@mtndev/cli 1.1.0 → 2.0.1

package/cjs/commands/aws/iam/policies/user-admins-self-service-iam.json

@@ -0,0 +1,56 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "ViewAccountInfo",
+      "Effect": "Allow",
+      "Action": ["iam:GetAccountPasswordPolicy", "iam:ListVirtualMFADevices"],
+      "Resource": "*"
+    },
+    {
+      "Sid": "ManageOwnPassword",
+      "Effect": "Allow",
+      "Action": ["iam:ChangePassword", "iam:GetUser"],
+      "Resource": "arn:aws:iam::*:user/${aws:username}"
+    },
+    {
+      "Sid": "ManageOwnAccessKeys",
+      "Effect": "Allow",
+      "Action": [
+        "iam:CreateAccessKey",
+        "iam:DeleteAccessKey",
+        "iam:ListAccessKeys",
+        "iam:UpdateAccessKey",
+        "iam:GetAccessKeyLastUsed"
+      ],
+      "Resource": "arn:aws:iam::*:user/${aws:username}"
+    },
+    {
+      "Sid": "ManageOwnMFA",
+      "Effect": "Allow",
+      "Action": [
+        "iam:CreateVirtualMFADevice",
+        "iam:DeleteVirtualMFADevice",
+        "iam:EnableMFADevice",
+        "iam:ListMFADevices",
+        "iam:ResyncMFADevice",
+        "iam:DeactivateMFADevice"
+      ],
+      "Resource": [
+        "arn:aws:iam::*:mfa/${aws:username}",
+        "arn:aws:iam::*:user/${aws:username}"
+      ]
+    },
+    {
+      "Sid": "ValidateIAMPolicies",
+      "Effect": "Allow",
+      "Action": [
+        "access-analyzer:ValidatePolicy",
+        "access-analyzer:CheckAccessNotGranted",
+        "access-analyzer:CheckNoNewAccess",
+        "access-analyzer:CheckNoPublicAccess"
+      ],
+      "Resource": "*"
+    }
+  ]
+}

package/cjs/commands/aws/iam/policies/user-admins-write-list.json

@@ -0,0 +1,117 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "WriteComputeAndNetwork",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:*",
+        "elasticloadbalancing:*",
+        "autoscaling:*",
+        "application-autoscaling:*",
+        "lambda:*",
+        "ecs:*",
+        "ecr:*",
+        "elasticfilesystem:*",
+        "route53:*",
+        "route53domains:*",
+        "cloudfront:*",
+        "apigateway:*",
+        "servicediscovery:*"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "WriteDataAndStorage",
+      "Effect": "Allow",
+      "Action": ["s3:*", "rds:*", "pi:*", "dynamodb:*", "backup:*"],
+      "Resource": "*"
+    },
+    {
+      "Sid": "WriteDeploymentAndOps",
+      "Effect": "Allow",
+      "Action": [
+        "cloudformation:*",
+        "cloudwatch:*",
+        "logs:*",
+        "events:*",
+        "scheduler:*",
+        "ssm:*",
+        "cloudtrail:*",
+        "xray:*",
+        "states:*",
+        "cloudshell:*"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "WriteSecurityAndMessaging",
+      "Effect": "Allow",
+      "Action": [
+        "acm:*",
+        "secretsmanager:*",
+        "kms:*",
+        "sns:*",
+        "sqs:*",
+        "ses:*"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "WriteResourceOrganization",
+      "Effect": "Allow",
+      "Action": ["resource-groups:*", "tag:*", "ram:*"],
+      "Resource": "*"
+    },
+    {
+      "Sid": "SupportAndHealth",
+      "Effect": "Allow",
+      "Action": [
+        "support:*",
+        "supportplans:Get*",
+        "supportplans:List*",
+        "health:*",
+        "trustedadvisor:*"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "Sts",
+      "Effect": "Allow",
+      "Action": [
+        "sts:GetCallerIdentity",
+        "sts:GetFederationToken",
+        "sts:GetSessionToken"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "IamPassRoleForServices",
+      "Effect": "Allow",
+      "Action": "iam:PassRole",
+      "Resource": "arn:aws:iam::*:role/*",
+      "Condition": {
+        "StringEquals": {
+          "iam:PassedToService": [
+            "ec2.amazonaws.com",
+            "lambda.amazonaws.com",
+            "ecs.amazonaws.com",
+            "ecs-tasks.amazonaws.com",
+            "elasticloadbalancing.amazonaws.com",
+            "events.amazonaws.com",
+            "apigateway.amazonaws.com",
+            "rds.amazonaws.com",
+            "backup.amazonaws.com",
+            "cloudformation.amazonaws.com"
+          ]
+        }
+      }
+    },
+    {
+      "Sid": "ServiceLinkedRoles",
+      "Effect": "Allow",
+      "Action": ["iam:CreateServiceLinkedRole", "iam:DeleteServiceLinkedRole"],
+      "Resource": "*"
+    }
+  ]
+}

package/cjs/commands/aws/iam/remove-admin/handler.cjs

@@ -0,0 +1,120 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("../../utils/tty.cjs");
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_iam_admin_group = require("../admin-group.cjs");
+const require_commands_aws_iam_remove_admin_schema = require("./schema.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/iam/remove-admin/handler.js
+/**
+* `aws iam remove-admin` handler: remove users from the break-glass
+* acl-admin-do-not-use group, either for one profile or every aws-vault profile.
+* @param {unknown} options
+*/
+async function removeAdminCommand(options) {
+	try {
+		const { profile, all, user, yes, dryRun, verbose } = require_commands_aws_iam_remove_admin_schema.removeAdminOptionsSchema.parse(options);
+		require_commands_aws_utils_exec_aws.requireCommands(["aws"]);
+		const userFilter = new Set(user);
+		if (all || !(profile ?? process.env.AWS_PROFILE)) require_commands_aws_utils_exec_aws.requireCommands(["aws-vault"]);
+		/** @type {string[]} */
+		let profiles;
+		try {
+			profiles = require_commands_aws_iam_admin_group.resolveAdminScanProfiles({
+				profile,
+				all
+			});
+		} catch (resolveError) {
+			if (resolveError instanceof Error && resolveError.message === "No aws-vault profiles with credentials found.") {
+				console.error(chalk.default.red(resolveError.message));
+				process.exit(1);
+			}
+			throw resolveError;
+		}
+		console.log(chalk.default.blue(`\n==> Removing break-glass access (${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME}) across ${profiles.length} profile(s)\n`));
+		if (dryRun) console.log(chalk.default.yellow("[dry-run] No changes will be made.\n"));
+		let removed = 0;
+		let cleaned = 0;
+		let skipped = 0;
+		for (const candidate of profiles) {
+			const scan = require_commands_aws_iam_admin_group.resolveProfileScan({
+				profile: candidate,
+				verbose
+			});
+			if (!scan) {
+				skipped += 1;
+				continue;
+			}
+			if (scan.users.length === 0) {
+				if (verbose) console.log(chalk.default.green(`OK     ${candidate} (${scan.accountId}) — 0 users`));
+				cleaned += 1;
+				continue;
+			}
+			const targets = userFilter.size > 0 ? scan.users.filter((name) => userFilter.has(name)) : scan.users;
+			if (targets.length === 0) {
+				console.log(chalk.default.dim(`--     ${candidate} (${scan.accountId}) — has users but none match --user`));
+				skipped += 1;
+				continue;
+			}
+			console.log(chalk.default.red(`FOUND  ${candidate} (${scan.accountId}) — ${targets.length} user(s): ${targets.join(", ")}`));
+			if (dryRun) {
+				for (const name of targets) console.log(chalk.default.yellow(`  [dry-run] would remove ${name} from ${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME}`));
+				continue;
+			}
+			let confirmed = yes;
+			if (!confirmed) confirmed = await require_commands_aws_utils_tty.promptYesNo({
+				message: `  Remove ${targets.length} user(s) from ${require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME} in ${candidate}?`,
+				defaultYes: false
+			});
+			if (!confirmed) {
+				console.log(chalk.default.dim("  skipped (not confirmed)"));
+				skipped += 1;
+				continue;
+			}
+			for (const name of targets) try {
+				scan.run([
+					"iam",
+					"remove-user-from-group",
+					"--group-name",
+					require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME,
+					"--user-name",
+					name
+				], { expectJson: false });
+				console.log(chalk.default.green(`  removed ${name}`));
+				removed += 1;
+			} catch (removeError) {
+				const reason = removeError instanceof Error ? removeError.message.split("\n")[0] ?? "" : String(removeError);
+				console.log(chalk.default.red(`  failed to remove ${name}: ${reason}`));
+			}
+		}
+		console.log(chalk.default.blue("\n==> Summary"));
+		console.log(`  Profiles scanned:  ${profiles.length}`);
+		console.log(`  Users removed:     ${removed}`);
+		console.log(`  Already clean:     ${cleaned}`);
+		console.log(`  Skipped:           ${skipped}`);
+		if (dryRun) console.log(chalk.default.yellow("\n[dry-run] Re-run without --dry-run to apply changes."));
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ remove-admin failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Requires the AWS CLI (and aws-vault when scanning multiple profiles) and iam:RemoveUserFromGroup.\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.removeAdminCommand = removeAdminCommand;

package/cjs/commands/aws/iam/remove-admin/handler.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `aws iam remove-admin` handler: remove users from the break-glass
+ * acl-admin-do-not-use group, either for one profile or every aws-vault profile.
+ * @param {unknown} options
+ */
+export function removeAdminCommand(options: unknown): Promise<void>;

package/cjs/commands/aws/iam/remove-admin/index.cjs

@@ -0,0 +1,7 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_iam_admin_group = require("../admin-group.cjs");
+const require_commands_aws_iam_remove_admin_schema = require("./schema.cjs");
+const require_commands_aws_iam_remove_admin_handler = require("./handler.cjs");
+exports.ADMIN_GROUP_NAME = require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME;
+exports.removeAdminCommand = require_commands_aws_iam_remove_admin_handler.removeAdminCommand;
+exports.removeAdminOptionsSchema = require_commands_aws_iam_remove_admin_schema.removeAdminOptionsSchema;

package/cjs/commands/aws/iam/remove-admin/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./handler.js";
+export * from "./schema.js";

package/cjs/commands/aws/iam/remove-admin/schema.cjs

@@ -0,0 +1,22 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_schema = require("../../schema.cjs");
+const require_commands_aws_iam_admin_group = require("../admin-group.cjs");
+let zod = require("zod");
+//#region src/commands/aws/iam/remove-admin/schema.js
+/**
+* Zod schema for `aws iam remove-admin` options.
+*/
+const removeAdminOptionsSchema = zod.z.object({
+	profile: require_commands_aws_schema.profileField,
+	all: zod.z.boolean().optional().default(false).describe("Scan every aws-vault profile (default only when --profile and AWS_PROFILE are unset)"),
+	user: zod.z.array(zod.z.string()).optional().default([]).describe("Only remove these user(s); repeatable. Default: every user in the group"),
+	yes: zod.z.boolean().optional().default(false).describe("Skip the per-profile confirmation prompt"),
+	dryRun: zod.z.boolean().optional().default(false).describe("Preview removals without changing anything"),
+	verbose: require_commands_aws_schema.verboseField
+});
+/**
+* @typedef {z.infer<typeof removeAdminOptionsSchema>} RemoveAdminOptions
+*/
+//#endregion
+exports.ADMIN_GROUP_NAME = require_commands_aws_iam_admin_group.ADMIN_GROUP_NAME;
+exports.removeAdminOptionsSchema = removeAdminOptionsSchema;

package/cjs/commands/aws/iam/remove-admin/schema.d.ts

@@ -0,0 +1,28 @@
+export { ADMIN_GROUP_NAME } from "../admin-group.js";
+/**
+ * Zod schema for `aws iam remove-admin` options.
+ */
+export const removeAdminOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    all: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    user: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    yes: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    yes: boolean;
+    all: boolean;
+    user: string[];
+    dryRun: boolean;
+    profile?: string | undefined;
+}, {
+    profile?: string | undefined;
+    verbose?: boolean | undefined;
+    yes?: boolean | undefined;
+    all?: boolean | undefined;
+    user?: string[] | undefined;
+    dryRun?: boolean | undefined;
+}>;
+export type RemoveAdminOptions = z.infer<typeof removeAdminOptionsSchema>;
+import { z } from "zod";

package/cjs/commands/aws/iam/setup-acl/handler.cjs

@@ -0,0 +1,227 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("../../utils/tty.cjs");
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_utils_resolve_profile = require("../../utils/resolve-profile.cjs");
+const require_commands_aws_iam_users_utils = require("../users/utils.cjs");
+const require_commands_aws_iam_setup_acl_schema = require("./schema.cjs");
+const require_commands_aws_iam_setup_acl_utils = require("./utils.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/iam/setup-acl/handler.js
+/**
+* Decide whether to attach the region restriction policy.
+* @param {{ restrictRegions?: "yes" | "no" }} params
+* @returns {Promise<boolean>}
+*/
+async function resolveRestrictRegions(params) {
+	const { restrictRegions } = params;
+	if (restrictRegions) {
+		console.log(`Region restriction: ${restrictRegions}`);
+		return restrictRegions === "yes";
+	}
+	console.log("Region restriction");
+	console.log("  The policy UserAdminsDenyRegionsList limits acl-power-users to a hard-coded");
+	console.log("  region allowlist. Most accounts should leave this OFF unless you have a strong reason.");
+	const restrict = await require_commands_aws_utils_tty.promptYesNo({
+		message: "  Attach region restriction to acl-power-users?",
+		defaultYes: false
+	});
+	console.log(`  → ${restrict ? "yes" : "no"}`);
+	console.log("");
+	return restrict;
+}
+/**
+* `aws iam setup-acl` handler: idempotently create ACL groups, publish policies,
+* attach/detach them per group, and optionally create IAM users.
+* @param {unknown} options
+*/
+async function setupAclCommand(options) {
+	try {
+		const { restrictRegions, createUsers, profile: profileOption, region, verbose } = require_commands_aws_iam_setup_acl_schema.setupAclOptionsSchema.parse(options);
+		require_commands_aws_utils_exec_aws.requireCommands(["aws"]);
+		const profile = await require_commands_aws_utils_resolve_profile.resolveProfile({ profile: profileOption });
+		const identity = require_commands_aws_utils_exec_aws.getCallerIdentity({
+			profile,
+			region,
+			verbose
+		});
+		const accountId = identity.Account;
+		console.log("Caller:");
+		console.log(`  Account: ${accountId}`);
+		console.log(`  Arn:     ${identity.Arn}`);
+		console.log("");
+		const restrict = await resolveRestrictRegions({ restrictRegions });
+		console.log("1. Ensure groups exist...");
+		for (const group of require_commands_aws_iam_setup_acl_utils.ACL_GROUPS) require_commands_aws_iam_setup_acl_utils.ensureGroup({
+			name: group,
+			profile,
+			verbose
+		});
+		console.log("");
+		console.log("2. Publish custom policies...");
+		for (const policy of require_commands_aws_iam_setup_acl_utils.CUSTOM_POLICIES) require_commands_aws_iam_setup_acl_utils.publishPolicy({
+			name: policy.name,
+			fileName: policy.fileName,
+			accountId,
+			profile,
+			verbose
+		});
+		console.log("");
+		const ADMIN = "arn:aws:iam::aws:policy/AdministratorAccess";
+		const IAM_FULL = "arn:aws:iam::aws:policy/IAMFullAccess";
+		const READ_ONLY = "arn:aws:iam::aws:policy/ReadOnlyAccess";
+		const WRITE_LIST = `arn:aws:iam::${accountId}:policy/UserAdminsWriteList`;
+		const DENY_LIST = `arn:aws:iam::${accountId}:policy/UserAdminsDenyList`;
+		const SELF_SERVICE = `arn:aws:iam::${accountId}:policy/UserAdminsSelfServiceIAM`;
+		const DENY_REGIONS = `arn:aws:iam::${accountId}:policy/UserAdminsDenyRegionsList`;
+		const STS_FEDERATION = `arn:aws:iam::${accountId}:policy/sts-federation`;
+		const S3_RESTRICTIONS = `arn:aws:iam::${accountId}:policy/S3RestrictionsDenyNonS3Services`;
+		console.log("3. Attach policies to groups...");
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-admin-do-not-use",
+			arn: ADMIN,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-iam-full-access",
+			arn: IAM_FULL,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-iam-full-access",
+			arn: READ_ONLY,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-iam-full-access",
+			arn: SELF_SERVICE,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-iam-full-access",
+			arn: STS_FEDERATION,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.detach({
+			group: "acl-iam-full-access",
+			arn: DENY_LIST,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-power-users",
+			arn: READ_ONLY,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-power-users",
+			arn: WRITE_LIST,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-power-users",
+			arn: DENY_LIST,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-power-users",
+			arn: SELF_SERVICE,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-read-only",
+			arn: READ_ONLY,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-read-only",
+			arn: STS_FEDERATION,
+			profile,
+			verbose
+		});
+		require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-s3-restrictions",
+			arn: S3_RESTRICTIONS,
+			profile,
+			verbose
+		});
+		console.log("");
+		console.log("4. Apply region restriction to acl-power-users...");
+		if (restrict) require_commands_aws_iam_setup_acl_utils.attach({
+			group: "acl-power-users",
+			arn: DENY_REGIONS,
+			profile,
+			verbose
+		});
+		else require_commands_aws_iam_setup_acl_utils.detach({
+			group: "acl-power-users",
+			arn: DENY_REGIONS,
+			profile,
+			verbose
+		});
+		console.log("");
+		console.log("5. Detach legacy policies (if present)...");
+		const legacyArns = [
+			"arn:aws:iam::aws:policy/PowerUserAccess",
+			"arn:aws:iam::aws:policy/IAMReadOnlyAccess",
+			`arn:aws:iam::${accountId}:policy/UserAdminsAllowList`,
+			`arn:aws:iam::${accountId}:policy/UserAdminsDenyListServices`,
+			`arn:aws:iam::${accountId}:policy/UserAdminsDenyListGpu`
+		];
+		for (const group of require_commands_aws_iam_setup_acl_utils.ACL_GROUPS) for (const arn of legacyArns) require_commands_aws_iam_setup_acl_utils.detach({
+			group,
+			arn,
+			profile,
+			verbose
+		});
+		console.log("");
+		console.log("6. Final state:");
+		require_commands_aws_iam_setup_acl_utils.printFinalState({
+			profile,
+			verbose
+		});
+		console.log("");
+		if (createUsers) {
+			console.log("7. Create IAM users (optional)");
+			console.log("");
+			await require_commands_aws_iam_users_utils.createUsersInteractive({
+				profile,
+				verbose
+			});
+		}
+		console.log(chalk.default.green("\n✅ ACL setup complete."));
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ iam setup-acl failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Run with a profile that has IAMFullAccess (e.g. md-*-iam-admin).\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.setupAclCommand = setupAclCommand;

package/cjs/commands/aws/iam/setup-acl/handler.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `aws iam setup-acl` handler: idempotently create ACL groups, publish policies,
+ * attach/detach them per group, and optionally create IAM users.
+ * @param {unknown} options
+ */
+export function setupAclCommand(options: unknown): Promise<void>;

package/cjs/commands/aws/iam/setup-acl/index.cjs

@@ -0,0 +1,13 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_iam_setup_acl_schema = require("./schema.cjs");
+const require_commands_aws_iam_setup_acl_utils = require("./utils.cjs");
+const require_commands_aws_iam_setup_acl_handler = require("./handler.cjs");
+exports.ACL_GROUPS = require_commands_aws_iam_setup_acl_utils.ACL_GROUPS;
+exports.CUSTOM_POLICIES = require_commands_aws_iam_setup_acl_utils.CUSTOM_POLICIES;
+exports.attach = require_commands_aws_iam_setup_acl_utils.attach;
+exports.detach = require_commands_aws_iam_setup_acl_utils.detach;
+exports.ensureGroup = require_commands_aws_iam_setup_acl_utils.ensureGroup;
+exports.printFinalState = require_commands_aws_iam_setup_acl_utils.printFinalState;
+exports.publishPolicy = require_commands_aws_iam_setup_acl_utils.publishPolicy;
+exports.setupAclCommand = require_commands_aws_iam_setup_acl_handler.setupAclCommand;
+exports.setupAclOptionsSchema = require_commands_aws_iam_setup_acl_schema.setupAclOptionsSchema;

package/cjs/commands/aws/iam/setup-acl/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./handler.js";
+export * from "./schema.js";
+export * from "./utils.js";

package/cjs/commands/aws/iam/setup-acl/schema.cjs

@@ -0,0 +1,19 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_schema = require("../../schema.cjs");
+let zod = require("zod");
+//#region src/commands/aws/iam/setup-acl/schema.js
+/**
+* Zod schema for `aws iam setup-acl` options.
+*/
+const setupAclOptionsSchema = zod.z.object({
+	restrictRegions: zod.z.enum(["yes", "no"]).optional().describe("Attach the region restriction to acl-power-users (skips the interactive prompt)"),
+	createUsers: zod.z.boolean().optional().default(true).describe("Create IAM users after configuring groups (use --no-create-users to skip)"),
+	profile: require_commands_aws_schema.profileField,
+	region: require_commands_aws_schema.regionField,
+	verbose: require_commands_aws_schema.verboseField
+});
+/**
+* @typedef {z.infer<typeof setupAclOptionsSchema>} SetupAclOptions
+*/
+//#endregion
+exports.setupAclOptionsSchema = setupAclOptionsSchema;

package/cjs/commands/aws/iam/setup-acl/schema.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Zod schema for `aws iam setup-acl` options.
+ */
+export const setupAclOptionsSchema: z.ZodObject<{
+    restrictRegions: z.ZodOptional<z.ZodEnum<["yes", "no"]>>;
+    createUsers: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    profile: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodString>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    createUsers: boolean;
+    profile?: string | undefined;
+    region?: string | undefined;
+    restrictRegions?: "yes" | "no" | undefined;
+}, {
+    profile?: string | undefined;
+    region?: string | undefined;
+    verbose?: boolean | undefined;
+    restrictRegions?: "yes" | "no" | undefined;
+    createUsers?: boolean | undefined;
+}>;
+export type SetupAclOptions = z.infer<typeof setupAclOptionsSchema>;
+import { z } from "zod";