@quadnix/octo-aws-cdk 0.2.0 → 0.2.1

package/dist/resources/iam-role/iam-role.resource.js

@@ -53,30 +53,74 @@ let IamRole = class IamRole extends ATerraformResource {
         }
     }
     /**
+     * Grants this role read or write on a table in its own account.
+     *
+     * The table is not a parent: IAM accepts a policy naming a table that does not exist yet. It is
+     * passed in so its name and region are read off the table itself rather than handed over as strings.
+     *
      * @internal
      */
-    addS3BucketPolicy(policyId, bucketName, remoteDirectoryPath, options) {
+    addDynamoDBTablePolicy(policyId, table, options) {
+        const { awsAccountId, awsRegionId, TableName } = table.getSchemaInstance().properties;
+        if (awsAccountId !== this.properties.awsAccountId) {
+            throw new ResourceError(`Table "${TableName}" is in account "${awsAccountId}", not in the role's account "${this.properties.awsAccountId}"!`, this);
+        }
+        const policy = {
+            allowRead: options.allowRead,
+            allowWrite: options.allowWrite,
+            awsRegionId,
+            tableName: TableName,
+        };
         const index = this.properties.policies.findIndex((p) => p.policyId === policyId);
         if (index === -1) {
-            const policy = {
-                allowRead: options.allowRead,
-                allowWrite: options.allowWrite,
-                bucketName,
-                remoteDirectoryPath,
-            };
-            this.properties.policies.push({
-                policy,
-                policyId,
-                policyType: 's3-storage-access-policy',
-            });
+            this.properties.policies.push({ policy, policyId, policyType: 'dynamodb-table-access-policy' });
+        }
+        else {
+            this.properties.policies[index].policy = policy;
+        }
+    }
+    /**
+     * Allows this role the given IAM statements, as written. Neither the actions nor the resource ARNs are
+     * checked, and a resource may be in any account.
+     *
+     * @internal
+     */
+    addIamStatementsPolicy(policyId, statements) {
+        const policy = statements.map((s) => ({ actions: [...s.actions], resources: [...s.resources] }));
+        const index = this.properties.policies.findIndex((p) => p.policyId === policyId);
+        if (index === -1) {
+            this.properties.policies.push({ policy, policyId, policyType: 'iam-statements-policy' });
+        }
+        else {
+            this.properties.policies[index].policy = policy;
+        }
+    }
+    /**
+     * Grants this role read or write on a prefix of a bucket in its own account.
+     *
+     * The bucket is not a parent: IAM accepts a policy naming a bucket that does not exist yet. It is
+     * passed in so its name is read off the bucket itself rather than handed over as a string, and so a
+     * bucket in another account is refused.
+     *
+     * @internal
+     */
+    addS3BucketPolicy(policyId, bucket, accessPrefix, options) {
+        const { awsAccountId, Bucket } = bucket.getSchemaInstance().properties;
+        if (awsAccountId !== this.properties.awsAccountId) {
+            throw new ResourceError(`Bucket "${Bucket}" is in account "${awsAccountId}", not in the role's account "${this.properties.awsAccountId}"!`, this);
+        }
+        const policy = {
+            accessPrefix,
+            allowRead: options.allowRead,
+            allowWrite: options.allowWrite,
+            bucketName: Bucket,
+        };
+        const index = this.properties.policies.findIndex((p) => p.policyId === policyId);
+        if (index === -1) {
+            this.properties.policies.push({ policy, policyId, policyType: 's3-storage-access-policy' });
         }
         else {
-            this.properties.policies[index].policy = {
-                allowRead: options.allowRead,
-                allowWrite: options.allowWrite,
-                bucketName,
-                remoteDirectoryPath,
-            };
+            this.properties.policies[index].policy = policy;
         }
     }
     /**
@@ -111,7 +155,17 @@ let IamRole = class IamRole extends ATerraformResource {
             }
         }
         for (const policy of this.properties.policies) {
-            if (!previous.properties.policies.find((p) => p.policyId === policy.policyId)) {
+            const previousPolicy = previous.properties.policies.find((p) => p.policyId === policy.policyId);
+            // A policy whose body moved under the same id is a delete and an add, because a policy is
+            // one terraform resource named by that id and there is no third action to edit it with.
+            if (previousPolicy && !DiffUtility.isObjectDeepEquals({ p: previousPolicy.policy }, { p: policy.policy })) {
+                diffs.push(new Diff(this, DiffAction.UPDATE, policy.policyType, {
+                    action: 'delete',
+                    policyId: policy.policyType === 'aws-policy' ? previousPolicy.policy : policy.policyId,
+                    policyType: policy.policyType,
+                }));
+            }
+            if (!previousPolicy || !DiffUtility.isObjectDeepEquals({ p: previousPolicy.policy }, { p: policy.policy })) {
                 diffs.push(new Diff(this, DiffAction.UPDATE, policy.policyType, {
                     action: 'add',
                     policy: policy.policy,
@@ -165,18 +219,11 @@ let IamRole = class IamRole extends ATerraformResource {
      */
     async toHCL(terraform) {
         const assumeRolePolicies = this.properties.policies.filter((p) => p.policyType === 'assume-role-policy');
-        const policyStatement = assumeRolePolicies
-            .map((p) => {
-            if (p.policy === 'ecs-tasks.amazonaws.com') {
-                return {
-                    Action: 'sts:AssumeRole',
-                    Effect: 'Allow',
-                    Principal: { Service: 'ecs-tasks.amazonaws.com' },
-                };
-            }
-            return null;
-        })
-            .filter(Boolean);
+        const policyStatement = assumeRolePolicies.map((p) => ({
+            Action: 'sts:AssumeRole',
+            Effect: 'Allow',
+            Principal: { Service: p.policy },
+        }));
         const iamRoleOctoResource = terraform.addOctoTerraformResource(this, {
             provider: { accountId: this.properties.awsAccountId },
         });
@@ -199,19 +246,79 @@ let IamRole = class IamRole extends ATerraformResource {
                 role: terraform.raw(`${iamRoleTFResource.address}.name`),
             });
         }
+        const dynamoDBPolicies = this.properties.policies.filter((p) => p.policyType === 'dynamodb-table-access-policy');
+        for (const policy of dynamoDBPolicies) {
+            const dynamoDBPolicy = policy.policy;
+            const tableArn = [
+                'arn:aws:dynamodb',
+                dynamoDBPolicy.awsRegionId,
+                this.properties.awsAccountId,
+                `table/${dynamoDBPolicy.tableName}`,
+            ].join(':');
+            const policyStatements = [];
+            if (dynamoDBPolicy.allowRead) {
+                policyStatements.push({
+                    Action: [
+                        'dynamodb:BatchGetItem',
+                        'dynamodb:ConditionCheckItem',
+                        'dynamodb:DescribeTable',
+                        'dynamodb:GetItem',
+                        'dynamodb:Query',
+                        'dynamodb:Scan',
+                    ],
+                    Effect: 'Allow',
+                    Resource: [tableArn, `${tableArn}/index/*`],
+                    Sid: PolicyUtility.getSafeSid(`Allow read from table ${dynamoDBPolicy.tableName}`),
+                });
+            }
+            if (dynamoDBPolicy.allowWrite) {
+                policyStatements.push({
+                    Action: ['dynamodb:BatchWriteItem', 'dynamodb:DeleteItem', 'dynamodb:PutItem', 'dynamodb:UpdateItem'],
+                    Effect: 'Allow',
+                    Resource: [tableArn],
+                    Sid: PolicyUtility.getSafeSid(`Allow write to table ${dynamoDBPolicy.tableName}`),
+                });
+            }
+            const iamPolicyTFResource = iamRoleOctoResource.addTerraformResource('aws_iam_policy', `${this.resourceId}_${policy.policyId}`, {
+                name: policy.policyId,
+                policy: terraform.jsonencode({
+                    Statement: policyStatements,
+                    Version: '2012-10-17',
+                }),
+            });
+            iamRoleOctoResource.addTerraformResource('aws_iam_role_policy_attachment', `${this.resourceId}_${policy.policyId}_attach`, {
+                policy_arn: terraform.raw(`${iamPolicyTFResource.address}.arn`),
+                role: terraform.raw(`${iamRoleTFResource.address}.name`),
+            });
+        }
+        const iamStatementsPolicies = this.properties.policies.filter((p) => p.policyType === 'iam-statements-policy');
+        for (const policy of iamStatementsPolicies) {
+            const statements = policy.policy;
+            const iamPolicyTFResource = iamRoleOctoResource.addTerraformResource('aws_iam_policy', `${this.resourceId}_${policy.policyId}`, {
+                name: policy.policyId,
+                policy: terraform.jsonencode({
+                    Statement: statements.map((s) => ({ Action: s.actions, Effect: 'Allow', Resource: s.resources })),
+                    Version: '2012-10-17',
+                }),
+            });
+            iamRoleOctoResource.addTerraformResource('aws_iam_role_policy_attachment', `${this.resourceId}_${policy.policyId}_attach`, {
+                policy_arn: terraform.raw(`${iamPolicyTFResource.address}.arn`),
+                role: terraform.raw(`${iamRoleTFResource.address}.name`),
+            });
+        }
         const s3Policies = this.properties.policies.filter((p) => p.policyType === 's3-storage-access-policy');
         for (const policy of s3Policies) {
             const s3Policy = policy.policy;
-            const isRootPath = s3Policy.remoteDirectoryPath === '' || s3Policy.remoteDirectoryPath === '/';
+            const isRootPath = s3Policy.accessPrefix === '' || s3Policy.accessPrefix === '/';
             const bucketResources = isRootPath
                 ? [`arn:aws:s3:::${s3Policy.bucketName}`, `arn:aws:s3:::${s3Policy.bucketName}/*`]
                 : [
-                    `arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.remoteDirectoryPath}`,
-                    `arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.remoteDirectoryPath}/*`,
+                    `arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.accessPrefix}`,
+                    `arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.accessPrefix}/*`,
                 ];
             const bucketWriteResources = isRootPath
                 ? [`arn:aws:s3:::${s3Policy.bucketName}`, `arn:aws:s3:::${s3Policy.bucketName}/*`]
-                : [`arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.remoteDirectoryPath}/*`];
+                : [`arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.accessPrefix}/*`];
             const policyStatements = [];
             if (s3Policy.allowRead) {
                 policyStatements.push({
@@ -222,12 +329,29 @@ let IamRole = class IamRole extends ATerraformResource {
                         's3:GetObjectVersionAcl',
                         's3:GetObjectVersionAttributes',
                         's3:GetObjectVersionTagging',
-                        's3:ListBucket',
                     ],
                     Effect: 'Allow',
                     Resource: bucketResources,
                     Sid: PolicyUtility.getSafeSid(`Allow read from bucket ${s3Policy.bucketName}`),
                 });
+                // s3:ListBucket is a bucket-level action, so it is only ever evaluated against the bucket
+                // ARN. Granting it alongside the object actions above, whose Resource is a prefix,
+                // silently grants nothing. The prefix is expressed as an s3:prefix condition instead.
+                policyStatements.push({
+                    Action: ['s3:ListBucket'],
+                    Effect: 'Allow',
+                    Resource: [`arn:aws:s3:::${s3Policy.bucketName}`],
+                    Sid: PolicyUtility.getSafeSid(`Allow list from bucket ${s3Policy.bucketName}`),
+                    ...(isRootPath
+                        ? {}
+                        : {
+                            Condition: {
+                                StringLike: {
+                                    's3:prefix': [s3Policy.accessPrefix, `${s3Policy.accessPrefix}/*`],
+                                },
+                            },
+                        }),
+                });
             }
             if (s3Policy.allowWrite) {
                 policyStatements.push({
@@ -255,7 +379,9 @@ let IamRole = class IamRole extends ATerraformResource {
     }
 };
 IamRole = __decorate([
-    Resource('@octo', 'iam-role', IamRoleSchema),
+    Resource('@octo', 'iam-role', IamRoleSchema, {
+        uniqueProperties: [{ path: 'rolename', within: ['awsAccountId'] }],
+    }),
     __metadata("design:paramtypes", [String, Object])
 ], IamRole);
 export { IamRole };

package/dist/resources/iam-role/iam-role.resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam-role.resource.js","sourceRoot":"","sources":["../../../src/resources/iam-role/iam-role.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,kBAAkB,EAClB,IAAI,EACJ,UAAU,EACV,WAAW,EACX,QAAQ,EACR,aAAa,GAEd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EAIL,aAAa,GACd,MAAM,mBAAmB,CAAC;AAgB3B;;GAEG;AAEI,IAAM,OAAO,GAAb,MAAM,OAAQ,SAAQ,kBAA0C;IAIrE;;OAEG;IACH,YAAY,UAAkB,EAAE,UAAuC;QACrE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAElC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,IAAI,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,oBAAoB,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,aAAa,CAAC,8CAA8C,EAAE,IAAI,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,QAAgB,EAAE,UAAoC;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,MAAM,EAAE,UAAU;gBAClB,QAAQ;gBACR,UAAU,EAAE,oBAAoB;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAgB,EAAE,MAAc;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,MAAM,EAAE,MAAM;gBACd,QAAQ;gBACR,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB,CACf,QAAgB,EAChB,UAAkB,EAClB,mBAA2B,EAC3B,OAAoD;QAEpD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,MAAM,GAA2B;gBACrC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU;gBACV,mBAAmB;aACpB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,MAAM;gBACN,QAAQ;gBACR,UAAU,EAAE,0BAA0B;aACvC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG;gBACvC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU;gBACV,mBAAmB;aACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAgB;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,cAAc,CAAC,QAAiB;QAC7C,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACxF,OAAO;gBACL,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,OAAO,EAClB,YAAY,EACZ,IAAI,CAAC,UAAU,EAAE,EACjB,gEAAgE,CACjE;aACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,KAAK,GAAW,EAAE,CAAC;QAEzB,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1E,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBAC9E,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9E,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA6B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC/E,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACM,UAAU,CAAC,IAAmB;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,CAAC;YAE7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACnD,IAAI,MAAM,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;oBAC/C,SAAS;gBACX,CAAC;gBAED,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA6B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC/E,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAW,EAAE,CAAC;YAEzB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACnD,IAAI,MAAM,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;oBAC/C,SAAS;gBACX,CAAC;gBAED,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBAC9E,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,KAAK,CAAC,SAA+B;QAClD,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,oBAAoB,CAAC,CAAC;QACzG,MAAM,eAAe,GAAG,kBAAkB;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,IAAI,CAAC,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;gBAC3C,OAAO;oBACL,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE;iBAClD,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;aACD,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,MAAM,mBAAmB,GAAG,SAAS,CAAC,wBAAwB,CAAC,IAAe,EAAE;YAC9E,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE;SACtD,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE;YAClG,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAC;gBACvC,SAAS,EAAE,eAAe;gBAC1B,OAAO,EAAE,YAAY;aACtB,CAAC;YACF,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;SAC/B,CAAC,CAAC;QACH,mBAAmB,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,MAAM,CAAC;YACtD,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,YAAY,CAAC;YAC/D,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC;QAC1F,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,mBAAmB,CAAC,oBAAoB,CACtC,gCAAgC,EAChC,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACvC;gBACE,UAAU,EAAE,MAAM,CAAC,MAAgB;gBACnC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;aACzD,CACF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,0BAA0B,CAAC,CAAC;QACvG,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAgC,CAAC;YACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,mBAAmB,KAAK,EAAE,IAAI,QAAQ,CAAC,mBAAmB,KAAK,GAAG,CAAC;YAC/F,MAAM,eAAe,GAAG,UAAU;gBAChC,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,EAAE,EAAE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,CAAC;gBAClF,CAAC,CAAC;oBACE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,mBAAmB,EAAE;oBACrE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,mBAAmB,IAAI;iBACxE,CAAC;YACN,MAAM,oBAAoB,GAAG,UAAU;gBACrC,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,EAAE,EAAE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,CAAC;gBAClF,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,mBAAmB,IAAI,CAAC,CAAC;YAE9E,MAAM,gBAAgB,GAAa,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACvB,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE;wBACN,cAAc;wBACd,wBAAwB;wBACxB,qBAAqB;wBACrB,wBAAwB;wBACxB,+BAA+B;wBAC/B,4BAA4B;wBAC5B,eAAe;qBAChB;oBACD,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,eAAe;oBACzB,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,0BAA0B,QAAQ,CAAC,UAAU,EAAE,CAAC;iBAC/E,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACxB,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE,CAAC,cAAc,EAAE,wBAAwB,EAAE,iBAAiB,CAAC;oBACrE,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,oBAAoB;oBAC9B,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,2BAA2B,QAAQ,CAAC,UAAU,EAAE,CAAC;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,oBAAoB,CAClE,gBAAgB,EAChB,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACvC;gBACE,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;oBAC3B,SAAS,EAAE,gBAAgB;oBAC3B,OAAO,EAAE,YAAY;iBACtB,CAAC;aACH,CACF,CAAC;YAEF,mBAAmB,CAAC,oBAAoB,CACtC,gCAAgC,EAChC,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,SAAS,EAC9C;gBACE,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,MAAM,CAAC;gBAC/D,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;aACzD,CACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,iBAAiB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF,CAAA;AAzSY,OAAO;IADnB,QAAQ,CAAU,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC;;GACzC,OAAO,CAySnB"}
+{"version":3,"file":"iam-role.resource.js","sourceRoot":"","sources":["../../../src/resources/iam-role/iam-role.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,kBAAkB,EAClB,IAAI,EACJ,UAAU,EACV,WAAW,EAEX,QAAQ,EACR,aAAa,GAEd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAGzE,OAAO,EAKL,aAAa,GACd,MAAM,mBAAmB,CAAC;AAgB3B;;GAEG;AAII,IAAM,OAAO,GAAb,MAAM,OAAQ,SAAQ,kBAA0C;IAIrE;;OAEG;IACH,YAAY,UAAkB,EAAE,UAAuC;QACrE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAElC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,IAAI,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,oBAAoB,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,aAAa,CAAC,8CAA8C,EAAE,IAAI,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,QAAgB,EAAE,UAAoC;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,MAAM,EAAE,UAAU;gBAClB,QAAQ;gBACR,UAAU,EAAE,oBAAoB;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAgB,EAAE,MAAc;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,MAAM,EAAE,MAAM;gBACd,QAAQ;gBACR,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,sBAAsB,CACpB,QAAgB,EAChB,KAAuC,EACvC,OAAoD;QAEpD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;QACtF,IAAI,YAAY,KAAK,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;YAClD,MAAM,IAAI,aAAa,CACrB,UAAU,SAAS,oBAAoB,YAAY,iCAAiC,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,EACpH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAgC;YAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW;YACX,SAAS,EAAE,SAAS;SACrB,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,QAAgB,EAAE,UAAwD;QAC/F,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAEjG,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,iBAAiB,CACf,QAAgB,EAChB,MAAyC,EACzC,YAAoB,EACpB,OAAoD;QAEpD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;QACvE,IAAI,YAAY,KAAK,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;YAClD,MAAM,IAAI,aAAa,CACrB,WAAW,MAAM,oBAAoB,YAAY,iCAAiC,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,EAClH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAA2B;YACrC,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,MAAM;SACnB,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAgB;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,cAAc,CAAC,QAAiB;QAC7C,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACxF,OAAO;gBACL,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,OAAO,EAClB,YAAY,EACZ,IAAI,CAAC,UAAU,EAAE,EACjB,gEAAgE,CACjE;aACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,KAAK,GAAW,EAAE,CAAC;QAEzB,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1E,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBAC9E,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChG,0FAA0F;YAC1F,wFAAwF;YACxF,IAAI,cAAc,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC1G,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAE,cAAc,CAAC,MAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBAClG,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC3G,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA6B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC/E,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACM,UAAU,CAAC,IAAmB;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,CAAC;YAE7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACnD,IAAI,MAAM,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;oBAC/C,SAAS;gBACX,CAAC;gBAED,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA6B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC/E,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAW,EAAE,CAAC;YAEzB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACnD,IAAI,MAAM,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;oBAC/C,SAAS;gBACX,CAAC;gBAED,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBAC9E,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,KAAK,CAAC,SAA+B;QAClD,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,oBAAoB,CAAC,CAAC;QACzG,MAAM,eAAe,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAkC,EAAE;SAC7D,CAAC,CAAC,CAAC;QAEJ,MAAM,mBAAmB,GAAG,SAAS,CAAC,wBAAwB,CAAC,IAAe,EAAE;YAC9E,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE;SACtD,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE;YAClG,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAC;gBACvC,SAAS,EAAE,eAAe;gBAC1B,OAAO,EAAE,YAAY;aACtB,CAAC;YACF,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;SAC/B,CAAC,CAAC;QACH,mBAAmB,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,MAAM,CAAC;YACtD,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,YAAY,CAAC;YAC/D,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC;QAC1F,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,mBAAmB,CAAC,oBAAoB,CACtC,gCAAgC,EAChC,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACvC;gBACE,UAAU,EAAE,MAAM,CAAC,MAAgB;gBACnC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;aACzD,CACF,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,8BAA8B,CAAC,CAAC;QACjH,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAqC,CAAC;YACpE,MAAM,QAAQ,GAAG;gBACf,kBAAkB;gBAClB,cAAc,CAAC,WAAW;gBAC1B,IAAI,CAAC,UAAU,CAAC,YAAY;gBAC5B,SAAS,cAAc,CAAC,SAAS,EAAE;aACpC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEZ,MAAM,gBAAgB,GAAa,EAAE,CAAC;YACtC,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;gBAC7B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE;wBACN,uBAAuB;wBACvB,6BAA6B;wBAC7B,wBAAwB;wBACxB,kBAAkB;wBAClB,gBAAgB;wBAChB,eAAe;qBAChB;oBACD,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,CAAC,QAAQ,EAAE,GAAG,QAAQ,UAAU,CAAC;oBAC3C,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,yBAAyB,cAAc,CAAC,SAAS,EAAE,CAAC;iBACnF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,qBAAqB,CAAC;oBACrG,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,wBAAwB,cAAc,CAAC,SAAS,EAAE,CAAC;iBAClF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,oBAAoB,CAClE,gBAAgB,EAChB,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACvC;gBACE,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;oBAC3B,SAAS,EAAE,gBAAgB;oBAC3B,OAAO,EAAE,YAAY;iBACtB,CAAC;aACH,CACF,CAAC;YAEF,mBAAmB,CAAC,oBAAoB,CACtC,gCAAgC,EAChC,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,SAAS,EAC9C;gBACE,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,MAAM,CAAC;gBAC/D,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;aACzD,CACF,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,uBAAuB,CAAC,CAAC;QAC/G,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAsD,CAAC;YAEjF,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,oBAAoB,CAClE,gBAAgB,EAChB,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACvC;gBACE,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;oBAC3B,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;oBACjG,OAAO,EAAE,YAAY;iBACtB,CAAC;aACH,CACF,CAAC;YAEF,mBAAmB,CAAC,oBAAoB,CACtC,gCAAgC,EAChC,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,SAAS,EAC9C;gBACE,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,MAAM,CAAC;gBAC/D,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;aACzD,CACF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,0BAA0B,CAAC,CAAC;QACvG,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAgC,CAAC;YACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,KAAK,EAAE,IAAI,QAAQ,CAAC,YAAY,KAAK,GAAG,CAAC;YACjF,MAAM,eAAe,GAAG,UAAU;gBAChC,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,EAAE,EAAE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,CAAC;gBAClF,CAAC,CAAC;oBACE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,YAAY,EAAE;oBAC9D,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,YAAY,IAAI;iBACjE,CAAC;YACN,MAAM,oBAAoB,GAAG,UAAU;gBACrC,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,EAAE,EAAE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,CAAC;gBAClF,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC;YAEvE,MAAM,gBAAgB,GAAa,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACvB,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE;wBACN,cAAc;wBACd,wBAAwB;wBACxB,qBAAqB;wBACrB,wBAAwB;wBACxB,+BAA+B;wBAC/B,4BAA4B;qBAC7B;oBACD,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,eAAe;oBACzB,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,0BAA0B,QAAQ,CAAC,UAAU,EAAE,CAAC;iBAC/E,CAAC,CAAC;gBACH,0FAA0F;gBAC1F,mFAAmF;gBACnF,sFAAsF;gBACtF,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE,CAAC,eAAe,CAAC;oBACzB,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,CAAC,gBAAgB,QAAQ,CAAC,UAAU,EAAE,CAAC;oBACjD,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,0BAA0B,QAAQ,CAAC,UAAU,EAAE,CAAC;oBAC9E,GAAG,CAAC,UAAU;wBACZ,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,SAAS,EAAE;gCACT,UAAU,EAAE;oCACV,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,YAAY,IAAI,CAAC;iCACnE;6BACF;yBACF,CAAC;iBACP,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACxB,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE,CAAC,cAAc,EAAE,wBAAwB,EAAE,iBAAiB,CAAC;oBACrE,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,oBAAoB;oBAC9B,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,2BAA2B,QAAQ,CAAC,UAAU,EAAE,CAAC;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,oBAAoB,CAClE,gBAAgB,EAChB,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACvC;gBACE,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;oBAC3B,SAAS,EAAE,gBAAgB;oBAC3B,OAAO,EAAE,YAAY;iBACtB,CAAC;aACH,CACF,CAAC;YAEF,mBAAmB,CAAC,oBAAoB,CACtC,gCAAgC,EAChC,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,SAAS,EAC9C;gBACE,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,MAAM,CAAC;gBAC/D,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;aACzD,CACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,iBAAiB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF,CAAA;AA7cY,OAAO;IAHnB,QAAQ,CAAU,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE;QACrD,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;KACnE,CAAC;;GACW,OAAO,CA6cnB"}

package/dist/resources/iam-role/index.schema.d.ts

@@ -1,14 +1,13 @@
 import { BaseResourceSchema } from '@quadnix/octo';
 /**
- * List of IAM entities regarding roles, policies, and permissions.
- * Possible values are,
- * * `ecs-tasks.amazonaws.com`: This is an AWS service principal for ECS tasks.
- * It is used in IAM trust policies to allow ECS tasks to assume a role.
- * You must add this to the set of policies if you are running ECS tasks in your cluster.
+ * The AWS service principal a role is assumed by. A role trusts one of these for every service that
+ * runs as it, and a service missing from the list cannot use the role at all.
+ * * `ecs-tasks.amazonaws.com`: an ECS task runs as the role.
+ * * `lambda.amazonaws.com`: a Lambda function runs as the role.
  *
  * @group Resources/IamRole
  */
-export type IIamRoleAssumeRolePolicy = 'ecs-tasks.amazonaws.com';
+export type IIamRoleAssumeRolePolicy = 'ecs-tasks.amazonaws.com' | 'lambda.amazonaws.com';
 /**
  * Defines the types of policies that can be attached to this IAM role.
  *
@@ -25,17 +24,57 @@ export type IIamRolePolicyTypes = {
      * This can be a predefined AWS managed policy ARN or custom policy ARN that you create.
      */
     'aws-policy': string;
+    /**
+     * You can provide options to create a policy for accessing a DynamoDB table.
+     */
+    'dynamodb-table-access-policy': IIamRoleDynamoDBTablePolicy;
+    /**
+     * You can provide IAM statements to allow, each as actions on resource ARNs, written into one policy.
+     */
+    'iam-statements-policy': {
+        actions: string[];
+        resources: string[];
+    }[];
     /**
      * You can provide options to create a policy for accessing a S3 bucket.
      */
     's3-storage-access-policy': IIamRoleS3BucketPolicy;
 };
+/**
+ * Defines the DynamoDB table access policy for an IAM role.
+ * Read covers the table and its indexes; write covers the table's items.
+ *
+ * @group Resources/IamRole
+ */
+export interface IIamRoleDynamoDBTablePolicy {
+    /**
+     * Allows reading items from the table and querying its indexes.
+     */
+    allowRead: boolean;
+    /**
+     * Allows writing and deleting items in the table.
+     */
+    allowWrite: boolean;
+    /**
+     * The AWS region the table is in. The table is in the role's own account.
+     */
+    awsRegionId: string;
+    /**
+     * The name of the table.
+     */
+    tableName: string;
+}
 /**
  * Defines the S3 storage access policy for an IAM role.
  *
  * @group Resources/IamRole
  */
 export interface IIamRoleS3BucketPolicy {
+    /**
+     * The key prefix within the bucket this policy is for, e.g. `uploads`.
+     * If you want to allow access to the entire bucket, use empty string `''`.
+     */
+    accessPrefix: string;
     /**
      * Allows read access to the bucket prefix.
      */
@@ -48,11 +87,6 @@ export interface IIamRoleS3BucketPolicy {
      * The name of the bucket.
      */
     bucketName: string;
-    /**
-     * The path within the bucket this policy is for.
-     * If you want to allow access to the entire bucket, use empty string `''`.
-     */
-    remoteDirectoryPath: string;
 }
 /**
  * The `IamRoleSchema` class is the schema for the `IamRole` resource,

package/dist/resources/iam-role/index.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/iam-role/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAiErE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAc,SAAQ,kBAAkB;IAArD;;QACE,uDAAuD;QACvD;;;;;WAKG;QAKM,eAAU,GAAG,MAAM,EAMxB,CAAC;QAEL;;;;;WAKG;QAiBM,aAAQ,GAAG,MAAM,CAIvB;YACD,GAAG,EAAE,0CAA0C;YAC/C,MAAM,EAAE,uBAAuB;YAC/B,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC;CAAA;AAvCU;IAJR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAkC,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC;QAChG,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;iDAOG;AAwBI;IAhBR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAgC,EAAY,EAAE;YACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;+CASC"}
+{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/iam-role/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAsGrE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAc,SAAQ,kBAAkB;IAArD;;QACE,uDAAuD;QACvD;;;;;WAKG;QAKM,eAAU,GAAG,MAAM,EAMxB,CAAC;QAEL;;;;;WAKG;QAiBM,aAAQ,GAAG,MAAM,CAIvB;YACD,GAAG,EAAE,0CAA0C;YAC/C,MAAM,EAAE,uBAAuB;YAC/B,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC;CAAA;AAvCU;IAJR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAkC,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC;QAChG,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;iDAOG;AAwBI;IAhBR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAgC,EAAY,EAAE;YACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;+CASC"}

package/dist/resources/iam-user/iam-user.resource.d.ts

@@ -1,4 +1,6 @@
-import { ATerraformResource, Diff, type TerraformModuleScope } from '@quadnix/octo';
+import { ATerraformResource, Diff, type MatchingResource, type TerraformModuleScope } from '@quadnix/octo';
+import type { DynamoDBSchema } from '../dynamodb/index.schema.js';
+import type { S3StorageSchema } from '../s3-storage/index.schema.js';
 import { type IIamUserPolicyTypes, IamUserSchema } from './index.schema.js';
 /**
  * @internal
@@ -28,9 +30,28 @@ export declare class IamUser extends ATerraformResource<IamUserSchema, IamUser>
      */
     constructor(resourceId: string, properties: IamUserSchema['properties']);
     /**
+     * Grants this user read or write on a table in its own account.
+     *
+     * The table is not a parent: IAM accepts a policy naming a table that does not exist yet. It is
+     * passed in so its name and region are read off the table itself rather than handed over as
+     * strings, and so a table in another account is refused.
+     *
      * @internal
      */
-    addS3BucketPolicy(policyId: string, bucketName: string, remoteDirectoryPath: string, options: {
+    addDynamoDBTablePolicy(policyId: string, table: MatchingResource<DynamoDBSchema>, options: {
+        allowRead: boolean;
+        allowWrite: boolean;
+    }): void;
+    /**
+     * Grants this user read or write on a prefix of a bucket in its own account.
+     *
+     * The bucket is not a parent: IAM accepts a policy naming a bucket that does not exist yet. It is
+     * passed in so its name is read off the bucket itself rather than handed over as a string, and so a
+     * bucket in another account is refused.
+     *
+     * @internal
+     */
+    addS3BucketPolicy(policyId: string, bucket: MatchingResource<S3StorageSchema>, accessPrefix: string, options: {
         allowRead: boolean;
         allowWrite: boolean;
     }): void;