@quadnix/octo-aws-cdk 0.2.0 → 0.2.1

package/dist/resources/iam-user/iam-user.resource.js

@@ -7,9 +7,9 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { ATerraformResource, Diff, DiffAction, DiffUtility, Resource } from '@quadnix/octo';
+import { ATerraformResource, Diff, DiffAction, DiffUtility, Resource, ResourceError, } from '@quadnix/octo';
 import { PolicyUtility } from '../../utilities/policy/policy.utility.js';
-import { IamUserSchema } from './index.schema.js';
+import { IamUserSchema, } from './index.schema.js';
 /**
  * @internal
  */
@@ -21,30 +21,59 @@ let IamUser = class IamUser extends ATerraformResource {
         super(resourceId, properties, []);
     }
     /**
+     * Grants this user read or write on a table in its own account.
+     *
+     * The table is not a parent: IAM accepts a policy naming a table that does not exist yet. It is
+     * passed in so its name and region are read off the table itself rather than handed over as
+     * strings, and so a table in another account is refused.
+     *
      * @internal
      */
-    addS3BucketPolicy(policyId, bucketName, remoteDirectoryPath, options) {
+    addDynamoDBTablePolicy(policyId, table, options) {
+        const { awsAccountId, awsRegionId, TableName } = table.getSchemaInstance().properties;
+        if (awsAccountId !== this.properties.awsAccountId) {
+            throw new ResourceError(`Table "${TableName}" is in account "${awsAccountId}", not in the user's account "${this.properties.awsAccountId}"!`, this);
+        }
+        const policy = {
+            allowRead: options.allowRead,
+            allowWrite: options.allowWrite,
+            awsRegionId,
+            tableName: TableName,
+        };
         const index = this.properties.policies.findIndex((p) => p.policyId === policyId);
         if (index === -1) {
-            const policy = {
-                allowRead: options.allowRead,
-                allowWrite: options.allowWrite,
-                bucketName,
-                remoteDirectoryPath,
-            };
-            this.properties.policies.push({
-                policy,
-                policyId,
-                policyType: 's3-storage-access-policy',
-            });
+            this.properties.policies.push({ policy, policyId, policyType: 'dynamodb-table-access-policy' });
+        }
+        else {
+            this.properties.policies[index].policy = policy;
+        }
+    }
+    /**
+     * Grants this user read or write on a prefix of a bucket in its own account.
+     *
+     * The bucket is not a parent: IAM accepts a policy naming a bucket that does not exist yet. It is
+     * passed in so its name is read off the bucket itself rather than handed over as a string, and so a
+     * bucket in another account is refused.
+     *
+     * @internal
+     */
+    addS3BucketPolicy(policyId, bucket, accessPrefix, options) {
+        const { awsAccountId, Bucket } = bucket.getSchemaInstance().properties;
+        if (awsAccountId !== this.properties.awsAccountId) {
+            throw new ResourceError(`Bucket "${Bucket}" is in account "${awsAccountId}", not in the user's account "${this.properties.awsAccountId}"!`, this);
+        }
+        const policy = {
+            accessPrefix,
+            allowRead: options.allowRead,
+            allowWrite: options.allowWrite,
+            bucketName: Bucket,
+        };
+        const index = this.properties.policies.findIndex((p) => p.policyId === policyId);
+        if (index === -1) {
+            this.properties.policies.push({ policy, policyId, policyType: 's3-storage-access-policy' });
         }
         else {
-            this.properties.policies[index].policy = {
-                allowRead: options.allowRead,
-                allowWrite: options.allowWrite,
-                bucketName,
-                remoteDirectoryPath,
-            };
+            this.properties.policies[index].policy = policy;
         }
     }
     /**
@@ -76,7 +105,17 @@ let IamUser = class IamUser extends ATerraformResource {
             }
         }
         for (const policy of this.properties.policies) {
-            if (!previous.properties.policies.find((p) => p.policyId === policy.policyId)) {
+            const previousPolicy = previous.properties.policies.find((p) => p.policyId === policy.policyId);
+            // A policy whose body moved under the same id is a delete and an add, because a policy is
+            // one terraform resource named by that id and there is no third action to edit it with.
+            if (previousPolicy && !DiffUtility.isObjectDeepEquals({ p: previousPolicy.policy }, { p: policy.policy })) {
+                diffs.push(new Diff(this, DiffAction.UPDATE, policy.policyType, {
+                    action: 'delete',
+                    policyId: policy.policyId,
+                    policyType: policy.policyType,
+                }));
+            }
+            if (!previousPolicy || !DiffUtility.isObjectDeepEquals({ p: previousPolicy.policy }, { p: policy.policy })) {
                 diffs.push(new Diff(this, DiffAction.UPDATE, policy.policyType, {
                     action: 'add',
                     policy: policy.policy,
@@ -134,19 +173,64 @@ let IamUser = class IamUser extends ATerraformResource {
             UserId: terraform.raw(`${iamUserTFResource.address}.unique_id`),
             UserName: terraform.raw(`${iamUserTFResource.address}.name`),
         });
+        const dynamoDBPolicies = this.properties.policies.filter((p) => p.policyType === 'dynamodb-table-access-policy');
+        for (const policy of dynamoDBPolicies) {
+            const dynamoDBPolicy = policy.policy;
+            const tableArn = [
+                'arn:aws:dynamodb',
+                dynamoDBPolicy.awsRegionId,
+                this.properties.awsAccountId,
+                `table/${dynamoDBPolicy.tableName}`,
+            ].join(':');
+            const policyStatements = [];
+            if (dynamoDBPolicy.allowRead) {
+                policyStatements.push({
+                    Action: [
+                        'dynamodb:BatchGetItem',
+                        'dynamodb:ConditionCheckItem',
+                        'dynamodb:DescribeTable',
+                        'dynamodb:GetItem',
+                        'dynamodb:Query',
+                        'dynamodb:Scan',
+                    ],
+                    Effect: 'Allow',
+                    Resource: [tableArn, `${tableArn}/index/*`],
+                    Sid: PolicyUtility.getSafeSid(`Allow read from table ${dynamoDBPolicy.tableName}`),
+                });
+            }
+            if (dynamoDBPolicy.allowWrite) {
+                policyStatements.push({
+                    Action: ['dynamodb:BatchWriteItem', 'dynamodb:DeleteItem', 'dynamodb:PutItem', 'dynamodb:UpdateItem'],
+                    Effect: 'Allow',
+                    Resource: [tableArn],
+                    Sid: PolicyUtility.getSafeSid(`Allow write to table ${dynamoDBPolicy.tableName}`),
+                });
+            }
+            const iamPolicyTFResource = iamUserOctoResource.addTerraformResource('aws_iam_policy', `${this.resourceId}_${policy.policyId}`, {
+                name: policy.policyId,
+                policy: terraform.jsonencode({
+                    Statement: policyStatements,
+                    Version: '2012-10-17',
+                }),
+            });
+            iamUserOctoResource.addTerraformResource('aws_iam_user_policy_attachment', `${this.resourceId}_${policy.policyId}_attach`, {
+                policy_arn: terraform.raw(`${iamPolicyTFResource.address}.arn`),
+                user: terraform.raw(`${iamUserTFResource.address}.name`),
+            });
+        }
         const s3Policies = this.properties.policies.filter((p) => p.policyType === 's3-storage-access-policy');
         for (const policy of s3Policies) {
             const s3Policy = policy.policy;
-            const isRootPath = s3Policy.remoteDirectoryPath === '' || s3Policy.remoteDirectoryPath === '/';
+            const isRootPath = s3Policy.accessPrefix === '' || s3Policy.accessPrefix === '/';
             const bucketReadResources = isRootPath
                 ? [`arn:aws:s3:::${s3Policy.bucketName}`, `arn:aws:s3:::${s3Policy.bucketName}/*`]
                 : [
-                    `arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.remoteDirectoryPath}`,
-                    `arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.remoteDirectoryPath}/*`,
+                    `arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.accessPrefix}`,
+                    `arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.accessPrefix}/*`,
                 ];
             const bucketWriteResources = isRootPath
                 ? [`arn:aws:s3:::${s3Policy.bucketName}`, `arn:aws:s3:::${s3Policy.bucketName}/*`]
-                : [`arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.remoteDirectoryPath}/*`];
+                : [`arn:aws:s3:::${s3Policy.bucketName}/${s3Policy.accessPrefix}/*`];
             const policyStatements = [];
             if (s3Policy.allowRead) {
                 policyStatements.push({
@@ -157,12 +241,29 @@ let IamUser = class IamUser extends ATerraformResource {
                         's3:GetObjectVersionAcl',
                         's3:GetObjectVersionAttributes',
                         's3:GetObjectVersionTagging',
-                        's3:ListBucket',
                     ],
                     Effect: 'Allow',
                     Resource: bucketReadResources,
                     Sid: PolicyUtility.getSafeSid(`Allow read from bucket ${s3Policy.bucketName}`),
                 });
+                // s3:ListBucket is a bucket-level action, so it is only ever evaluated against the bucket
+                // ARN. Granting it alongside the object actions above, whose Resource is a prefix,
+                // silently grants nothing. The prefix is expressed as an s3:prefix condition instead.
+                policyStatements.push({
+                    Action: ['s3:ListBucket'],
+                    Effect: 'Allow',
+                    Resource: [`arn:aws:s3:::${s3Policy.bucketName}`],
+                    Sid: PolicyUtility.getSafeSid(`Allow list from bucket ${s3Policy.bucketName}`),
+                    ...(isRootPath
+                        ? {}
+                        : {
+                            Condition: {
+                                StringLike: {
+                                    's3:prefix': [s3Policy.accessPrefix, `${s3Policy.accessPrefix}/*`],
+                                },
+                            },
+                        }),
+                });
             }
             if (s3Policy.allowWrite) {
                 policyStatements.push({
@@ -190,7 +291,9 @@ let IamUser = class IamUser extends ATerraformResource {
     }
 };
 IamUser = __decorate([
-    Resource('@octo', 'iam-user', IamUserSchema),
+    Resource('@octo', 'iam-user', IamUserSchema, {
+        uniqueProperties: [{ path: 'username', within: ['awsAccountId'] }],
+    }),
     __metadata("design:paramtypes", [String, Object])
 ], IamUser);
 export { IamUser };

package/dist/resources/iam-user/iam-user.resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam-user.resource.js","sourceRoot":"","sources":["../../../src/resources/iam-user/iam-user.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAA6B,MAAM,eAAe,CAAC;AACvH,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EAAyD,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAgBzG;;GAEG;AAEI,IAAM,OAAO,GAAb,MAAM,OAAQ,SAAQ,kBAA0C;IAIrE;;OAEG;IACH,YAAY,UAAkB,EAAE,UAAuC;QACrE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,iBAAiB,CACf,QAAgB,EAChB,UAAkB,EAClB,mBAA2B,EAC3B,OAAoD;QAEpD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,MAAM,GAA2B;gBACrC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU;gBACV,mBAAmB;aACpB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,MAAM;gBACN,QAAQ;gBACR,UAAU,EAAE,0BAA0B;aACvC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG;gBACvC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU;gBACV,mBAAmB;aACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAgB;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,cAAc,CAAC,QAAiB;QAC7C,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACxF,OAAO;gBACL,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,OAAO,EAClB,YAAY,EACZ,IAAI,CAAC,UAAU,EAAE,EACjB,gEAAgE,CACjE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAW,EAAE,CAAC;QAEzB,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1E,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9E,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA6B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC/E,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACM,UAAU,CAAC,IAAmB;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,CAAC;YAE7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACnD,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA6B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC/E,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAW,EAAE,CAAC;YAEzB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACnD,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,KAAK,CAAC,SAA+B;QAClD,MAAM,mBAAmB,GAAG,SAAS,CAAC,wBAAwB,CAAC,IAAe,EAAE;YAC9E,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE;SACtD,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE;YAClG,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;SAC/B,CAAC,CAAC;QACH,mBAAmB,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,MAAM,CAAC;YACtD,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,YAAY,CAAC;YAC/D,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,0BAA0B,CAAC,CAAC;QACvG,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAgC,CAAC;YACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,mBAAmB,KAAK,EAAE,IAAI,QAAQ,CAAC,mBAAmB,KAAK,GAAG,CAAC;YAC/F,MAAM,mBAAmB,GAAG,UAAU;gBACpC,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,EAAE,EAAE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,CAAC;gBAClF,CAAC,CAAC;oBACE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,mBAAmB,EAAE;oBACrE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,mBAAmB,IAAI;iBACxE,CAAC;YACN,MAAM,oBAAoB,GAAG,UAAU;gBACrC,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,EAAE,EAAE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,CAAC;gBAClF,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,mBAAmB,IAAI,CAAC,CAAC;YAE9E,MAAM,gBAAgB,GAAa,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACvB,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE;wBACN,cAAc;wBACd,wBAAwB;wBACxB,qBAAqB;wBACrB,wBAAwB;wBACxB,+BAA+B;wBAC/B,4BAA4B;wBAC5B,eAAe;qBAChB;oBACD,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,mBAAmB;oBAC7B,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,0BAA0B,QAAQ,CAAC,UAAU,EAAE,CAAC;iBAC/E,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACxB,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE,CAAC,cAAc,EAAE,wBAAwB,EAAE,iBAAiB,CAAC;oBACrE,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,oBAAoB;oBAC9B,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,2BAA2B,QAAQ,CAAC,UAAU,EAAE,CAAC;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,oBAAoB,CAClE,gBAAgB,EAChB,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACvC;gBACE,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;oBAC3B,SAAS,EAAE,gBAAgB;oBAC3B,OAAO,EAAE,YAAY;iBACtB,CAAC;aACH,CACF,CAAC;YAEF,mBAAmB,CAAC,oBAAoB,CACtC,gCAAgC,EAChC,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,SAAS,EAC9C;gBACE,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,MAAM,CAAC;gBAC/D,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;aACzD,CACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,iBAAiB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF,CAAA;AA5NY,OAAO;IADnB,QAAQ,CAAU,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC;;GACzC,OAAO,CA4NnB"}
+{"version":3,"file":"iam-user.resource.js","sourceRoot":"","sources":["../../../src/resources/iam-user/iam-user.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,kBAAkB,EAClB,IAAI,EACJ,UAAU,EACV,WAAW,EAEX,QAAQ,EACR,aAAa,GAEd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAGzE,OAAO,EAIL,aAAa,GACd,MAAM,mBAAmB,CAAC;AAgB3B;;GAEG;AAII,IAAM,OAAO,GAAb,MAAM,OAAQ,SAAQ,kBAA0C;IAIrE;;OAEG;IACH,YAAY,UAAkB,EAAE,UAAuC;QACrE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,sBAAsB,CACpB,QAAgB,EAChB,KAAuC,EACvC,OAAoD;QAEpD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;QACtF,IAAI,YAAY,KAAK,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;YAClD,MAAM,IAAI,aAAa,CACrB,UAAU,SAAS,oBAAoB,YAAY,iCAAiC,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,EACpH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAgC;YAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW;YACX,SAAS,EAAE,SAAS;SACrB,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,iBAAiB,CACf,QAAgB,EAChB,MAAyC,EACzC,YAAoB,EACpB,OAAoD;QAEpD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;QACvE,IAAI,YAAY,KAAK,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;YAClD,MAAM,IAAI,aAAa,CACrB,WAAW,MAAM,oBAAoB,YAAY,iCAAiC,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,EAClH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAA2B;YACrC,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,MAAM;SACnB,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAgB;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,cAAc,CAAC,QAAiB;QAC7C,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACxF,OAAO;gBACL,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,OAAO,EAClB,YAAY,EACZ,IAAI,CAAC,UAAU,EAAE,EACjB,gEAAgE,CACjE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAW,EAAE,CAAC;QAEzB,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1E,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChG,0FAA0F;YAC1F,wFAAwF;YACxF,IAAI,cAAc,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC1G,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC3G,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA6B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC/E,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACM,UAAU,CAAC,IAAmB;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,CAAC;YAE7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACnD,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA6B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC/E,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAW,EAAE,CAAC;YAEzB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACnD,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAgC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClF,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,KAAK,CAAC,SAA+B;QAClD,MAAM,mBAAmB,GAAG,SAAS,CAAC,wBAAwB,CAAC,IAAe,EAAE;YAC9E,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE;SACtD,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE;YAClG,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;SAC/B,CAAC,CAAC;QACH,mBAAmB,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,MAAM,CAAC;YACtD,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,YAAY,CAAC;YAC/D,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,8BAA8B,CAAC,CAAC;QACjH,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAqC,CAAC;YACpE,MAAM,QAAQ,GAAG;gBACf,kBAAkB;gBAClB,cAAc,CAAC,WAAW;gBAC1B,IAAI,CAAC,UAAU,CAAC,YAAY;gBAC5B,SAAS,cAAc,CAAC,SAAS,EAAE;aACpC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEZ,MAAM,gBAAgB,GAAa,EAAE,CAAC;YACtC,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;gBAC7B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE;wBACN,uBAAuB;wBACvB,6BAA6B;wBAC7B,wBAAwB;wBACxB,kBAAkB;wBAClB,gBAAgB;wBAChB,eAAe;qBAChB;oBACD,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,CAAC,QAAQ,EAAE,GAAG,QAAQ,UAAU,CAAC;oBAC3C,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,yBAAyB,cAAc,CAAC,SAAS,EAAE,CAAC;iBACnF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,qBAAqB,CAAC;oBACrG,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,wBAAwB,cAAc,CAAC,SAAS,EAAE,CAAC;iBAClF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,oBAAoB,CAClE,gBAAgB,EAChB,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACvC;gBACE,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;oBAC3B,SAAS,EAAE,gBAAgB;oBAC3B,OAAO,EAAE,YAAY;iBACtB,CAAC;aACH,CACF,CAAC;YAEF,mBAAmB,CAAC,oBAAoB,CACtC,gCAAgC,EAChC,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,SAAS,EAC9C;gBACE,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,MAAM,CAAC;gBAC/D,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;aACzD,CACF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,0BAA0B,CAAC,CAAC;QACvG,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAgC,CAAC;YACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,KAAK,EAAE,IAAI,QAAQ,CAAC,YAAY,KAAK,GAAG,CAAC;YACjF,MAAM,mBAAmB,GAAG,UAAU;gBACpC,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,EAAE,EAAE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,CAAC;gBAClF,CAAC,CAAC;oBACE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,YAAY,EAAE;oBAC9D,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,YAAY,IAAI;iBACjE,CAAC;YACN,MAAM,oBAAoB,GAAG,UAAU;gBACrC,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,EAAE,EAAE,gBAAgB,QAAQ,CAAC,UAAU,IAAI,CAAC;gBAClF,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC;YAEvE,MAAM,gBAAgB,GAAa,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACvB,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE;wBACN,cAAc;wBACd,wBAAwB;wBACxB,qBAAqB;wBACrB,wBAAwB;wBACxB,+BAA+B;wBAC/B,4BAA4B;qBAC7B;oBACD,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,mBAAmB;oBAC7B,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,0BAA0B,QAAQ,CAAC,UAAU,EAAE,CAAC;iBAC/E,CAAC,CAAC;gBACH,0FAA0F;gBAC1F,mFAAmF;gBACnF,sFAAsF;gBACtF,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE,CAAC,eAAe,CAAC;oBACzB,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,CAAC,gBAAgB,QAAQ,CAAC,UAAU,EAAE,CAAC;oBACjD,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,0BAA0B,QAAQ,CAAC,UAAU,EAAE,CAAC;oBAC9E,GAAG,CAAC,UAAU;wBACZ,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,SAAS,EAAE;gCACT,UAAU,EAAE;oCACV,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,YAAY,IAAI,CAAC;iCACnE;6BACF;yBACF,CAAC;iBACP,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACxB,gBAAgB,CAAC,IAAI,CAAC;oBACpB,MAAM,EAAE,CAAC,cAAc,EAAE,wBAAwB,EAAE,iBAAiB,CAAC;oBACrE,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,oBAAoB;oBAC9B,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,2BAA2B,QAAQ,CAAC,UAAU,EAAE,CAAC;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,oBAAoB,CAClE,gBAAgB,EAChB,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACvC;gBACE,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;oBAC3B,SAAS,EAAE,gBAAgB;oBAC3B,OAAO,EAAE,YAAY;iBACtB,CAAC;aACH,CACF,CAAC;YAEF,mBAAmB,CAAC,oBAAoB,CACtC,gCAAgC,EAChC,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,SAAS,EAC9C;gBACE,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,MAAM,CAAC;gBAC/D,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,OAAO,CAAC;aACzD,CACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,iBAAiB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF,CAAA;AA7VY,OAAO;IAHnB,QAAQ,CAAU,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE;QACrD,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;KACnE,CAAC;;GACW,OAAO,CA6VnB"}

package/dist/resources/iam-user/index.schema.d.ts

@@ -5,17 +5,50 @@ import { BaseResourceSchema } from '@quadnix/octo';
  * @group Resources/IamUser
  */
 export type IIamUserPolicyTypes = {
+    /**
+     * You can provide options to create a policy for accessing a DynamoDB table.
+     */
+    'dynamodb-table-access-policy': IIamUserDynamoDBTablePolicy;
     /**
      * You can provide options to create a policy for accessing a S3 bucket.
      */
     's3-storage-access-policy': IIamUserS3BucketPolicy;
 };
+/**
+ * Defines the DynamoDB table access policy for an IAM user.
+ * Read covers the table and its indexes; write covers the table's items.
+ *
+ * @group Resources/IamUser
+ */
+export interface IIamUserDynamoDBTablePolicy {
+    /**
+     * Allows reading items from the table and querying its indexes.
+     */
+    allowRead: boolean;
+    /**
+     * Allows writing and deleting items in the table.
+     */
+    allowWrite: boolean;
+    /**
+     * The AWS region the table is in. The table is in the user's own account.
+     */
+    awsRegionId: string;
+    /**
+     * The name of the table.
+     */
+    tableName: string;
+}
 /**
  * Defines the S3 storage access policy for an IAM user.
  *
  * @group Resources/IamUser
  */
 export interface IIamUserS3BucketPolicy {
+    /**
+     * The key prefix within the bucket this policy is for, e.g. `uploads`.
+     * If you want to allow access to the entire bucket, use empty string `''`.
+     */
+    accessPrefix: string;
     /**
      * Allows read access to the bucket prefix.
      */
@@ -28,11 +61,6 @@ export interface IIamUserS3BucketPolicy {
      * The name of the bucket.
      */
     bucketName: string;
-    /**
-     * The path within the bucket this policy is for.
-     * If you want to allow access to the entire bucket, use empty string `''`.
-     */
-    remoteDirectoryPath: string;
 }
 /**
  * The `IamUserSchema` class is the schema for the `IamUser` resource,

package/dist/resources/iam-user/index.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/iam-user/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AA0CrE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAc,SAAQ,kBAAkB;IAArD;;QACE,uDAAuD;QACvD;;;;;WAKG;QAKM,eAAU,GAAG,MAAM,EAMxB,CAAC;QAEL;;;;;WAKG;QAiBM,aAAQ,GAAG,MAAM,CAIvB;YACD,GAAG,EAAE,0CAA0C;YAC/C,MAAM,EAAE,uBAAuB;YAC/B,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC;CAAA;AAvCU;IAJR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAkC,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC;QAChG,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;iDAOG;AAwBI;IAhBR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAgC,EAAY,EAAE;YACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;+CASC"}
+{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/iam-user/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AA2ErE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAc,SAAQ,kBAAkB;IAArD;;QACE,uDAAuD;QACvD;;;;;WAKG;QAKM,eAAU,GAAG,MAAM,EAMxB,CAAC;QAEL;;;;;WAKG;QAiBM,aAAQ,GAAG,MAAM,CAIvB;YACD,GAAG,EAAE,0CAA0C;YAC/C,MAAM,EAAE,uBAAuB;YAC/B,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC;CAAA;AAvCU;IAJR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAkC,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC;QAChG,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;iDAOG;AAwBI;IAhBR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAgC,EAAY,EAAE;YACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;+CASC"}

package/dist/resources/lambda-function/index.d.ts

@@ -0,0 +1 @@
+export { LambdaFunction } from './lambda-function.resource.js';

package/dist/resources/lambda-function/index.js

@@ -0,0 +1,2 @@
+export { LambdaFunction } from './lambda-function.resource.js';
+//# sourceMappingURL=index.js.map

package/dist/resources/lambda-function/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/resources/lambda-function/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/resources/lambda-function/index.schema.d.ts

@@ -0,0 +1,75 @@
+import { BaseResourceSchema } from '@quadnix/octo';
+/**
+ * The `LambdaFunctionSchema` class is the schema for the `LambdaFunction` resource, which
+ * represents an AWS Lambda function running a container image. Terraform provisions it as
+ * [`aws_lambda_function`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function),
+ * with an
+ * [`aws_lambda_function_url`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function_url)
+ * that only signed requests may call. Each caller of the URL - an account, or CloudFront - is admitted by a
+ * pair of [`aws_lambda_permission`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission),
+ * because a function URL needs both `lambda:InvokeFunctionUrl` and `lambda:InvokeFunction`.
+ *
+ * The function writes no logs: its role is given no permission to, so Lambda creates no log group
+ * outside of octo.
+ *
+ * @group Resources/LambdaFunction
+ *
+ * @hideconstructor
+ *
+ * @overrideProperty parents - The IAM role the function runs as, and the published image it runs.
+ * ```mermaid
+ * graph TD;
+ *   iam_role((IAM<br>Role)) --> lambda_function((Lambda<br>Function))
+ *   ecr_image_tag((ECR<br>Image Tag)) --> lambda_function
+ * ```
+ * @overrideProperty resourceId - The resource id is of format `lambda-function-<function-name>`.
+ */
+export declare class LambdaFunctionSchema extends BaseResourceSchema {
+    /**
+     * Input properties.
+     * * `properties.allowCloudFrontOriginAccess` - Whether CloudFront distributions of the function's own
+     * account may call its URL, signing each request with an origin access control.
+     * * `properties.architecture` - The processor the function runs on. The image must be built for it.
+     * * `properties.awsAccountId` - The AWS account id.
+     * * `properties.awsRegionId` - The AWS region id.
+     * * `properties.environmentVariables` - Values the function reads out of its environment.
+     * * `properties.functionName` - The name of the function. Part of its identity.
+     * * `properties.imageCommand` - The command the image runs, replacing its own. Empty keeps the image's
+     * own command.
+     * * `properties.invokeMode` - How the function's URL returns a response: `BUFFERED`, whole and up to 6 MB,
+     * or `RESPONSE_STREAM`, streamed as the function writes it, up to 200 MB.
+     * * `properties.invokerAccountIds` - The AWS accounts allowed to call the function's URL.
+     * * `properties.memoryInMegabytes` - How much memory the function gets, from 128 to 10240. It also
+     * decides how much CPU the function gets.
+     * * `properties.reservedConcurrency` - How many instances of the function may run at once, reserved
+     * out of the account's concurrency. Left out, nothing is reserved.
+     * * `properties.timeoutInSeconds` - How long an invocation may run before Lambda stops it, from 1 to 900.
+     */
+    properties: {
+        allowCloudFrontOriginAccess: boolean;
+        architecture: "arm64" | "x86_64";
+        awsAccountId: string;
+        awsRegionId: string;
+        environmentVariables: Record<string, string>;
+        functionName: string;
+        imageCommand: string[];
+        invokeMode: "BUFFERED" | "RESPONSE_STREAM";
+        invokerAccountIds: string[];
+        memoryInMegabytes: number;
+        reservedConcurrency: number | null;
+        timeoutInSeconds: number;
+    };
+    /**
+     * Saved response.
+     * * `response.Arn` - The ARN of the function.
+     * * `response.FunctionName` - The name of the function.
+     * * `response.FunctionUrl` - The URL the function answers on.
+     * * `response.FunctionUrlDomainName` - The host name of the URL, which a CloudFront origin names.
+     */
+    response: {
+        Arn?: string;
+        FunctionName?: string;
+        FunctionUrl?: string;
+        FunctionUrlDomainName?: string;
+    };
+}

package/dist/resources/lambda-function/index.schema.js

@@ -0,0 +1,139 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { BaseResourceSchema, Schema, Validate } from '@quadnix/octo';
+/**
+ * The `LambdaFunctionSchema` class is the schema for the `LambdaFunction` resource, which
+ * represents an AWS Lambda function running a container image. Terraform provisions it as
+ * [`aws_lambda_function`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function),
+ * with an
+ * [`aws_lambda_function_url`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function_url)
+ * that only signed requests may call. Each caller of the URL - an account, or CloudFront - is admitted by a
+ * pair of [`aws_lambda_permission`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission),
+ * because a function URL needs both `lambda:InvokeFunctionUrl` and `lambda:InvokeFunction`.
+ *
+ * The function writes no logs: its role is given no permission to, so Lambda creates no log group
+ * outside of octo.
+ *
+ * @group Resources/LambdaFunction
+ *
+ * @hideconstructor
+ *
+ * @overrideProperty parents - The IAM role the function runs as, and the published image it runs.
+ * ```mermaid
+ * graph TD;
+ *   iam_role((IAM<br>Role)) --> lambda_function((Lambda<br>Function))
+ *   ecr_image_tag((ECR<br>Image Tag)) --> lambda_function
+ * ```
+ * @overrideProperty resourceId - The resource id is of format `lambda-function-<function-name>`.
+ */
+export class LambdaFunctionSchema extends BaseResourceSchema {
+    constructor() {
+        super(...arguments);
+        /**
+         * Input properties.
+         * * `properties.allowCloudFrontOriginAccess` - Whether CloudFront distributions of the function's own
+         * account may call its URL, signing each request with an origin access control.
+         * * `properties.architecture` - The processor the function runs on. The image must be built for it.
+         * * `properties.awsAccountId` - The AWS account id.
+         * * `properties.awsRegionId` - The AWS region id.
+         * * `properties.environmentVariables` - Values the function reads out of its environment.
+         * * `properties.functionName` - The name of the function. Part of its identity.
+         * * `properties.imageCommand` - The command the image runs, replacing its own. Empty keeps the image's
+         * own command.
+         * * `properties.invokeMode` - How the function's URL returns a response: `BUFFERED`, whole and up to 6 MB,
+         * or `RESPONSE_STREAM`, streamed as the function writes it, up to 200 MB.
+         * * `properties.invokerAccountIds` - The AWS accounts allowed to call the function's URL.
+         * * `properties.memoryInMegabytes` - How much memory the function gets, from 128 to 10240. It also
+         * decides how much CPU the function gets.
+         * * `properties.reservedConcurrency` - How many instances of the function may run at once, reserved
+         * out of the account's concurrency. Left out, nothing is reserved.
+         * * `properties.timeoutInSeconds` - How long an invocation may run before Lambda stops it, from 1 to 900.
+         */
+        this.properties = Schema();
+        /**
+         * Saved response.
+         * * `response.Arn` - The ARN of the function.
+         * * `response.FunctionName` - The name of the function.
+         * * `response.FunctionUrl` - The URL the function answers on.
+         * * `response.FunctionUrlDomainName` - The host name of the URL, which a CloudFront origin names.
+         */
+        this.response = Schema({
+            Arn: 'arn:aws:lambda:us-east-1:000000000000:function:mock-function',
+            FunctionName: 'mock-function',
+            FunctionUrl: 'https://mock-function.lambda-url.us-east-1.on.aws/',
+            FunctionUrlDomainName: 'mock-function.lambda-url.us-east-1.on.aws',
+        });
+    }
+}
+__decorate([
+    Validate([
+        {
+            destruct: (value) => [
+                value.architecture,
+                value.awsAccountId,
+                value.awsRegionId,
+                value.functionName,
+                ...value.imageCommand,
+                ...value.invokerAccountIds,
+            ],
+            options: { minLength: 1 },
+        },
+        {
+            destruct: (value) => [value.architecture],
+            options: { regex: /^(arm64|x86_64)$/ },
+        },
+        {
+            destruct: (value) => [value.functionName],
+            options: { regex: /^[\w-]{1,64}$/ },
+        },
+        {
+            destruct: (value) => [value.invokeMode],
+            options: { regex: /^(BUFFERED|RESPONSE_STREAM)$/ },
+        },
+        {
+            destruct: (value) => value.invokerAccountIds,
+            options: { regex: /^\d{12}$/ },
+        },
+        {
+            destruct: (value) => [value.memoryInMegabytes],
+            options: { maxLength: 10240, minLength: 128 },
+        },
+        {
+            destruct: (value) => value.reservedConcurrency === null ? [] : [value.reservedConcurrency],
+            options: { minLength: 0 },
+        },
+        {
+            destruct: (value) => [value.timeoutInSeconds],
+            options: { maxLength: 900, minLength: 1 },
+        },
+        {
+            destruct: (value) => Object.keys(value.environmentVariables),
+            options: { regex: /^[a-zA-Z]\w+$/ },
+        },
+    ]),
+    __metadata("design:type", Object)
+], LambdaFunctionSchema.prototype, "properties", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => {
+            const subjects = [];
+            if (value.Arn) {
+                subjects.push(value.Arn);
+            }
+            if (value.FunctionName) {
+                subjects.push(value.FunctionName);
+            }
+            return subjects;
+        },
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], LambdaFunctionSchema.prototype, "response", void 0);
+//# sourceMappingURL=index.schema.js.map

package/dist/resources/lambda-function/index.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/lambda-function/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,oBAAqB,SAAQ,kBAAkB;IAA5D;;QACE;;;;;;;;;;;;;;;;;;;WAmBG;QA+CM,eAAU,GAAG,MAAM,EAaxB,CAAC;QAEL;;;;;;WAMG;QAcM,aAAQ,GAAG,MAAM,CAKvB;YACD,GAAG,EAAE,8DAA8D;YACnE,YAAY,EAAE,eAAe;YAC7B,WAAW,EAAE,oDAAoD;YACjE,qBAAqB,EAAE,2CAA2C;SACnE,CAAC,CAAC;IACL,CAAC;CAAA;AA9CU;IA9CR,QAAQ,CAAU;QACjB;YACE,QAAQ,EAAE,CAAC,KAAyC,EAAY,EAAE,CAAC;gBACjE,KAAK,CAAC,YAAY;gBAClB,KAAK,CAAC,YAAY;gBAClB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,YAAY;gBAClB,GAAG,KAAK,CAAC,YAAY;gBACrB,GAAG,KAAK,CAAC,iBAAiB;aAC3B;YACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;SAC1B;QACD;YACE,QAAQ,EAAE,CAAC,KAAyC,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;YACvF,OAAO,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE;SACvC;QACD;YACE,QAAQ,EAAE,CAAC,KAAyC,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;YACvF,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;SACpC;QACD;YACE,QAAQ,EAAE,CAAC,KAAyC,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;YACrF,OAAO,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE;SACnD;QACD;YACE,QAAQ,EAAE,CAAC,KAAyC,EAAY,EAAE,CAAC,KAAK,CAAC,iBAAiB;YAC1F,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE;SAC/B;QACD;YACE,QAAQ,EAAE,CAAC,KAAyC,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC5F,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE;SAC9C;QACD;YACE,QAAQ,EAAE,CAAC,KAAyC,EAAY,EAAE,CAChE,KAAK,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;YACvE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;SAC1B;QACD;YACE,QAAQ,EAAE,CAAC,KAAyC,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAC3F,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE;SAC1C;QACD;YACE,QAAQ,EAAE,CAAC,KAAyC,EAAY,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC;YAC1G,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;SACpC;KACF,CAAC;;wDAcG;AAsBI;IAbR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAuC,EAAY,EAAE;YAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;sDAWC"}

package/dist/resources/lambda-function/lambda-function.resource.d.ts

@@ -0,0 +1,50 @@
+import { ATerraformResource, Diff, type MatchingResource, type TerraformModuleScope } from '@quadnix/octo';
+import type { EcrImageTagSchema } from '../ecr-image-tag/index.schema.js';
+import type { IamRoleSchema } from '../iam-role/index.schema.js';
+import { LambdaFunctionSchema } from './index.schema.js';
+/**
+ * @internal
+ */
+export declare class LambdaFunction extends ATerraformResource<LambdaFunctionSchema, LambdaFunction> {
+    parents: [MatchingResource<IamRoleSchema>, MatchingResource<EcrImageTagSchema>];
+    properties: LambdaFunctionSchema['properties'];
+    response: LambdaFunctionSchema['response'];
+    /**
+     * @internal
+     */
+    constructor(resourceId: string, properties: LambdaFunctionSchema['properties'], parents: [MatchingResource<IamRoleSchema>, MatchingResource<EcrImageTagSchema>]);
+    /**
+     * Admits CloudFront distributions of the function's own account to its URL.
+     *
+     * @internal
+     */
+    allowCloudFrontOriginAccess(): void;
+    /**
+     * @internal
+     */
+    diff(previous: LambdaFunction): Promise<Diff[]>;
+    /**
+     * A function belongs to one account and one region, and its name is already in the resource id.
+     * Everything else Lambda edits in place.
+     *
+     * @internal
+     */
+    diffProperties(previous: LambdaFunction): Promise<Diff[]>;
+    /**
+     * @internal
+     */
+    toHCL(terraform: TerraformModuleScope): Promise<void>;
+    /**
+     * @internal
+     */
+    private updateLambdaFunctionIamRole;
+    /**
+     * Orders this function against the published image it runs.
+     *
+     * A published image is deleted by octo at commit, outside terraform's own ordering, so nothing
+     * else holds it back until the function has stopped naming it.
+     *
+     * @internal
+     */
+    private updateLambdaFunctionImageTag;
+}