@mtndev/cli 0.0.0-dev-20260626045221 → 0.0.0-dev-20260914234436

package/cjs/commands/aws/iam/policies/s3-restrictions-deny-non-s3-services.cjs

@@ -0,0 +1,28 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/commands/aws/iam/policies/s3-restrictions-deny-non-s3-services.json
+var Version = "2012-10-17";
+var Statement = [
+  {
+    Sid: "DenyNonS3Services",
+    Effect: "Deny",
+    NotAction: [
+      "s3:*",
+      "logs:*",
+      "sts:AssumeRole",
+      "iam:PassRole",
+      "kms:Decrypt",
+      "kms:GenerateDataKey",
+      "kms:DescribeKey",
+      "lambda:InvokeFunction"
+    ],
+    Resource: "*"
+  }
+];
+var s3_restrictions_deny_non_s3_services_default = {
+  Version,
+  Statement
+};
+
+
+
+
+exports.Statement = Statement; exports.Version = Version; exports.default = s3_restrictions_deny_non_s3_services_default;

package/cjs/commands/aws/iam/policies/sts-federation.cjs

@@ -0,0 +1,19 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/commands/aws/iam/policies/sts-federation.json
+var Version = "2012-10-17";
+var Statement = [
+  {
+    Sid: "StsFederation",
+    Effect: "Allow",
+    Action: ["sts:GetFederationToken", "sts:GetCallerIdentity"],
+    Resource: "*"
+  }
+];
+var sts_federation_default = {
+  Version,
+  Statement
+};
+
+
+
+
+exports.Statement = Statement; exports.Version = Version; exports.default = sts_federation_default;

package/cjs/commands/aws/iam/policies/user-admins-deny-list.cjs

@@ -0,0 +1,183 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/commands/aws/iam/policies/user-admins-deny-list.json
+var Version = "2012-10-17";
+var Statement = [
+  {
+    Sid: "DenyAIServices",
+    Effect: "Deny",
+    Action: [
+      "bedrock:*",
+      "sagemaker:*",
+      "comprehend:*",
+      "comprehendmedical:*",
+      "rekognition:*",
+      "textract:*",
+      "personalize:*",
+      "forecast:*",
+      "lex:*",
+      "polly:*",
+      "translate:*",
+      "transcribe:*",
+      "kendra:*",
+      "q:*"
+    ],
+    Resource: "*"
+  },
+  {
+    Sid: "DenyOrgAndAccountWrites",
+    Effect: "Deny",
+    Action: [
+      "organizations:*",
+      "account:CloseAccount",
+      "account:DeleteAlternateContact",
+      "account:PutAlternateContact",
+      "account:PutChallengeQuestions",
+      "account:EnableRegion",
+      "account:DisableRegion",
+      "account:PutAccountName"
+    ],
+    Resource: "*"
+  },
+  {
+    Sid: "DenyBillingMutations",
+    Effect: "Deny",
+    Action: [
+      "aws-portal:Modify*",
+      "billing:Update*",
+      "billing:Put*",
+      "billing:Delete*",
+      "budgets:Modify*",
+      "budgets:Create*",
+      "budgets:Delete*",
+      "savingsplans:Create*",
+      "savingsplans:Delete*",
+      "supportplans:Create*",
+      "supportplans:Delete*",
+      "purchase-orders:Modify*",
+      "purchase-orders:Create*",
+      "cur:Put*",
+      "cur:Delete*"
+    ],
+    Resource: "*"
+  },
+  {
+    Sid: "DenyCloudTrailTampering",
+    Effect: "Deny",
+    Action: [
+      "cloudtrail:StopLogging",
+      "cloudtrail:DeleteTrail",
+      "cloudtrail:UpdateTrail",
+      "cloudtrail:PutEventSelectors",
+      "cloudtrail:DeleteEventDataStore"
+    ],
+    Resource: "*"
+  },
+  {
+    Sid: "DenyExpensiveServices",
+    Effect: "Deny",
+    Action: [
+      "airflow:CreateEnvironment",
+      "airflow:UpdateEnvironment",
+      "mwaa:*",
+      "transfer:CreateServer",
+      "transfer:UpdateServer",
+      "transfer:StartServer",
+      "shield:CreateSubscription",
+      "shield:CreateProtection",
+      "shield:CreateProtectionGroup"
+    ],
+    Resource: "*"
+  },
+  {
+    Sid: "DenyKMSDestruction",
+    Effect: "Deny",
+    Action: [
+      "kms:ScheduleKeyDeletion",
+      "kms:DisableKey",
+      "kms:DisableKeyRotation"
+    ],
+    Resource: "*"
+  },
+  {
+    Sid: "DenyNeptuneViaRds",
+    Effect: "Deny",
+    Action: [
+      "rds:CreateDBCluster",
+      "rds:CreateDBInstance",
+      "rds:ModifyDBCluster",
+      "rds:ModifyDBInstance",
+      "rds:RestoreDBClusterFromSnapshot",
+      "rds:RestoreDBInstanceFromDBSnapshot"
+    ],
+    Resource: "*",
+    Condition: {
+      StringEquals: {
+        "rds:DatabaseEngine": "neptune"
+      }
+    }
+  },
+  {
+    Sid: "DenyExpensiveGpuEc2",
+    Effect: "Deny",
+    Action: [
+      "ec2:RunInstances",
+      "ec2:RequestSpotInstances",
+      "ec2:RequestSpotFleet",
+      "ec2:ModifyInstanceAttribute"
+    ],
+    Resource: "*",
+    Condition: {
+      StringLike: {
+        "ec2:InstanceType": [
+          "p2.*",
+          "p3.*",
+          "p4d.*",
+          "p4de.*",
+          "p5.*",
+          "p5d.*",
+          "p5e.*",
+          "p5en.*",
+          "p6*",
+          "g3.*",
+          "g3s.*",
+          "g4dn.*",
+          "g4ad.*",
+          "g5.*",
+          "g5g.*",
+          "g6.*",
+          "g6e.*",
+          "g6f.*",
+          "inf1.*",
+          "inf2.*",
+          "trn1.*",
+          "trn1n.*",
+          "trn2.*",
+          "trn2a.*",
+          "trn2i.*",
+          "dl1.*",
+          "dl2q.*",
+          "f1.*",
+          "f2.*",
+          "vt1.*",
+          "hpc6id.*",
+          "u-12tb1.metal",
+          "u-18tb1.metal",
+          "u-24tb1.metal",
+          "u-6tb1.56xlarge",
+          "u-9tb1.112xlarge",
+          "x2iedn.*",
+          "x2idn.*",
+          "x2iezn.*"
+        ]
+      }
+    }
+  }
+];
+var user_admins_deny_list_default = {
+  Version,
+  Statement
+};
+
+
+
+
+exports.Statement = Statement; exports.Version = Version; exports.default = user_admins_deny_list_default;

package/cjs/commands/aws/iam/policies/user-admins-deny-regions-list.cjs

@@ -0,0 +1,49 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/commands/aws/iam/policies/user-admins-deny-regions-list.json
+var Version = "2012-10-17";
+var Statement = [
+  {
+    Sid: "DenyNonApprovedRegions",
+    Effect: "Deny",
+    NotAction: [
+      "iam:*",
+      "organizations:*",
+      "route53:*",
+      "route53domains:*",
+      "cloudfront:*",
+      "waf:*",
+      "wafv2:*",
+      "shield:*",
+      "globalaccelerator:*",
+      "sts:*",
+      "support:*",
+      "supportplans:*",
+      "trustedadvisor:*",
+      "health:*",
+      "budgets:*",
+      "ce:*",
+      "cur:*",
+      "account:*",
+      "billing:*",
+      "aws-portal:*",
+      "tag:*",
+      "resource-groups:*",
+      "ram:*",
+      "cloudshell:*"
+    ],
+    Resource: "*",
+    Condition: {
+      StringNotEquals: {
+        "aws:RequestedRegion": ["us-east-1", "us-east-2", "us-west-2"]
+      }
+    }
+  }
+];
+var user_admins_deny_regions_list_default = {
+  Version,
+  Statement
+};
+
+
+
+
+exports.Statement = Statement; exports.Version = Version; exports.default = user_admins_deny_regions_list_default;

package/cjs/commands/aws/iam/policies/user-admins-self-service-iam.cjs

@@ -0,0 +1,64 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/commands/aws/iam/policies/user-admins-self-service-iam.json
+var Version = "2012-10-17";
+var Statement = [
+  {
+    Sid: "ViewAccountInfo",
+    Effect: "Allow",
+    Action: ["iam:GetAccountPasswordPolicy", "iam:ListVirtualMFADevices"],
+    Resource: "*"
+  },
+  {
+    Sid: "ManageOwnPassword",
+    Effect: "Allow",
+    Action: ["iam:ChangePassword", "iam:GetUser"],
+    Resource: "arn:aws:iam::*:user/${aws:username}"
+  },
+  {
+    Sid: "ManageOwnAccessKeys",
+    Effect: "Allow",
+    Action: [
+      "iam:CreateAccessKey",
+      "iam:DeleteAccessKey",
+      "iam:ListAccessKeys",
+      "iam:UpdateAccessKey",
+      "iam:GetAccessKeyLastUsed"
+    ],
+    Resource: "arn:aws:iam::*:user/${aws:username}"
+  },
+  {
+    Sid: "ManageOwnMFA",
+    Effect: "Allow",
+    Action: [
+      "iam:CreateVirtualMFADevice",
+      "iam:DeleteVirtualMFADevice",
+      "iam:EnableMFADevice",
+      "iam:ListMFADevices",
+      "iam:ResyncMFADevice",
+      "iam:DeactivateMFADevice"
+    ],
+    Resource: [
+      "arn:aws:iam::*:mfa/${aws:username}",
+      "arn:aws:iam::*:user/${aws:username}"
+    ]
+  },
+  {
+    Sid: "ValidateIAMPolicies",
+    Effect: "Allow",
+    Action: [
+      "access-analyzer:ValidatePolicy",
+      "access-analyzer:CheckAccessNotGranted",
+      "access-analyzer:CheckNoNewAccess",
+      "access-analyzer:CheckNoPublicAccess"
+    ],
+    Resource: "*"
+  }
+];
+var user_admins_self_service_iam_default = {
+  Version,
+  Statement
+};
+
+
+
+
+exports.Statement = Statement; exports.Version = Version; exports.default = user_admins_self_service_iam_default;

package/cjs/commands/aws/iam/policies/user-admins-write-list.cjs

@@ -0,0 +1,125 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/commands/aws/iam/policies/user-admins-write-list.json
+var Version = "2012-10-17";
+var Statement = [
+  {
+    Sid: "WriteComputeAndNetwork",
+    Effect: "Allow",
+    Action: [
+      "ec2:*",
+      "elasticloadbalancing:*",
+      "autoscaling:*",
+      "application-autoscaling:*",
+      "lambda:*",
+      "ecs:*",
+      "ecr:*",
+      "elasticfilesystem:*",
+      "route53:*",
+      "route53domains:*",
+      "cloudfront:*",
+      "apigateway:*",
+      "servicediscovery:*"
+    ],
+    Resource: "*"
+  },
+  {
+    Sid: "WriteDataAndStorage",
+    Effect: "Allow",
+    Action: ["s3:*", "rds:*", "pi:*", "dynamodb:*", "backup:*"],
+    Resource: "*"
+  },
+  {
+    Sid: "WriteDeploymentAndOps",
+    Effect: "Allow",
+    Action: [
+      "cloudformation:*",
+      "cloudwatch:*",
+      "logs:*",
+      "events:*",
+      "scheduler:*",
+      "ssm:*",
+      "cloudtrail:*",
+      "xray:*",
+      "states:*",
+      "cloudshell:*"
+    ],
+    Resource: "*"
+  },
+  {
+    Sid: "WriteSecurityAndMessaging",
+    Effect: "Allow",
+    Action: [
+      "acm:*",
+      "secretsmanager:*",
+      "kms:*",
+      "sns:*",
+      "sqs:*",
+      "ses:*"
+    ],
+    Resource: "*"
+  },
+  {
+    Sid: "WriteResourceOrganization",
+    Effect: "Allow",
+    Action: ["resource-groups:*", "tag:*", "ram:*"],
+    Resource: "*"
+  },
+  {
+    Sid: "SupportAndHealth",
+    Effect: "Allow",
+    Action: [
+      "support:*",
+      "supportplans:Get*",
+      "supportplans:List*",
+      "health:*",
+      "trustedadvisor:*"
+    ],
+    Resource: "*"
+  },
+  {
+    Sid: "Sts",
+    Effect: "Allow",
+    Action: [
+      "sts:GetCallerIdentity",
+      "sts:GetFederationToken",
+      "sts:GetSessionToken"
+    ],
+    Resource: "*"
+  },
+  {
+    Sid: "IamPassRoleForServices",
+    Effect: "Allow",
+    Action: "iam:PassRole",
+    Resource: "arn:aws:iam::*:role/*",
+    Condition: {
+      StringEquals: {
+        "iam:PassedToService": [
+          "ec2.amazonaws.com",
+          "lambda.amazonaws.com",
+          "ecs.amazonaws.com",
+          "ecs-tasks.amazonaws.com",
+          "elasticloadbalancing.amazonaws.com",
+          "events.amazonaws.com",
+          "apigateway.amazonaws.com",
+          "rds.amazonaws.com",
+          "backup.amazonaws.com",
+          "cloudformation.amazonaws.com"
+        ]
+      }
+    }
+  },
+  {
+    Sid: "ServiceLinkedRoles",
+    Effect: "Allow",
+    Action: ["iam:CreateServiceLinkedRole", "iam:DeleteServiceLinkedRole"],
+    Resource: "*"
+  }
+];
+var user_admins_write_list_default = {
+  Version,
+  Statement
+};
+
+
+
+
+exports.Statement = Statement; exports.Version = Version; exports.default = user_admins_write_list_default;

package/cjs/commands/aws/iam/remove-admin/handler.cjs

@@ -0,0 +1,11 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _N5MXFOQZcjs = require('../../../../__chunks/N5MXFOQZ.cjs');
+require('../../../../__chunks/S3LVCWPN.cjs');
+require('../../../../__chunks/T2A7TN4F.cjs');
+require('../../../../__chunks/R3GUC7O7.cjs');
+require('../../../../__chunks/WOYF2L6T.cjs');
+require('../../../../__chunks/CMUD7LLN.cjs');
+
+
+exports.removeAdminCommand = _N5MXFOQZcjs.removeAdminCommand;

package/cjs/commands/aws/iam/remove-admin/handler.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `aws iam remove-admin` handler: remove users from the break-glass
+ * acl-admin-do-not-use group, either for one profile or every aws-vault profile.
+ * @param {unknown} options
+ */
+export function removeAdminCommand(options: unknown): Promise<void>;

package/cjs/commands/aws/iam/remove-admin/index.cjs

@@ -0,0 +1,18 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});require('../../../../__chunks/3BY5Y4W7.cjs');
+
+
+var _N5MXFOQZcjs = require('../../../../__chunks/N5MXFOQZ.cjs');
+
+
+var _S3LVCWPNcjs = require('../../../../__chunks/S3LVCWPN.cjs');
+
+
+var _T2A7TN4Fcjs = require('../../../../__chunks/T2A7TN4F.cjs');
+require('../../../../__chunks/R3GUC7O7.cjs');
+require('../../../../__chunks/WOYF2L6T.cjs');
+require('../../../../__chunks/CMUD7LLN.cjs');
+
+
+
+
+exports.ADMIN_GROUP_NAME = _T2A7TN4Fcjs.ADMIN_GROUP_NAME; exports.removeAdminCommand = _N5MXFOQZcjs.removeAdminCommand; exports.removeAdminOptionsSchema = _S3LVCWPNcjs.removeAdminOptionsSchema;

package/cjs/commands/aws/iam/remove-admin/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./handler.js";
+export * from "./schema.js";

package/cjs/commands/aws/iam/remove-admin/schema.cjs

@@ -0,0 +1,12 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _S3LVCWPNcjs = require('../../../../__chunks/S3LVCWPN.cjs');
+
+
+var _T2A7TN4Fcjs = require('../../../../__chunks/T2A7TN4F.cjs');
+require('../../../../__chunks/R3GUC7O7.cjs');
+require('../../../../__chunks/WOYF2L6T.cjs');
+
+
+
+exports.ADMIN_GROUP_NAME = _T2A7TN4Fcjs.ADMIN_GROUP_NAME; exports.removeAdminOptionsSchema = _S3LVCWPNcjs.removeAdminOptionsSchema;

package/cjs/commands/aws/iam/remove-admin/schema.d.ts

@@ -0,0 +1,28 @@
+export { ADMIN_GROUP_NAME } from "../admin-group.js";
+/**
+ * Zod schema for `aws iam remove-admin` options.
+ */
+export const removeAdminOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    all: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    user: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    yes: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    yes: boolean;
+    all: boolean;
+    user: string[];
+    dryRun: boolean;
+    profile?: string | undefined;
+}, {
+    profile?: string | undefined;
+    verbose?: boolean | undefined;
+    yes?: boolean | undefined;
+    all?: boolean | undefined;
+    user?: string[] | undefined;
+    dryRun?: boolean | undefined;
+}>;
+export type RemoveAdminOptions = z.infer<typeof removeAdminOptionsSchema>;
+import { z } from "zod";

package/cjs/commands/aws/iam/setup-acl/handler.cjs

@@ -0,0 +1,14 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _LHE24ECKcjs = require('../../../../__chunks/LHE24ECK.cjs');
+require('../../../../__chunks/SBBNW2BF.cjs');
+require('../../../../__chunks/3T2LXW7J.cjs');
+require('../../../../__chunks/FM5MVRQF.cjs');
+require('../../../../__chunks/R3GUC7O7.cjs');
+require('../../../../__chunks/3NOHGUCF.cjs');
+require('../../../../__chunks/NT2XXAI6.cjs');
+require('../../../../__chunks/WOYF2L6T.cjs');
+require('../../../../__chunks/CMUD7LLN.cjs');
+
+
+exports.setupAclCommand = _LHE24ECKcjs.setupAclCommand;

package/cjs/commands/aws/iam/setup-acl/handler.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `aws iam setup-acl` handler: idempotently create ACL groups, publish policies,
+ * attach/detach them per group, and optionally create IAM users.
+ * @param {unknown} options
+ */
+export function setupAclCommand(options: unknown): Promise<void>;

package/cjs/commands/aws/iam/setup-acl/index.cjs

@@ -0,0 +1,33 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});require('../../../../__chunks/LIKQ3SI4.cjs');
+
+
+var _LHE24ECKcjs = require('../../../../__chunks/LHE24ECK.cjs');
+
+
+
+
+
+
+
+
+var _SBBNW2BFcjs = require('../../../../__chunks/SBBNW2BF.cjs');
+require('../../../../__chunks/3T2LXW7J.cjs');
+
+
+var _FM5MVRQFcjs = require('../../../../__chunks/FM5MVRQF.cjs');
+require('../../../../__chunks/R3GUC7O7.cjs');
+require('../../../../__chunks/3NOHGUCF.cjs');
+require('../../../../__chunks/NT2XXAI6.cjs');
+require('../../../../__chunks/WOYF2L6T.cjs');
+require('../../../../__chunks/CMUD7LLN.cjs');
+
+
+
+
+
+
+
+
+
+
+exports.ACL_GROUPS = _SBBNW2BFcjs.ACL_GROUPS; exports.CUSTOM_POLICIES = _SBBNW2BFcjs.CUSTOM_POLICIES; exports.attach = _SBBNW2BFcjs.attach; exports.detach = _SBBNW2BFcjs.detach; exports.ensureGroup = _SBBNW2BFcjs.ensureGroup; exports.printFinalState = _SBBNW2BFcjs.printFinalState; exports.publishPolicy = _SBBNW2BFcjs.publishPolicy; exports.setupAclCommand = _LHE24ECKcjs.setupAclCommand; exports.setupAclOptionsSchema = _FM5MVRQFcjs.setupAclOptionsSchema;

package/cjs/commands/aws/iam/setup-acl/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./handler.js";
+export * from "./schema.js";
+export * from "./utils.js";

package/cjs/commands/aws/iam/setup-acl/schema.cjs

@@ -0,0 +1,7 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _FM5MVRQFcjs = require('../../../../__chunks/FM5MVRQF.cjs');
+require('../../../../__chunks/WOYF2L6T.cjs');
+
+
+exports.setupAclOptionsSchema = _FM5MVRQFcjs.setupAclOptionsSchema;

package/cjs/commands/aws/iam/setup-acl/schema.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Zod schema for `aws iam setup-acl` options.
+ */
+export const setupAclOptionsSchema: z.ZodObject<{
+    restrictRegions: z.ZodOptional<z.ZodEnum<["yes", "no"]>>;
+    createUsers: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    profile: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodString>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    createUsers: boolean;
+    profile?: string | undefined;
+    region?: string | undefined;
+    restrictRegions?: "yes" | "no" | undefined;
+}, {
+    profile?: string | undefined;
+    region?: string | undefined;
+    verbose?: boolean | undefined;
+    restrictRegions?: "yes" | "no" | undefined;
+    createUsers?: boolean | undefined;
+}>;
+export type SetupAclOptions = z.infer<typeof setupAclOptionsSchema>;
+import { z } from "zod";

package/cjs/commands/aws/iam/setup-acl/utils.cjs

@@ -0,0 +1,20 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+var _SBBNW2BFcjs = require('../../../../__chunks/SBBNW2BF.cjs');
+require('../../../../__chunks/R3GUC7O7.cjs');
+require('../../../../__chunks/3NOHGUCF.cjs');
+
+
+
+
+
+
+
+
+exports.ACL_GROUPS = _SBBNW2BFcjs.ACL_GROUPS; exports.CUSTOM_POLICIES = _SBBNW2BFcjs.CUSTOM_POLICIES; exports.attach = _SBBNW2BFcjs.attach; exports.detach = _SBBNW2BFcjs.detach; exports.ensureGroup = _SBBNW2BFcjs.ensureGroup; exports.printFinalState = _SBBNW2BFcjs.printFinalState; exports.publishPolicy = _SBBNW2BFcjs.publishPolicy;