@terra-graph/conventions-aws 1.0.0-rc.1

package/dist/cjs/plugins/AwsIam.js

@@ -0,0 +1,432 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsIamGraphPlugin = exports.AWS_IAM_POLICY_DOCUMENT_MODES = exports.AWS_IAM_ATTACHMENT_MODES = exports.AWS_IAM_PLUGIN_MODES = void 0;
+const core_1 = require("@terra-graph/core");
+const namespaces_js_1 = require("../namespaces.js");
+exports.AWS_IAM_PLUGIN_MODES = ['roles_only', 'roles_policies', 'full'];
+exports.AWS_IAM_ATTACHMENT_MODES = ['remove', 'convert_to_edge', 'keep'];
+exports.AWS_IAM_POLICY_DOCUMENT_MODES = ['none', 'trust_only', 'all'];
+const IAM_ROLE_RESOURCES = ['aws_iam_role'];
+const IAM_POLICY_RESOURCES = ['aws_iam_policy', 'aws_iam_role_policy'];
+const IAM_ATTACHMENT_RESOURCES = ['aws_iam_role_policy_attachment', 'aws_iam_policy_attachment'];
+const IAM_POLICY_DOCUMENT_RESOURCE = 'aws_iam_policy_document';
+const IAM_DATA_POLICY_RESOURCE = 'aws_iam_policy';
+const IAM_ORPHAN_PRUNABLE_RESOURCES = [
+    ...IAM_ROLE_RESOURCES,
+    ...IAM_POLICY_RESOURCES,
+    ...IAM_ATTACHMENT_RESOURCES,
+];
+const IAM_ORPHAN_PRUNABLE_DATA_RESOURCES = [IAM_POLICY_DOCUMENT_RESOURCE, IAM_DATA_POLICY_RESOURCE];
+class AwsIamGraphPlugin extends core_1.GraphPlugin {
+    static id = (0, namespaces_js_1.pluginId)(`aws.${AwsIamGraphPlugin.name}`);
+    constructor() {
+        super(AwsIamGraphPlugin.id, {
+            mode: 'roles_only',
+        });
+    }
+    build({ options, }) {
+        const resolved = this.resolveOptions(options);
+        const phases = [
+            ...this.toPhases('normalize', this.buildIamDirectionPhases()),
+            ...this.toPhases('main', this.buildIamLabelHintPhases()),
+            ...this.toPhases('main', this.buildAttachmentPhases(resolved)),
+        ];
+        if (resolved.mode !== 'full') {
+            phases.push(...this.toPhases('main', [
+                [
+                    new core_1.RemoveNodeAndReconnectEdges({
+                        node: {
+                            and: [
+                                {
+                                    attr: {
+                                        key: 'terraform.resource',
+                                        startsWith: 'aws_iam_',
+                                    },
+                                },
+                                {
+                                    not: {
+                                        attr: {
+                                            key: 'terraform.resource',
+                                            in: this.buildKeepResourcesForMode(resolved),
+                                        },
+                                    },
+                                },
+                            ],
+                        },
+                    }),
+                ],
+            ]));
+            if (resolved.policyDocuments === 'trust_only') {
+                phases.push(...this.toPhases('main', this.buildPolicyDocumentPhases(resolved)));
+            }
+            phases.push(...this.buildCleanupPhases(resolved));
+            return { phases };
+        }
+        phases.push(...this.toPhases('main', this.buildPolicyDocumentPhases(resolved)));
+        phases.push(...this.buildCleanupPhases(resolved));
+        return { phases };
+    }
+    toPhases(phase, phases) {
+        return phases.map((rules) => ({ phase, rules }));
+    }
+    isEnumValue(value, values) {
+        return typeof value === 'string' && values.includes(value);
+    }
+    resolveOptions(options) {
+        const mode = options.mode ?? 'roles_only';
+        if (!this.isEnumValue(mode, exports.AWS_IAM_PLUGIN_MODES)) {
+            throw new Error(`${this.name} options.mode must be one of: ${exports.AWS_IAM_PLUGIN_MODES.join(', ')}`);
+        }
+        const attachments = options.attachments ?? (mode === 'full' ? 'keep' : 'remove');
+        if (!this.isEnumValue(attachments, exports.AWS_IAM_ATTACHMENT_MODES)) {
+            throw new Error(`${this.name} options.attachments must be one of: ${exports.AWS_IAM_ATTACHMENT_MODES.join(', ')}`);
+        }
+        const policyDocuments = options.policyDocuments ?? (mode === 'full' ? 'all' : 'none');
+        if (!this.isEnumValue(policyDocuments, exports.AWS_IAM_POLICY_DOCUMENT_MODES)) {
+            throw new Error(`${this.name} options.policyDocuments must be one of: ${exports.AWS_IAM_POLICY_DOCUMENT_MODES.join(', ')}`);
+        }
+        const removeOrphans = options.removeOrphans ?? false;
+        if (typeof removeOrphans !== 'boolean') {
+            throw new Error(`${this.name} options.removeOrphans must be a boolean`);
+        }
+        return {
+            mode,
+            attachments,
+            policyDocuments,
+            removeOrphans,
+        };
+    }
+    buildKeepResourcesForMode(options) {
+        const keep = new Set(IAM_ROLE_RESOURCES);
+        if (options.mode === 'roles_policies') {
+            for (const resource of IAM_POLICY_RESOURCES) {
+                keep.add(resource);
+            }
+        }
+        if (options.attachments === 'keep') {
+            for (const resource of IAM_ATTACHMENT_RESOURCES) {
+                keep.add(resource);
+            }
+        }
+        if (options.policyDocuments !== 'none') {
+            keep.add(IAM_POLICY_DOCUMENT_RESOURCE);
+        }
+        return [...keep];
+    }
+    buildAttachmentPhases(options) {
+        if (options.attachments === 'keep') {
+            return [];
+        }
+        const phases = [];
+        if (options.attachments === 'convert_to_edge') {
+            phases.push([
+                new core_1.ConvertNodeToEdge({
+                    node: {
+                        attr: {
+                            key: 'terraform.resource',
+                            in: IAM_ATTACHMENT_RESOURCES,
+                        },
+                    },
+                }),
+            ]);
+        }
+        phases.push([
+            new core_1.RemoveNodeAndReconnectEdges({
+                node: {
+                    attr: {
+                        key: 'terraform.resource',
+                        in: IAM_ATTACHMENT_RESOURCES,
+                    },
+                },
+            }),
+        ]);
+        return phases;
+    }
+    buildIamDirectionPhases() {
+        return [
+            [
+                new core_1.EdgeReverse({
+                    edge: {
+                        from: this.iamDataQuery(),
+                        to: this.iamResourceQuery('aws_iam_role_policy'),
+                    },
+                }),
+                new core_1.EdgeReverse({
+                    edge: {
+                        from: this.iamResourceQuery('aws_iam_role_policy'),
+                        to: this.iamResourceQuery('aws_iam_role_policy_attachment'),
+                    },
+                }),
+                new core_1.EdgeReverse({
+                    edge: {
+                        from: this.iamDataQuery(),
+                        to: this.iamResourceQuery('aws_iam_policy'),
+                    },
+                }),
+                new core_1.EdgeReverse({
+                    edge: {
+                        from: this.iamResourceQuery('aws_iam_policy'),
+                        to: this.iamResourceQuery('aws_iam_role_policy_attachment'),
+                    },
+                }),
+                new core_1.EdgeReverse({
+                    edge: {
+                        from: this.iamResourceQuery('aws_iam_policy'),
+                        to: this.iamResourceQuery('aws_iam_policy_attachment'),
+                    },
+                }),
+                new core_1.EdgeReverse({
+                    edge: {
+                        from: this.iamResourceQuery('aws_iam_role'),
+                        to: this.iamAttachmentQuery(),
+                    },
+                }),
+                new core_1.EdgeReverse({
+                    edge: {
+                        from: this.iamAttachmentQuery(),
+                        to: this.anyNonIamResourceQuery(),
+                    },
+                }),
+                new core_1.EdgeReverse({
+                    edge: {
+                        from: this.iamDataQuery(),
+                        to: this.iamResourceQuery('aws_iam_role'),
+                    },
+                }),
+                new core_1.EdgeReverse({
+                    edge: {
+                        from: this.iamResourceQuery('aws_iam_role'),
+                        to: this.anyNonIamResourceQuery(),
+                    },
+                }),
+            ],
+        ];
+    }
+    buildIamLabelHintPhases() {
+        return [
+            [
+                new core_1.NodeProperties({
+                    node: {
+                        and: [
+                            {
+                                attr: {
+                                    key: 'terraform.kind',
+                                    in: ['resource', 'data'],
+                                },
+                            },
+                            {
+                                attr: {
+                                    key: 'terraform.resource',
+                                    startsWith: 'aws_iam_',
+                                },
+                            },
+                            {
+                                attr: {
+                                    key: 'terraform.moduleAddress',
+                                    exists: true,
+                                },
+                            },
+                        ],
+                    },
+                    options: {
+                        hints: {
+                            label: {
+                                end: {
+                                    from: 'terraform.name',
+                                },
+                            },
+                        },
+                    },
+                }),
+            ],
+        ];
+    }
+    iamDataQuery() {
+        return {
+            and: [
+                {
+                    attr: {
+                        key: 'terraform.kind',
+                        eq: 'data',
+                    },
+                },
+                {
+                    attr: {
+                        key: 'terraform.resource',
+                        startsWith: 'aws_iam_',
+                    },
+                },
+            ],
+        };
+    }
+    iamResourceQuery(resource) {
+        return {
+            and: [
+                {
+                    attr: {
+                        key: 'terraform.kind',
+                        eq: 'resource',
+                    },
+                },
+                {
+                    attr: {
+                        key: 'terraform.resource',
+                        eq: resource,
+                    },
+                },
+            ],
+        };
+    }
+    iamAttachmentQuery() {
+        return {
+            and: [
+                {
+                    attr: {
+                        key: 'terraform.kind',
+                        eq: 'resource',
+                    },
+                },
+                {
+                    attr: {
+                        key: 'terraform.resource',
+                        in: IAM_ATTACHMENT_RESOURCES,
+                    },
+                },
+            ],
+        };
+    }
+    anyNonIamResourceQuery() {
+        return {
+            and: [
+                {
+                    attr: {
+                        key: 'terraform.kind',
+                        eq: 'resource',
+                    },
+                },
+                {
+                    not: {
+                        attr: {
+                            key: 'terraform.resource',
+                            startsWith: 'aws_iam_',
+                        },
+                    },
+                },
+            ],
+        };
+    }
+    orphanPrunableIamQuery() {
+        return {
+            or: [
+                {
+                    and: [
+                        {
+                            attr: {
+                                key: 'terraform.kind',
+                                eq: 'resource',
+                            },
+                        },
+                        {
+                            attr: {
+                                key: 'terraform.resource',
+                                in: IAM_ORPHAN_PRUNABLE_RESOURCES,
+                            },
+                        },
+                    ],
+                },
+                {
+                    and: [
+                        {
+                            attr: {
+                                key: 'terraform.kind',
+                                eq: 'data',
+                            },
+                        },
+                        {
+                            attr: {
+                                key: 'terraform.resource',
+                                in: IAM_ORPHAN_PRUNABLE_DATA_RESOURCES,
+                            },
+                        },
+                    ],
+                },
+            ],
+        };
+    }
+    buildCleanupPhases(options) {
+        const phases = [...this.toPhases('cleanup', this.buildIamDirectionPhases())];
+        if (!options.removeOrphans) {
+            return phases;
+        }
+        phases.push(...this.toPhases('cleanup', [
+            [
+                new core_1.RemoveLeafChain({
+                    node: this.orphanPrunableIamQuery(),
+                }),
+            ],
+        ]));
+        return phases;
+    }
+    buildPolicyDocumentPhases(options) {
+        if (options.policyDocuments === 'all') {
+            return [];
+        }
+        if (options.policyDocuments === 'none') {
+            return [
+                [
+                    new core_1.RemoveNodeAndReconnectEdges({
+                        node: {
+                            attr: {
+                                key: 'terraform.resource',
+                                eq: IAM_POLICY_DOCUMENT_RESOURCE,
+                            },
+                        },
+                    }),
+                ],
+            ];
+        }
+        return [
+            [
+                new core_1.RemoveNodeAndReconnectEdges({
+                    node: {
+                        and: [
+                            {
+                                attr: {
+                                    key: 'terraform.resource',
+                                    eq: IAM_POLICY_DOCUMENT_RESOURCE,
+                                },
+                            },
+                            {
+                                not: {
+                                    or: [
+                                        {
+                                            edge: {
+                                                in: {
+                                                    attr: {
+                                                        key: 'terraform.resource',
+                                                        eq: 'aws_iam_role',
+                                                    },
+                                                },
+                                            },
+                                        },
+                                        {
+                                            edge: {
+                                                out: {
+                                                    attr: {
+                                                        key: 'terraform.resource',
+                                                        eq: 'aws_iam_role',
+                                                    },
+                                                },
+                                            },
+                                        },
+                                    ],
+                                },
+                            },
+                        ],
+                    },
+                }),
+            ],
+        ];
+    }
+}
+exports.AwsIamGraphPlugin = AwsIamGraphPlugin;