@guardian/cdk 63.0.0 → 63.1.0

package/lib/experimental/constructs/iam/policies/developer-policy.d.ts

@@ -1,29 +1,35 @@
 import { type PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { ManagedPolicy } from "aws-cdk-lib/aws-iam";
 import type { GuStack } from "../../../../constructs/core";
-export type GuWorkloadPolicyProps = {
+export type GuDeveloperPolicyExperimentalProps = {
     /**
-     * Initial set of permissions to add to this policy document.
-     * You can also use `addPermission(statement)` to add permissions later.
+     * IAM policy statements to include in the developer policy.
      *
-     * @default - No statements.
+     * At least one statement is required.
      */
-    readonly statements?: PolicyStatement[];
+    readonly statements: [PolicyStatement, ...PolicyStatement[]];
     /**
-     * The unique identifier of the policy, which will be displayed when creating credentials.
+     * Unique identifier of the developer policy grant.
+     * This must match the grant ID used in Janus DeveloperPolicyGrant!
      */
-    readonly permission: string;
+    readonly grantId: string;
     /**
-     * An optional description of the policy which will be displayed if present.
+     * A brief description to help choose the correct developer policy in Janus or elsewhere.
+     *
+     * In AWS this will appear as the managed policy description.
+     */
+    readonly friendlyName: string;
+    /**
+     * An optional marker which suppresses the check and warnings on overbroad permissions
      */
-    readonly description?: string;
+    readonly withoutPolicyChecks?: boolean;
 };
 /**
  * Creates a structured `AWS::IAM::ManagedPolicy` resource to manage arbitrary permissions on general account
  * resources which can then be used to create limited permission credentials for use with specific activities.
  *
  * The permission scope is not controlled.  This class should be used with care to create minimal permissions.
- * To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.
+ * To that end, broad ALLOW permissions can be pruned with narrower optional DENY permissions.
  *
  * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path.  This will
  * be used for discovery and display.  It is restricted to the same character set as AWS `path`.
@@ -52,6 +58,6 @@ export type GuWorkloadPolicyProps = {
  * @experimental
  */
 export declare class GuDeveloperPolicyExperimental extends ManagedPolicy {
-    constructor(scope: GuStack, id: string, props: GuWorkloadPolicyProps);
+    constructor(scope: GuStack, id: string, props: GuDeveloperPolicyExperimentalProps);
 }
 //# sourceMappingURL=developer-policy.d.ts.map

package/lib/experimental/constructs/iam/policies/developer-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"developer-policy.d.ts","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAU,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAoB,aAAa,EAAuB,MAAM,qBAAqB,CAAC;AAE3F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAE3D,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IACxC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,6BAA8B,SAAQ,aAAa;gBAClD,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;CAerE"}
+{"version":3,"file":"developer-policy.d.ts","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAA+B,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAoB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAE3D,MAAM,MAAM,kCAAkC,GAAG;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC;IAC7D;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,6BAA8B,SAAQ,aAAa;gBAClD,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,kCAAkC;CAelF"}

package/lib/experimental/constructs/iam/policies/developer-policy.js

@@ -9,7 +9,7 @@ const aws_iam_2 = require("aws-cdk-lib/aws-iam");
  * resources which can then be used to create limited permission credentials for use with specific activities.
  *
  * The permission scope is not controlled.  This class should be used with care to create minimal permissions.
- * To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.
+ * To that end, broad ALLOW permissions can be pruned with narrower optional DENY permissions.
  *
  * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path.  This will
  * be used for discovery and display.  It is restricted to the same character set as AWS `path`.
@@ -40,20 +40,36 @@ const aws_iam_2 = require("aws-cdk-lib/aws-iam");
 class GuDeveloperPolicyExperimental extends aws_iam_2.ManagedPolicy {
     constructor(scope, id, props) {
         super(scope, id, {
-            description: `${props.permission} developer policy`,
             ...props,
-            path: `/developer-policy/${props.permission}/`,
+            // Bear in mind that path has max length 512 chars
+            path: `/developer-policy/${scope.repositoryName}/${scope.stack}/${scope.stage}/${props.grantId}/`,
+            description: props.friendlyName,
         });
-        // Don't mind if it's missing, but if it's used it must not be empty
-        if (props.statements?.length == 0) {
-            throw new Error("Empty statements array passed to GuDeveloperPolicyExperimental");
+        aws_cdk_lib_1.Aspects.of(this).add(new GuDeveloperPolicyExperimentalRequiredChecker());
+        if (!props.withoutPolicyChecks) {
+            // Later, apply to the stack and check for specific errors
+            aws_cdk_lib_1.Aspects.of(this).add(new GuDeveloperPolicyExperimentalOptionalChecker());
         }
-        // Later, apply to the stack and check for specific errors
-        aws_cdk_lib_1.Aspects.of(this).add(new GuDeveloperPolicyExperimentalChecker());
     }
 }
 exports.GuDeveloperPolicyExperimental = GuDeveloperPolicyExperimental;
-class GuDeveloperPolicyExperimentalChecker {
+// Add checks here that we require and don't allow users to opt out of.
+class GuDeveloperPolicyExperimentalRequiredChecker {
+    visit(node) {
+        if (node instanceof aws_iam_2.CfnManagedPolicy) {
+            const description = node.description;
+            const maxLength = 60;
+            if (!description?.length) {
+                aws_cdk_lib_1.Annotations.of(node).addError("friendlyName must be filled in");
+            }
+            else if (description.length > maxLength) {
+                aws_cdk_lib_1.Annotations.of(node).addError(`friendlyName must be no more than ${maxLength} characters long, but was ${description.length} characters`);
+            }
+        }
+    }
+}
+// Add checks here that we recommend for most scenarios but don't require.
+class GuDeveloperPolicyExperimentalOptionalChecker {
     visit(node) {
         if (node instanceof aws_iam_2.CfnManagedPolicy) {
             const policyDocumentJson = node.policyDocument.toJSON();
@@ -64,7 +80,10 @@ class GuDeveloperPolicyExperimentalChecker {
             if (!("Statement" in policyDocumentJson)) {
                 return;
             }
-            if (!Array.isArray(policyDocumentJson.Statement) || policyDocumentJson.Statement.length == 0) {
+            if (!Array.isArray(policyDocumentJson.Statement)) {
+                return;
+            }
+            if (policyDocumentJson.Statement.length === 0) {
                 return;
             }
             // For the following conditions, we want to make a strong assertions: you cannot "Allow" with wildcards.
@@ -84,7 +103,8 @@ class GuDeveloperPolicyExperimentalChecker {
                         }
                     }
                     if (!("Resource" in statement)) {
-                        aws_cdk_lib_1.Annotations.of(node).addError("Statement is missing an Resource");
+                        // Typescript requires us to check this, because the data model doesn't guarantee it
+                        aws_cdk_lib_1.Annotations.of(node).addError("Statement is missing a Resource");
                     }
                     else {
                         const resource = statement.Resource;
@@ -110,13 +130,14 @@ class GuDeveloperPolicyExperimentalChecker {
      *   arn:aws:dynamodb:us-east-2:account-ID-without-hyphens:table/*
      *   arn:aws:s3:::*
      *
-     * @param checkString resource or action
-     * @param node
+     * @param checkString Action or resource value to validate.
+     * @param checkType Label used in validation error messages (for example, Action or Resource).
+     * @param node Policy node used to attach validation annotations.
      * @private
      */
     check(checkString, checkType, node) {
-        if (checkString === "*" || checkString.indexOf(":*") || checkString.indexOf("/*") > 0) {
-            aws_cdk_lib_1.Annotations.of(node).addError(`Statement ${checkType} is too broad: ${checkString}`);
+        if (checkString === "*" || checkString.includes(":*") || checkString.includes("/*")) {
+            aws_cdk_lib_1.Annotations.of(node).addError(`Statement ${checkType} is too broad: ${checkString}. If this is necessary and intended, use withoutPolicyChecks: true in properties to turn off this check`);
         }
     }
     checkAction(checkString, node) {

package/lib/experimental/constructs/iam/policies/developer-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"developer-policy.js","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":";;;AACA,6CAAmD;AACnD,iDAAmE;AACnE,iDAA2F;AAsB3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAa,6BAA8B,SAAQ,uBAAa;IAC9D,YAAY,KAAc,EAAE,EAAU,EAAE,KAA4B;QAClE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,WAAW,EAAE,GAAG,KAAK,CAAC,UAAU,mBAAmB;YACnD,GAAG,KAAK;YACR,IAAI,EAAE,qBAAqB,KAAK,CAAC,UAAU,GAAG;SAC/C,CAAC,CAAC;QAEH,oEAAoE;QACpE,IAAI,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,EAAE;YACjC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;SACnF;QAED,0DAA0D;QAC1D,qBAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,oCAAoC,EAAE,CAAC,CAAC;IACnE,CAAC;CACF;AAhBD,sEAgBC;AAED,MAAM,oCAAoC;IACjC,KAAK,CAAC,IAAgB;QAC3B,IAAI,IAAI,YAAY,0BAAgB,EAAE;YACpC,MAAM,kBAAkB,GAAa,IAAI,CAAC,cAAiC,CAAC,MAAM,EAAE,CAAC;YAErF,+GAA+G;YAC/G,IAAI,kBAAkB,KAAK,IAAI,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE;gBACzE,OAAO;aACR;YACD,IAAI,CAAC,CAAC,WAAW,IAAI,kBAAkB,CAAC,EAAE;gBACxC,OAAO;aACR;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE;gBAC5F,OAAO;aACR;YAED,wGAAwG;YACxG,KAAK,MAAM,SAAS,IAAI,kBAAkB,CAAC,SAAS,EAAE;gBACpD,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAK,SAAiC,CAAC,MAAM,KAAK,gBAAM,CAAC,KAAK,EAAE;oBAC1F,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE;wBAC5B,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;qBACjE;yBAAM;wBACL,MAAM,MAAM,GAAI,SAAiC,CAAC,MAAM,CAAC;wBAEzD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;4BAC9B,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;yBAChC;6BAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;4BAChC,MAAM,WAAW,GAAG,MAAkB,CAAC;4BACvC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;yBACjE;qBACF;oBAED,IAAI,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE;wBAC9B,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;qBACnE;yBAAM;wBACL,MAAM,QAAQ,GAAI,SAAmC,CAAC,QAAQ,CAAC;wBAE/D,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE;4BAChC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;yBACpC;6BAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;4BAClC,MAAM,aAAa,GAAG,QAAoB,CAAC;4BAC3C,aAAa,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;gCACjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;4BACrC,CAAC,CAAC,CAAC;yBACJ;qBACF;iBACF;aACF;SACF;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,WAAmB,EAAE,SAAiB,EAAE,IAAsB;QAC1E,IAAI,WAAW,KAAK,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACrF,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,SAAS,kBAAkB,WAAW,EAAE,CAAC,CAAC;SACtF;IACH,CAAC;IACO,WAAW,CAAC,WAAmB,EAAE,IAAsB;QAC7D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IACO,aAAa,CAAC,WAAmB,EAAE,IAAsB;QAC/D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;CACF","sourcesContent":["import type { IAspect } from \"aws-cdk-lib\";\nimport { Annotations, Aspects } from \"aws-cdk-lib\";\nimport { Effect, type PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { CfnManagedPolicy, ManagedPolicy, type PolicyDocument } from \"aws-cdk-lib/aws-iam\";\nimport type { IConstruct } from \"constructs\";\nimport type { GuStack } from \"../../../../constructs/core\";\n\nexport type GuWorkloadPolicyProps = {\n  /**\n   * Initial set of permissions to add to this policy document.\n   * You can also use `addPermission(statement)` to add permissions later.\n   *\n   * @default - No statements.\n   */\n  readonly statements?: PolicyStatement[];\n  /**\n   * The unique identifier of the policy, which will be displayed when creating credentials.\n   */\n  readonly permission: string;\n  /**\n   * An optional description of the policy which will be displayed if present.\n   */\n  readonly description?: string;\n};\n\n/**\n * Creates a structured `AWS::IAM::ManagedPolicy` resource to manage arbitrary permissions on general account\n * resources which can then be used to create limited permission credentials for use with specific activities.\n *\n * The permission scope is not controlled.  This class should be used with care to create minimal permissions.\n * To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.\n *\n * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path.  This will\n * be used for discovery and display.  It is restricted to the same character set as AWS `path`.\n *\n * `description` is optionally used to construct the AWS Managed Policy description and used for display.\n *\n * ```yaml\n *  TestingECAE2E87:\n *     Type: AWS::IAM::ManagedPolicy\n *     Properties:\n *       Description: This is testing stuff\n *       Path: /developer-policy/read-from-mybucket-under-mypath/\n *       PolicyDocument:\n *         Statement:\n *           - Action: s3:GetObject\n *             Effect: Allow\n *             Resource: arn:aws:s3:::mybucket/mypath\n *           - Action: s3:GetObject\n *             Effect: Deny\n *             Resource: arn:aws:s3:::mybucket/mypath/butnotthispath\n *         Version: \"2012-10-17\"\n *     Metadata:\n *       aws:cdk:path: janus-resources-for-testing-managed-policy-tagging/justin-testing/Resource* ```\n * ```\n *\n * @experimental\n */\nexport class GuDeveloperPolicyExperimental extends ManagedPolicy {\n  constructor(scope: GuStack, id: string, props: GuWorkloadPolicyProps) {\n    super(scope, id, {\n      description: `${props.permission} developer policy`,\n      ...props,\n      path: `/developer-policy/${props.permission}/`,\n    });\n\n    // Don't mind if it's missing, but if it's used it must not be empty\n    if (props.statements?.length == 0) {\n      throw new Error(\"Empty statements array passed to GuDeveloperPolicyExperimental\");\n    }\n\n    // Later, apply to the stack and check for specific errors\n    Aspects.of(this).add(new GuDeveloperPolicyExperimentalChecker());\n  }\n}\n\nclass GuDeveloperPolicyExperimentalChecker implements IAspect {\n  public visit(node: IConstruct): void {\n    if (node instanceof CfnManagedPolicy) {\n      const policyDocumentJson: unknown = (node.policyDocument as PolicyDocument).toJSON();\n\n      // These conditions will result in failures from the AWS classes themselves, so we don't need to validate them.\n      if (policyDocumentJson === null || typeof policyDocumentJson !== \"object\") {\n        return;\n      }\n      if (!(\"Statement\" in policyDocumentJson)) {\n        return;\n      }\n      if (!Array.isArray(policyDocumentJson.Statement) || policyDocumentJson.Statement.length == 0) {\n        return;\n      }\n\n      // For the following conditions, we want to make a strong assertions: you cannot \"Allow\" with wildcards.\n      for (const statement of policyDocumentJson.Statement) {\n        if (!(\"Effect\" in statement) || (statement as { Effect: unknown }).Effect === Effect.ALLOW) {\n          if (!(\"Action\" in statement)) {\n            Annotations.of(node).addError(\"Statement is missing an Action\");\n          } else {\n            const action = (statement as { Action: unknown }).Action;\n\n            if (typeof action === \"string\") {\n              this.checkAction(action, node);\n            } else if (Array.isArray(action)) {\n              const actionArray = action as string[];\n              actionArray.forEach((action) => this.checkAction(action, node));\n            }\n          }\n\n          if (!(\"Resource\" in statement)) {\n            Annotations.of(node).addError(\"Statement is missing an Resource\");\n          } else {\n            const resource = (statement as { Resource: unknown }).Resource;\n\n            if (typeof resource === \"string\") {\n              this.checkResource(resource, node);\n            } else if (Array.isArray(resource)) {\n              const resourceArray = resource as string[];\n              resourceArray.forEach((resource) => {\n                this.checkResource(resource, node);\n              });\n            }\n          }\n        }\n      }\n    }\n  }\n\n  /**\n   * Ensure that we don't have either actions or resources of the following forms:\n   *\n   *   *\n   *   s3:*\n   *   arn:aws:dynamodb:us-east-2:account-ID-without-hyphens:table/*\n   *   arn:aws:s3:::*\n   *\n   * @param checkString resource or action\n   * @param node\n   * @private\n   */\n  private check(checkString: string, checkType: string, node: CfnManagedPolicy) {\n    if (checkString === \"*\" || checkString.indexOf(\":*\") || checkString.indexOf(\"/*\") > 0) {\n      Annotations.of(node).addError(`Statement ${checkType} is too broad: ${checkString}`);\n    }\n  }\n  private checkAction(checkString: string, node: CfnManagedPolicy) {\n    this.check(checkString, \"Action\", node);\n  }\n  private checkResource(checkString: string, node: CfnManagedPolicy) {\n    this.check(checkString, \"Resource\", node);\n  }\n}\n"]}
+{"version":3,"file":"developer-policy.js","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":";;;AACA,6CAAmD;AACnD,iDAAwF;AACxF,iDAAsE;AA4BtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAa,6BAA8B,SAAQ,uBAAa;IAC9D,YAAY,KAAc,EAAE,EAAU,EAAE,KAAyC;QAC/E,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,GAAG,KAAK;YACR,kDAAkD;YAClD,IAAI,EAAE,qBAAqB,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG;YACjG,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC,CAAC;QAEH,qBAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,4CAA4C,EAAE,CAAC,CAAC;QAEzE,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE;YAC9B,0DAA0D;YAC1D,qBAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,4CAA4C,EAAE,CAAC,CAAC;SAC1E;IACH,CAAC;CACF;AAhBD,sEAgBC;AAED,uEAAuE;AACvE,MAAM,4CAA4C;IACzC,KAAK,CAAC,IAAgB;QAC3B,IAAI,IAAI,YAAY,0BAAgB,EAAE;YACpC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YACrC,MAAM,SAAS,GAAG,EAAE,CAAC;YAErB,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE;gBACxB,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;aACjE;iBAAM,IAAI,WAAW,CAAC,MAAM,GAAG,SAAS,EAAE;gBACzC,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAC3B,qCAAqC,SAAS,6BAA6B,WAAW,CAAC,MAAM,aAAa,CAC3G,CAAC;aACH;SACF;IACH,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,4CAA4C;IACzC,KAAK,CAAC,IAAgB;QAC3B,IAAI,IAAI,YAAY,0BAAgB,EAAE;YACpC,MAAM,kBAAkB,GAAa,IAAI,CAAC,cAAiC,CAAC,MAAM,EAAE,CAAC;YAErF,+GAA+G;YAC/G,IAAI,kBAAkB,KAAK,IAAI,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE;gBACzE,OAAO;aACR;YACD,IAAI,CAAC,CAAC,WAAW,IAAI,kBAAkB,CAAC,EAAE;gBACxC,OAAO;aACR;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE;gBAChD,OAAO;aACR;YACD,IAAI,kBAAkB,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;gBAC7C,OAAO;aACR;YAED,wGAAwG;YACxG,KAAK,MAAM,SAAS,IAAI,kBAAkB,CAAC,SAAS,EAAE;gBACpD,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAK,SAAiC,CAAC,MAAM,KAAK,gBAAM,CAAC,KAAK,EAAE;oBAC1F,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE;wBAC5B,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;qBACjE;yBAAM;wBACL,MAAM,MAAM,GAAI,SAAiC,CAAC,MAAM,CAAC;wBAEzD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;4BAC9B,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;yBAChC;6BAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;4BAChC,MAAM,WAAW,GAAG,MAAkB,CAAC;4BACvC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;yBACjE;qBACF;oBAED,IAAI,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE;wBAC9B,oFAAoF;wBACpF,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;qBAClE;yBAAM;wBACL,MAAM,QAAQ,GAAI,SAAmC,CAAC,QAAQ,CAAC;wBAE/D,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE;4BAChC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;yBACpC;6BAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;4BAClC,MAAM,aAAa,GAAG,QAAoB,CAAC;4BAC3C,aAAa,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;gCACjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;4BACrC,CAAC,CAAC,CAAC;yBACJ;qBACF;iBACF;aACF;SACF;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,WAAmB,EAAE,SAAiB,EAAE,IAAsB;QAC1E,IAAI,WAAW,KAAK,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACnF,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAC3B,aAAa,SAAS,kBAAkB,WAAW,yGAAyG,CAC7J,CAAC;SACH;IACH,CAAC;IACO,WAAW,CAAC,WAAmB,EAAE,IAAsB;QAC7D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IACO,aAAa,CAAC,WAAmB,EAAE,IAAsB;QAC/D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;CACF","sourcesContent":["import type { IAspect } from \"aws-cdk-lib\";\nimport { Annotations, Aspects } from \"aws-cdk-lib\";\nimport { Effect, type PolicyDocument, type PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { CfnManagedPolicy, ManagedPolicy } from \"aws-cdk-lib/aws-iam\";\nimport type { IConstruct } from \"constructs\";\nimport type { GuStack } from \"../../../../constructs/core\";\n\nexport type GuDeveloperPolicyExperimentalProps = {\n  /**\n   * IAM policy statements to include in the developer policy.\n   *\n   * At least one statement is required.\n   */\n  readonly statements: [PolicyStatement, ...PolicyStatement[]];\n  /**\n   * Unique identifier of the developer policy grant.\n   * This must match the grant ID used in Janus DeveloperPolicyGrant!\n   */\n  readonly grantId: string;\n  /**\n   * A brief description to help choose the correct developer policy in Janus or elsewhere.\n   *\n   * In AWS this will appear as the managed policy description.\n   */\n  readonly friendlyName: string;\n  /**\n   * An optional marker which suppresses the check and warnings on overbroad permissions\n   */\n  readonly withoutPolicyChecks?: boolean;\n};\n\n/**\n * Creates a structured `AWS::IAM::ManagedPolicy` resource to manage arbitrary permissions on general account\n * resources which can then be used to create limited permission credentials for use with specific activities.\n *\n * The permission scope is not controlled.  This class should be used with care to create minimal permissions.\n * To that end, broad ALLOW permissions can be pruned with narrower optional DENY permissions.\n *\n * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path.  This will\n * be used for discovery and display.  It is restricted to the same character set as AWS `path`.\n *\n * `description` is optionally used to construct the AWS Managed Policy description and used for display.\n *\n * ```yaml\n *  TestingECAE2E87:\n *     Type: AWS::IAM::ManagedPolicy\n *     Properties:\n *       Description: This is testing stuff\n *       Path: /developer-policy/read-from-mybucket-under-mypath/\n *       PolicyDocument:\n *         Statement:\n *           - Action: s3:GetObject\n *             Effect: Allow\n *             Resource: arn:aws:s3:::mybucket/mypath\n *           - Action: s3:GetObject\n *             Effect: Deny\n *             Resource: arn:aws:s3:::mybucket/mypath/butnotthispath\n *         Version: \"2012-10-17\"\n *     Metadata:\n *       aws:cdk:path: janus-resources-for-testing-managed-policy-tagging/justin-testing/Resource* ```\n * ```\n *\n * @experimental\n */\nexport class GuDeveloperPolicyExperimental extends ManagedPolicy {\n  constructor(scope: GuStack, id: string, props: GuDeveloperPolicyExperimentalProps) {\n    super(scope, id, {\n      ...props,\n      // Bear in mind that path has max length 512 chars\n      path: `/developer-policy/${scope.repositoryName}/${scope.stack}/${scope.stage}/${props.grantId}/`,\n      description: props.friendlyName,\n    });\n\n    Aspects.of(this).add(new GuDeveloperPolicyExperimentalRequiredChecker());\n\n    if (!props.withoutPolicyChecks) {\n      // Later, apply to the stack and check for specific errors\n      Aspects.of(this).add(new GuDeveloperPolicyExperimentalOptionalChecker());\n    }\n  }\n}\n\n// Add checks here that we require and don't allow users to opt out of.\nclass GuDeveloperPolicyExperimentalRequiredChecker implements IAspect {\n  public visit(node: IConstruct): void {\n    if (node instanceof CfnManagedPolicy) {\n      const description = node.description;\n      const maxLength = 60;\n\n      if (!description?.length) {\n        Annotations.of(node).addError(\"friendlyName must be filled in\");\n      } else if (description.length > maxLength) {\n        Annotations.of(node).addError(\n          `friendlyName must be no more than ${maxLength} characters long, but was ${description.length} characters`,\n        );\n      }\n    }\n  }\n}\n\n// Add checks here that we recommend for most scenarios but don't require.\nclass GuDeveloperPolicyExperimentalOptionalChecker implements IAspect {\n  public visit(node: IConstruct): void {\n    if (node instanceof CfnManagedPolicy) {\n      const policyDocumentJson: unknown = (node.policyDocument as PolicyDocument).toJSON();\n\n      // These conditions will result in failures from the AWS classes themselves, so we don't need to validate them.\n      if (policyDocumentJson === null || typeof policyDocumentJson !== \"object\") {\n        return;\n      }\n      if (!(\"Statement\" in policyDocumentJson)) {\n        return;\n      }\n      if (!Array.isArray(policyDocumentJson.Statement)) {\n        return;\n      }\n      if (policyDocumentJson.Statement.length === 0) {\n        return;\n      }\n\n      // For the following conditions, we want to make a strong assertions: you cannot \"Allow\" with wildcards.\n      for (const statement of policyDocumentJson.Statement) {\n        if (!(\"Effect\" in statement) || (statement as { Effect: unknown }).Effect === Effect.ALLOW) {\n          if (!(\"Action\" in statement)) {\n            Annotations.of(node).addError(\"Statement is missing an Action\");\n          } else {\n            const action = (statement as { Action: unknown }).Action;\n\n            if (typeof action === \"string\") {\n              this.checkAction(action, node);\n            } else if (Array.isArray(action)) {\n              const actionArray = action as string[];\n              actionArray.forEach((action) => this.checkAction(action, node));\n            }\n          }\n\n          if (!(\"Resource\" in statement)) {\n            // Typescript requires us to check this, because the data model doesn't guarantee it\n            Annotations.of(node).addError(\"Statement is missing a Resource\");\n          } else {\n            const resource = (statement as { Resource: unknown }).Resource;\n\n            if (typeof resource === \"string\") {\n              this.checkResource(resource, node);\n            } else if (Array.isArray(resource)) {\n              const resourceArray = resource as string[];\n              resourceArray.forEach((resource) => {\n                this.checkResource(resource, node);\n              });\n            }\n          }\n        }\n      }\n    }\n  }\n\n  /**\n   * Ensure that we don't have either actions or resources of the following forms:\n   *\n   *   *\n   *   s3:*\n   *   arn:aws:dynamodb:us-east-2:account-ID-without-hyphens:table/*\n   *   arn:aws:s3:::*\n   *\n   * @param checkString Action or resource value to validate.\n   * @param checkType Label used in validation error messages (for example, Action or Resource).\n   * @param node Policy node used to attach validation annotations.\n   * @private\n   */\n  private check(checkString: string, checkType: string, node: CfnManagedPolicy) {\n    if (checkString === \"*\" || checkString.includes(\":*\") || checkString.includes(\"/*\")) {\n      Annotations.of(node).addError(\n        `Statement ${checkType} is too broad: ${checkString}. If this is necessary and intended, use withoutPolicyChecks: true in properties to turn off this check`,\n      );\n    }\n  }\n  private checkAction(checkString: string, node: CfnManagedPolicy) {\n    this.check(checkString, \"Action\", node);\n  }\n  private checkResource(checkString: string, node: CfnManagedPolicy) {\n    this.check(checkString, \"Resource\", node);\n  }\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "63.0.0",
+  "version": "63.1.0",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [