@mtndev/cli 1.1.0 → 2.0.1

package/cjs/commands/aws/iam/setup-acl/utils.cjs

@@ -0,0 +1,305 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_utils_resolve_policy_path = require("../../utils/resolve-policy-path.cjs");
+//#region src/commands/aws/iam/setup-acl/utils.js
+/**
+* The five ACL groups managed by setup-acl.
+*/
+const ACL_GROUPS = [
+	"acl-admin-do-not-use",
+	"acl-iam-full-access",
+	"acl-power-users",
+	"acl-read-only",
+	"acl-s3-restrictions"
+];
+/**
+* Custom managed policies published from bundled JSON documents.
+* @type {Array<{ name: string; fileName: string }>}
+*/
+const CUSTOM_POLICIES = [
+	{
+		name: "UserAdminsWriteList",
+		fileName: "user-admins-write-list.json"
+	},
+	{
+		name: "UserAdminsDenyList",
+		fileName: "user-admins-deny-list.json"
+	},
+	{
+		name: "UserAdminsSelfServiceIAM",
+		fileName: "user-admins-self-service-iam.json"
+	},
+	{
+		name: "UserAdminsDenyRegionsList",
+		fileName: "user-admins-deny-regions-list.json"
+	},
+	{
+		name: "sts-federation",
+		fileName: "sts-federation.json"
+	},
+	{
+		name: "S3RestrictionsDenyNonS3Services",
+		fileName: "s3-restrictions-deny-non-s3-services.json"
+	}
+];
+/**
+* Create an IAM group if it does not already exist.
+* @param {{ name: string; profile?: string; verbose?: boolean }} params
+*/
+function ensureGroup(params) {
+	const { name, profile, verbose } = params;
+	let exists = true;
+	try {
+		require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"get-group",
+				"--group-name",
+				name
+			],
+			verbose
+		});
+	} catch {
+		exists = false;
+	}
+	if (exists) {
+		console.log(`  Group exists: ${name}`);
+		return;
+	}
+	console.log(`  Create group: ${name}`);
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"create-group",
+			"--group-name",
+			name,
+			"--path",
+			"/"
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Create or update a customer-managed policy from a bundled JSON document.
+* Handles the IAM five-version limit by pruning the oldest non-default version.
+* @param {{ name: string; fileName: string; accountId: string; profile?: string; verbose?: boolean }} params
+*/
+function publishPolicy(params) {
+	const { name, fileName, accountId, profile, verbose } = params;
+	const arn = `arn:aws:iam::${accountId}:policy/${name}`;
+	const file = require_commands_aws_utils_resolve_policy_path.resolvePolicyPath(fileName);
+	let exists = true;
+	try {
+		require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"get-policy",
+				"--policy-arn",
+				arn
+			],
+			verbose
+		});
+	} catch {
+		exists = false;
+	}
+	if (!exists) {
+		console.log(`  Create policy: ${name}`);
+		require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"create-policy",
+				"--policy-name",
+				name,
+				"--policy-document",
+				`file://${file}`,
+				"--description",
+				`ACL: ${name}`
+			],
+			expectJson: false,
+			verbose
+		});
+		return;
+	}
+	if ((Number.parseInt(require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"list-policy-versions",
+			"--policy-arn",
+			arn,
+			"--query",
+			"length(Versions[?IsDefaultVersion==`false`])",
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	}), 10) || 0) >= 4) {
+		const oldest = require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"list-policy-versions",
+				"--policy-arn",
+				arn,
+				"--query",
+				"Versions[?IsDefaultVersion==`false`] | sort_by(@, &CreateDate)[0].VersionId",
+				"--output",
+				"text"
+			],
+			expectJson: false,
+			verbose
+		});
+		console.log(`  Prune oldest version of ${name}: ${oldest}`);
+		require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"delete-policy-version",
+				"--policy-arn",
+				arn,
+				"--version-id",
+				oldest
+			],
+			expectJson: false,
+			verbose
+		});
+	}
+	console.log(`  Update policy: ${name}`);
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"create-policy-version",
+			"--policy-arn",
+			arn,
+			"--policy-document",
+			`file://${file}`,
+			"--set-as-default"
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* @param {{ group: string; arn: string; profile?: string; verbose?: boolean }} params
+* @returns {boolean}
+*/
+function isPolicyAttached(params) {
+	const { group, arn, profile, verbose } = params;
+	const out = require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"list-attached-group-policies",
+			"--group-name",
+			group,
+			"--query",
+			`AttachedPolicies[?PolicyArn=='${arn}'].PolicyArn`,
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	});
+	return Boolean(out);
+}
+/**
+* Attach a policy to a group if not already attached.
+* @param {{ group: string; arn: string; profile?: string; verbose?: boolean }} params
+*/
+function attach(params) {
+	const { group, arn, profile, verbose } = params;
+	const policyName = arn.split("/").pop() ?? arn;
+	if (isPolicyAttached({
+		group,
+		arn,
+		profile,
+		verbose
+	})) {
+		console.log(`  [${group}] already attached: ${policyName}`);
+		return;
+	}
+	console.log(`  [${group}] attach: ${policyName}`);
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"attach-group-policy",
+			"--group-name",
+			group,
+			"--policy-arn",
+			arn
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Detach a (legacy) policy from a group if it is currently attached.
+* @param {{ group: string; arn: string; profile?: string; verbose?: boolean }} params
+*/
+function detach(params) {
+	const { group, arn, profile, verbose } = params;
+	const policyName = arn.split("/").pop() ?? arn;
+	if (!isPolicyAttached({
+		group,
+		arn,
+		profile,
+		verbose
+	})) return;
+	console.log(`  [${group}] detach legacy: ${policyName}`);
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"detach-group-policy",
+			"--group-name",
+			group,
+			"--policy-arn",
+			arn
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Print the attached policies for each ACL group.
+* @param {{ profile?: string; verbose?: boolean }} params
+*/
+function printFinalState(params) {
+	const { profile, verbose } = params;
+	for (const group of ACL_GROUPS) {
+		console.log("");
+		console.log(`=== ${group} ===`);
+		const table = require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"list-attached-group-policies",
+				"--group-name",
+				group,
+				"--query",
+				"AttachedPolicies[].PolicyName",
+				"--output",
+				"table"
+			],
+			expectJson: false,
+			verbose
+		});
+		console.log(table);
+	}
+}
+//#endregion
+exports.ACL_GROUPS = ACL_GROUPS;
+exports.CUSTOM_POLICIES = CUSTOM_POLICIES;
+exports.attach = attach;
+exports.detach = detach;
+exports.ensureGroup = ensureGroup;
+exports.printFinalState = printFinalState;
+exports.publishPolicy = publishPolicy;

package/cjs/commands/aws/iam/setup-acl/utils.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Create an IAM group if it does not already exist.
+ * @param {{ name: string; profile?: string; verbose?: boolean }} params
+ */
+export function ensureGroup(params: {
+    name: string;
+    profile?: string;
+    verbose?: boolean;
+}): void;
+/**
+ * Create or update a customer-managed policy from a bundled JSON document.
+ * Handles the IAM five-version limit by pruning the oldest non-default version.
+ * @param {{ name: string; fileName: string; accountId: string; profile?: string; verbose?: boolean }} params
+ */
+export function publishPolicy(params: {
+    name: string;
+    fileName: string;
+    accountId: string;
+    profile?: string;
+    verbose?: boolean;
+}): void;
+/**
+ * Attach a policy to a group if not already attached.
+ * @param {{ group: string; arn: string; profile?: string; verbose?: boolean }} params
+ */
+export function attach(params: {
+    group: string;
+    arn: string;
+    profile?: string;
+    verbose?: boolean;
+}): void;
+/**
+ * Detach a (legacy) policy from a group if it is currently attached.
+ * @param {{ group: string; arn: string; profile?: string; verbose?: boolean }} params
+ */
+export function detach(params: {
+    group: string;
+    arn: string;
+    profile?: string;
+    verbose?: boolean;
+}): void;
+/**
+ * Print the attached policies for each ACL group.
+ * @param {{ profile?: string; verbose?: boolean }} params
+ */
+export function printFinalState(params: {
+    profile?: string;
+    verbose?: boolean;
+}): void;
+/**
+ * The five ACL groups managed by setup-acl.
+ */
+export const ACL_GROUPS: string[];
+/**
+ * Custom managed policies published from bundled JSON documents.
+ * @type {Array<{ name: string; fileName: string }>}
+ */
+export const CUSTOM_POLICIES: Array<{
+    name: string;
+    fileName: string;
+}>;

package/cjs/commands/aws/iam/users/handler.cjs

@@ -0,0 +1,59 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_utils_resolve_profile = require("../../utils/resolve-profile.cjs");
+const require_commands_aws_iam_users_schema = require("./schema.cjs");
+const require_commands_aws_iam_users_utils = require("./utils.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/iam/users/handler.js
+/**
+* `aws iam users` handler: interactively create IAM users and assign ACL groups.
+* @param {unknown} options
+*/
+async function usersCommand(options) {
+	try {
+		const { accountName, profile: profileOption, verbose } = require_commands_aws_iam_users_schema.usersOptionsSchema.parse(options);
+		require_commands_aws_utils_exec_aws.requireCommands(["aws"]);
+		const profile = await require_commands_aws_utils_resolve_profile.resolveProfile({ profile: profileOption });
+		console.log(chalk.default.blue("\nAWS IAM user management"));
+		console.log("");
+		console.log("Caller:");
+		const identity = require_commands_aws_utils_exec_aws.getCallerIdentity({
+			profile,
+			verbose
+		});
+		console.log(`  Account: ${identity.Account}`);
+		console.log(`  Arn:     ${identity.Arn}`);
+		console.log("");
+		await require_commands_aws_iam_users_utils.createUsersInteractive({
+			accountName,
+			profile,
+			identity,
+			verbose
+		});
+		console.log("Done.");
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ iam users failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Requires the AWS CLI and a profile with IAM write access.\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.usersCommand = usersCommand;

package/cjs/commands/aws/iam/users/handler.d.ts

@@ -0,0 +1,5 @@
+/**
+ * `aws iam users` handler: interactively create IAM users and assign ACL groups.
+ * @param {unknown} options
+ */
+export function usersCommand(options: unknown): Promise<void>;

package/cjs/commands/aws/iam/users/index.cjs

@@ -0,0 +1,18 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_iam_users_schema = require("./schema.cjs");
+const require_commands_aws_iam_users_utils = require("./utils.cjs");
+const require_commands_aws_iam_users_handler = require("./handler.cjs");
+exports.buildUsername = require_commands_aws_iam_users_utils.buildUsername;
+exports.createCliAccessKey = require_commands_aws_iam_users_utils.createCliAccessKey;
+exports.createUsersInteractive = require_commands_aws_iam_users_utils.createUsersInteractive;
+exports.ensureAclGroupsExist = require_commands_aws_iam_users_utils.ensureAclGroupsExist;
+exports.ensureUser = require_commands_aws_iam_users_utils.ensureUser;
+exports.ensureUserInGroup = require_commands_aws_iam_users_utils.ensureUserInGroup;
+exports.inferAccountName = require_commands_aws_iam_users_utils.inferAccountName;
+exports.isValidSlug = require_commands_aws_iam_users_utils.isValidSlug;
+exports.normalizeIdentifier = require_commands_aws_iam_users_utils.normalizeIdentifier;
+exports.normalizeSlug = require_commands_aws_iam_users_utils.normalizeSlug;
+exports.parseMdUsername = require_commands_aws_iam_users_utils.parseMdUsername;
+exports.roleToGroup = require_commands_aws_iam_users_utils.roleToGroup;
+exports.usersCommand = require_commands_aws_iam_users_handler.usersCommand;
+exports.usersOptionsSchema = require_commands_aws_iam_users_schema.usersOptionsSchema;

package/cjs/commands/aws/iam/users/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./handler.js";
+export * from "./schema.js";
+export * from "./utils.js";

package/cjs/commands/aws/iam/users/schema.cjs

@@ -0,0 +1,17 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_schema = require("../../schema.cjs");
+let zod = require("zod");
+//#region src/commands/aws/iam/users/schema.js
+/**
+* Zod schema for `aws iam users` options.
+*/
+const usersOptionsSchema = zod.z.object({
+	accountName: zod.z.string().optional().describe("AWS account slug used in md-{identifier}-{account}-{role}"),
+	profile: require_commands_aws_schema.profileField,
+	verbose: require_commands_aws_schema.verboseField
+});
+/**
+* @typedef {z.infer<typeof usersOptionsSchema>} UsersOptions
+*/
+//#endregion
+exports.usersOptionsSchema = usersOptionsSchema;

package/cjs/commands/aws/iam/users/schema.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Zod schema for `aws iam users` options.
+ */
+export const usersOptionsSchema: z.ZodObject<{
+    accountName: z.ZodOptional<z.ZodString>;
+    profile: z.ZodOptional<z.ZodString>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    profile?: string | undefined;
+    accountName?: string | undefined;
+}, {
+    profile?: string | undefined;
+    verbose?: boolean | undefined;
+    accountName?: string | undefined;
+}>;
+export type UsersOptions = z.infer<typeof usersOptionsSchema>;
+import { z } from "zod";