@gugananuvem/aws-local-simulator 1.0.35 → 1.0.39

package/src/services/organizations/iam-integration.js

@@ -0,0 +1,413 @@
+/**
+ * IAM Integration Module
+ * Integra Organizations/SCP com IAM para avaliação completa de permissões
+ */
+
+const logger = require('../../utils/logger');
+
+class IAMIntegration {
+  constructor(organizationsSimulator, iamService) {
+    this.organizationsSimulator = organizationsSimulator;
+    this.iamService = iamService;
+  }
+
+  /**
+   * Avalia ação completa: SCP + IAM Policy
+   * Retorna: allowed/denied com motivo detalhado
+   */
+  evaluateAction(principalArn, action, resource = '*', accountId = null, context = {}) {
+    logger.debug(`Evaluating action: ${action} on ${resource} by ${principalArn}`);
+
+    // 1. Extrai account ID do principal ARN
+    if (!accountId) {
+      const match = principalArn.match(/:(\d+):/);
+      accountId = match ? match[1] : null;
+    }
+
+    if (!accountId) {
+      return {
+        allowed: false,
+        deniedBy: ['UnknownAccount'],
+        reason: 'Could not determine account ID from principal ARN',
+        principal: principalArn,
+        action,
+        resource
+      };
+    }
+
+    // 2. Avalia SCPs primeiro (mais restritivas)
+    const scpEvaluation = this.organizationsSimulator.evaluateSCPs(accountId, action, resource);
+    
+    if (!scpEvaluation.allowed) {
+      return {
+        allowed: false,
+        deniedBy: scpEvaluation.deniedBy || ['SCP'],
+        reason: 'Denied by Service Control Policy',
+        principal: principalArn,
+        action,
+        resource,
+        policy: 'SCP'
+      };
+    }
+
+    // 3. Se houver IAM service, avalia IAM policies
+    if (this.iamService) {
+      const iamEvaluation = this.evaluateIAMPolicies(principalArn, action, resource, context);
+      
+      if (!iamEvaluation.allowed) {
+        return {
+          allowed: false,
+          deniedBy: iamEvaluation.deniedBy || ['IAM Policy'],
+          reason: iamEvaluation.reason || 'Denied by IAM policy',
+          principal: principalArn,
+          action,
+          resource,
+          policy: 'IAM'
+        };
+      }
+    }
+
+    // 4. Tudo permitido
+    return {
+      allowed: true,
+      principal: principalArn,
+      action,
+      resource,
+      evaluatedBy: ['SCP', 'IAM']
+    };
+  }
+
+  /**
+   * Avalia IAM policies associadas ao principal
+   */
+  evaluateIAMPolicies(principalArn, action, resource, context = {}) {
+    try {
+      // Extrai o tipo de principal (user, role, assumedRole)
+      const principalType = this.extractPrincipalType(principalArn);
+      
+      if (principalType === 'unknown') {
+        return {
+          allowed: false,
+          deniedBy: ['UnknownPrincipalType'],
+          reason: 'Unknown principal type'
+        };
+      }
+
+      // Obtém policies do principal
+      const policies = this.getPoliciesForPrincipal(principalArn, principalType);
+
+      if (policies.length === 0) {
+        return {
+          allowed: false,
+          deniedBy: ['NoPolicies'],
+          reason: 'No policies attached to principal'
+        };
+      }
+
+      // Avalia cada policy
+      for (const policy of policies) {
+        if (policy.Statement) {
+          for (const statement of policy.Statement) {
+            if (this.statementMatches(statement, action, resource, context)) {
+              if (statement.Effect === 'Deny') {
+                return {
+                  allowed: false,
+                  deniedBy: [policy.name || 'InlinePolicy'],
+                  reason: 'Explicitly denied by policy'
+                };
+              }
+              
+              if (statement.Effect === 'Allow') {
+                return {
+                  allowed: true,
+                  allowedBy: [policy.name || 'InlinePolicy']
+                };
+              }
+            }
+          }
+        }
+      }
+
+      // Nenhuma policy permitiu explicitamente
+      return {
+        allowed: false,
+        deniedBy: ['ImplicitDeny'],
+        reason: 'No policy explicitly allows this action'
+      };
+
+    } catch (error) {
+      logger.error(`Error evaluating IAM policies: ${error.message}`);
+      return {
+        allowed: false,
+        deniedBy: ['EvaluationError'],
+        reason: error.message
+      };
+    }
+  }
+
+  /**
+   * Extrai tipo de principal
+   */
+  extractPrincipalType(principalArn) {
+    if (principalArn.includes(':iam::') && principalArn.includes(':user/')) {
+      return 'user';
+    }
+    if (principalArn.includes(':iam::') && principalArn.includes(':role/')) {
+      return 'role';
+    }
+    if (principalArn.includes(':sts::') && principalArn.includes(':assumed-role/')) {
+      return 'assumed-role';
+    }
+    if (principalArn === '*') {
+      return 'everyone';
+    }
+    return 'unknown';
+  }
+
+  /**
+   * Obtém policies para um principal
+   */
+  getPoliciesForPrincipal(principalArn, principalType) {
+    if (!this.iamService) {
+      return [];
+    }
+
+    try {
+      const policies = [];
+
+      if (principalType === 'user' || principalType === 'assumed-role') {
+        // Extrai nome do usuário do ARN
+        const userMatch = principalArn.match(/user\/(.+?)(?::.*)?$/);
+        if (userMatch && this.iamService.simulator) {
+          const userName = userMatch[1];
+          const user = this.iamService.simulator.users?.get(userName);
+          
+          if (user && user.policies) {
+            policies.push(...Array.from(user.policies.values()));
+          }
+        }
+      }
+
+      if (principalType === 'role' || principalType === 'assumed-role') {
+        // Extrai nome da role
+        const roleMatch = principalArn.match(/role\/(.+?)(?::.*)?$/);
+        if (roleMatch) {
+          const roleName = roleMatch[1];
+          
+          // Procura em Organizations roles
+          for (const [, role] of this.organizationsSimulator.roles) {
+            if (role.name === roleName) {
+              // Retorna inline policies
+              for (const [, policy] of role.inlinePolicies) {
+                policies.push(policy);
+              }
+              break;
+            }
+          }
+
+          // Se IAM service disponível, procura lá também
+          if (this.iamService && this.iamService.simulator) {
+            const role = this.iamService.simulator.roles?.get(roleName);
+            if (role) {
+              // Retorna policies inline
+              if (role.inline_policies) {
+                for (const [, policy] of role.inline_policies) {
+                  policies.push(policy);
+                }
+              }
+            }
+          }
+        }
+      }
+
+      return policies;
+    } catch (error) {
+      logger.warn(`Could not get policies for ${principalArn}: ${error.message}`);
+      return [];
+    }
+  }
+
+  /**
+   * Verifica se um statement match com a ação/recurso
+   */
+  statementMatches(statement, action, resource, context = {}) {
+    if (!statement.Action || !statement.Resource) {
+      return false;
+    }
+
+    // Verifica Action
+    const actionMatches = this.patternMatches(statement.Action, action);
+    if (!actionMatches) {
+      return false;
+    }
+
+    // Verifica Resource
+    const resourceMatches = this.patternMatches(statement.Resource, resource);
+    if (!resourceMatches) {
+      return false;
+    }
+
+    // Verifica Condition se houver
+    if (statement.Condition) {
+      return this.evaluateCondition(statement.Condition, context);
+    }
+
+    return true;
+  }
+
+  /**
+   * Verifica se padrão (com wildcards) match
+   */
+  patternMatches(pattern, value) {
+    const patterns = Array.isArray(pattern) ? pattern : [pattern];
+    
+    for (const p of patterns) {
+      if (p === '*') {
+        return true;
+      }
+      
+      const regex = new RegExp('^' + p.replace(/\*/g, '.*').replace(/\?/g, '.') + '$');
+      if (regex.test(value)) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  /**
+   * Avalia conditions (versão simplificada)
+   */
+  evaluateCondition(condition, context = {}) {
+    // Implementação simplificada
+    // Em produção seria mais complexo com vários operadores
+    if (!condition) {
+      return true;
+    }
+
+    try {
+      // Suporta StringEquals, StringLike, etc
+      for (const [operator, conditions] of Object.entries(condition)) {
+        for (const [key, values] of Object.entries(conditions)) {
+          const contextValue = context[key];
+          
+          if (!contextValue) {
+            return false;
+          }
+
+          const condValues = Array.isArray(values) ? values : [values];
+          
+          switch (operator) {
+            case 'StringEquals':
+              if (!condValues.includes(contextValue)) {
+                return false;
+              }
+              break;
+            
+            case 'StringLike':
+              let matched = false;
+              for (const condValue of condValues) {
+                const regex = new RegExp('^' + condValue.replace(/\*/g, '.*') + '$');
+                if (regex.test(contextValue)) {
+                  matched = true;
+                  break;
+                }
+              }
+              if (!matched) {
+                return false;
+              }
+              break;
+            
+            default:
+              // Operadores desconhecidos são ignorados
+              break;
+          }
+        }
+      }
+
+      return true;
+    } catch (error) {
+      logger.warn(`Error evaluating condition: ${error.message}`);
+      return false;
+    }
+  }
+
+  /**
+   * Avalia AssumeRole - pode o principal assumir a role?
+   */
+  canAssumeRole(principalArn, roleArn) {
+    try {
+      // Procura role pelo ARN
+      let targetRole = null;
+
+      for (const [, role] of this.organizationsSimulator.roles) {
+        if (role.arn === roleArn) {
+          targetRole = role;
+          break;
+        }
+      }
+
+      if (!targetRole) {
+        return {
+          allowed: false,
+          reason: 'Role not found'
+        };
+      }
+
+      // Verifica trust policy
+      if (!targetRole.trustPolicy || !targetRole.trustPolicy.Statement) {
+        return {
+          allowed: false,
+          reason: 'No trust policy defined'
+        };
+      }
+
+      // Valida trust policy
+      for (const statement of targetRole.trustPolicy.Statement) {
+        if (statement.Effect === 'Allow') {
+          if (statement.Principal?.AWS) {
+            if (this.patternMatches(statement.Principal.AWS, principalArn)) {
+              return {
+                allowed: true,
+                reason: 'Allowed by trust policy'
+              };
+            }
+          }
+          
+          if (statement.Principal === '*') {
+            return {
+              allowed: true,
+              reason: 'Allowed by wildcard principal'
+            };
+          }
+        }
+      }
+
+      return {
+        allowed: false,
+        reason: 'Not allowed by trust policy'
+      };
+
+    } catch (error) {
+      logger.error(`Error checking AssumeRole: ${error.message}`);
+      return {
+        allowed: false,
+        reason: error.message
+      };
+    }
+  }
+
+  /**
+   * Gera audit log de avaliação
+   */
+  auditEvaluation(evaluation) {
+    const level = evaluation.allowed ? 'INFO' : 'WARN';
+    const message = evaluation.allowed 
+      ? `Action allowed: ${evaluation.action} on ${evaluation.resource}`
+      : `Action denied: ${evaluation.action} on ${evaluation.resource} - ${evaluation.reason}`;
+
+    logger.log(level, `[Policy Evaluation] ${message} - Principal: ${evaluation.principal}`);
+  }
+}
+
+module.exports = IAMIntegration;

package/src/services/organizations/index.js

@@ -0,0 +1,172 @@
+/**
+ * AWS Organizations & Control Tower Service - Ponto de entrada
+ */
+
+const OrganizationsServer = require('./server');
+const OrganizationsSimulator = require('./simulator');
+const ControlTowerSimulator = require('./control-tower-simulator');
+
+class OrganizationsService {
+  constructor(config) {
+    this.config = config;
+    this.name = 'organizations';
+    this.port = config.ports.organizations || 4580;
+    this.server = null;
+    this.organizationsSimulator = null;
+    this.controlTowerSimulator = null;
+    this.isRunning = false;
+  }
+
+  async initialize() {
+    const logger = require('../../utils/logger');
+    logger.debug(`Inicializando Organizations Service na porta ${this.port}...`);
+
+    // Inicializa simuladores
+    this.organizationsSimulator = new OrganizationsSimulator(this.config);
+    await this.organizationsSimulator.initialize();
+
+    this.controlTowerSimulator = new ControlTowerSimulator(this.config, this.organizationsSimulator);
+    await this.controlTowerSimulator.initialize();
+
+    // Inicializa server
+    this.server = new OrganizationsServer(this.port, this.config);
+    this.server.organizationsSimulator = this.organizationsSimulator;
+    this.server.controlTowerSimulator = this.controlTowerSimulator;
+
+    await this.server.initialize();
+
+    logger.debug('Organizations Service inicializado');
+  }
+
+  injectDependencies(server) {
+    // Injetar dependências de outros serviços (IAM, VPC, EC2, etc)
+  }
+
+  async start() {
+    const logger = require('../../utils/logger');
+
+    if (this.isRunning) {
+      logger.warn('Organizations Service já está em execução');
+      return;
+    }
+
+    try {
+      await this.server.start();
+      this.isRunning = true;
+      logger.info('Organizations Service iniciado com sucesso');
+    } catch (error) {
+      logger.error(`Erro ao iniciar Organizations Service: ${error.message}`);
+      throw error;
+    }
+  }
+
+  async stop() {
+    const logger = require('../../utils/logger');
+
+    if (!this.isRunning) {
+      logger.warn('Organizations Service não está em execução');
+      return;
+    }
+
+    try {
+      await this.server.stop();
+      this.isRunning = false;
+      logger.info('Organizations Service parado com sucesso');
+    } catch (error) {
+      logger.error(`Erro ao parar Organizations Service: ${error.message}`);
+      throw error;
+    }
+  }
+
+  async reset() {
+    const logger = require('../../utils/logger');
+    try {
+      await this.organizationsSimulator.reset();
+      await this.controlTowerSimulator.reset();
+      logger.info('Organizations Service resetado');
+    } catch (error) {
+      logger.error(`Erro ao resetar Organizations Service: ${error.message}`);
+      throw error;
+    }
+  }
+
+  getStatus() {
+    const orgStats = this.organizationsSimulator?.getStats() || {};
+    const ctStats = this.controlTowerSimulator?.getStats() || {};
+
+    return {
+      name: this.name,
+      running: this.isRunning,
+      port: this.port,
+      endpoint: `http://localhost:${this.port}`,
+      resources: {
+        organizationId: orgStats.organizationId,
+        accounts: orgStats.accountCount,
+        ous: orgStats.ouCount,
+        policies: orgStats.policyCount,
+        roles: orgStats.roleCount,
+        landingZones: ctStats.landingZonesCount,
+        guardrails: ctStats.guardrailsCount,
+        preventiveGuardrails: ctStats.preventiveGuardrailsCount,
+        detectiveGuardrails: ctStats.detectiveGuardrailsCount,
+        enabledGuardrails: ctStats.enabledGuardrailsCount
+      }
+    };
+  }
+
+  // Métodos auxiliares para integração com outros serviços
+
+  /**
+   * Integração com IAM - Valida se um role pode assumir outro
+   */
+  validateAssumeRole(assumingRoleId, targetRoleId) {
+    const assumingRole = this.organizationsSimulator.roles.get(assumingRoleId);
+    const targetRole = this.organizationsSimulator.roles.get(targetRoleId);
+
+    if (!assumingRole || !targetRole) {
+      return false;
+    }
+
+    return targetRole.canAssumeRole(assumingRole.arn);
+  }
+
+  /**
+   * Integração com IAM - Avalia se ação é permitida
+   */
+  evaluateIAMAction(roleId, action, resource = '*') {
+    const role = this.organizationsSimulator.roles.get(roleId);
+    if (!role) {
+      return false;
+    }
+
+    return role.canPerformAction(action, resource);
+  }
+
+  /**
+   * Integração com VPC - Valida restrições regionais por SCP
+   */
+  validateRegionalRestrictions(accountId, region, service) {
+    const evaluation = this.organizationsSimulator.evaluateSCPs(
+      accountId,
+      `${service}:*`,
+      `arn:aws:${service}:${region}:*:*`
+    );
+
+    return evaluation.allowed;
+  }
+
+  /**
+   * Integração com EC2 - Valida se instância pode ser criada
+   */
+  validateEC2Instance(accountId, instanceType, region) {
+    // Verifica SCP
+    const scpEvaluation = this.evaluateSCPs(accountId, 'ec2:RunInstances');
+    
+    // Verifica restrições regionais
+    const regionalCheck = this.validateRegionalRestrictions(accountId, region, 'ec2');
+
+    return scpEvaluation.allowed && regionalCheck;
+  }
+}
+
+module.exports = OrganizationsService;

package/src/services/organizations/models/index.js

@@ -0,0 +1,13 @@
+/**
+ * AWS Organizations Models
+ */
+
+const Organization = require('./organization');
+const ServiceControlPolicy = require('./scp');
+const OrganizationRole = require('./role');
+
+module.exports = {
+  Organization,
+  ServiceControlPolicy,
+  OrganizationRole
+};

package/src/services/organizations/models/invitation.js

@@ -0,0 +1,48 @@
+/**
+ * AWS Organizations - Invitation (Handshake) Model
+ * Representa um convite para uma conta entrar na organização.
+ */
+
+const { v4: uuidv4 } = require('uuid');
+
+const EXPIRATION_DAYS = 15;
+
+class Invitation {
+  constructor(config = {}) {
+    this.id = config.id || `h-${uuidv4().substring(0, 8)}`;
+    this.organizationId = config.organizationId;
+    this.email = config.email;
+    this.accountId = config.accountId || null;
+    this.message = config.message || '';
+    this.state = config.state || 'REQUESTED'; // REQUESTED | ACCEPTED | DECLINED | CANCELED | EXPIRED
+    this.action = config.action || 'INVITE';
+    this.requestedTimestamp = config.requestedTimestamp || Math.floor(Date.now() / 1000);
+    this.expirationTimestamp =
+      config.expirationTimestamp || this.requestedTimestamp + EXPIRATION_DAYS * 24 * 60 * 60;
+    this.completedTimestamp = config.completedTimestamp || null;
+  }
+
+  /**
+   * Formato Handshake do AWS Organizations.
+   */
+  toHandshake() {
+    const parties = [
+      { Id: this.organizationId, Type: 'ORGANIZATION' },
+      { Id: this.email, Type: 'EMAIL' },
+    ];
+
+    return {
+      Id: this.id,
+      Arn: `arn:aws:organizations::123456789012:handshake/o-${this.organizationId}/invite/${this.id}`,
+      Parties: parties,
+      State: this.state,
+      Action: this.action,
+      RequestedTimestamp: this.requestedTimestamp,
+      ExpirationTimestamp: this.expirationTimestamp,
+      CompletedTimestamp: this.completedTimestamp,
+      Resources: this.accountId ? [{ Type: 'ACCOUNT', Value: this.accountId }] : [],
+    };
+  }
+}
+
+module.exports = Invitation;