@guardian/cdk 62.3.5 → 62.4.0

package/lib/experimental/constructs/iam/policies/developer-policy.d.ts

@@ -0,0 +1,65 @@
+import { ManagedPolicy, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { GuStack } from "../../../../constructs/core";
+import type { GuAllowPolicyProps, GuDenyPolicyProps } from "../../../../constructs/iam";
+export type GuWorkloadPolicyProps = {
+    /**
+     * List of explicitly allowed permissions given by this policy.
+     */
+    readonly allow?: GuAllowPolicyProps[];
+    /**
+     * List of explicitly denied permissions which can be used to fine tune this policy by pruning the allow permissions.
+     */
+    readonly deny?: GuDenyPolicyProps[];
+    /**
+     * Initial set of permissions to add to this policy document.
+     * You can also use `addPermission(statement)` to add permissions later.
+     *
+     * @default - No statements.
+     */
+    readonly statements?: PolicyStatement[];
+    /**
+     * The unique identifier of the policy, which will be displayed when creating credentials.
+     */
+    readonly permission: string;
+    /**
+     * An optional description of the policy which will be displayed if present.
+     */
+    readonly description?: string;
+};
+/**
+ * Creates a structured `AWS::IAM::ManagedPolicy` resource to manage arbitrary permissions on general account
+ * resources which can then be used to create limited permission credentials for use with specific activities.
+ *
+ * The permission scope is not controlled.  This class should be used with care to create minimal permissions.
+ * To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.
+ *
+ * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path.  This will
+ * be used for discovery and display.  It is restricted to the same character set as AWS `path`.
+ *
+ * `description` is optionally used to construct the AWS Managed Policy description and used for display.
+ *
+ * ```yaml
+ *  TestingECAE2E87:
+ *     Type: AWS::IAM::ManagedPolicy
+ *     Properties:
+ *       Description: This is testing stuff
+ *       Path: /developer-policy/read-from-mybucket-under-mypath/
+ *       PolicyDocument:
+ *         Statement:
+ *           - Action: s3:GetObject
+ *             Effect: Allow
+ *             Resource: arn:aws:s3:::mybucket/mypath
+ *           - Action: s3:GetObject
+ *             Effect: Deny
+ *             Resource: arn:aws:s3:::mybucket/mypath/butnotthispath
+ *         Version: "2012-10-17"
+ *     Metadata:
+ *       aws:cdk:path: janus-resources-for-testing-managed-policy-tagging/justin-testing/Resource* ```
+ * ```
+ *
+ * @experimental
+ */
+export declare class GuDeveloperPolicyExperimental extends ManagedPolicy {
+    constructor(scope: GuStack, id: string, props: GuWorkloadPolicyProps);
+}
+//# sourceMappingURL=developer-policy.d.ts.map

package/lib/experimental/constructs/iam/policies/developer-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-policy.d.ts","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAExF,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACtC;;OAEG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IACxC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,6BAA8B,SAAQ,aAAa;gBAClD,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;CAsErE"}

package/lib/experimental/constructs/iam/policies/developer-policy.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuDeveloperPolicyExperimental = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+/**
+ * Creates a structured `AWS::IAM::ManagedPolicy` resource to manage arbitrary permissions on general account
+ * resources which can then be used to create limited permission credentials for use with specific activities.
+ *
+ * The permission scope is not controlled.  This class should be used with care to create minimal permissions.
+ * To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.
+ *
+ * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path.  This will
+ * be used for discovery and display.  It is restricted to the same character set as AWS `path`.
+ *
+ * `description` is optionally used to construct the AWS Managed Policy description and used for display.
+ *
+ * ```yaml
+ *  TestingECAE2E87:
+ *     Type: AWS::IAM::ManagedPolicy
+ *     Properties:
+ *       Description: This is testing stuff
+ *       Path: /developer-policy/read-from-mybucket-under-mypath/
+ *       PolicyDocument:
+ *         Statement:
+ *           - Action: s3:GetObject
+ *             Effect: Allow
+ *             Resource: arn:aws:s3:::mybucket/mypath
+ *           - Action: s3:GetObject
+ *             Effect: Deny
+ *             Resource: arn:aws:s3:::mybucket/mypath/butnotthispath
+ *         Version: "2012-10-17"
+ *     Metadata:
+ *       aws:cdk:path: janus-resources-for-testing-managed-policy-tagging/justin-testing/Resource* ```
+ * ```
+ *
+ * @experimental
+ */
+class GuDeveloperPolicyExperimental extends aws_iam_1.ManagedPolicy {
+    constructor(scope, id, props) {
+        super(scope, id, {
+            description: `${props.permission} developer policy`,
+            ...props,
+            path: `/developer-policy/${props.permission}/`,
+        });
+        let valid = true;
+        const { statements = [] } = props;
+        for (const statement of statements) {
+            if (statement.effect === aws_iam_1.Effect.ALLOW) {
+                for (const action of statement.actions) {
+                    if (action === "*") {
+                        const name = statement.actions.join(",");
+                        aws_cdk_lib_1.Annotations.of(this).addError(`Action of '*' found in ${name} ALLOW permission`);
+                        valid = false;
+                    }
+                }
+                for (const resource of statement.resources) {
+                    if (resource === "*") {
+                        const name = statement.actions.join(",");
+                        aws_cdk_lib_1.Annotations.of(this).addError(`Resource of '*' found in ${name} ALLOW permission`);
+                        valid = false;
+                    }
+                }
+            }
+        }
+        const { allow = [] } = props;
+        for (const allowed of allow) {
+            // validity checks
+            const name = allowed.policyName ?? allowed.actions.join(",") + " on " + allowed.resources.join(",");
+            for (const resource of allowed.resources) {
+                if (resource === "*") {
+                    aws_cdk_lib_1.Annotations.of(this).addError(`Resource of '*' found in ${name} ALLOW permission`);
+                    valid = false;
+                }
+            }
+            for (const action of allowed.actions) {
+                if (action === "*") {
+                    const name = allowed.policyName ?? allowed.actions.join(",");
+                    aws_cdk_lib_1.Annotations.of(this).addError(`Action of '*' found in ${name} ALLOW permission`);
+                    valid = false;
+                }
+            }
+            this.addStatements(new aws_iam_1.PolicyStatement({
+                effect: aws_iam_1.Effect.ALLOW,
+                resources: allowed.resources,
+                actions: allowed.actions,
+            }));
+        }
+        if (!valid) {
+            throw new Error("Overly broad permission present, see annotations for details");
+        }
+        const { deny = [] } = props;
+        for (const denied of deny) {
+            this.addStatements(new aws_iam_1.PolicyStatement({
+                effect: aws_iam_1.Effect.DENY,
+                resources: denied.resources,
+                actions: denied.actions,
+            }));
+        }
+    }
+}
+exports.GuDeveloperPolicyExperimental = GuDeveloperPolicyExperimental;
+//# sourceMappingURL=developer-policy.js.map

package/lib/experimental/constructs/iam/policies/developer-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-policy.js","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":";;;AAAA,6CAA0C;AAC1C,iDAA6E;AA8B7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAa,6BAA8B,SAAQ,uBAAa;IAC9D,YAAY,KAAc,EAAE,EAAU,EAAE,KAA4B;QAClE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,WAAW,EAAE,GAAG,KAAK,CAAC,UAAU,mBAAmB;YACnD,GAAG,KAAK;YACR,IAAI,EAAE,qBAAqB,KAAK,CAAC,UAAU,GAAG;SAC/C,CAAC,CAAC;QAEH,IAAI,KAAK,GAAG,IAAI,CAAC;QAEjB,MAAM,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;QAClC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE;YAClC,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAM,CAAC,KAAK,EAAE;gBACrC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE;oBACtC,IAAI,MAAM,KAAK,GAAG,EAAE;wBAClB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACzC,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,0BAA0B,IAAI,mBAAmB,CAAC,CAAC;wBACjF,KAAK,GAAG,KAAK,CAAC;qBACf;iBACF;gBACD,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE;oBAC1C,IAAI,QAAQ,KAAK,GAAG,EAAE;wBACpB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACzC,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4BAA4B,IAAI,mBAAmB,CAAC,CAAC;wBACnF,KAAK,GAAG,KAAK,CAAC;qBACf;iBACF;aACF;SACF;QAED,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE;YAC3B,kBAAkB;YAClB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpG,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE;gBACxC,IAAI,QAAQ,KAAK,GAAG,EAAE;oBACpB,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4BAA4B,IAAI,mBAAmB,CAAC,CAAC;oBACnF,KAAK,GAAG,KAAK,CAAC;iBACf;aACF;YACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE;gBACpC,IAAI,MAAM,KAAK,GAAG,EAAE;oBAClB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC7D,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,0BAA0B,IAAI,mBAAmB,CAAC,CAAC;oBACjF,KAAK,GAAG,KAAK,CAAC;iBACf;aACF;YACD,IAAI,CAAC,aAAa,CAChB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,KAAK,EAAE;YACV,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;SACjF;QAED,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE;YACzB,IAAI,CAAC,aAAa,CAChB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,IAAI;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CACH,CAAC;SACH;IACH,CAAC;CACF;AAvED,sEAuEC","sourcesContent":["import { Annotations } from \"aws-cdk-lib\";\nimport { Effect, ManagedPolicy, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport type { GuStack } from \"../../../../constructs/core\";\nimport type { GuAllowPolicyProps, GuDenyPolicyProps } from \"../../../../constructs/iam\";\n\nexport type GuWorkloadPolicyProps = {\n  /**\n   * List of explicitly allowed permissions given by this policy.\n   */\n  readonly allow?: GuAllowPolicyProps[];\n  /**\n   * List of explicitly denied permissions which can be used to fine tune this policy by pruning the allow permissions.\n   */\n  readonly deny?: GuDenyPolicyProps[];\n  /**\n   * Initial set of permissions to add to this policy document.\n   * You can also use `addPermission(statement)` to add permissions later.\n   *\n   * @default - No statements.\n   */\n  readonly statements?: PolicyStatement[];\n  /**\n   * The unique identifier of the policy, which will be displayed when creating credentials.\n   */\n  readonly permission: string;\n  /**\n   * An optional description of the policy which will be displayed if present.\n   */\n  readonly description?: string;\n};\n\n/**\n * Creates a structured `AWS::IAM::ManagedPolicy` resource to manage arbitrary permissions on general account\n * resources which can then be used to create limited permission credentials for use with specific activities.\n *\n * The permission scope is not controlled.  This class should be used with care to create minimal permissions.\n * To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.\n *\n * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path.  This will\n * be used for discovery and display.  It is restricted to the same character set as AWS `path`.\n *\n * `description` is optionally used to construct the AWS Managed Policy description and used for display.\n *\n * ```yaml\n *  TestingECAE2E87:\n *     Type: AWS::IAM::ManagedPolicy\n *     Properties:\n *       Description: This is testing stuff\n *       Path: /developer-policy/read-from-mybucket-under-mypath/\n *       PolicyDocument:\n *         Statement:\n *           - Action: s3:GetObject\n *             Effect: Allow\n *             Resource: arn:aws:s3:::mybucket/mypath\n *           - Action: s3:GetObject\n *             Effect: Deny\n *             Resource: arn:aws:s3:::mybucket/mypath/butnotthispath\n *         Version: \"2012-10-17\"\n *     Metadata:\n *       aws:cdk:path: janus-resources-for-testing-managed-policy-tagging/justin-testing/Resource* ```\n * ```\n *\n * @experimental\n */\nexport class GuDeveloperPolicyExperimental extends ManagedPolicy {\n  constructor(scope: GuStack, id: string, props: GuWorkloadPolicyProps) {\n    super(scope, id, {\n      description: `${props.permission} developer policy`,\n      ...props,\n      path: `/developer-policy/${props.permission}/`,\n    });\n\n    let valid = true;\n\n    const { statements = [] } = props;\n    for (const statement of statements) {\n      if (statement.effect === Effect.ALLOW) {\n        for (const action of statement.actions) {\n          if (action === \"*\") {\n            const name = statement.actions.join(\",\");\n            Annotations.of(this).addError(`Action of '*' found in ${name} ALLOW permission`);\n            valid = false;\n          }\n        }\n        for (const resource of statement.resources) {\n          if (resource === \"*\") {\n            const name = statement.actions.join(\",\");\n            Annotations.of(this).addError(`Resource of '*' found in ${name} ALLOW permission`);\n            valid = false;\n          }\n        }\n      }\n    }\n\n    const { allow = [] } = props;\n    for (const allowed of allow) {\n      // validity checks\n      const name = allowed.policyName ?? allowed.actions.join(\",\") + \" on \" + allowed.resources.join(\",\");\n      for (const resource of allowed.resources) {\n        if (resource === \"*\") {\n          Annotations.of(this).addError(`Resource of '*' found in ${name} ALLOW permission`);\n          valid = false;\n        }\n      }\n      for (const action of allowed.actions) {\n        if (action === \"*\") {\n          const name = allowed.policyName ?? allowed.actions.join(\",\");\n          Annotations.of(this).addError(`Action of '*' found in ${name} ALLOW permission`);\n          valid = false;\n        }\n      }\n      this.addStatements(\n        new PolicyStatement({\n          effect: Effect.ALLOW,\n          resources: allowed.resources,\n          actions: allowed.actions,\n        }),\n      );\n    }\n\n    if (!valid) {\n      throw new Error(\"Overly broad permission present, see annotations for details\");\n    }\n\n    const { deny = [] } = props;\n    for (const denied of deny) {\n      this.addStatements(\n        new PolicyStatement({\n          effect: Effect.DENY,\n          resources: denied.resources,\n          actions: denied.actions,\n        }),\n      );\n    }\n  }\n}\n"]}

package/lib/experimental/constructs/iam/policies/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./developer-policy";
+//# sourceMappingURL=index.d.ts.map

package/lib/experimental/constructs/iam/policies/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC"}

package/lib/experimental/constructs/iam/policies/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./developer-policy"), exports);
+//# sourceMappingURL=index.js.map

package/lib/experimental/constructs/iam/policies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC","sourcesContent":["export * from \"./developer-policy\";\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "62.3.5",
+  "version": "62.4.0",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [
@@ -46,7 +46,7 @@
     "eslint": "^9.39.2",
     "eslint-plugin-custom-rules": "file:tools/eslint",
     "gh-pages": "^6.3.0",
-    "jest": "^29.7.0",
+    "jest": "30.2.0",
     "prettier": "^3.8.1",
     "serve": "^14.2.5",
     "ts-jest": "^29.4.6",