@guardian/cdk 62.3.5 → 62.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/bin/commands/new-project/index.d.ts.map +1 -1
- package/lib/bin/commands/new-project/index.js +8 -9
- package/lib/bin/commands/new-project/index.js.map +1 -1
- package/lib/experimental/constructs/iam/policies/developer-policy.d.ts +65 -0
- package/lib/experimental/constructs/iam/policies/developer-policy.d.ts.map +1 -0
- package/lib/experimental/constructs/iam/policies/developer-policy.js +103 -0
- package/lib/experimental/constructs/iam/policies/developer-policy.js.map +1 -0
- package/lib/experimental/constructs/iam/policies/index.d.ts +2 -0
- package/lib/experimental/constructs/iam/policies/index.d.ts.map +1 -0
- package/lib/experimental/constructs/iam/policies/index.js +18 -0
- package/lib/experimental/constructs/iam/policies/index.js.map +1 -0
- package/package.json +6 -7
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bin/commands/new-project/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bin/commands/new-project/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAY7D,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,CAAC;AAE5C,UAAU,eAAe;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,cAAc,CAAC;CAChC;AAuED,eAAO,MAAM,aAAa,UAAiB,eAAe,uBA4EzD,CAAC"}
|
|
@@ -6,7 +6,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
6
6
|
exports.newCdkProject = void 0;
|
|
7
7
|
const fs_1 = require("fs");
|
|
8
8
|
const path_1 = require("path");
|
|
9
|
-
const core_1 = require("@oclif/core");
|
|
10
9
|
const chalk_1 = __importDefault(require("chalk"));
|
|
11
10
|
const exec_1 = require("../../../utils/exec");
|
|
12
11
|
const git_1 = require("../../../utils/git");
|
|
@@ -103,23 +102,23 @@ const newCdkProject = async (props) => {
|
|
|
103
102
|
});
|
|
104
103
|
const commands = (0, utils_1.getCommands)(config.packageManager, config.cdkDir);
|
|
105
104
|
if (config.init) {
|
|
106
|
-
|
|
105
|
+
console.log(chalk_1.default.yellow("Installing dependencies. This may take a while..."));
|
|
107
106
|
await commands.installDependencies();
|
|
108
|
-
|
|
107
|
+
console.log(chalk_1.default.green(" ✅ Successfully installed dependencies"));
|
|
109
108
|
}
|
|
110
109
|
// Run `eslint --fix` on the generated files instead of trying to generate code that completely satisfies the linter
|
|
111
110
|
await (0, exec_1.execute)("./node_modules/.bin/eslint", ["lib/** bin/**", "--no-error-on-unmatched-pattern", "--fix"], {
|
|
112
111
|
cwd: config.cdkDir,
|
|
113
112
|
});
|
|
114
|
-
|
|
113
|
+
console.log(chalk_1.default.yellow("Running lint check..."));
|
|
115
114
|
await commands.lint();
|
|
116
|
-
|
|
117
|
-
|
|
115
|
+
console.log(chalk_1.default.green(" ✅ Successfully passed lint check"));
|
|
116
|
+
console.log(chalk_1.default.yellow("Running tests..."));
|
|
118
117
|
await commands.test();
|
|
119
|
-
|
|
120
|
-
|
|
118
|
+
console.log(chalk_1.default.green(" ✅ Successfully passed tests"));
|
|
119
|
+
console.log(chalk_1.default.yellow("Running initial synthesis..."));
|
|
121
120
|
await commands.synth();
|
|
122
|
-
|
|
121
|
+
console.log(chalk_1.default.green(" ✅ Successfully synthesized CDK app"));
|
|
123
122
|
console.log(chalk_1.default.green("Success! Here's a summary of the created files:"));
|
|
124
123
|
const tree = await (0, exec_1.execute)("tree", ["-I 'node_modules|cdk.out'"], {
|
|
125
124
|
cwd: config.cdkDir,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/bin/commands/new-project/index.ts"],"names":[],"mappings":";;;;;;AAAA,2BAAgC;AAChC,+BAA+C;AAC/C,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/bin/commands/new-project/index.ts"],"names":[],"mappings":";;;;;;AAAA,2BAAgC;AAChC,+BAA+C;AAC/C,kDAA0B;AAE1B,8CAA8C;AAC9C,4CAAkD;AAClD,kDAAkE;AAClE,qCAA2C;AAC3C,6CAA0C;AAC1C,uCAA8C;AAC9C,+CAAiD;AACjD,yCAA+C;AAE/C,yCAA4C;AAuB5C,MAAM,eAAe,GAAG,CAAC,IAAY,EAAQ,EAAE;IAC7C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;KAC7C;AACH,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAQ,EAAE;IACnD,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE;QACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;KACzD;AACH,CAAC,CAAC;AAEF,SAAS,cAAc,CAAC,MAAwB;IAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAChB,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAChC;IACD,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,iDAAiD;IACxF,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,oBAAoB,EAAE;QAC/B,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;KAC9C;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAE1F,MAAM,OAAO,GAAG,IAAA,kBAAY,GAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAErC,MAAM,OAAO,GAAG,IAAA,qBAAY,EAAC,GAAG,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,IAAA,oBAAW,EAAC,SAAS,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAqB;QAC/B,IAAI;QACJ,oBAAoB;QACpB,MAAM;QACN,OAAO;QACP,MAAM;QACN,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,OAAO;SAChB;QACD,OAAO,EAAE,GAAG,MAAM,QAAQ,YAAY,KAAK;QAC3C,SAAS,EAAE;YACT,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,SAAS;SAClB;QACD,SAAS,EAAE,GAAG,MAAM,QAAQ,YAAY,KAAK;QAC7C,QAAQ,EAAE,GAAG,MAAM,QAAQ,YAAY,UAAU;QACjD,cAAc;KACf,CAAC;IAEF,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,MAAM,aAAa,GAAG,KAAK,EAAE,KAAsB,EAAsB,EAAE;IAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,MAAM,CAAC,IAAI,EAAE;QACf,IAAA,qBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;KAC9C;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,uBAAuB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,SAAS,CAAC,MAAM,uBAAuB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAE3F,gBAAgB;IAChB,MAAM,IAAA,kBAAY,EAAC;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,MAAM,CAAC,SAAS;QACvB,OAAO,EAAE,iBAAO,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,IAAA,sBAAc,EAAC;QACnB,OAAO,EAAE,iBAAO,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC/D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAA,eAAQ,EAAC,MAAM,CAAC,SAAS,CAAC;QACtC,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,SAAS,CAAC;QACpC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;KAClD,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,IAAA,wBAAa,EAAC;QAClB,OAAO,EAAE,iBAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAA,eAAQ,EAAC,MAAM,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,SAAS,CAAC;KACrC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnE,IAAI,MAAM,CAAC,IAAI,EAAE;QACf,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC/E,MAAM,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;KACrE;IAED,oHAAoH;IACpH,MAAM,IAAA,cAAO,EAAC,4BAA4B,EAAE,CAAC,eAAe,EAAE,iCAAiC,EAAE,OAAO,CAAC,EAAE;QACzG,GAAG,EAAE,MAAM,CAAC,MAAM;KACnB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAE/D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC9C,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;IAE1D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;IAEjE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,IAAA,cAAO,EAAC,MAAM,EAAE,CAAC,2BAA2B,CAAC,EAAE;QAChE,GAAG,EAAE,MAAM,CAAC,MAAM;KACnB,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElB,MAAM,OAAO,GAAG,gDAAgD,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,wBAAwB,OAAO,mBAAmB,CAAC,CAAC,CAAC;IAE7E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC,CAAC;AA5EW,QAAA,aAAa,iBA4ExB","sourcesContent":["import { existsSync } from \"fs\";\nimport { basename, dirname, join } from \"path\";\nimport chalk from \"chalk\";\nimport type { CliCommandResponse } from \"../../../types/cli\";\nimport { execute } from \"../../../utils/exec\";\nimport { gitRootOrCwd } from \"../../../utils/git\";\nimport { toKebabCase, toPascalCase } from \"../../../utils/string\";\nimport { constructApp } from \"./utils/app\";\nimport { Imports } from \"./utils/imports\";\nimport { buildDirectory } from \"./utils/init\";\nimport { constructTest } from \"./utils/snapshot\";\nimport { constructStack } from \"./utils/stack\";\nimport type { Name } from \"./utils/utils\";\nimport { getCommands } from \"./utils/utils\";\n\nexport type PackageManager = \"npm\" | \"yarn\";\n\ninterface NewProjectProps {\n init: boolean;\n app: string;\n stack: string;\n stages: string[];\n regions: string[];\n yamlTemplateLocation?: string;\n packageManager: PackageManager;\n}\n\ninterface NewProjectConfig extends Omit<NewProjectProps, \"stack\" | \"app\"> {\n cdkDir: string;\n appPath: string;\n appName: Name;\n stackPath: string;\n stackName: Name;\n testPath: string;\n}\n\nconst checkPathExists = (path: string): void => {\n if (!existsSync(path)) {\n throw new Error(`File not found - ${path}`);\n }\n};\n\nconst checkPathDoesNotExist = (path: string): void => {\n if (existsSync(path)) {\n throw new Error(`There is already a file at - ${path}`);\n }\n};\n\nfunction validateConfig(config: NewProjectConfig): void {\n if (!config.init) {\n checkPathExists(config.cdkDir);\n }\n checkPathDoesNotExist(config.appPath); // TODO: Update the app file if it already exists\n checkPathDoesNotExist(config.stackPath);\n\n if (config.yamlTemplateLocation) {\n checkPathExists(config.yamlTemplateLocation);\n }\n}\n\nfunction getConfig(props: NewProjectProps): NewProjectConfig {\n const { init, app, stack, stages, regions, yamlTemplateLocation, packageManager } = props;\n\n const rootDir = gitRootOrCwd();\n const cdkDir = join(rootDir, \"/cdk\");\n\n const appName = toPascalCase(app);\n const kebabAppName = toKebabCase(appName);\n const stackName = toPascalCase(stack);\n const kebabStackName = toKebabCase(stackName);\n\n const config: NewProjectConfig = {\n init,\n yamlTemplateLocation,\n stages,\n regions,\n cdkDir,\n appName: {\n kebab: kebabAppName,\n pascal: appName,\n },\n appPath: `${cdkDir}/bin/${kebabAppName}.ts`,\n stackName: {\n kebab: kebabStackName,\n pascal: stackName,\n },\n stackPath: `${cdkDir}/lib/${kebabAppName}.ts`,\n testPath: `${cdkDir}/lib/${kebabAppName}.test.ts`,\n packageManager,\n };\n\n validateConfig(config);\n\n return config;\n}\n\nexport const newCdkProject = async (props: NewProjectProps): CliCommandResponse => {\n console.log(\"Starting CDK generator\");\n\n const config = getConfig(props);\n\n if (config.init) {\n buildDirectory({ outputDir: config.cdkDir });\n }\n\n console.log(`New app ${config.appName.pascal} will be written to ${config.appPath}`);\n console.log(`New stack ${config.stackName.pascal} will be written to ${config.stackPath}`);\n\n // bin directory\n await constructApp({\n appName: config.appName,\n outputFile: \"cdk.ts\",\n outputDir: dirname(config.appPath),\n stack: config.stackName,\n imports: Imports.newAppImports(config.appName),\n stages: config.stages,\n regions: config.regions,\n });\n\n // lib directory\n await constructStack({\n imports: Imports.newStackImports(!!config.yamlTemplateLocation),\n appName: config.appName,\n outputFile: basename(config.stackPath),\n outputDir: dirname(config.stackPath),\n yamlTemplateLocation: config.yamlTemplateLocation,\n });\n\n // lib directory\n await constructTest({\n imports: Imports.newTestImports(config.appName),\n stackName: config.stackName,\n appName: config.appName,\n outputFile: basename(config.testPath),\n outputDir: dirname(config.stackPath),\n });\n\n const commands = getCommands(config.packageManager, config.cdkDir);\n\n if (config.init) {\n console.log(chalk.yellow(\"Installing dependencies. This may take a while...\"));\n await commands.installDependencies();\n console.log(chalk.green(\" ✅ Successfully installed dependencies\"));\n }\n\n // Run `eslint --fix` on the generated files instead of trying to generate code that completely satisfies the linter\n await execute(\"./node_modules/.bin/eslint\", [\"lib/** bin/**\", \"--no-error-on-unmatched-pattern\", \"--fix\"], {\n cwd: config.cdkDir,\n });\n\n console.log(chalk.yellow(\"Running lint check...\"));\n await commands.lint();\n console.log(chalk.green(\" ✅ Successfully passed lint check\"));\n\n console.log(chalk.yellow(\"Running tests...\"));\n await commands.test();\n console.log(chalk.green(\" ✅ Successfully passed tests\"));\n\n console.log(chalk.yellow(\"Running initial synthesis...\"));\n await commands.synth();\n console.log(chalk.green(\" ✅ Successfully synthesized CDK app\"));\n\n console.log(chalk.green(\"Success! Here's a summary of the created files:\"));\n const tree = await execute(\"tree\", [\"-I 'node_modules|cdk.out'\"], {\n cwd: config.cdkDir,\n });\n console.log(tree);\n\n const docsUrl = \"https://github.com/guardian/cdk/tree/main/docs\";\n console.log(chalk.green(`Please see the docs (${docsUrl}) for next steps.`));\n\n return Promise.resolve(0);\n};\n"]}
|
|
@@ -0,0 +1,65 @@
|
|
|
1
|
+
import { ManagedPolicy, PolicyStatement } from "aws-cdk-lib/aws-iam";
|
|
2
|
+
import type { GuStack } from "../../../../constructs/core";
|
|
3
|
+
import type { GuAllowPolicyProps, GuDenyPolicyProps } from "../../../../constructs/iam";
|
|
4
|
+
export type GuWorkloadPolicyProps = {
|
|
5
|
+
/**
|
|
6
|
+
* List of explicitly allowed permissions given by this policy.
|
|
7
|
+
*/
|
|
8
|
+
readonly allow?: GuAllowPolicyProps[];
|
|
9
|
+
/**
|
|
10
|
+
* List of explicitly denied permissions which can be used to fine tune this policy by pruning the allow permissions.
|
|
11
|
+
*/
|
|
12
|
+
readonly deny?: GuDenyPolicyProps[];
|
|
13
|
+
/**
|
|
14
|
+
* Initial set of permissions to add to this policy document.
|
|
15
|
+
* You can also use `addPermission(statement)` to add permissions later.
|
|
16
|
+
*
|
|
17
|
+
* @default - No statements.
|
|
18
|
+
*/
|
|
19
|
+
readonly statements?: PolicyStatement[];
|
|
20
|
+
/**
|
|
21
|
+
* The unique identifier of the policy, which will be displayed when creating credentials.
|
|
22
|
+
*/
|
|
23
|
+
readonly permission: string;
|
|
24
|
+
/**
|
|
25
|
+
* An optional description of the policy which will be displayed if present.
|
|
26
|
+
*/
|
|
27
|
+
readonly description?: string;
|
|
28
|
+
};
|
|
29
|
+
/**
|
|
30
|
+
* Creates a structured `AWS::IAM::ManagedPolicy` resource to manage arbitrary permissions on general account
|
|
31
|
+
* resources which can then be used to create limited permission credentials for use with specific activities.
|
|
32
|
+
*
|
|
33
|
+
* The permission scope is not controlled. This class should be used with care to create minimal permissions.
|
|
34
|
+
* To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.
|
|
35
|
+
*
|
|
36
|
+
* `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path. This will
|
|
37
|
+
* be used for discovery and display. It is restricted to the same character set as AWS `path`.
|
|
38
|
+
*
|
|
39
|
+
* `description` is optionally used to construct the AWS Managed Policy description and used for display.
|
|
40
|
+
*
|
|
41
|
+
* ```yaml
|
|
42
|
+
* TestingECAE2E87:
|
|
43
|
+
* Type: AWS::IAM::ManagedPolicy
|
|
44
|
+
* Properties:
|
|
45
|
+
* Description: This is testing stuff
|
|
46
|
+
* Path: /developer-policy/read-from-mybucket-under-mypath/
|
|
47
|
+
* PolicyDocument:
|
|
48
|
+
* Statement:
|
|
49
|
+
* - Action: s3:GetObject
|
|
50
|
+
* Effect: Allow
|
|
51
|
+
* Resource: arn:aws:s3:::mybucket/mypath
|
|
52
|
+
* - Action: s3:GetObject
|
|
53
|
+
* Effect: Deny
|
|
54
|
+
* Resource: arn:aws:s3:::mybucket/mypath/butnotthispath
|
|
55
|
+
* Version: "2012-10-17"
|
|
56
|
+
* Metadata:
|
|
57
|
+
* aws:cdk:path: janus-resources-for-testing-managed-policy-tagging/justin-testing/Resource* ```
|
|
58
|
+
* ```
|
|
59
|
+
*
|
|
60
|
+
* @experimental
|
|
61
|
+
*/
|
|
62
|
+
export declare class GuDeveloperPolicyExperimental extends ManagedPolicy {
|
|
63
|
+
constructor(scope: GuStack, id: string, props: GuWorkloadPolicyProps);
|
|
64
|
+
}
|
|
65
|
+
//# sourceMappingURL=developer-policy.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"developer-policy.d.ts","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAExF,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACtC;;OAEG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IACxC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,6BAA8B,SAAQ,aAAa;gBAClD,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;CAsErE"}
|
|
@@ -0,0 +1,103 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.GuDeveloperPolicyExperimental = void 0;
|
|
4
|
+
const aws_cdk_lib_1 = require("aws-cdk-lib");
|
|
5
|
+
const aws_iam_1 = require("aws-cdk-lib/aws-iam");
|
|
6
|
+
/**
|
|
7
|
+
* Creates a structured `AWS::IAM::ManagedPolicy` resource to manage arbitrary permissions on general account
|
|
8
|
+
* resources which can then be used to create limited permission credentials for use with specific activities.
|
|
9
|
+
*
|
|
10
|
+
* The permission scope is not controlled. This class should be used with care to create minimal permissions.
|
|
11
|
+
* To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.
|
|
12
|
+
*
|
|
13
|
+
* `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path. This will
|
|
14
|
+
* be used for discovery and display. It is restricted to the same character set as AWS `path`.
|
|
15
|
+
*
|
|
16
|
+
* `description` is optionally used to construct the AWS Managed Policy description and used for display.
|
|
17
|
+
*
|
|
18
|
+
* ```yaml
|
|
19
|
+
* TestingECAE2E87:
|
|
20
|
+
* Type: AWS::IAM::ManagedPolicy
|
|
21
|
+
* Properties:
|
|
22
|
+
* Description: This is testing stuff
|
|
23
|
+
* Path: /developer-policy/read-from-mybucket-under-mypath/
|
|
24
|
+
* PolicyDocument:
|
|
25
|
+
* Statement:
|
|
26
|
+
* - Action: s3:GetObject
|
|
27
|
+
* Effect: Allow
|
|
28
|
+
* Resource: arn:aws:s3:::mybucket/mypath
|
|
29
|
+
* - Action: s3:GetObject
|
|
30
|
+
* Effect: Deny
|
|
31
|
+
* Resource: arn:aws:s3:::mybucket/mypath/butnotthispath
|
|
32
|
+
* Version: "2012-10-17"
|
|
33
|
+
* Metadata:
|
|
34
|
+
* aws:cdk:path: janus-resources-for-testing-managed-policy-tagging/justin-testing/Resource* ```
|
|
35
|
+
* ```
|
|
36
|
+
*
|
|
37
|
+
* @experimental
|
|
38
|
+
*/
|
|
39
|
+
class GuDeveloperPolicyExperimental extends aws_iam_1.ManagedPolicy {
|
|
40
|
+
constructor(scope, id, props) {
|
|
41
|
+
super(scope, id, {
|
|
42
|
+
description: `${props.permission} developer policy`,
|
|
43
|
+
...props,
|
|
44
|
+
path: `/developer-policy/${props.permission}/`,
|
|
45
|
+
});
|
|
46
|
+
let valid = true;
|
|
47
|
+
const { statements = [] } = props;
|
|
48
|
+
for (const statement of statements) {
|
|
49
|
+
if (statement.effect === aws_iam_1.Effect.ALLOW) {
|
|
50
|
+
for (const action of statement.actions) {
|
|
51
|
+
if (action === "*") {
|
|
52
|
+
const name = statement.actions.join(",");
|
|
53
|
+
aws_cdk_lib_1.Annotations.of(this).addError(`Action of '*' found in ${name} ALLOW permission`);
|
|
54
|
+
valid = false;
|
|
55
|
+
}
|
|
56
|
+
}
|
|
57
|
+
for (const resource of statement.resources) {
|
|
58
|
+
if (resource === "*") {
|
|
59
|
+
const name = statement.actions.join(",");
|
|
60
|
+
aws_cdk_lib_1.Annotations.of(this).addError(`Resource of '*' found in ${name} ALLOW permission`);
|
|
61
|
+
valid = false;
|
|
62
|
+
}
|
|
63
|
+
}
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
const { allow = [] } = props;
|
|
67
|
+
for (const allowed of allow) {
|
|
68
|
+
// validity checks
|
|
69
|
+
const name = allowed.policyName ?? allowed.actions.join(",") + " on " + allowed.resources.join(",");
|
|
70
|
+
for (const resource of allowed.resources) {
|
|
71
|
+
if (resource === "*") {
|
|
72
|
+
aws_cdk_lib_1.Annotations.of(this).addError(`Resource of '*' found in ${name} ALLOW permission`);
|
|
73
|
+
valid = false;
|
|
74
|
+
}
|
|
75
|
+
}
|
|
76
|
+
for (const action of allowed.actions) {
|
|
77
|
+
if (action === "*") {
|
|
78
|
+
const name = allowed.policyName ?? allowed.actions.join(",");
|
|
79
|
+
aws_cdk_lib_1.Annotations.of(this).addError(`Action of '*' found in ${name} ALLOW permission`);
|
|
80
|
+
valid = false;
|
|
81
|
+
}
|
|
82
|
+
}
|
|
83
|
+
this.addStatements(new aws_iam_1.PolicyStatement({
|
|
84
|
+
effect: aws_iam_1.Effect.ALLOW,
|
|
85
|
+
resources: allowed.resources,
|
|
86
|
+
actions: allowed.actions,
|
|
87
|
+
}));
|
|
88
|
+
}
|
|
89
|
+
if (!valid) {
|
|
90
|
+
throw new Error("Overly broad permission present, see annotations for details");
|
|
91
|
+
}
|
|
92
|
+
const { deny = [] } = props;
|
|
93
|
+
for (const denied of deny) {
|
|
94
|
+
this.addStatements(new aws_iam_1.PolicyStatement({
|
|
95
|
+
effect: aws_iam_1.Effect.DENY,
|
|
96
|
+
resources: denied.resources,
|
|
97
|
+
actions: denied.actions,
|
|
98
|
+
}));
|
|
99
|
+
}
|
|
100
|
+
}
|
|
101
|
+
}
|
|
102
|
+
exports.GuDeveloperPolicyExperimental = GuDeveloperPolicyExperimental;
|
|
103
|
+
//# sourceMappingURL=developer-policy.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"developer-policy.js","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":";;;AAAA,6CAA0C;AAC1C,iDAA6E;AA8B7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAa,6BAA8B,SAAQ,uBAAa;IAC9D,YAAY,KAAc,EAAE,EAAU,EAAE,KAA4B;QAClE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,WAAW,EAAE,GAAG,KAAK,CAAC,UAAU,mBAAmB;YACnD,GAAG,KAAK;YACR,IAAI,EAAE,qBAAqB,KAAK,CAAC,UAAU,GAAG;SAC/C,CAAC,CAAC;QAEH,IAAI,KAAK,GAAG,IAAI,CAAC;QAEjB,MAAM,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;QAClC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE;YAClC,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAM,CAAC,KAAK,EAAE;gBACrC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE;oBACtC,IAAI,MAAM,KAAK,GAAG,EAAE;wBAClB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACzC,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,0BAA0B,IAAI,mBAAmB,CAAC,CAAC;wBACjF,KAAK,GAAG,KAAK,CAAC;qBACf;iBACF;gBACD,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE;oBAC1C,IAAI,QAAQ,KAAK,GAAG,EAAE;wBACpB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACzC,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4BAA4B,IAAI,mBAAmB,CAAC,CAAC;wBACnF,KAAK,GAAG,KAAK,CAAC;qBACf;iBACF;aACF;SACF;QAED,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE;YAC3B,kBAAkB;YAClB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpG,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE;gBACxC,IAAI,QAAQ,KAAK,GAAG,EAAE;oBACpB,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4BAA4B,IAAI,mBAAmB,CAAC,CAAC;oBACnF,KAAK,GAAG,KAAK,CAAC;iBACf;aACF;YACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE;gBACpC,IAAI,MAAM,KAAK,GAAG,EAAE;oBAClB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC7D,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,0BAA0B,IAAI,mBAAmB,CAAC,CAAC;oBACjF,KAAK,GAAG,KAAK,CAAC;iBACf;aACF;YACD,IAAI,CAAC,aAAa,CAChB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,KAAK,EAAE;YACV,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;SACjF;QAED,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE;YACzB,IAAI,CAAC,aAAa,CAChB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,IAAI;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CACH,CAAC;SACH;IACH,CAAC;CACF;AAvED,sEAuEC","sourcesContent":["import { Annotations } from \"aws-cdk-lib\";\nimport { Effect, ManagedPolicy, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport type { GuStack } from \"../../../../constructs/core\";\nimport type { GuAllowPolicyProps, GuDenyPolicyProps } from \"../../../../constructs/iam\";\n\nexport type GuWorkloadPolicyProps = {\n /**\n * List of explicitly allowed permissions given by this policy.\n */\n readonly allow?: GuAllowPolicyProps[];\n /**\n * List of explicitly denied permissions which can be used to fine tune this policy by pruning the allow permissions.\n */\n readonly deny?: GuDenyPolicyProps[];\n /**\n * Initial set of permissions to add to this policy document.\n * You can also use `addPermission(statement)` to add permissions later.\n *\n * @default - No statements.\n */\n readonly statements?: PolicyStatement[];\n /**\n * The unique identifier of the policy, which will be displayed when creating credentials.\n */\n readonly permission: string;\n /**\n * An optional description of the policy which will be displayed if present.\n */\n readonly description?: string;\n};\n\n/**\n * Creates a structured `AWS::IAM::ManagedPolicy` resource to manage arbitrary permissions on general account\n * resources which can then be used to create limited permission credentials for use with specific activities.\n *\n * The permission scope is not controlled. This class should be used with care to create minimal permissions.\n * To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.\n *\n * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path. This will\n * be used for discovery and display. It is restricted to the same character set as AWS `path`.\n *\n * `description` is optionally used to construct the AWS Managed Policy description and used for display.\n *\n * ```yaml\n * TestingECAE2E87:\n * Type: AWS::IAM::ManagedPolicy\n * Properties:\n * Description: This is testing stuff\n * Path: /developer-policy/read-from-mybucket-under-mypath/\n * PolicyDocument:\n * Statement:\n * - Action: s3:GetObject\n * Effect: Allow\n * Resource: arn:aws:s3:::mybucket/mypath\n * - Action: s3:GetObject\n * Effect: Deny\n * Resource: arn:aws:s3:::mybucket/mypath/butnotthispath\n * Version: \"2012-10-17\"\n * Metadata:\n * aws:cdk:path: janus-resources-for-testing-managed-policy-tagging/justin-testing/Resource* ```\n * ```\n *\n * @experimental\n */\nexport class GuDeveloperPolicyExperimental extends ManagedPolicy {\n constructor(scope: GuStack, id: string, props: GuWorkloadPolicyProps) {\n super(scope, id, {\n description: `${props.permission} developer policy`,\n ...props,\n path: `/developer-policy/${props.permission}/`,\n });\n\n let valid = true;\n\n const { statements = [] } = props;\n for (const statement of statements) {\n if (statement.effect === Effect.ALLOW) {\n for (const action of statement.actions) {\n if (action === \"*\") {\n const name = statement.actions.join(\",\");\n Annotations.of(this).addError(`Action of '*' found in ${name} ALLOW permission`);\n valid = false;\n }\n }\n for (const resource of statement.resources) {\n if (resource === \"*\") {\n const name = statement.actions.join(\",\");\n Annotations.of(this).addError(`Resource of '*' found in ${name} ALLOW permission`);\n valid = false;\n }\n }\n }\n }\n\n const { allow = [] } = props;\n for (const allowed of allow) {\n // validity checks\n const name = allowed.policyName ?? allowed.actions.join(\",\") + \" on \" + allowed.resources.join(\",\");\n for (const resource of allowed.resources) {\n if (resource === \"*\") {\n Annotations.of(this).addError(`Resource of '*' found in ${name} ALLOW permission`);\n valid = false;\n }\n }\n for (const action of allowed.actions) {\n if (action === \"*\") {\n const name = allowed.policyName ?? allowed.actions.join(\",\");\n Annotations.of(this).addError(`Action of '*' found in ${name} ALLOW permission`);\n valid = false;\n }\n }\n this.addStatements(\n new PolicyStatement({\n effect: Effect.ALLOW,\n resources: allowed.resources,\n actions: allowed.actions,\n }),\n );\n }\n\n if (!valid) {\n throw new Error(\"Overly broad permission present, see annotations for details\");\n }\n\n const { deny = [] } = props;\n for (const denied of deny) {\n this.addStatements(\n new PolicyStatement({\n effect: Effect.DENY,\n resources: denied.resources,\n actions: denied.actions,\n }),\n );\n }\n }\n}\n"]}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
14
|
+
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
|
+
};
|
|
16
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
+
__exportStar(require("./developer-policy"), exports);
|
|
18
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC","sourcesContent":["export * from \"./developer-policy\";\n"]}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@guardian/cdk",
|
|
3
3
|
"description": "Generic Guardian flavoured AWS CDK components",
|
|
4
|
-
"version": "62.
|
|
4
|
+
"version": "62.5.0",
|
|
5
5
|
"main": "lib/index.js",
|
|
6
6
|
"types": "lib/index.d.ts",
|
|
7
7
|
"files": [
|
|
@@ -46,7 +46,7 @@
|
|
|
46
46
|
"eslint": "^9.39.2",
|
|
47
47
|
"eslint-plugin-custom-rules": "file:tools/eslint",
|
|
48
48
|
"gh-pages": "^6.3.0",
|
|
49
|
-
"jest": "
|
|
49
|
+
"jest": "30.2.0",
|
|
50
50
|
"prettier": "^3.8.1",
|
|
51
51
|
"serve": "^14.2.5",
|
|
52
52
|
"ts-jest": "^29.4.6",
|
|
@@ -55,12 +55,11 @@
|
|
|
55
55
|
"typescript": "5.1.6"
|
|
56
56
|
},
|
|
57
57
|
"dependencies": {
|
|
58
|
-
"@aws-sdk/client-ec2": "^3.
|
|
59
|
-
"@aws-sdk/client-ssm": "^3.
|
|
60
|
-
"@aws-sdk/credential-providers": "^3.
|
|
61
|
-
"@oclif/core": "4.8.1",
|
|
58
|
+
"@aws-sdk/client-ec2": "^3.1000.0",
|
|
59
|
+
"@aws-sdk/client-ssm": "^3.1000.0",
|
|
60
|
+
"@aws-sdk/credential-providers": "^3.1000.0",
|
|
62
61
|
"chalk": "^4.1.2",
|
|
63
|
-
"codemaker": "^1.
|
|
62
|
+
"codemaker": "^1.127.0",
|
|
64
63
|
"git-url-parse": "^16.0.1",
|
|
65
64
|
"js-yaml": "^4.1.1",
|
|
66
65
|
"read-pkg-up": "7.0.1",
|