@gradientedge/cdk-utils-aws 1.0.0

package/dist/src/services/identity-access-management/main.d.ts

@@ -0,0 +1,263 @@
+import { ICluster, ITaskDefinition } from 'aws-cdk-lib/aws-ecs';
+import { IRule } from 'aws-cdk-lib/aws-events';
+import { CfnRole, PolicyDocument, PolicyStatement, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { CfnLogGroup } from 'aws-cdk-lib/aws-logs';
+import { IBucket } from 'aws-cdk-lib/aws-s3';
+import { Queue } from 'aws-cdk-lib/aws-sqs';
+import { CommonConstruct } from '../../common/index.js';
+/**
+ * @classdesc Provides operations on AWS
+ * - A new instance of this class is injected into {@link CommonConstruct} constructor.
+ * - If a custom construct extends {@link CommonConstruct}, an instance is available within the context.
+ * @example
+ * import { CommonConstruct } from '@gradientedge/cdk-utils'
+ *
+ * class CustomConstruct extends CommonConstruct {
+ *   constructor(parent: Construct, id: string, props: common.CommonStackProps) {
+ *     super(parent, id, props)
+ *     this.props = props
+ *     this.iamManager.createRoleForEcsEvent('MyEcsRole', this, cluster, task)
+ *   }
+ * }
+ * @see [CDK IAM Module]{@link https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_iam-readme.html}
+ */
+export declare class IamManager {
+    /**
+     * @summary Method to create iam statement to read secrets
+     * @param scope scope in which this resource is defined
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForReadSecrets(scope: CommonConstruct, resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to put events
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForPutEvents(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to start step function execution
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForStartExecution(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to poll queue
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForPollQueue(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to invoke lambda function
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForInvokeLambda(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to read app config
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForReadAnyAppConfig(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to access app config
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForAppConfigExecution(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to put xray telemetry
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForPutXrayTelemetry(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to decrypt kms
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForDecryptKms(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to list s3 buckets
+     * @param scope scope in which this resource is defined
+     * @param bucket
+     */
+    statementForListBucket(scope: CommonConstruct, bucket: IBucket): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to list all s3 buckets
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForListAllMyBuckets(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to get s3 objects in buckets
+     * @param scope scope in which this resource is defined
+     * @param bucket
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForGetAnyS3Objects(scope: CommonConstruct, bucket: IBucket, resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to delete s3 objects in buckets
+     * @param scope scope in which this resource is defined
+     * @param bucket
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForDeleteAnyS3Objects(scope: CommonConstruct, bucket: IBucket, resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to write s3 objects in buckets
+     * @param scope scope in which this resource is defined
+     * @param bucket
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForPutAnyS3Objects(scope: CommonConstruct, bucket: IBucket, resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to pass iam role
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForPassRole(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to invalidate cloudfront cache
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForCloudfrontInvalidation(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to access efs
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForWriteEfs(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to assume iam role
+     * @param scope scope in which this resource is defined
+     * @param servicePrincipals
+     */
+    statementForAssumeRole(scope: CommonConstruct, servicePrincipals: ServicePrincipal[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to pass ecs role
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForEcsPassRole(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to run ecs task
+     * @param scope scope in which this resource is defined
+     * @param cluster
+     * @param task
+     */
+    statementForRunEcsTask(scope: CommonConstruct, cluster: ICluster, task: ITaskDefinition): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to create log stream
+     * @param scope scope in which this resource is defined
+     * @param logGroup
+     */
+    statementForCreateLogStream(scope: CommonConstruct, logGroup: CfnLogGroup): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to create any log stream
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForCreateAnyLogStream(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to write log events
+     * @param scope scope in which this resource is defined
+     * @param logGroup
+     */
+    statementForPutLogEvent(scope: CommonConstruct, logGroup: CfnLogGroup): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to write any log events
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForPutAnyLogEvent(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to read items from dynamodb table
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForReadTableItems(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to write items from dynamodb table
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementForWriteTableItems(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam statement to poll from dynamodb table
+     * @param resourceArns list of ARNs to allow access to
+     */
+    statementFordynamoDbStream(resourceArns?: string[]): PolicyStatement;
+    /**
+     * @summary Method to create iam policy to invalidate cloudfront cache
+     * @param resourceArns list of ARNs to allow access to
+     */
+    createPolicyForCloudfrontInvalidation(resourceArns?: string[]): PolicyDocument;
+    /**
+     * @summary Method to create iam policy for sqs
+     * @param id scoped id of the resource
+     * @param scope scope in which this resource is defined
+     * @param sqsQueue
+     * @param eventBridgeRule
+     * @param servicePrincipals
+     */
+    createPolicyForSqsEvent(id: string, scope: CommonConstruct, sqsQueue: Queue, eventBridgeRule: IRule, servicePrincipals?: ServicePrincipal[]): PolicyDocument;
+    /**
+     * @summary Method to create iam role to invalidate cloudfront cache
+     * @param id scoped id of the resource
+     * @param scope scope in which this resource is defined
+     */
+    createRoleForCloudfrontInvalidation(id: string, scope: CommonConstruct): Role;
+    /**
+     * @summary Method to create iam statement for cloud trail
+     * @param id scoped id of the resource
+     * @param scope scope in which this resource is defined
+     * @param logGroup
+     */
+    createRoleForCloudTrail(id: string, scope: CommonConstruct, logGroup: CfnLogGroup): CfnRole;
+    /**
+     * @summary Method to create iam statement for ecs event
+     * @param id scoped id of the resource
+     * @param scope scope in which this resource is defined
+     * @param cluster
+     * @param task
+     */
+    createRoleForEcsEvent(id: string, scope: CommonConstruct, cluster: ICluster, task: ITaskDefinition): Role;
+    /**
+     * @summary Method to create iam statement for ecs execution
+     * @param id scoped id of the resource
+     * @param scope scope in which this resource is defined
+     * @param policy
+     */
+    createRoleForEcsExecution(id: string, scope: CommonConstruct, policy: PolicyDocument): Role;
+    /**
+     * @summary Method to create iam statement for lambda execution
+     * @param id scoped id of the resource
+     * @param scope scope in which this resource is defined
+     * @param policy
+     * @param servicePrincipal
+     */
+    createRoleForLambda(id: string, scope: CommonConstruct, policy: PolicyDocument, servicePrincipal?: ServicePrincipal): Role;
+    /**
+     * @summary Method to create iam statement for appconfig secrets manager integration
+     * @param id scoped id of the resource
+     * @param scope scope in which this resource is defined
+     * @param policy
+     * @param servicePrincipal
+     */
+    createRoleForAppConfigSecrets(id: string, scope: CommonConstruct, policy: PolicyDocument, servicePrincipal?: ServicePrincipal): Role;
+    /**
+     * @summary Method to create iam statement for step function execution
+     * @param id scoped id of the resource
+     * @param scope scope in which this resource is defined
+     * @param policy
+     * @param servicePrincipal
+     */
+    createRoleForStepFunction(id: string, scope: CommonConstruct, policy: PolicyDocument, servicePrincipal?: ServicePrincipal): Role;
+    /**
+     * @summary Method to create iam statement for sqs to step function pipe
+     * @param id scoped id of the resource
+     * @param scope scope in which this resource is defined
+     * @param queueArn the arn of the sqs queue
+     * @param stepFunctionArn the arn of the step function
+     */
+    createRoleForSqsToSfnPipe(id: string, scope: CommonConstruct, queueArn: string, stepFunctionArn: string): Role;
+    /**
+     * @summary Method to create iam statement for sqs to lambda pipe
+     * @param id scoped id of the resource
+     * @param scope scope in which this resource is defined
+     * @param queueArn the arn of the sqs queue
+     * @param lambdaArn the arn of the lambda function
+     */
+    createRoleForSqsToLambdaPipe(id: string, scope: CommonConstruct, queueArn: string, lambdaArn: string): Role;
+    /**
+     * @summary Method to create iam statement for dynamoDb to lambda function pipe
+     * @param id scoped id of the resource
+     * @param scope scope in which this resource is defined
+     * @param dynamoDbStreamArn the arn of the dynamoDb Stream queue
+     * @param lambdaFunctionArn the arn of the lambda function
+     */
+    createRoleForDynamoDbToLambdaPipe(id: string, scope: CommonConstruct, dynamoDbStreamArn: string, lambdaFunctionArn: string): Role;
+}