@mtndev/cli 1.1.0 → 2.0.1

package/cjs/commands/aws/iam/admin-group.d.ts

@@ -0,0 +1,55 @@
+/**
+ * A function bound to a profile's working credential mode (direct or aws-vault).
+ * @typedef {(args: string[], options?: { expectJson?: boolean }) => any} ProfileRunner
+ */
+/**
+ * List aws-vault profiles that have stored credentials.
+ * @returns {string[]}
+ */
+export function listVaultProfiles(): string[];
+/**
+ * Resolve which profiles to scan for admin-group commands.
+ * Uses `--profile`, then `AWS_PROFILE`, for a single profile unless `--all` is set.
+ * @param {{ profile?: string; all?: boolean }} params
+ * @returns {string[]}
+ */
+export function resolveAdminScanProfiles({ profile, all }: {
+    profile?: string;
+    all?: boolean;
+}): string[];
+/**
+ * @param {{ Users?: Array<{ UserName: string }> }} group
+ * @returns {string[]}
+ */
+export function groupUserNames(group: {
+    Users?: Array<{
+        UserName: string;
+    }>;
+}): string[];
+/**
+ * Resolve a working credential runner for a profile and read the admin group.
+ * Tries stored credentials first, then falls back to `aws-vault exec`.
+ * The returned `run` reuses whichever mode worked, so callers can perform
+ * follow-up mutations (e.g. remove-user-from-group) with the same credentials.
+ * @param {{ profile: string; verbose?: boolean }} params
+ * @returns {{ accountId: string; arn: string; users: string[]; run: ProfileRunner } | null} Null when the profile is skipped
+ */
+export function resolveProfileScan(params: {
+    profile: string;
+    verbose?: boolean;
+}): {
+    accountId: string;
+    arn: string;
+    users: string[];
+    run: ProfileRunner;
+} | null;
+/**
+ * The IAM group that grants break-glass admin access and should normally be empty.
+ */
+export const ADMIN_GROUP_NAME: "acl-admin-do-not-use";
+/**
+ * A function bound to a profile's working credential mode (direct or aws-vault).
+ */
+export type ProfileRunner = (args: string[], options?: {
+    expectJson?: boolean;
+}) => any;

package/cjs/commands/aws/iam/break-glass/handler.cjs

@@ -0,0 +1,127 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("../../utils/tty.cjs");
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_utils_resolve_profile = require("../../utils/resolve-profile.cjs");
+const require_commands_aws_iam_admin_group = require("../admin-group.cjs");
+const require_commands_aws_iam_break_glass_schema = require("./schema.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/iam/break-glass/handler.js
+/**
+* Derive an IAM user name from a caller-identity ARN.
+* Returns null for non-user ARNs (assumed roles, root, etc.).
+* @param {string} arn
+* @returns {string | null}
+*/
+function userNameFromArn(arn) {
+	const index = arn.indexOf(":user/");
+	if (index === -1) return null;
+	const name = arn.slice(index + 6).split("/").pop();
+	return name && name.length > 0 ? name : null;
+}
+/**
+* `aws iam break-glass` handler: grant break-glass admin access by adding a user
+* to the acl-admin-do-not-use group for a single profile. Defaults to the
+* caller's own IAM user when no --user is given.
+* @param {unknown} options
+*/
+async function breakGlassCommand(options) {
+	try {
+		const { profile, user, yes, dryRun, verbose } = require_commands_aws_iam_break_glass_schema.breakGlassOptionsSchema.parse(options);
+		require_commands_aws_utils_exec_aws.requireCommands(["aws"]);
+		const targetProfile = await require_commands_aws_utils_resolve_profile.resolveProfile({ profile });
+		if (!targetProfile) {
+			console.error(chalk.default.red("No profile specified. Pass --profile <name> or set AWS_PROFILE."));
+			process.exit(1);
+		}
+		const scan = require_commands_aws_iam_admin_group.resolveProfileScan({
+			profile: targetProfile,
+			verbose
+		});
+		if (!scan) {
+			console.error(chalk.default.red(`\n❌ Could not read ${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME} for profile "${targetProfile}".`));
+			console.error(chalk.default.yellow("   Check your credentials, and run `mtn aws iam setup-acl` first if the group does not exist yet.\n"));
+			process.exit(1);
+		}
+		/** @type {string[]} */
+		let targets = user;
+		if (targets.length === 0) {
+			const derived = userNameFromArn(scan.arn);
+			if (!derived) {
+				console.error(chalk.default.red(`\n❌ Could not determine your IAM user from the caller identity:\n   ${scan.arn}`));
+				console.error(chalk.default.yellow("   Pass --user <name> to choose who to grant.\n"));
+				process.exit(1);
+			}
+			targets = [derived];
+		}
+		const alreadyMembers = new Set(scan.users);
+		const toGrant = targets.filter((name) => !alreadyMembers.has(name));
+		const existing = targets.filter((name) => alreadyMembers.has(name));
+		console.log(chalk.default.blue(`\n==> Break-glass admin (${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME}) — profile ${targetProfile} (${scan.accountId})\n`));
+		for (const name of existing) console.log(chalk.default.dim(`--     ${name} already has break-glass access`));
+		if (toGrant.length === 0) {
+			console.log(chalk.default.green("\nNothing to do — all target user(s) already have break-glass access.\n"));
+			return;
+		}
+		console.log(chalk.default.red.bold(`⚠  This grants AdministratorAccess to ${toGrant.length} user(s): ${toGrant.join(", ")}`));
+		if (dryRun) {
+			for (const name of toGrant) console.log(chalk.default.yellow(`  [dry-run] would add ${name} to ${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME}`));
+			console.log(chalk.default.yellow("\n[dry-run] Re-run without --dry-run to apply.\n"));
+			return;
+		}
+		let confirmed = yes;
+		if (!confirmed) confirmed = await require_commands_aws_utils_tty.promptYesNo({
+			message: `  Grant break-glass admin to ${toGrant.length} user(s) in ${targetProfile}?`,
+			defaultYes: false
+		});
+		if (!confirmed) {
+			console.log(chalk.default.dim("  aborted (not confirmed)\n"));
+			return;
+		}
+		let granted = 0;
+		for (const name of toGrant) try {
+			scan.run([
+				"iam",
+				"add-user-to-group",
+				"--group-name",
+				require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME,
+				"--user-name",
+				name
+			], { expectJson: false });
+			console.log(chalk.default.green(`  granted ${name}`));
+			granted += 1;
+		} catch (grantError) {
+			const reason = grantError instanceof Error ? grantError.message.split("\n")[0] ?? "" : String(grantError);
+			console.log(chalk.default.red(`  failed to grant ${name}: ${reason}`));
+		}
+		console.log(chalk.default.blue("\n==> Summary"));
+		console.log(`  Profile:          ${targetProfile} (${scan.accountId})`);
+		console.log(`  Users granted:    ${granted}`);
+		console.log(`  Already had it:   ${existing.length}`);
+		console.log(chalk.default.yellow("\n💡 Revoke with `mtn aws iam remove-admin` when you are done."));
+		console.log(chalk.default.dim("   You may need a fresh session (e.g. clear the aws-vault cache) before the new permissions apply.\n"));
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ break-glass failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Requires the AWS CLI and iam:AddUserToGroup on the target profile.\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.breakGlassCommand = breakGlassCommand;

package/cjs/commands/aws/iam/break-glass/handler.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `aws iam break-glass` handler: grant break-glass admin access by adding a user
+ * to the acl-admin-do-not-use group for a single profile. Defaults to the
+ * caller's own IAM user when no --user is given.
+ * @param {unknown} options
+ */
+export function breakGlassCommand(options: unknown): Promise<void>;

package/cjs/commands/aws/iam/break-glass/index.cjs

@@ -0,0 +1,7 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_iam_admin_group = require("../admin-group.cjs");
+const require_commands_aws_iam_break_glass_schema = require("./schema.cjs");
+const require_commands_aws_iam_break_glass_handler = require("./handler.cjs");
+exports.ADMIN_GROUP_NAME = require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME;
+exports.breakGlassCommand = require_commands_aws_iam_break_glass_handler.breakGlassCommand;
+exports.breakGlassOptionsSchema = require_commands_aws_iam_break_glass_schema.breakGlassOptionsSchema;

package/cjs/commands/aws/iam/break-glass/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./handler.js";
+export * from "./schema.js";

package/cjs/commands/aws/iam/break-glass/schema.cjs

@@ -0,0 +1,21 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_schema = require("../../schema.cjs");
+const require_commands_aws_iam_admin_group = require("../admin-group.cjs");
+let zod = require("zod");
+//#region src/commands/aws/iam/break-glass/schema.js
+/**
+* Zod schema for `aws iam break-glass` options.
+*/
+const breakGlassOptionsSchema = zod.z.object({
+	profile: require_commands_aws_schema.profileField,
+	user: zod.z.array(zod.z.string()).optional().default([]).describe("Grant break-glass to this user (repeatable). Default: your own IAM user"),
+	yes: zod.z.boolean().optional().default(false).describe("Skip the confirmation prompt"),
+	dryRun: zod.z.boolean().optional().default(false).describe("Preview the grant without changing anything"),
+	verbose: require_commands_aws_schema.verboseField
+});
+/**
+* @typedef {z.infer<typeof breakGlassOptionsSchema>} BreakGlassOptions
+*/
+//#endregion
+exports.ADMIN_GROUP_NAME = require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME;
+exports.breakGlassOptionsSchema = breakGlassOptionsSchema;

package/cjs/commands/aws/iam/break-glass/schema.d.ts

@@ -0,0 +1,25 @@
+export { ADMIN_GROUP_NAME } from "../admin-group.js";
+/**
+ * Zod schema for `aws iam break-glass` options.
+ */
+export const breakGlassOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    user: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    yes: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    yes: boolean;
+    user: string[];
+    dryRun: boolean;
+    profile?: string | undefined;
+}, {
+    profile?: string | undefined;
+    verbose?: boolean | undefined;
+    yes?: boolean | undefined;
+    user?: string[] | undefined;
+    dryRun?: boolean | undefined;
+}>;
+export type BreakGlassOptions = z.infer<typeof breakGlassOptionsSchema>;
+import { z } from "zod";

package/cjs/commands/aws/iam/check-admin/handler.cjs

@@ -0,0 +1,89 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_iam_admin_group = require("../admin-group.cjs");
+const require_commands_aws_iam_check_admin_schema = require("./schema.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/iam/check-admin/handler.js
+/**
+* `aws iam check-admin` handler: alert if anyone is a member of acl-admin-do-not-use.
+* @param {unknown} options
+*/
+async function checkAdminCommand(options) {
+	try {
+		const { profile, all, verbose } = require_commands_aws_iam_check_admin_schema.checkAdminOptionsSchema.parse(options);
+		require_commands_aws_utils_exec_aws.requireCommands(["aws"]);
+		if (all || !(profile ?? process.env.AWS_PROFILE)) require_commands_aws_utils_exec_aws.requireCommands(["aws-vault"]);
+		/** @type {string[]} */
+		let profiles;
+		try {
+			profiles = require_commands_aws_iam_admin_group.resolveAdminScanProfiles({
+				profile,
+				all
+			});
+		} catch (resolveError) {
+			if (resolveError instanceof Error && resolveError.message === "No aws-vault profiles with credentials found.") {
+				console.error(chalk.default.red(resolveError.message));
+				process.exit(1);
+			}
+			throw resolveError;
+		}
+		console.log(chalk.default.blue(`\n==> Checking ${profiles.length} profile(s) for ${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME}\n`));
+		let ok = 0;
+		let alert = 0;
+		let skip = 0;
+		for (const candidate of profiles) {
+			const scan = require_commands_aws_iam_admin_group.resolveProfileScan({
+				profile: candidate,
+				verbose
+			});
+			if (!scan) {
+				skip += 1;
+				continue;
+			}
+			if (scan.users.length === 0) {
+				console.log(chalk.default.green(`OK     ${candidate} (${scan.accountId}) — ${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME}: 0 users`));
+				ok += 1;
+			} else {
+				console.log(chalk.default.red(`ALERT  ${candidate} (${scan.accountId}) — ${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME}: ${scan.users.length} user(s): ${scan.users.join(", ")}`));
+				alert += 1;
+			}
+		}
+		console.log(chalk.default.blue("\n==> Summary"));
+		console.log(`  Profiles scanned:  ${profiles.length}`);
+		console.log(`  OK (empty group):  ${ok}`);
+		console.log(`  ALERT (has users): ${alert}`);
+		console.log(`  Skipped (silent):  ${skip}`);
+		if (alert > 0) {
+			console.log(chalk.default.red(`\nRemove users from ${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME} when break-glass access is no longer needed.`));
+			process.exit(1);
+		}
+		if (ok === 0) {
+			console.log(chalk.default.yellow(`\nNo profiles returned IAM access for ${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME}.`));
+			console.log(chalk.default.yellow("  Use a profile with iam:GetGroup (e.g. md-*-iam-admin) or run with --verbose."));
+		}
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ check-admin failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Requires the AWS CLI, and aws-vault when scanning multiple profiles.\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.checkAdminCommand = checkAdminCommand;

package/cjs/commands/aws/iam/check-admin/handler.d.ts

@@ -0,0 +1,5 @@
+/**
+ * `aws iam check-admin` handler: alert if anyone is a member of acl-admin-do-not-use.
+ * @param {unknown} options
+ */
+export function checkAdminCommand(options: unknown): Promise<void>;

package/cjs/commands/aws/iam/check-admin/index.cjs

@@ -0,0 +1,7 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_iam_admin_group = require("../admin-group.cjs");
+const require_commands_aws_iam_check_admin_schema = require("./schema.cjs");
+const require_commands_aws_iam_check_admin_handler = require("./handler.cjs");
+exports.ADMIN_GROUP_NAME = require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME;
+exports.checkAdminCommand = require_commands_aws_iam_check_admin_handler.checkAdminCommand;
+exports.checkAdminOptionsSchema = require_commands_aws_iam_check_admin_schema.checkAdminOptionsSchema;

package/cjs/commands/aws/iam/check-admin/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./handler.js";
+export * from "./schema.js";

package/cjs/commands/aws/iam/check-admin/schema.cjs

@@ -0,0 +1,19 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_schema = require("../../schema.cjs");
+const require_commands_aws_iam_admin_group = require("../admin-group.cjs");
+let zod = require("zod");
+//#region src/commands/aws/iam/check-admin/schema.js
+/**
+* Zod schema for `aws iam check-admin` options.
+*/
+const checkAdminOptionsSchema = zod.z.object({
+	profile: require_commands_aws_schema.profileField,
+	all: zod.z.boolean().optional().default(false).describe("Scan every aws-vault profile (default only when --profile and AWS_PROFILE are unset)"),
+	verbose: require_commands_aws_schema.verboseField
+});
+/**
+* @typedef {z.infer<typeof checkAdminOptionsSchema>} CheckAdminOptions
+*/
+//#endregion
+exports.ADMIN_GROUP_NAME = require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME;
+exports.checkAdminOptionsSchema = checkAdminOptionsSchema;

package/cjs/commands/aws/iam/check-admin/schema.d.ts

@@ -0,0 +1,19 @@
+export { ADMIN_GROUP_NAME } from "../admin-group.js";
+/**
+ * Zod schema for `aws iam check-admin` options.
+ */
+export const checkAdminOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    all: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    all: boolean;
+    profile?: string | undefined;
+}, {
+    profile?: string | undefined;
+    verbose?: boolean | undefined;
+    all?: boolean | undefined;
+}>;
+export type CheckAdminOptions = z.infer<typeof checkAdminOptionsSchema>;
+import { z } from "zod";

package/cjs/commands/aws/iam/policies/s3-restrictions-deny-non-s3-services.json

@@ -0,0 +1,20 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "DenyNonS3Services",
+      "Effect": "Deny",
+      "NotAction": [
+        "s3:*",
+        "logs:*",
+        "sts:AssumeRole",
+        "iam:PassRole",
+        "kms:Decrypt",
+        "kms:GenerateDataKey",
+        "kms:DescribeKey",
+        "lambda:InvokeFunction"
+      ],
+      "Resource": "*"
+    }
+  ]
+}

package/cjs/commands/aws/iam/policies/sts-federation.json

@@ -0,0 +1,11 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "StsFederation",
+      "Effect": "Allow",
+      "Action": ["sts:GetFederationToken", "sts:GetCallerIdentity"],
+      "Resource": "*"
+    }
+  ]
+}

package/cjs/commands/aws/iam/policies/user-admins-deny-list.json

@@ -0,0 +1,175 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "DenyAIServices",
+      "Effect": "Deny",
+      "Action": [
+        "bedrock:*",
+        "sagemaker:*",
+        "comprehend:*",
+        "comprehendmedical:*",
+        "rekognition:*",
+        "textract:*",
+        "personalize:*",
+        "forecast:*",
+        "lex:*",
+        "polly:*",
+        "translate:*",
+        "transcribe:*",
+        "kendra:*",
+        "q:*"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "DenyOrgAndAccountWrites",
+      "Effect": "Deny",
+      "Action": [
+        "organizations:*",
+        "account:CloseAccount",
+        "account:DeleteAlternateContact",
+        "account:PutAlternateContact",
+        "account:PutChallengeQuestions",
+        "account:EnableRegion",
+        "account:DisableRegion",
+        "account:PutAccountName"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "DenyBillingMutations",
+      "Effect": "Deny",
+      "Action": [
+        "aws-portal:Modify*",
+        "billing:Update*",
+        "billing:Put*",
+        "billing:Delete*",
+        "budgets:Modify*",
+        "budgets:Create*",
+        "budgets:Delete*",
+        "savingsplans:Create*",
+        "savingsplans:Delete*",
+        "supportplans:Create*",
+        "supportplans:Delete*",
+        "purchase-orders:Modify*",
+        "purchase-orders:Create*",
+        "cur:Put*",
+        "cur:Delete*"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "DenyCloudTrailTampering",
+      "Effect": "Deny",
+      "Action": [
+        "cloudtrail:StopLogging",
+        "cloudtrail:DeleteTrail",
+        "cloudtrail:UpdateTrail",
+        "cloudtrail:PutEventSelectors",
+        "cloudtrail:DeleteEventDataStore"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "DenyExpensiveServices",
+      "Effect": "Deny",
+      "Action": [
+        "airflow:CreateEnvironment",
+        "airflow:UpdateEnvironment",
+        "mwaa:*",
+        "transfer:CreateServer",
+        "transfer:UpdateServer",
+        "transfer:StartServer",
+        "shield:CreateSubscription",
+        "shield:CreateProtection",
+        "shield:CreateProtectionGroup"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "DenyKMSDestruction",
+      "Effect": "Deny",
+      "Action": [
+        "kms:ScheduleKeyDeletion",
+        "kms:DisableKey",
+        "kms:DisableKeyRotation"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "DenyNeptuneViaRds",
+      "Effect": "Deny",
+      "Action": [
+        "rds:CreateDBCluster",
+        "rds:CreateDBInstance",
+        "rds:ModifyDBCluster",
+        "rds:ModifyDBInstance",
+        "rds:RestoreDBClusterFromSnapshot",
+        "rds:RestoreDBInstanceFromDBSnapshot"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "StringEquals": {
+          "rds:DatabaseEngine": "neptune"
+        }
+      }
+    },
+    {
+      "Sid": "DenyExpensiveGpuEc2",
+      "Effect": "Deny",
+      "Action": [
+        "ec2:RunInstances",
+        "ec2:RequestSpotInstances",
+        "ec2:RequestSpotFleet",
+        "ec2:ModifyInstanceAttribute"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "StringLike": {
+          "ec2:InstanceType": [
+            "p2.*",
+            "p3.*",
+            "p4d.*",
+            "p4de.*",
+            "p5.*",
+            "p5d.*",
+            "p5e.*",
+            "p5en.*",
+            "p6*",
+            "g3.*",
+            "g3s.*",
+            "g4dn.*",
+            "g4ad.*",
+            "g5.*",
+            "g5g.*",
+            "g6.*",
+            "g6e.*",
+            "g6f.*",
+            "inf1.*",
+            "inf2.*",
+            "trn1.*",
+            "trn1n.*",
+            "trn2.*",
+            "trn2a.*",
+            "trn2i.*",
+            "dl1.*",
+            "dl2q.*",
+            "f1.*",
+            "f2.*",
+            "vt1.*",
+            "hpc6id.*",
+            "u-12tb1.metal",
+            "u-18tb1.metal",
+            "u-24tb1.metal",
+            "u-6tb1.56xlarge",
+            "u-9tb1.112xlarge",
+            "x2iedn.*",
+            "x2idn.*",
+            "x2iezn.*"
+          ]
+        }
+      }
+    }
+  ]
+}

package/cjs/commands/aws/iam/policies/user-admins-deny-regions-list.json

@@ -0,0 +1,41 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "DenyNonApprovedRegions",
+      "Effect": "Deny",
+      "NotAction": [
+        "iam:*",
+        "organizations:*",
+        "route53:*",
+        "route53domains:*",
+        "cloudfront:*",
+        "waf:*",
+        "wafv2:*",
+        "shield:*",
+        "globalaccelerator:*",
+        "sts:*",
+        "support:*",
+        "supportplans:*",
+        "trustedadvisor:*",
+        "health:*",
+        "budgets:*",
+        "ce:*",
+        "cur:*",
+        "account:*",
+        "billing:*",
+        "aws-portal:*",
+        "tag:*",
+        "resource-groups:*",
+        "ram:*",
+        "cloudshell:*"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "StringNotEquals": {
+          "aws:RequestedRegion": ["us-east-1", "us-east-2", "us-west-2"]
+        }
+      }
+    }
+  ]
+}