@quadnix/octo-aws-cdk 0.0.11 → 0.0.13

package/dist/resources/iam-role/actions/update-iam-role-with-s3-storage-policy.resource.action.js

@@ -0,0 +1,150 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { AttachRolePolicyCommand, CreatePolicyCommand, DeletePolicyCommand, DetachRolePolicyCommand, IAMClient, } from '@aws-sdk/client-iam';
+import { Action, Container, DiffAction, Factory, hasNodeName } from '@quadnix/octo';
+import { PolicyUtility } from '../../../utilities/policy/policy.utility.js';
+import { IamRole, isAddPolicyDiff, isDeletePolicyDiff } from '../iam-role.resource.js';
+/**
+ * @internal
+ */
+let UpdateIamRoleWithS3StoragePolicyResourceAction = class UpdateIamRoleWithS3StoragePolicyResourceAction {
+    constructor(container) {
+        this.container = container;
+    }
+    filter(diff) {
+        return (diff.action === DiffAction.UPDATE &&
+            diff.node instanceof IamRole &&
+            hasNodeName(diff.node, 'iam-role') &&
+            diff.field === 's3-storage-access-policy');
+    }
+    async handle(diff) {
+        // Get properties.
+        const iamRole = diff.node;
+        const iamRolePolicyDiff = diff.value;
+        const properties = iamRole.properties;
+        const response = iamRole.response;
+        // Get instances.
+        const iamClient = await this.container.get(IAMClient, {
+            args: [properties.awsAccountId],
+            metadata: { package: '@octo' },
+        });
+        // Attach policies to IAM Role to read/write from bucket.
+        if (isAddPolicyDiff(iamRolePolicyDiff)) {
+            const policyDocument = [];
+            const policy = iamRolePolicyDiff.policy;
+            if (policy.allowRead) {
+                policyDocument.push({
+                    Action: [
+                        's3:GetObject',
+                        's3:GetObjectAttributes',
+                        's3:GetObjectTagging',
+                        's3:GetObjectVersionAcl',
+                        's3:GetObjectVersionAttributes',
+                        's3:GetObjectVersionTagging',
+                        's3:ListBucket',
+                    ],
+                    Effect: 'Allow',
+                    Resource: policy.remoteDirectoryPath === '' || policy.remoteDirectoryPath === '/'
+                        ? [`arn:aws:s3:::${policy.bucketName}`, `arn:aws:s3:::${policy.bucketName}/*`]
+                        : [
+                            `arn:aws:s3:::${policy.bucketName}/${policy.remoteDirectoryPath}`,
+                            `arn:aws:s3:::${policy.bucketName}/${policy.remoteDirectoryPath}/*`,
+                        ],
+                    Sid: PolicyUtility.getSafeSid(`Allow read from bucket ${policy.bucketName}`),
+                });
+            }
+            if (policy.allowWrite) {
+                policyDocument.push({
+                    Action: ['s3:PutObject', 's3:DeleteObjectVersion', 's3:DeleteObject'],
+                    Effect: 'Allow',
+                    Resource: policy.remoteDirectoryPath === '' || policy.remoteDirectoryPath === '/'
+                        ? [`arn:aws:s3:::${policy.bucketName}`, `arn:aws:s3:::${policy.bucketName}/*`]
+                        : [`arn:aws:s3:::${policy.bucketName}/${policy.remoteDirectoryPath}/*`],
+                    Sid: PolicyUtility.getSafeSid(`Allow write from bucket ${policy.bucketName}`),
+                });
+            }
+            const data = await iamClient.send(new CreatePolicyCommand({
+                PolicyDocument: JSON.stringify({
+                    Statement: policyDocument,
+                    Version: '2012-10-17',
+                }),
+                PolicyName: iamRolePolicyDiff.policyId,
+            }));
+            await iamClient.send(new AttachRolePolicyCommand({
+                PolicyArn: data.Policy.Arn,
+                RoleName: response.RoleName,
+            }));
+            // Set response.
+            response.policies[iamRolePolicyDiff.policyId] = [data.Policy.Arn];
+        }
+        else if (isDeletePolicyDiff(iamRolePolicyDiff)) {
+            const policyARNs = response.policies[iamRolePolicyDiff.policyId] || [];
+            await Promise.all(policyARNs.map(async (policyArn) => {
+                await iamClient.send(new DetachRolePolicyCommand({
+                    PolicyArn: policyArn,
+                    RoleName: response.RoleName,
+                }));
+                await iamClient.send(new DeletePolicyCommand({
+                    PolicyArn: policyArn,
+                }));
+            }));
+            // Set response.
+            if (!Object.isFrozen(response)) {
+                delete response.policies[iamRolePolicyDiff.policyId];
+            }
+        }
+    }
+    async mock(diff, capture) {
+        // Get properties.
+        const iamRole = diff.node;
+        const iamRolePolicyDiff = diff.value;
+        const properties = iamRole.properties;
+        const iamClient = await this.container.get(IAMClient, {
+            args: [properties.awsAccountId],
+            metadata: { package: '@octo' },
+        });
+        iamClient.send = async (instance) => {
+            if (instance instanceof CreatePolicyCommand) {
+                return { Policy: { Arn: capture.policies[iamRolePolicyDiff.policyId][0] } };
+            }
+            else if (instance instanceof AttachRolePolicyCommand) {
+                return;
+            }
+            else if (instance instanceof DetachRolePolicyCommand) {
+                return;
+            }
+            else if (instance instanceof DeletePolicyCommand) {
+                return;
+            }
+        };
+    }
+};
+UpdateIamRoleWithS3StoragePolicyResourceAction = __decorate([
+    Action(IamRole),
+    __metadata("design:paramtypes", [Container])
+], UpdateIamRoleWithS3StoragePolicyResourceAction);
+export { UpdateIamRoleWithS3StoragePolicyResourceAction };
+/**
+ * @internal
+ */
+let UpdateIamRoleWithS3StoragePolicyResourceActionFactory = class UpdateIamRoleWithS3StoragePolicyResourceActionFactory {
+    static async create() {
+        if (!this.instance) {
+            const container = Container.getInstance();
+            this.instance = new UpdateIamRoleWithS3StoragePolicyResourceAction(container);
+        }
+        return this.instance;
+    }
+};
+UpdateIamRoleWithS3StoragePolicyResourceActionFactory = __decorate([
+    Factory(UpdateIamRoleWithS3StoragePolicyResourceAction)
+], UpdateIamRoleWithS3StoragePolicyResourceActionFactory);
+export { UpdateIamRoleWithS3StoragePolicyResourceActionFactory };
+//# sourceMappingURL=update-iam-role-with-s3-storage-policy.resource.action.js.map

package/dist/resources/iam-role/actions/update-iam-role-with-s3-storage-policy.resource.action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-iam-role-with-s3-storage-policy.resource.action.js","sourceRoot":"","sources":["../../../../src/resources/iam-role/actions/update-iam-role-with-s3-storage-policy.resource.action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,SAAS,GACV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAa,UAAU,EAAE,OAAO,EAAwB,WAAW,EAAE,MAAM,eAAe,CAAC;AAErH,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAC;AAC5E,OAAO,EAA2B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGhH;;GAEG;AAEI,IAAM,8CAA8C,GAApD,MAAM,8CAA8C;IACzD,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,MAAM,CAAC,IAAU;QACf,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YACjC,IAAI,CAAC,IAAI,YAAY,OAAO;YAC5B,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;YAClC,IAAI,CAAC,KAAK,KAAK,0BAA0B,CAC1C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAuC;QAClD,kBAAkB;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAElC,iBAAiB;QACjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAqC,SAAS,EAAE;YACxF,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;YAC/B,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;SAC/B,CAAC,CAAC;QAEH,yDAAyD;QACzD,IAAI,eAAe,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvC,MAAM,cAAc,GAA6E,EAAE,CAAC;YACpG,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAgC,CAAC;YAElE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,cAAc,CAAC,IAAI,CAAC;oBAClB,MAAM,EAAE;wBACN,cAAc;wBACd,wBAAwB;wBACxB,qBAAqB;wBACrB,wBAAwB;wBACxB,+BAA+B;wBAC/B,4BAA4B;wBAC5B,eAAe;qBAChB;oBACD,MAAM,EAAE,OAAO;oBACf,QAAQ,EACN,MAAM,CAAC,mBAAmB,KAAK,EAAE,IAAI,MAAM,CAAC,mBAAmB,KAAK,GAAG;wBACrE,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,UAAU,EAAE,EAAE,gBAAgB,MAAM,CAAC,UAAU,IAAI,CAAC;wBAC9E,CAAC,CAAC;4BACE,gBAAgB,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,EAAE;4BACjE,gBAAgB,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,IAAI;yBACpE;oBACP,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,0BAA0B,MAAM,CAAC,UAAU,EAAE,CAAC;iBAC7E,CAAC,CAAC;YACL,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,cAAc,CAAC,IAAI,CAAC;oBAClB,MAAM,EAAE,CAAC,cAAc,EAAE,wBAAwB,EAAE,iBAAiB,CAAC;oBACrE,MAAM,EAAE,OAAO;oBACf,QAAQ,EACN,MAAM,CAAC,mBAAmB,KAAK,EAAE,IAAI,MAAM,CAAC,mBAAmB,KAAK,GAAG;wBACrE,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,UAAU,EAAE,EAAE,gBAAgB,MAAM,CAAC,UAAU,IAAI,CAAC;wBAC9E,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC;oBAC3E,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,2BAA2B,MAAM,CAAC,UAAU,EAAE,CAAC;iBAC9E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAC/B,IAAI,mBAAmB,CAAC;gBACtB,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC;oBAC7B,SAAS,EAAE,cAAc;oBACzB,OAAO,EAAE,YAAY;iBACtB,CAAC;gBACF,UAAU,EAAE,iBAAiB,CAAC,QAAQ;aACvC,CAAC,CACH,CAAC;YACF,MAAM,SAAS,CAAC,IAAI,CAClB,IAAI,uBAAuB,CAAC;gBAC1B,SAAS,EAAE,IAAI,CAAC,MAAO,CAAC,GAAG;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC,CACH,CAAC;YAEF,gBAAgB;YAChB,QAAQ,CAAC,QAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAO,CAAC,GAAI,CAAC,CAAC;QACvE,CAAC;aAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxE,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBACjC,MAAM,SAAS,CAAC,IAAI,CAClB,IAAI,uBAAuB,CAAC;oBAC1B,SAAS,EAAE,SAAS;oBACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iBAC5B,CAAC,CACH,CAAC;gBACF,MAAM,SAAS,CAAC,IAAI,CAClB,IAAI,mBAAmB,CAAC;oBACtB,SAAS,EAAE,SAAS;iBACrB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CACH,CAAC;YAEF,gBAAgB;YAChB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,OAAO,QAAQ,CAAC,QAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAuC,EAAE,OAA2C;QAC7F,kBAAkB;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QAEtC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAqC,SAAS,EAAE;YACxF,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;YAC/B,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;SAC/B,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,GAAG,KAAK,EAAE,QAAiB,EAAoB,EAAE;YAC7D,IAAI,QAAQ,YAAY,mBAAmB,EAAE,CAAC;gBAC5C,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,QAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC/E,CAAC;iBAAM,IAAI,QAAQ,YAAY,uBAAuB,EAAE,CAAC;gBACvD,OAAO;YACT,CAAC;iBAAM,IAAI,QAAQ,YAAY,uBAAuB,EAAE,CAAC;gBACvD,OAAO;YACT,CAAC;iBAAM,IAAI,QAAQ,YAAY,mBAAmB,EAAE,CAAC;gBACnD,OAAO;YACT,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;CACF,CAAA;AAjIY,8CAA8C;IAD1D,MAAM,CAAC,OAAO,CAAC;qCAE0B,SAAS;GADtC,8CAA8C,CAiI1D;;AAED;;GAEG;AAEI,IAAM,qDAAqD,GAA3D,MAAM,qDAAqD;IAGhE,MAAM,CAAC,KAAK,CAAC,MAAM;QACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,GAAG,IAAI,8CAA8C,CAAC,SAAS,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF,CAAA;AAVY,qDAAqD;IADjE,OAAO,CAAiD,8CAA8C,CAAC;GAC3F,qDAAqD,CAUjE"}

package/dist/resources/iam-role/iam-role.resource.d.ts

@@ -0,0 +1,49 @@
+import { AResource, Diff } from '@quadnix/octo';
+import { type IIamRoleAssumeRolePolicy, type IIamRolePolicyTypes, IamRoleSchema } from './index.schema.js';
+/**
+ * @internal
+ */
+export type IIamRoleAddPolicyDiff = {
+    action: 'add';
+    policy: IIamRolePolicyTypes[keyof IIamRolePolicyTypes];
+    policyId: string;
+    policyType: keyof IIamRolePolicyTypes;
+};
+/**
+ * @internal
+ */
+export type IIamRoleDeletePolicyDiff = {
+    action: 'delete';
+    policyId: string;
+    policyType: keyof IIamRolePolicyTypes;
+};
+/**
+ * @internal
+ */
+export type IIamRolePolicyDiff = IIamRoleAddPolicyDiff | IIamRoleDeletePolicyDiff;
+/**
+ * @internal
+ */
+export declare function isAddPolicyDiff(policy: IIamRolePolicyDiff): policy is IIamRoleAddPolicyDiff;
+/**
+ * @internal
+ */
+export declare function isDeletePolicyDiff(policy: IIamRolePolicyDiff): policy is IIamRoleDeletePolicyDiff;
+/**
+ * @internal
+ */
+export declare class IamRole extends AResource<IamRoleSchema, IamRole> {
+    properties: IamRoleSchema['properties'];
+    response: IamRoleSchema['response'];
+    constructor(resourceId: string, properties: IamRoleSchema['properties']);
+    addAssumeRolePolicy(policyId: string, awsService: IIamRoleAssumeRolePolicy): void;
+    addAwsPolicy(policyId: string, policy: string): void;
+    addS3BucketPolicy(policyId: string, bucketName: string, remoteDirectoryPath: string, options: {
+        allowRead: boolean;
+        allowWrite: boolean;
+    }): void;
+    deletePolicy(policyId: string): void;
+    diffInverse(diff: Diff<IamRole, IIamRolePolicyDiff>, deReferenceResource: (resourceId: string) => Promise<never>): Promise<void>;
+    diffProperties(previous: IamRole): Promise<Diff[]>;
+    diffUnpack(diff: Diff<IamRole>): Diff[];
+}

package/dist/resources/iam-role/iam-role.resource.js

@@ -0,0 +1,184 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { AResource, Diff, DiffAction, Resource } from '@quadnix/octo';
+import { IamRoleSchema, } from './index.schema.js';
+/**
+ * @internal
+ */
+export function isAddPolicyDiff(policy) {
+    return policy.action === 'add';
+}
+/**
+ * @internal
+ */
+export function isDeletePolicyDiff(policy) {
+    return policy.action === 'delete';
+}
+/**
+ * @internal
+ */
+let IamRole = class IamRole extends AResource {
+    constructor(resourceId, properties) {
+        if (properties.policies.length === 0) {
+            throw new Error('At least one policy is required!');
+        }
+        super(resourceId, properties, []);
+    }
+    addAssumeRolePolicy(policyId, awsService) {
+        const index = this.properties.policies.findIndex((p) => p.policyId === policyId);
+        if (index === -1) {
+            this.properties.policies.push({
+                policy: awsService,
+                policyId,
+                policyType: 'assume-role-policy',
+            });
+        }
+    }
+    addAwsPolicy(policyId, policy) {
+        const index = this.properties.policies.findIndex((p) => p.policyId === policyId);
+        if (index === -1) {
+            this.properties.policies.push({
+                policy: policy,
+                policyId,
+                policyType: 'aws-policy',
+            });
+        }
+    }
+    addS3BucketPolicy(policyId, bucketName, remoteDirectoryPath, options) {
+        const index = this.properties.policies.findIndex((p) => p.policyId === policyId);
+        if (index === -1) {
+            const policy = {
+                allowRead: options.allowRead,
+                allowWrite: options.allowWrite,
+                bucketName,
+                remoteDirectoryPath,
+            };
+            this.properties.policies.push({
+                policy,
+                policyId,
+                policyType: 's3-storage-access-policy',
+            });
+        }
+        else {
+            this.properties.policies[index].policy = {
+                allowRead: options.allowRead,
+                allowWrite: options.allowWrite,
+                bucketName,
+                remoteDirectoryPath,
+            };
+        }
+    }
+    deletePolicy(policyId) {
+        const index = this.properties.policies.findIndex((p) => p.policyId === policyId);
+        if (index > -1) {
+            this.properties.policies.splice(index, 1);
+        }
+    }
+    async diffInverse(diff, deReferenceResource) {
+        if (diff.action === DiffAction.UPDATE && diff.field === 'tags') {
+            await super.diffInverse(diff, deReferenceResource);
+        }
+        else if (diff.action === DiffAction.UPDATE) {
+            if (isAddPolicyDiff(diff.value || {})) {
+                const newPolicy = diff.node.properties.policies.find((p) => p.policyId === diff.value.policyId);
+                if (newPolicy && !this.properties.policies.find((p) => p.policyId === newPolicy.policyId)) {
+                    this.properties.policies.push(newPolicy);
+                }
+            }
+            else if (isDeletePolicyDiff(diff.value || {})) {
+                const deletedPolicyIndex = this.properties.policies.findIndex((p) => {
+                    if (diff.value.policyType === 'aws-policy') {
+                        return p.policy === diff.value.policyId;
+                    }
+                    else {
+                        return p.policyId === diff.value.policyId;
+                    }
+                });
+                if (deletedPolicyIndex > -1) {
+                    this.properties.policies.splice(deletedPolicyIndex, 1);
+                }
+            }
+            else {
+                this.clonePropertiesInPlace(diff.node);
+            }
+            this.cloneResponseInPlace(diff.node);
+        }
+        else {
+            await super.diffInverse(diff, deReferenceResource);
+        }
+    }
+    async diffProperties(previous) {
+        if (this.properties.policies.length === 0) {
+            return [new Diff(previous, DiffAction.DELETE, 'resourceId', previous.getContext())];
+        }
+        const diffs = [];
+        for (const policy of previous.properties.policies) {
+            if (!this.properties.policies.find((p) => p.policyId === policy.policyId)) {
+                diffs.push(new Diff(this, DiffAction.UPDATE, policy.policyType, {
+                    action: 'delete',
+                    policyId: policy.policyType === 'aws-policy' ? policy.policy : policy.policyId,
+                    policyType: policy.policyType,
+                }));
+            }
+        }
+        for (const policy of this.properties.policies) {
+            if (!previous.properties.policies.find((p) => p.policyId === policy.policyId)) {
+                diffs.push(new Diff(this, DiffAction.UPDATE, policy.policyType, {
+                    action: 'add',
+                    policy: policy.policy,
+                    policyId: policy.policyId,
+                    policyType: policy.policyType,
+                }));
+            }
+        }
+        return diffs;
+    }
+    diffUnpack(diff) {
+        if (diff.action === DiffAction.ADD && diff.field === 'resourceId') {
+            const diffs = [diff];
+            for (const policy of diff.node.properties.policies) {
+                if (policy.policyType === 'assume-role-policy') {
+                    continue;
+                }
+                diffs.push(new Diff(this, DiffAction.UPDATE, policy.policyType, {
+                    action: 'add',
+                    policy: policy.policy,
+                    policyId: policy.policyId,
+                    policyType: policy.policyType,
+                }));
+            }
+            return diffs;
+        }
+        else if (diff.action === DiffAction.DELETE && diff.field === 'resourceId') {
+            const diffs = [];
+            for (const policy of diff.node.properties.policies) {
+                if (policy.policyType === 'assume-role-policy') {
+                    continue;
+                }
+                diffs.push(new Diff(this, DiffAction.UPDATE, policy.policyType, {
+                    action: 'delete',
+                    policyId: policy.policyType === 'aws-policy' ? policy.policy : policy.policyId,
+                    policyType: policy.policyType,
+                }));
+            }
+            diffs.push(diff);
+            return diffs;
+        }
+        else {
+            return [diff];
+        }
+    }
+};
+IamRole = __decorate([
+    Resource('@octo', 'iam-role', IamRoleSchema),
+    __metadata("design:paramtypes", [String, Object])
+], IamRole);
+export { IamRole };
+//# sourceMappingURL=iam-role.resource.js.map

package/dist/resources/iam-role/iam-role.resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-role.resource.js","sourceRoot":"","sources":["../../../src/resources/iam-role/iam-role.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAIL,aAAa,GACd,MAAM,mBAAmB,CAAC;AAoB3B;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,OAAO,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;AACpC,CAAC;AAED;;GAEG;AAEI,IAAM,OAAO,GAAb,MAAM,OAAQ,SAAQ,SAAiC;IAI5D,YAAY,UAAkB,EAAE,UAAuC;QACrE,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,mBAAmB,CAAC,QAAgB,EAAE,UAAoC;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,MAAM,EAAE,UAAU;gBAClB,QAAQ;gBACR,UAAU,EAAE,oBAAoB;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,MAAc;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,MAAM,EAAE,MAAM;gBACd,QAAQ;gBACR,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iBAAiB,CACf,QAAgB,EAChB,UAAkB,EAClB,mBAA2B,EAC3B,OAAoD;QAEpD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,MAAM,GAA2B;gBACrC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU;gBACV,mBAAmB;aACpB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,MAAM;gBACN,QAAQ;gBACR,UAAU,EAAE,0BAA0B;aACvC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG;gBACvC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU;gBACV,mBAAmB;aACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAEQ,KAAK,CAAC,WAAW,CACxB,IAAuC,EACvC,mBAA2D;QAE3D,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC/D,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAChG,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1F,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;iBAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;gBAChD,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;oBAClE,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;wBAC3C,OAAO,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAC1C,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAC5C,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,IAAI,kBAAkB,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;YAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEQ,KAAK,CAAC,cAAc,CAAC,QAAiB;QAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,KAAK,GAAW,EAAE,CAAC;QAEzB,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1E,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBAC9E,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9E,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA6B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC/E,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEQ,UAAU,CAAC,IAAmB;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,CAAC;YAE7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACnD,IAAI,MAAM,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;oBAC/C,SAAS;gBACX,CAAC;gBAED,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA6B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC/E,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAW,EAAE,CAAC;YAEzB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACnD,IAAI,MAAM,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;oBAC/C,SAAS;gBACX,CAAC;gBAED,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBAC9E,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;CACF,CAAA;AApLY,OAAO;IADnB,QAAQ,CAAU,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC;;GACzC,OAAO,CAoLnB"}

package/dist/resources/iam-role/index.d.ts

@@ -0,0 +1,7 @@
+import './actions/add-iam-role.resource.action.js';
+import './actions/delete-iam-role.resource.action.js';
+import './actions/update-iam-role-assume-role-policy.resource.action.js';
+import './actions/update-iam-role-with-aws-policy.resource.action.js';
+import './actions/update-iam-role-with-s3-storage-policy.resource.action.js';
+import './actions/update-iam-role-tags.resource.action.js';
+export { IamRole } from './iam-role.resource.js';

package/dist/resources/iam-role/index.js

@@ -0,0 +1,8 @@
+import './actions/add-iam-role.resource.action.js';
+import './actions/delete-iam-role.resource.action.js';
+import './actions/update-iam-role-assume-role-policy.resource.action.js';
+import './actions/update-iam-role-with-aws-policy.resource.action.js';
+import './actions/update-iam-role-with-s3-storage-policy.resource.action.js';
+import './actions/update-iam-role-tags.resource.action.js';
+export { IamRole } from './iam-role.resource.js';
+//# sourceMappingURL=index.js.map

package/dist/resources/iam-role/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/resources/iam-role/index.ts"],"names":[],"mappings":"AAAA,OAAO,2CAA2C,CAAC;AACnD,OAAO,8CAA8C,CAAC;AACtD,OAAO,iEAAiE,CAAC;AACzE,OAAO,8DAA8D,CAAC;AACtE,OAAO,qEAAqE,CAAC;AAC7E,OAAO,mDAAmD,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/resources/iam-role/index.schema.d.ts

@@ -0,0 +1,101 @@
+import { BaseResourceSchema } from '@quadnix/octo';
+/**
+ * List of IAM entities regarding roles, policies, and permissions.
+ * Possible values are,
+ * * `ecs-tasks.amazonaws.com`: This is an AWS service principal for ECS tasks.
+ * It is used in IAM trust policies to allow ECS tasks to assume a role.
+ * You must add this to the set of policies if you are running ECS tasks in your cluster.
+ *
+ * @group Resources/IamRole
+ */
+export type IIamRoleAssumeRolePolicy = 'ecs-tasks.amazonaws.com';
+/**
+ * Defines the types of policies that can be attached to this IAM role.
+ *
+ * @group Resources/IamRole
+ */
+export type IIamRolePolicyTypes = {
+    /**
+     * You can provide a policy that allows the role to assume another role, or establish trust relationships.
+     * See {@link IIamRoleAssumeRolePolicy} for options.
+     */
+    'assume-role-policy': IIamRoleAssumeRolePolicy;
+    /**
+     * You can provide a policy that allows the role to perform actions on AWS resources.
+     * This can be a predefined AWS managed policy ARN or custom policy ARN that you create.
+     */
+    'aws-policy': string;
+    /**
+     * You can provide options to create a policy for accessing a S3 bucket.
+     */
+    's3-storage-access-policy': IIamRoleS3BucketPolicy;
+};
+/**
+ * Defines the S3 storage access policy for an IAM role.
+ *
+ * @group Resources/IamRole
+ */
+export interface IIamRoleS3BucketPolicy {
+    /**
+     * Allows read access to the bucket prefix.
+     */
+    allowRead: boolean;
+    /**
+     * Allows write access to the bucket prefix.
+     */
+    allowWrite: boolean;
+    /**
+     * The name of the bucket.
+     */
+    bucketName: string;
+    /**
+     * The path within the bucket this policy is for.
+     * If you want to allow access to the entire bucket, use empty string `''`.
+     */
+    remoteDirectoryPath: string;
+}
+/**
+ * The `IamRoleSchema` class is the schema for the `IamRole` resource,
+ * which represents the AWS Identity and Access Management (IAM) Role resource.
+ * This resource can create a iam role in AWS using the AWS JavaScript SDK V3 API.
+ * See [official sdk docs](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/).
+ *
+ * @group Resources/IamRole
+ *
+ * @hideconstructor
+ *
+ * @overrideProperty parents - This resource has no parents.
+ * @overrideProperty resourceId - The resource id is of format `iam-role-<role-name>`
+ */
+export declare class IamRoleSchema extends BaseResourceSchema {
+    /**
+     * Input properties.
+     * * `properties.awsAccountId`: The AWS account ID.
+     * * `properties.policies`: The policies to attach to the role. See {@link IIamRolePolicyTypes} for options.
+     * * `properties.rolename`: The name of the role to create.
+     */
+    properties: {
+        awsAccountId: string;
+        policies: { [K in keyof IIamRolePolicyTypes]-?: {
+            policy: IIamRolePolicyTypes[K];
+            policyId: string;
+            policyType: K;
+        }; }[keyof IIamRolePolicyTypes][];
+        rolename: string;
+    };
+    /**
+     * Saved response.
+     * * `response.Arn`: The ARN of the role.
+     * * `response.policies`: A map of policy IDs to policy ARNs.
+     * * `response.RoleId`: The ID of the role.
+     * * `response.RoleName`: The name of the role.
+     */
+    response: {
+        Arn?: string;
+        policies?: {
+            [key: string]: string[];
+        };
+        RoleId?: string;
+        RoleName?: string;
+    };
+}

package/dist/resources/iam-role/index.schema.js

@@ -0,0 +1,74 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { BaseResourceSchema, Schema, Validate } from '@quadnix/octo';
+/**
+ * The `IamRoleSchema` class is the schema for the `IamRole` resource,
+ * which represents the AWS Identity and Access Management (IAM) Role resource.
+ * This resource can create a iam role in AWS using the AWS JavaScript SDK V3 API.
+ * See [official sdk docs](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/).
+ *
+ * @group Resources/IamRole
+ *
+ * @hideconstructor
+ *
+ * @overrideProperty parents - This resource has no parents.
+ * @overrideProperty resourceId - The resource id is of format `iam-role-<role-name>`
+ */
+export class IamRoleSchema extends BaseResourceSchema {
+    constructor() {
+        super(...arguments);
+        // Source: https://stackoverflow.com/a/56837244/1834562
+        /**
+         * Input properties.
+         * * `properties.awsAccountId`: The AWS account ID.
+         * * `properties.policies`: The policies to attach to the role. See {@link IIamRolePolicyTypes} for options.
+         * * `properties.rolename`: The name of the role to create.
+         */
+        this.properties = Schema();
+        /**
+         * Saved response.
+         * * `response.Arn`: The ARN of the role.
+         * * `response.policies`: A map of policy IDs to policy ARNs.
+         * * `response.RoleId`: The ID of the role.
+         * * `response.RoleName`: The name of the role.
+         */
+        this.response = Schema();
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => [value.awsAccountId, value.rolename],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], IamRoleSchema.prototype, "properties", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => {
+            const subjects = [];
+            if (value.Arn) {
+                subjects.push(value.Arn);
+            }
+            if (value.policies && Object.keys(value.policies).length > 0) {
+                subjects.push(...Object.values(value.policies).flat());
+            }
+            if (value.RoleId) {
+                subjects.push(value.RoleId);
+            }
+            if (value.RoleName) {
+                subjects.push(value.RoleName);
+            }
+            return subjects;
+        },
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], IamRoleSchema.prototype, "response", void 0);
+//# sourceMappingURL=index.schema.js.map

package/dist/resources/iam-role/index.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/iam-role/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAiErE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAc,SAAQ,kBAAkB;IAArD;;QACE,uDAAuD;QACvD;;;;;WAKG;QAKM,eAAU,GAAG,MAAM,EAMxB,CAAC;QAEL;;;;;;WAMG;QAoBM,aAAQ,GAAG,MAAM,EAKtB,CAAC;IACP,CAAC;CAAA;AAxCU;IAJR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAkC,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC;QAChG,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;iDAOG;AA4BI;IAnBR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAgC,EAAY,EAAE;YACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;+CAMG"}

package/dist/resources/iam-user/actions/add-iam-user.resource.action.d.ts

@@ -0,0 +1,20 @@
+import { Container, type Diff, type IResourceAction } from '@quadnix/octo';
+import { IamUser } from '../iam-user.resource.js';
+import type { IamUserSchema } from '../index.schema.js';
+/**
+ * @internal
+ */
+export declare class AddIamUserResourceAction implements IResourceAction<IamUser> {
+    private readonly container;
+    constructor(container: Container);
+    filter(diff: Diff): boolean;
+    handle(diff: Diff<IamUser>): Promise<void>;
+    mock(diff: Diff<IamUser>, capture: Partial<IamUserSchema['response']>): Promise<void>;
+}
+/**
+ * @internal
+ */
+export declare class AddIamUserResourceActionFactory {
+    private static instance;
+    static create(): Promise<AddIamUserResourceAction>;
+}