@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/aws-authority/stage-authority.d.ts

@@ -0,0 +1,248 @@
+export declare const STAGE_AUTHORITY_SCHEMA_VERSION: 1;
+export declare const STAGE_AUTHORITY_STAGES: readonly ["development", "staging", "production"];
+export declare const STAGE_AUTHORITY_PARTITIONS: readonly ["aws", "aws-cn", "aws-us-gov"];
+export declare const STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS: readonly ["read", "regional-mutation", "global-iam-mutation", "global-resource-mutation", "generated-resource-mutation", "stage-containment", "permission-guardrails", "guardrails"];
+export declare const STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = 6144;
+export declare const STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = 200;
+export declare const STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = 51200;
+export declare const STAGE_AUTHORITY_BOUND_TEMPLATE_BODY_MINIMUM_HEADROOM = 1024;
+export type StageAuthorityStage = (typeof STAGE_AUTHORITY_STAGES)[number];
+export type StageAuthorityPartition = (typeof STAGE_AUTHORITY_PARTITIONS)[number];
+export type StageAuthorityDeploymentPolicyKind = (typeof STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS)[number];
+type ConditionValue = string | readonly string[];
+type ConditionEntries = Readonly<Record<string, ConditionValue>>;
+export type StageAuthorityPolicyStatement = {
+    Condition?: Readonly<Record<string, ConditionEntries>>;
+    Effect: 'Allow' | 'Deny';
+    NotResource?: readonly string[];
+    Resource?: readonly string[];
+    Sid: string;
+} & ({
+    Action: readonly string[];
+    NotAction?: never;
+} | {
+    Action?: never;
+    NotAction: readonly string[];
+});
+export interface StageAuthorityPolicyDocument {
+    Statement: readonly StageAuthorityPolicyStatement[];
+    Version: '2012-10-17';
+}
+export interface StageAuthorityGithubTrust {
+    oidcProviderArn: string;
+    subject: string;
+}
+export interface StageAuthorityInput {
+    accountId: string;
+    awsPrincipalArns?: readonly string[];
+    github?: StageAuthorityGithubTrust;
+    partition?: StageAuthorityPartition;
+    region: string;
+    stage: StageAuthorityStage;
+}
+export interface StageAuthorityIdentity {
+    boundaryArn: string;
+    boundaryName: string;
+    boundaryPath: string;
+    deploymentPolicyArns: readonly string[];
+    deploymentPolicyNames: readonly string[];
+    deploymentRoleArn: string;
+    deploymentRoleName: string;
+    deploymentRolePath: string;
+    stackName: string;
+    workloadInstanceProfileArnPattern: string;
+    workloadInstanceProfilePath: string;
+    workloadRoleArnPattern: string;
+    workloadRolePath: string;
+}
+export interface StageAuthorityDeploymentPolicy {
+    arn: string;
+    document: StageAuthorityPolicyDocument;
+    kind: StageAuthorityDeploymentPolicyKind;
+    logicalId: string;
+    name: string;
+}
+export interface StageAuthorityLimitations {
+    protectedDatabaseConfiguration: 'iam-cannot-inspect-rds-modify-request-fields-lifecycle-preflight-required';
+    resourcePolicyAttributes: 'sns-and-sqs-set-attributes-can-write-resource-policies-name-account-region-containment-applies';
+    sameAccountStageDeploymentIsolation: 'deployment-role-is-account-scoped-use-production-isolated-for-hard-production-boundary';
+    wafLoggingResourcePolicy: 'cloudwatch-logs-put-resource-policy-has-no-resource-or-action-condition-keys-reviewed-generated-source-is-control';
+    workloadTrust: 'iam-cannot-inspect-create-role-trust-reviewed-generated-source-is-control';
+}
+export interface StageAuthorityPlan {
+    deploymentPolicies: readonly StageAuthorityDeploymentPolicy[];
+    digest: string;
+    identity: StageAuthorityIdentity;
+    limitations: StageAuthorityLimitations;
+    runtimeBoundaryPolicy: StageAuthorityPolicyDocument;
+    schemaVersion: typeof STAGE_AUTHORITY_SCHEMA_VERSION;
+    template: Readonly<Record<string, unknown>>;
+}
+export interface StageIamBoundaryTransformContract {
+    boundaryArn: string;
+    instanceProfilePath: string;
+    rolePath: string;
+}
+export interface StageIamBoundaryTransformArgs {
+    path?: unknown;
+    permissionsBoundary?: unknown;
+    [key: string]: unknown;
+}
+export interface StageIamBoundaryTransformInput {
+    accountId: string;
+    instanceProfileResource: unknown;
+    partition?: StageAuthorityPartition;
+    registerTransform: (resource: unknown, transform: (args: StageIamBoundaryTransformArgs) => void) => void;
+    roleResource: unknown;
+    stage: StageAuthorityStage;
+    /** Internal generated resource identity; never a deployment-stage override. */
+    resourceStage?: string;
+}
+/** Native lifecycle required by the generated machine-authorization nested
+ * stack. Recovery-only and stack-policy mutation APIs remain ungranted. */
+export declare const STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS: readonly string[];
+/** EventBridge archives expose no request-tag or resource-tag IAM condition
+ * keys. Their lifecycle is contained by the exact canonical archive ARN and
+ * requested Region instead. */
+export declare const STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_WAF_LOGGING_ACTIONS: readonly string[];
+/** SST's CloudFront-scope WAF logging component owns exactly one generated log
+ * group in the edge control Region. These resource-capable actions stay bound
+ * to that generated ARN below. */
+export declare const STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS: readonly string[];
+/** CloudWatch Logs exposes these WAF delivery mutations only at account scope.
+ * In particular, PutResourcePolicy supports neither resource ARNs nor
+ * action-specific condition keys. Requested Region and reviewed generated
+ * source are therefore the strongest honest controls for that one exception. */
+export declare const STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_KMS_ROTATION_ACTIONS: readonly string[];
+/** Cost Explorer creation is account-global, while existing anomaly controls
+ * support account-bound ARNs. These exact verbs are admitted only to the
+ * production stage role below. */
+export declare const STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_COST_ANOMALY_WRITE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_REGIONAL_READ_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_GLOBAL_READ_ACTIONS: readonly string[];
+/** CloudFront-scope WAF publishes its observability signals through the edge
+ * control Region. Keep this read surface exact instead of broadening every
+ * regional read when the application Region differs from us-east-1. */
+export declare const STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS: readonly string[];
+/** A deployment role is a temporary infrastructure administrator, not a
+ * runtime workload identity. Routine regional services therefore use one
+ * stable service-family contract instead of a provider-call inventory. The
+ * families whose policy, protection, launch, or trust semantics need tighter
+ * treatment remain on the bounded action sets below. */
+export declare const STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS: readonly string[];
+/** AddPermission, RemovePermission, and InvokeFunction remain in exact
+ * statements so the family allow cannot bypass Lambda resource-policy and
+ * deployment-smoke constraints. */
+export declare const STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS: readonly string[];
+/** These APIs establish unsupported replicas, global resources, alternate
+ * database topologies, integrations, or cross-Region copies. The generated
+ * architecture does not use them. */
+export declare const STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS: readonly string[];
+export declare const STAGE_RUNTIME_REGIONAL_ACTIONS: readonly string[];
+export declare const STAGE_RUNTIME_GLOBAL_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES: readonly string[];
+/** Logs application resources live in the deployment Region, while native WAF
+ * delivery resources live in the CloudFront edge control Region. The allow
+ * statements remain separate; this family exists only to deny mutations in a
+ * third Region. */
+export declare const STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES: readonly string[];
+export declare const STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES: readonly string[];
+export declare const STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES: readonly string[];
+export declare const STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS: readonly string[];
+/** Compact service-family scope guards keep mutation outside the selected AWS
+ * account/Region closed. They intentionally do not claim same-account stage
+ * isolation, because native SST owns account-shared bootstrap resources. */
+export declare const STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES: readonly string[];
+export declare const STAGE_AUTHORITY_CLOUDCONTROL_EDGE_MUTATION_ACTIONS: readonly string[];
+/** SST 4.17.1 resolves the generated nonproduction VPC's EC2 NAT image from
+ * this commercial-partition fck-nat publisher. The generated development
+ * bastion reuses that NAT instance, while production uses managed NAT. No
+ * publisher is admitted in partitions where the pinned source is unproven. */
+export declare const STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION: Readonly<{
+    aws: readonly string[];
+    'aws-cn': readonly any[];
+    'aws-us-gov': readonly any[];
+}>;
+/** Preserve the generic cross-account guard for ordinary EC2 mutations while
+ * routing RunInstances through its resource-aware statements below. A service
+ * family wildcard would otherwise reject SST's deliberately external AMI. */
+export declare const STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS: readonly string[];
+/** A deliberately narrow destructive set for same-account stage defense in
+ * depth. It protects named/tagged production resources without pretending the
+ * deployment roles form a complete IAM boundary. */
+export declare const STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS: readonly string[];
+/** Existing-resource mutations must either retain the exact stage tag or use a
+ * generated stage/SST shared resource identity. Initial create/tag calls are
+ * governed by their request-tag or exact-resource statements instead. */
+export declare const STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS: readonly string[];
+/** Operations whose target already exposes a stage tag may use the broader
+ * deployer contract. A known different-stage tag must still win as an explicit
+ * deny, including for provider calls that are not destructive by name. */
+export declare const STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS: readonly string[];
+/** Permission-management actions that the generated lifecycle must call. Each
+ * exception is named exactly here and remains subject to the resource and
+ * condition containment statements below. */
+export declare const STAGE_AUTHORITY_REVIEWED_PERMISSION_MANAGEMENT_ACTIONS: readonly string[];
+/** Compact deny patterns covering permission-management actions admitted by
+ * wildcard lifecycle grants but not named as reviewed exceptions. The focused
+ * oracle derives every wildcard service family from the policy and proves each
+ * currently admitted permission-management action is reviewed or denied, and
+ * that no compact pattern also captures a retained read-only action. */
+export declare const STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS: readonly string[];
+/** Stable exclusions from the temporary infrastructure-administrator role.
+ * These are account administration, direct application data/user mutation,
+ * message handling, or export paths rather than native stack reconciliation.
+ * The generated deployed smoke retains only its four exact Cognito admin calls. */
+export declare const STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS: readonly string[];
+export declare const STAGE_AUTHORITY_SERVICE_LINKED_ROLES: readonly (Readonly<{
+    path: "ecs.amazonaws.com/AWSServiceRoleForECS";
+    serviceName: "ecs.amazonaws.com";
+}> | Readonly<{
+    path: "ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService";
+    serviceName: "ecs.application-autoscaling.amazonaws.com";
+}> | Readonly<{
+    path: "rds.amazonaws.com/AWSServiceRoleForRDS";
+    serviceName: "rds.amazonaws.com";
+}> | Readonly<{
+    path: "rds.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_RDSCluster";
+    serviceName: "rds.application-autoscaling.amazonaws.com";
+}> | Readonly<{
+    path: "wafv2.amazonaws.com/AWSServiceRoleForWAFV2Logging";
+    serviceName: "wafv2.amazonaws.com";
+}>)[];
+export declare function createStageAuthorityIdentity(input: Pick<StageAuthorityInput, 'accountId' | 'partition' | 'region' | 'stage'>): StageAuthorityIdentity;
+export declare function canonicalStageAuthorityTemplate(template: Readonly<Record<string, unknown>>): string;
+export declare function digestStageAuthorityTemplate(template: Readonly<Record<string, unknown>>): string;
+export declare function assertBoundStageAuthorityTemplateFitsBodyLimit(template: Readonly<Record<string, unknown>>): number;
+export declare function createStageAuthorityPlan(input: StageAuthorityInput): StageAuthorityPlan;
+export declare function createStageIamBoundaryTransformContract(input: Pick<StageAuthorityInput, 'accountId' | 'partition' | 'stage'>): StageIamBoundaryTransformContract;
+/**
+ * Installs ordinary Pulumi resource transforms before generated SST components
+ * are constructed. SST remains responsible for creating its roles and NAT
+ * instance profiles; this helper contributes only the stable stage path and
+ * permissions boundary.
+ */
+export declare function installStageIamBoundaryTransforms(input: StageIamBoundaryTransformInput): StageIamBoundaryTransformContract;
+export {};