@mtndev/cli 2.0.0 → 2.0.1

package/cjs/commands/aws/iam/setup-acl/utils.cjs

@@ -1,20 +1,305 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-
-
-
-
-
-
-var _SBBNW2BFcjs = require('../../../../__chunks/SBBNW2BF.cjs');
-require('../../../../__chunks/R3GUC7O7.cjs');
-require('../../../../__chunks/3NOHGUCF.cjs');
-
-
-
-
-
-
-
-
-exports.ACL_GROUPS = _SBBNW2BFcjs.ACL_GROUPS; exports.CUSTOM_POLICIES = _SBBNW2BFcjs.CUSTOM_POLICIES; exports.attach = _SBBNW2BFcjs.attach; exports.detach = _SBBNW2BFcjs.detach; exports.ensureGroup = _SBBNW2BFcjs.ensureGroup; exports.printFinalState = _SBBNW2BFcjs.printFinalState; exports.publishPolicy = _SBBNW2BFcjs.publishPolicy;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_utils_resolve_policy_path = require("../../utils/resolve-policy-path.cjs");
+//#region src/commands/aws/iam/setup-acl/utils.js
+/**
+* The five ACL groups managed by setup-acl.
+*/
+const ACL_GROUPS = [
+	"acl-admin-do-not-use",
+	"acl-iam-full-access",
+	"acl-power-users",
+	"acl-read-only",
+	"acl-s3-restrictions"
+];
+/**
+* Custom managed policies published from bundled JSON documents.
+* @type {Array<{ name: string; fileName: string }>}
+*/
+const CUSTOM_POLICIES = [
+	{
+		name: "UserAdminsWriteList",
+		fileName: "user-admins-write-list.json"
+	},
+	{
+		name: "UserAdminsDenyList",
+		fileName: "user-admins-deny-list.json"
+	},
+	{
+		name: "UserAdminsSelfServiceIAM",
+		fileName: "user-admins-self-service-iam.json"
+	},
+	{
+		name: "UserAdminsDenyRegionsList",
+		fileName: "user-admins-deny-regions-list.json"
+	},
+	{
+		name: "sts-federation",
+		fileName: "sts-federation.json"
+	},
+	{
+		name: "S3RestrictionsDenyNonS3Services",
+		fileName: "s3-restrictions-deny-non-s3-services.json"
+	}
+];
+/**
+* Create an IAM group if it does not already exist.
+* @param {{ name: string; profile?: string; verbose?: boolean }} params
+*/
+function ensureGroup(params) {
+	const { name, profile, verbose } = params;
+	let exists = true;
+	try {
+		require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"get-group",
+				"--group-name",
+				name
+			],
+			verbose
+		});
+	} catch {
+		exists = false;
+	}
+	if (exists) {
+		console.log(`  Group exists: ${name}`);
+		return;
+	}
+	console.log(`  Create group: ${name}`);
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"create-group",
+			"--group-name",
+			name,
+			"--path",
+			"/"
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Create or update a customer-managed policy from a bundled JSON document.
+* Handles the IAM five-version limit by pruning the oldest non-default version.
+* @param {{ name: string; fileName: string; accountId: string; profile?: string; verbose?: boolean }} params
+*/
+function publishPolicy(params) {
+	const { name, fileName, accountId, profile, verbose } = params;
+	const arn = `arn:aws:iam::${accountId}:policy/${name}`;
+	const file = require_commands_aws_utils_resolve_policy_path.resolvePolicyPath(fileName);
+	let exists = true;
+	try {
+		require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"get-policy",
+				"--policy-arn",
+				arn
+			],
+			verbose
+		});
+	} catch {
+		exists = false;
+	}
+	if (!exists) {
+		console.log(`  Create policy: ${name}`);
+		require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"create-policy",
+				"--policy-name",
+				name,
+				"--policy-document",
+				`file://${file}`,
+				"--description",
+				`ACL: ${name}`
+			],
+			expectJson: false,
+			verbose
+		});
+		return;
+	}
+	if ((Number.parseInt(require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"list-policy-versions",
+			"--policy-arn",
+			arn,
+			"--query",
+			"length(Versions[?IsDefaultVersion==`false`])",
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	}), 10) || 0) >= 4) {
+		const oldest = require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"list-policy-versions",
+				"--policy-arn",
+				arn,
+				"--query",
+				"Versions[?IsDefaultVersion==`false`] | sort_by(@, &CreateDate)[0].VersionId",
+				"--output",
+				"text"
+			],
+			expectJson: false,
+			verbose
+		});
+		console.log(`  Prune oldest version of ${name}: ${oldest}`);
+		require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"delete-policy-version",
+				"--policy-arn",
+				arn,
+				"--version-id",
+				oldest
+			],
+			expectJson: false,
+			verbose
+		});
+	}
+	console.log(`  Update policy: ${name}`);
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"create-policy-version",
+			"--policy-arn",
+			arn,
+			"--policy-document",
+			`file://${file}`,
+			"--set-as-default"
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* @param {{ group: string; arn: string; profile?: string; verbose?: boolean }} params
+* @returns {boolean}
+*/
+function isPolicyAttached(params) {
+	const { group, arn, profile, verbose } = params;
+	const out = require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"list-attached-group-policies",
+			"--group-name",
+			group,
+			"--query",
+			`AttachedPolicies[?PolicyArn=='${arn}'].PolicyArn`,
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	});
+	return Boolean(out);
+}
+/**
+* Attach a policy to a group if not already attached.
+* @param {{ group: string; arn: string; profile?: string; verbose?: boolean }} params
+*/
+function attach(params) {
+	const { group, arn, profile, verbose } = params;
+	const policyName = arn.split("/").pop() ?? arn;
+	if (isPolicyAttached({
+		group,
+		arn,
+		profile,
+		verbose
+	})) {
+		console.log(`  [${group}] already attached: ${policyName}`);
+		return;
+	}
+	console.log(`  [${group}] attach: ${policyName}`);
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"attach-group-policy",
+			"--group-name",
+			group,
+			"--policy-arn",
+			arn
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Detach a (legacy) policy from a group if it is currently attached.
+* @param {{ group: string; arn: string; profile?: string; verbose?: boolean }} params
+*/
+function detach(params) {
+	const { group, arn, profile, verbose } = params;
+	const policyName = arn.split("/").pop() ?? arn;
+	if (!isPolicyAttached({
+		group,
+		arn,
+		profile,
+		verbose
+	})) return;
+	console.log(`  [${group}] detach legacy: ${policyName}`);
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"detach-group-policy",
+			"--group-name",
+			group,
+			"--policy-arn",
+			arn
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Print the attached policies for each ACL group.
+* @param {{ profile?: string; verbose?: boolean }} params
+*/
+function printFinalState(params) {
+	const { profile, verbose } = params;
+	for (const group of ACL_GROUPS) {
+		console.log("");
+		console.log(`=== ${group} ===`);
+		const table = require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"list-attached-group-policies",
+				"--group-name",
+				group,
+				"--query",
+				"AttachedPolicies[].PolicyName",
+				"--output",
+				"table"
+			],
+			expectJson: false,
+			verbose
+		});
+		console.log(table);
+	}
+}
+//#endregion
+exports.ACL_GROUPS = ACL_GROUPS;
+exports.CUSTOM_POLICIES = CUSTOM_POLICIES;
+exports.attach = attach;
+exports.detach = detach;
+exports.ensureGroup = ensureGroup;
+exports.printFinalState = printFinalState;
+exports.publishPolicy = publishPolicy;

package/cjs/commands/aws/iam/users/handler.cjs

@@ -1,12 +1,59 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-var _LXOOJR2Rcjs = require('../../../../__chunks/LXOOJR2R.cjs');
-require('../../../../__chunks/XMKOKRXZ.cjs');
-require('../../../../__chunks/3T2LXW7J.cjs');
-require('../../../../__chunks/R3GUC7O7.cjs');
-require('../../../../__chunks/NT2XXAI6.cjs');
-require('../../../../__chunks/WOYF2L6T.cjs');
-require('../../../../__chunks/CMUD7LLN.cjs');
-
-
-exports.usersCommand = _LXOOJR2Rcjs.usersCommand;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_utils_resolve_profile = require("../../utils/resolve-profile.cjs");
+const require_commands_aws_iam_users_schema = require("./schema.cjs");
+const require_commands_aws_iam_users_utils = require("./utils.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/aws/iam/users/handler.js
+/**
+* `aws iam users` handler: interactively create IAM users and assign ACL groups.
+* @param {unknown} options
+*/
+async function usersCommand(options) {
+	try {
+		const { accountName, profile: profileOption, verbose } = require_commands_aws_iam_users_schema.usersOptionsSchema.parse(options);
+		require_commands_aws_utils_exec_aws.requireCommands(["aws"]);
+		const profile = await require_commands_aws_utils_resolve_profile.resolveProfile({ profile: profileOption });
+		console.log(chalk.default.blue("\nAWS IAM user management"));
+		console.log("");
+		console.log("Caller:");
+		const identity = require_commands_aws_utils_exec_aws.getCallerIdentity({
+			profile,
+			verbose
+		});
+		console.log(`  Account: ${identity.Account}`);
+		console.log(`  Arn:     ${identity.Arn}`);
+		console.log("");
+		await require_commands_aws_iam_users_utils.createUsersInteractive({
+			accountName,
+			profile,
+			identity,
+			verbose
+		});
+		console.log("Done.");
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ iam users failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Requires the AWS CLI and a profile with IAM write access.\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.usersCommand = usersCommand;

package/cjs/commands/aws/iam/users/index.cjs

@@ -1,41 +1,18 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});require('../../../../__chunks/RPVAXPJ4.cjs');
-
-
-var _LXOOJR2Rcjs = require('../../../../__chunks/LXOOJR2R.cjs');
-
-
-var _XMKOKRXZcjs = require('../../../../__chunks/XMKOKRXZ.cjs');
-
-
-
-
-
-
-
-
-
-
-
-
-
-var _3T2LXW7Jcjs = require('../../../../__chunks/3T2LXW7J.cjs');
-require('../../../../__chunks/R3GUC7O7.cjs');
-require('../../../../__chunks/NT2XXAI6.cjs');
-require('../../../../__chunks/WOYF2L6T.cjs');
-require('../../../../__chunks/CMUD7LLN.cjs');
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-exports.buildUsername = _3T2LXW7Jcjs.buildUsername; exports.createCliAccessKey = _3T2LXW7Jcjs.createCliAccessKey; exports.createUsersInteractive = _3T2LXW7Jcjs.createUsersInteractive; exports.ensureAclGroupsExist = _3T2LXW7Jcjs.ensureAclGroupsExist; exports.ensureUser = _3T2LXW7Jcjs.ensureUser; exports.ensureUserInGroup = _3T2LXW7Jcjs.ensureUserInGroup; exports.inferAccountName = _3T2LXW7Jcjs.inferAccountName; exports.isValidSlug = _3T2LXW7Jcjs.isValidSlug; exports.normalizeIdentifier = _3T2LXW7Jcjs.normalizeIdentifier; exports.normalizeSlug = _3T2LXW7Jcjs.normalizeSlug; exports.parseMdUsername = _3T2LXW7Jcjs.parseMdUsername; exports.roleToGroup = _3T2LXW7Jcjs.roleToGroup; exports.usersCommand = _LXOOJR2Rcjs.usersCommand; exports.usersOptionsSchema = _XMKOKRXZcjs.usersOptionsSchema;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_iam_users_schema = require("./schema.cjs");
+const require_commands_aws_iam_users_utils = require("./utils.cjs");
+const require_commands_aws_iam_users_handler = require("./handler.cjs");
+exports.buildUsername = require_commands_aws_iam_users_utils.buildUsername;
+exports.createCliAccessKey = require_commands_aws_iam_users_utils.createCliAccessKey;
+exports.createUsersInteractive = require_commands_aws_iam_users_utils.createUsersInteractive;
+exports.ensureAclGroupsExist = require_commands_aws_iam_users_utils.ensureAclGroupsExist;
+exports.ensureUser = require_commands_aws_iam_users_utils.ensureUser;
+exports.ensureUserInGroup = require_commands_aws_iam_users_utils.ensureUserInGroup;
+exports.inferAccountName = require_commands_aws_iam_users_utils.inferAccountName;
+exports.isValidSlug = require_commands_aws_iam_users_utils.isValidSlug;
+exports.normalizeIdentifier = require_commands_aws_iam_users_utils.normalizeIdentifier;
+exports.normalizeSlug = require_commands_aws_iam_users_utils.normalizeSlug;
+exports.parseMdUsername = require_commands_aws_iam_users_utils.parseMdUsername;
+exports.roleToGroup = require_commands_aws_iam_users_utils.roleToGroup;
+exports.usersCommand = require_commands_aws_iam_users_handler.usersCommand;
+exports.usersOptionsSchema = require_commands_aws_iam_users_schema.usersOptionsSchema;

package/cjs/commands/aws/iam/users/schema.cjs

@@ -1,7 +1,17 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-var _XMKOKRXZcjs = require('../../../../__chunks/XMKOKRXZ.cjs');
-require('../../../../__chunks/WOYF2L6T.cjs');
-
-
-exports.usersOptionsSchema = _XMKOKRXZcjs.usersOptionsSchema;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_schema = require("../../schema.cjs");
+let zod = require("zod");
+//#region src/commands/aws/iam/users/schema.js
+/**
+* Zod schema for `aws iam users` options.
+*/
+const usersOptionsSchema = zod.z.object({
+	accountName: zod.z.string().optional().describe("AWS account slug used in md-{identifier}-{account}-{role}"),
+	profile: require_commands_aws_schema.profileField,
+	verbose: require_commands_aws_schema.verboseField
+});
+/**
+* @typedef {z.infer<typeof usersOptionsSchema>} UsersOptions
+*/
+//#endregion
+exports.usersOptionsSchema = usersOptionsSchema;