAOX;QACC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,qBAAqB;YACxB,IAAA,yDAAuC,EAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,0BAA0B;YAC7B,IAAA,8DAA4C,EAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,IAAA,8CAA4B,EAC5C,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,OAAO,CAChB,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,EAAE,IAAI,CAAC,qBAAqB;SAChC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YACtB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,EAAE,IAAI,CAAC,UAAU;SACrB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAA4B;QAC5C,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,EAAE,IAAI,CAAC,UAAU;YACpB,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,QAAiE;QAEjE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;gBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,0BAA0B;aACrC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,EAAE,IAAI,CAAC,0BAA0B;YACpC,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;IACL,CAAC;CACF;AA7ED,kEA6EC"}

package/src/workload-roles/aws-sdk-control-plane.d.ts

@@ -0,0 +1,12 @@
+import { type FixedAwsIamControlPlane } from './aws-adapter.js';
+/**
+ * Creates the actual AWS SDK v3 command implementation used by the
+ * baseline-owned Lambda. Production callers use the declared SDK dependency;
+ * the injected module seam lets the generated baseline bundle close over its
+ * statically bundled SDK without exposing client selection to invocation.
+ */
+export declare function createAwsSdkV3IamControlPlane(options?: {
+    clientConfiguration?: Readonly<Record<string, unknown>>;
+    /** @internal Test-only module seam. */
+    loadModule?: () => Promise<unknown>;
+}): Promise<FixedAwsIamControlPlane>;

package/src/workload-roles/aws-sdk-control-plane.js

@@ -0,0 +1,291 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAwsSdkV3IamControlPlane = createAwsSdkV3IamControlPlane;
+const defaultIamSdk = require("@aws-sdk/client-iam");
+const aws_adapter_js_1 = require("./aws-adapter.js");
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function requireRecord(value, label) {
+    if (!isRecord(value)) {
+        throw new aws_adapter_js_1.FixedAwsIamAdapterError('aws-iam-observation-invalid', `${label} is missing from the AWS IAM response.`);
+    }
+    return value;
+}
+function requireString(value, label) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new aws_adapter_js_1.FixedAwsIamAdapterError('aws-iam-observation-invalid', `${label} is missing from the AWS IAM response.`);
+    }
+    return value;
+}
+function optionalString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function noSuchEntity(error) {
+    return (isRecord(error) &&
+        (error.name === 'NoSuchEntityException' ||
+            error.name === 'NoSuchEntity' ||
+            error.Code === 'NoSuchEntity'));
+}
+function commandConstructor(value, name) {
+    if (typeof value !== 'function') {
+        throw new aws_adapter_js_1.FixedAwsIamAdapterError('aws-iam-observation-invalid', `AWS IAM SDK module is missing ${name}.`);
+    }
+    return value;
+}
+function requireIamSdk(value) {
+    const module = requireRecord(value, 'AWS IAM SDK module');
+    const names = [
+        'AddRoleToInstanceProfileCommand',
+        'CreateInstanceProfileCommand',
+        'CreateRoleCommand',
+        'DeleteInstanceProfileCommand',
+        'DeleteRoleCommand',
+        'DeleteRolePolicyCommand',
+        'DetachRolePolicyCommand',
+        'GetInstanceProfileCommand',
+        'GetRoleCommand',
+        'GetRolePolicyCommand',
+        'IAMClient',
+        'ListAttachedRolePoliciesCommand',
+        'ListRolePoliciesCommand',
+        'PutRolePermissionsBoundaryCommand',
+        'PutRolePolicyCommand',
+        'RemoveRoleFromInstanceProfileCommand',
+        'TagRoleCommand',
+        'UntagRoleCommand',
+        'UpdateAssumeRolePolicyCommand',
+    ];
+    return Object.fromEntries(names.map((name) => [name, commandConstructor(module[name], name)]));
+}
+function tagsFromAws(value) {
+    if (value === undefined) {
+        return {};
+    }
+    if (!Array.isArray(value)) {
+        throw new aws_adapter_js_1.FixedAwsIamAdapterError('aws-iam-observation-invalid', 'AWS IAM role tags are malformed.');
+    }
+    const tags = {};
+    for (const entry of value) {
+        const tag = requireRecord(entry, 'AWS IAM role tag');
+        const key = requireString(tag.Key, 'AWS IAM role tag key');
+        const tagValue = requireString(tag.Value, 'AWS IAM role tag value');
+        if (Object.prototype.hasOwnProperty.call(tags, key)) {
+            throw new aws_adapter_js_1.FixedAwsIamAdapterError('aws-iam-observation-invalid', `AWS IAM returned duplicate role tag ${key}.`);
+        }
+        tags[key] = tagValue;
+    }
+    return tags;
+}
+function tagsToAws(value) {
+    return Object.keys(value)
+        .sort()
+        .map((Key) => ({ Key, Value: value[Key] }));
+}
+async function collectPages(options) {
+    const values = [];
+    let marker;
+    for (let pageNumber = 0; pageNumber < 100; pageNumber += 1) {
+        const response = requireRecord(await options.send(new options.command({
+            ...(marker ? { Marker: marker } : {}),
+            RoleName: options.roleName,
+        })), `AWS IAM ${options.itemLabel} page`);
+        const pageItems = options.items(response);
+        if (!Array.isArray(pageItems)) {
+            throw new aws_adapter_js_1.FixedAwsIamAdapterError('aws-iam-observation-invalid', `AWS IAM ${options.itemLabel} page is malformed.`);
+        }
+        for (const item of pageItems) {
+            values.push(requireString(item, `AWS IAM ${options.itemLabel} entry`));
+        }
+        if (response.IsTruncated !== true) {
+            return values;
+        }
+        marker = optionalString(response.Marker);
+        if (!marker) {
+            throw new aws_adapter_js_1.FixedAwsIamAdapterError('aws-iam-observation-invalid', `AWS IAM ${options.itemLabel} pagination omitted its marker.`);
+        }
+    }
+    throw new aws_adapter_js_1.FixedAwsIamAdapterError('aws-iam-observation-invalid', `AWS IAM ${options.itemLabel} pagination exceeded its fixed bound.`);
+}
+/**
+ * Creates the actual AWS SDK v3 command implementation used by the
+ * baseline-owned Lambda. Production callers use the declared SDK dependency;
+ * the injected module seam lets the generated baseline bundle close over its
+ * statically bundled SDK without exposing client selection to invocation.
+ */
+async function createAwsSdkV3IamControlPlane(options = {}) {
+    const sdk = requireIamSdk(options.loadModule ? await options.loadModule() : defaultIamSdk);
+    const client = new sdk.IAMClient(options.clientConfiguration ?? {});
+    const send = (command) => client.send(command);
+    const getRole = async (roleName) => {
+        let response;
+        try {
+            response = requireRecord(await send(new sdk.GetRoleCommand({ RoleName: roleName })), 'AWS IAM GetRole response');
+        }
+        catch (error) {
+            if (noSuchEntity(error))
+                return undefined;
+            throw error;
+        }
+        const role = requireRecord(response.Role, 'AWS IAM role');
+        const returnedName = requireString(role.RoleName, 'AWS IAM role name');
+        if (returnedName !== roleName) {
+            throw new aws_adapter_js_1.FixedAwsIamAdapterError('aws-iam-observation-invalid', `AWS IAM returned ${returnedName} for exact role ${roleName}.`);
+        }
+        const boundary = role.PermissionsBoundary === undefined
+            ? undefined
+            : requireRecord(role.PermissionsBoundary, 'AWS IAM role permissions boundary');
+        return {
+            arn: requireString(role.Arn, 'AWS IAM role ARN'),
+            assumeRolePolicyDocument: role.AssumeRolePolicyDocument,
+            permissionsBoundaryArn: boundary
+                ? (optionalString(boundary.PermissionsBoundaryArn) ?? null)
+                : null,
+            roleName,
+            tags: tagsFromAws(role.Tags),
+        };
+    };
+    const getInstanceProfile = async (instanceProfileName) => {
+        let response;
+        try {
+            response = requireRecord(await send(new sdk.GetInstanceProfileCommand({
+                InstanceProfileName: instanceProfileName,
+            })), 'AWS IAM GetInstanceProfile response');
+        }
+        catch (error) {
+            if (noSuchEntity(error))
+                return undefined;
+            throw error;
+        }
+        const profile = requireRecord(response.InstanceProfile, 'AWS IAM instance profile');
+        const returnedName = requireString(profile.InstanceProfileName, 'AWS IAM instance-profile name');
+        if (returnedName !== instanceProfileName || !Array.isArray(profile.Roles)) {
+            throw new aws_adapter_js_1.FixedAwsIamAdapterError('aws-iam-observation-invalid', `AWS IAM returned a substituted instance profile for ${instanceProfileName}.`);
+        }
+        return {
+            instanceProfileName,
+            roleNames: profile.Roles.map((entry) => requireString(requireRecord(entry, 'AWS IAM instance-profile role').RoleName, 'AWS IAM instance-profile role name')),
+        };
+    };
+    return {
+        async addRoleToInstanceProfile(input) {
+            await send(new sdk.AddRoleToInstanceProfileCommand({
+                InstanceProfileName: input.instanceProfileName,
+                RoleName: input.roleName,
+            }));
+        },
+        async createInstanceProfile(input) {
+            await send(new sdk.CreateInstanceProfileCommand({
+                InstanceProfileName: input.instanceProfileName,
+            }));
+        },
+        async createRole(input) {
+            await send(new sdk.CreateRoleCommand({
+                AssumeRolePolicyDocument: JSON.stringify(input.assumeRolePolicyDocument),
+                PermissionsBoundary: input.permissionsBoundaryArn,
+                RoleName: input.roleName,
+                Tags: tagsToAws(input.tags),
+            }));
+        },
+        async deleteInstanceProfile(input) {
+            await send(new sdk.DeleteInstanceProfileCommand({
+                InstanceProfileName: input.instanceProfileName,
+            }));
+        },
+        async deleteRole(input) {
+            await send(new sdk.DeleteRoleCommand({ RoleName: input.roleName }));
+        },
+        async deleteRolePolicy(input) {
+            await send(new sdk.DeleteRolePolicyCommand({
+                PolicyName: input.policyName,
+                RoleName: input.roleName,
+            }));
+        },
+        async detachRolePolicy(input) {
+            await send(new sdk.DetachRolePolicyCommand({
+                PolicyArn: input.policyArn,
+                RoleName: input.roleName,
+            }));
+        },
+        getInstanceProfile,
+        getRole,
+        async getRolePolicy(input) {
+            try {
+                const response = requireRecord(await send(new sdk.GetRolePolicyCommand({
+                    PolicyName: input.policyName,
+                    RoleName: input.roleName,
+                })), 'AWS IAM GetRolePolicy response');
+                if (response.PolicyDocument === undefined) {
+                    throw new aws_adapter_js_1.FixedAwsIamAdapterError('aws-iam-observation-invalid', `AWS IAM omitted inline policy ${input.policyName}.`);
+                }
+                return response.PolicyDocument;
+            }
+            catch (error) {
+                if (noSuchEntity(error))
+                    return undefined;
+                throw error;
+            }
+        },
+        listAttachedRolePolicyArns(roleName) {
+            return collectPages({
+                command: sdk.ListAttachedRolePoliciesCommand,
+                itemLabel: 'attached role policies',
+                items: (page) => {
+                    if (!Array.isArray(page.AttachedPolicies)) {
+                        return page.AttachedPolicies;
+                    }
+                    return page.AttachedPolicies.map((entry) => requireString(requireRecord(entry, 'AWS IAM attached policy').PolicyArn, 'AWS IAM attached policy ARN'));
+                },
+                roleName,
+                send,
+            });
+        },
+        listRolePolicyNames(roleName) {
+            return collectPages({
+                command: sdk.ListRolePoliciesCommand,
+                itemLabel: 'inline role policies',
+                items: (page) => page.PolicyNames,
+                roleName,
+                send,
+            });
+        },
+        async putRolePermissionsBoundary(input) {
+            await send(new sdk.PutRolePermissionsBoundaryCommand({
+                PermissionsBoundary: input.permissionsBoundaryArn,
+                RoleName: input.roleName,
+            }));
+        },
+        async putRolePolicy(input) {
+            await send(new sdk.PutRolePolicyCommand({
+                PolicyDocument: JSON.stringify(input.policyDocument),
+                PolicyName: input.policyName,
+                RoleName: input.roleName,
+            }));
+        },
+        async removeRoleFromInstanceProfile(input) {
+            await send(new sdk.RemoveRoleFromInstanceProfileCommand({
+                InstanceProfileName: input.instanceProfileName,
+                RoleName: input.roleName,
+            }));
+        },
+        async tagRole(input) {
+            await send(new sdk.TagRoleCommand({
+                RoleName: input.roleName,
+                Tags: tagsToAws(input.tags),
+            }));
+        },
+        async untagRole(input) {
+            await send(new sdk.UntagRoleCommand({
+                RoleName: input.roleName,
+                TagKeys: [...input.tagKeys],
+            }));
+        },
+        async updateAssumeRolePolicy(input) {
+            await send(new sdk.UpdateAssumeRolePolicyCommand({
+                PolicyDocument: JSON.stringify(input.assumeRolePolicyDocument),
+                RoleName: input.roleName,
+            }));
+        },
+    };
+}
+//# sourceMappingURL=aws-sdk-control-plane.js.map

package/src/workload-roles/aws-sdk-control-plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-sdk-control-plane.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/aws-sdk-control-plane.ts"],"names":[],"mappings":";;AA2MA,sEA2PC;AAtcD,qDAAqD;AAErD,qDAK0B;AAkC1B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,wCAAuB,CAC/B,6BAA6B,EAC7B,GAAG,KAAK,wCAAwC,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,wCAAuB,CAC/B,6BAA6B,EAC7B,GAAG,KAAK,wCAAwC,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,CAAC,KAAK,CAAC,IAAI,KAAK,uBAAuB;YACrC,KAAK,CAAC,IAAI,KAAK,cAAc;YAC7B,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAc,EACd,IAA2B;IAE3B,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,wCAAuB,CAC/B,6BAA6B,EAC7B,iCAAiC,IAAI,GAAG,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,KAA8B,CAAC;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG;QACZ,iCAAiC;QACjC,8BAA8B;QAC9B,mBAAmB;QACnB,8BAA8B;QAC9B,mBAAmB;QACnB,yBAAyB;QACzB,yBAAyB;QACzB,2BAA2B;QAC3B,gBAAgB;QAChB,sBAAsB;QACtB,WAAW;QACX,iCAAiC;QACjC,yBAAyB;QACzB,mCAAmC;QACnC,sBAAsB;QACtB,sCAAsC;QACtC,gBAAgB;QAChB,kBAAkB;QAClB,+BAA+B;KACvB,CAAC;IACX,OAAO,MAAM,CAAC,WAAW,CACvB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CACtC,CAAC;AAClC,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,wCAAuB,CAC/B,6BAA6B,EAC7B,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,wCAAuB,CAC/B,6BAA6B,EAC7B,uCAAuC,GAAG,GAAG,CAC9C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAuC;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAM3B;IACC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAA0B,CAAC;IAC/B,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,GAAG,EAAE,UAAU,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,aAAa,CAC5B,MAAM,OAAO,CAAC,IAAI,CAChB,IAAI,OAAO,CAAC,OAAO,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CACH,EACD,WAAW,OAAO,CAAC,SAAS,OAAO,CACpC,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,wCAAuB,CAC/B,6BAA6B,EAC7B,WAAW,OAAO,CAAC,SAAS,qBAAqB,CAClD,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,OAAO,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,wCAAuB,CAC/B,6BAA6B,EAC7B,WAAW,OAAO,CAAC,SAAS,iCAAiC,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,wCAAuB,CAC/B,6BAA6B,EAC7B,WAAW,OAAO,CAAC,SAAS,uCAAuC,CACpE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,6BAA6B,CACjD,UAII,EAAE;IAEN,MAAM,GAAG,GAAG,aAAa,CACvB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,aAAa,CAChE,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,KAAK,EACnB,QAAgB,EACsB,EAAE;QACxC,IAAI,QAAiC,CAAC;QACtC,IAAI,CAAC;YACH,QAAQ,GAAG,aAAa,CACtB,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,EAC1D,0BAA0B,CAC3B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,YAAY,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC1C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACvE,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,wCAAuB,CAC/B,6BAA6B,EAC7B,oBAAoB,YAAY,mBAAmB,QAAQ,GAAG,CAC/D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GACZ,IAAI,CAAC,mBAAmB,KAAK,SAAS;YACpC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,aAAa,CACX,IAAI,CAAC,mBAAmB,EACxB,mCAAmC,CACpC,CAAC;QACR,OAAO;YACL,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC;YAChD,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;YACvD,sBAAsB,EAAE,QAAQ;gBAC9B,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;gBAC3D,CAAC,CAAC,IAAI;YACR,QAAQ;YACR,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;SAC7B,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,KAAK,EAC9B,mBAA2B,EACsB,EAAE;QACnD,IAAI,QAAiC,CAAC;QACtC,IAAI,CAAC;YACH,QAAQ,GAAG,aAAa,CACtB,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,yBAAyB,CAAC;gBAChC,mBAAmB,EAAE,mBAAmB;aACzC,CAAC,CACH,EACD,qCAAqC,CACtC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,YAAY,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC1C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAC3B,QAAQ,CAAC,eAAe,EACxB,0BAA0B,CAC3B,CAAC;QACF,MAAM,YAAY,GAAG,aAAa,CAChC,OAAO,CAAC,mBAAmB,EAC3B,+BAA+B,CAChC,CAAC;QACF,IAAI,YAAY,KAAK,mBAAmB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,wCAAuB,CAC/B,6BAA6B,EAC7B,uDAAuD,mBAAmB,GAAG,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,mBAAmB;YACnB,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACrC,aAAa,CACX,aAAa,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC,QAAQ,EAC9D,oCAAoC,CACrC,CACF;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,wBAAwB,CAAC,KAAK;YAClC,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,+BAA+B,CAAC;gBACtC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CAAC,KAAK;YAC/B,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,4BAA4B,CAAC;gBACnC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;aAC/C,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,iBAAiB,CAAC;gBACxB,wBAAwB,EAAE,IAAI,CAAC,SAAS,CACtC,KAAK,CAAC,wBAAwB,CAC/B;gBACD,mBAAmB,EAAE,KAAK,CAAC,sBAAsB;gBACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CAAC,KAAK;YAC/B,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,4BAA4B,CAAC;gBACnC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;aAC/C,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,KAAK;YAC1B,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,uBAAuB,CAAC;gBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,KAAK;YAC1B,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,uBAAuB,CAAC;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,kBAAkB;QAClB,OAAO;QACP,KAAK,CAAC,aAAa,CAAC,KAAK;YACvB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,aAAa,CAC5B,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,oBAAoB,CAAC;oBAC3B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CACH,EACD,gCAAgC,CACjC,CAAC;gBACF,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;oBAC1C,MAAM,IAAI,wCAAuB,CAC/B,6BAA6B,EAC7B,iCAAiC,KAAK,CAAC,UAAU,GAAG,CACrD,CAAC;gBACJ,CAAC;gBACD,OAAO,QAAQ,CAAC,cAAc,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,YAAY,CAAC,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAC;gBAC1C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,0BAA0B,CAAC,QAAQ;YACjC,OAAO,YAAY,CAAC;gBAClB,OAAO,EAAE,GAAG,CAAC,+BAA+B;gBAC5C,SAAS,EAAE,wBAAwB;gBACnC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;oBACd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;wBAC1C,OAAO,IAAI,CAAC,gBAAgB,CAAC;oBAC/B,CAAC;oBACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,aAAa,CACX,aAAa,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC,SAAS,EACzD,6BAA6B,CAC9B,CACF,CAAC;gBACJ,CAAC;gBACD,QAAQ;gBACR,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,mBAAmB,CAAC,QAAQ;YAC1B,OAAO,YAAY,CAAC;gBAClB,OAAO,EAAE,GAAG,CAAC,uBAAuB;gBACpC,SAAS,EAAE,sBAAsB;gBACjC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW;gBACjC,QAAQ;gBACR,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,0BAA0B,CAAC,KAAK;YACpC,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,iCAAiC,CAAC;gBACxC,mBAAmB,EAAE,KAAK,CAAC,sBAAsB;gBACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,KAAK;YACvB,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,oBAAoB,CAAC;gBAC3B,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC;gBACpD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,6BAA6B,CAAC,KAAK;YACvC,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,oCAAoC,CAAC;gBAC3C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,cAAc,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK;YACnB,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,gBAAgB,CAAC;gBACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,sBAAsB,CAAC,KAAK;YAChC,MAAM,IAAI,CACR,IAAI,GAAG,CAAC,6BAA6B,CAAC;gBACpC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,wBAAwB,CAAC;gBAC9D,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/src/workload-roles/boundary.d.ts

@@ -0,0 +1,33 @@
+import { type CanonicalIamPolicyDocument, type WorkloadRoleEffectivePolicyBundle } from './effective-policy.js';
+export declare const WORKLOAD_ROLE_BOUNDARY_POLICY_PATH: "/ebk";
+export declare const WORKLOAD_ROLE_BOUNDARY_POLICY_NAME: "workload-role-boundary";
+export declare const WORKLOAD_ROLE_BOUNDARY_DENIED_ACTIONS: readonly ["iam:AttachRolePolicy", "iam:CreatePolicy", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:DeletePolicy", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DeleteRolePermissionsBoundary", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePermissionsBoundary", "iam:PutRolePolicy", "iam:SetDefaultPolicyVersion", "iam:TagRole", "iam:UntagRole", "iam:UpdateAssumeRolePolicy", "iam:UpdateRole", "iam:UpdateRoleDescription", "organizations:CreateAccount", "organizations:CreatePolicy", "organizations:LeaveOrganization", "sts:AssumeRole"];
+export interface WorkloadRoleBoundaryContract {
+    accountId: string;
+    arn: string;
+    candidateIdentity: string;
+    digest: string;
+    partition: 'aws' | 'aws-cn' | 'aws-us-gov';
+    path: string;
+    policy: CanonicalIamPolicyDocument;
+    policyName: typeof WORKLOAD_ROLE_BOUNDARY_POLICY_NAME;
+    stage: string;
+}
+export type WorkloadRoleBoundaryFailureClassification = 'boundary-identity-invalid' | 'boundary-policy-incomplete' | 'boundary-substitution';
+export declare class WorkloadRoleBoundaryContractError extends Error {
+    readonly classification: WorkloadRoleBoundaryFailureClassification;
+    constructor(classification: WorkloadRoleBoundaryFailureClassification, message: string);
+}
+export declare function workloadRoleBoundaryPath(stage: string): string;
+export declare function workloadRoleBoundaryArn(options: {
+    accountId: string;
+    partition: string;
+    stage: string;
+}): string;
+export declare function createWorkloadRoleBoundaryContract(options: {
+    accountId: string;
+    bundle: WorkloadRoleEffectivePolicyBundle;
+    manifest: unknown;
+    partition: string;
+    stage: string;
+}): WorkloadRoleBoundaryContract;

package/src/workload-roles/boundary.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadRoleBoundaryContractError = exports.WORKLOAD_ROLE_BOUNDARY_DENIED_ACTIONS = exports.WORKLOAD_ROLE_BOUNDARY_POLICY_NAME = exports.WORKLOAD_ROLE_BOUNDARY_POLICY_PATH = void 0;
+exports.workloadRoleBoundaryPath = workloadRoleBoundaryPath;
+exports.workloadRoleBoundaryArn = workloadRoleBoundaryArn;
+exports.createWorkloadRoleBoundaryContract = createWorkloadRoleBoundaryContract;
+const node_crypto_1 = require("node:crypto");
+const effective_policy_js_1 = require("./effective-policy.js");
+const manifest_js_1 = require("./manifest.js");
+exports.WORKLOAD_ROLE_BOUNDARY_POLICY_PATH = '/ebk';
+exports.WORKLOAD_ROLE_BOUNDARY_POLICY_NAME = 'workload-role-boundary';
+exports.WORKLOAD_ROLE_BOUNDARY_DENIED_ACTIONS = [
+    'iam:AttachRolePolicy',
+    'iam:CreatePolicy',
+    'iam:CreatePolicyVersion',
+    'iam:CreateRole',
+    'iam:DeletePolicy',
+    'iam:DeletePolicyVersion',
+    'iam:DeleteRole',
+    'iam:DeleteRolePermissionsBoundary',
+    'iam:DeleteRolePolicy',
+    'iam:DetachRolePolicy',
+    'iam:PutRolePermissionsBoundary',
+    'iam:PutRolePolicy',
+    'iam:SetDefaultPolicyVersion',
+    'iam:TagRole',
+    'iam:UntagRole',
+    'iam:UpdateAssumeRolePolicy',
+    'iam:UpdateRole',
+    'iam:UpdateRoleDescription',
+    'organizations:CreateAccount',
+    'organizations:CreatePolicy',
+    'organizations:LeaveOrganization',
+    'sts:AssumeRole',
+];
+class WorkloadRoleBoundaryContractError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'WorkloadRoleBoundaryContractError';
+    }
+}
+exports.WorkloadRoleBoundaryContractError = WorkloadRoleBoundaryContractError;
+const stagePattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const accountPattern = /^\d{12}$/;
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function requireIdentity(options) {
+    if (!accountPattern.test(options.accountId) ||
+        !stagePattern.test(options.stage) ||
+        !['aws', 'aws-cn', 'aws-us-gov'].includes(options.partition)) {
+        throw new WorkloadRoleBoundaryContractError('boundary-identity-invalid', 'Workload-role boundary identity requires an exact partition, 12-digit account, and normalized stage.');
+    }
+    return options;
+}
+function workloadRoleBoundaryPath(stage) {
+    if (!stagePattern.test(stage)) {
+        throw new WorkloadRoleBoundaryContractError('boundary-identity-invalid', `Workload-role boundary stage ${stage} is not normalized.`);
+    }
+    return `${exports.WORKLOAD_ROLE_BOUNDARY_POLICY_PATH}/${stage}/`;
+}
+function workloadRoleBoundaryArn(options) {
+    const identity = requireIdentity(options);
+    return `arn:${identity.partition}:iam::${identity.accountId}:policy${workloadRoleBoundaryPath(identity.stage)}${exports.WORKLOAD_ROLE_BOUNDARY_POLICY_NAME}`;
+}
+function boundaryAllowStatements(manifest, bundle) {
+    const statements = [];
+    for (const declaration of manifest.roles) {
+        const policy = (0, effective_policy_js_1.requireEffectivePolicy)(bundle, declaration.id);
+        if (policy.digest !== declaration.permissionPolicyDigest) {
+            throw new WorkloadRoleBoundaryContractError('boundary-substitution', `Effective policy for ${declaration.id} does not match the manifest digest.`);
+        }
+        for (const statement of policy.document.Statement) {
+            statements.push({
+                ...statement,
+                Sid: `Role${(0, node_crypto_1.createHash)('sha256')
+                    .update(`${declaration.id}:${statement.Sid}`, 'utf8')
+                    .digest('hex')
+                    .slice(0, 24)}`,
+            });
+        }
+    }
+    if (statements.length === 0) {
+        throw new WorkloadRoleBoundaryContractError('boundary-policy-incomplete', 'The workload-role boundary cannot be built without effective allow statements.');
+    }
+    return statements.sort((left, right) => compareStrings(left.Sid, right.Sid));
+}
+function createWorkloadRoleBoundaryContract(options) {
+    const identity = requireIdentity(options);
+    const manifest = (0, manifest_js_1.canonicalizeWorkloadRoleManifest)(options.manifest);
+    const manifestDigest = (0, manifest_js_1.digestWorkloadRoleManifest)(manifest);
+    if (manifest.candidate.stage !== identity.stage ||
+        options.bundle.stage !== identity.stage ||
+        options.bundle.candidateIdentity !== manifest.candidate.identity ||
+        options.bundle.manifestDigest !== manifestDigest) {
+        throw new WorkloadRoleBoundaryContractError('boundary-substitution', 'Boundary, manifest, and effective-policy bundle identities do not match.');
+    }
+    const arn = workloadRoleBoundaryArn(identity);
+    const substituted = manifest.roles.filter(({ boundaryArn }) => boundaryArn !== arn);
+    if (substituted.length > 0) {
+        throw new WorkloadRoleBoundaryContractError('boundary-substitution', `Manifest roles do not use the exact stage boundary: ${substituted.map(({ id }) => id).join(', ')}.`);
+    }
+    const policy = {
+        Statement: [
+            ...boundaryAllowStatements(manifest, options.bundle),
+            {
+                Action: [...exports.WORKLOAD_ROLE_BOUNDARY_DENIED_ACTIONS],
+                Effect: 'Deny',
+                Resource: ['*'],
+                Sid: 'DenyPrivilegeConstruction',
+            },
+        ],
+        Version: effective_policy_js_1.IAM_POLICY_VERSION,
+    };
+    const serialized = JSON.stringify(policy);
+    return {
+        accountId: identity.accountId,
+        arn,
+        candidateIdentity: manifest.candidate.identity,
+        digest: (0, node_crypto_1.createHash)('sha256').update(serialized, 'utf8').digest('hex'),
+        partition: identity.partition,
+        path: workloadRoleBoundaryPath(identity.stage),
+        policy,
+        policyName: exports.WORKLOAD_ROLE_BOUNDARY_POLICY_NAME,
+        stage: identity.stage,
+    };
+}
+//# sourceMappingURL=boundary.js.map