@terra-graph/conventions-aws 1.0.0-rc.1

package/dist/cjs/plugins/AwsIam.test.js

@@ -0,0 +1,468 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@terra-graph/core");
+const AwsIam_js_1 = require("./AwsIam.js");
+const buildPhases = (options = {}) => {
+    const plugin = new AwsIam_js_1.AwsIamGraphPlugin();
+    const result = plugin.build({
+        options,
+        namedRules: new core_1.NamedRuleRegistry(),
+        namedRuleSets: new core_1.NamedRuleSetRegistry(),
+    });
+    return (result.phases ?? []).map((phase) => ({
+        phase: phase.phase,
+        rules: phase.rules.map((rule) => rule.serialize()),
+    }));
+};
+describe('AwsIamGraphPlugin.build', () => {
+    it('shoud default to a roles_only projection without semantics', () => {
+        const phases = buildPhases();
+        expect(phases).toHaveLength(5);
+        expect(phases.map((phase) => phase.phase)).toStrictEqual([
+            'normalize',
+            'main',
+            'main',
+            'main',
+            'cleanup',
+        ]);
+        expect(phases[0]?.rules).toHaveLength(9);
+        expect(phases[0]?.rules.every((rule) => rule.id === 'EdgeReverse')).toBe(true);
+        expect(phases[1]?.rules[0]).toStrictEqual({
+            id: 'NodeProperties',
+            config: {
+                node: {
+                    and: [
+                        {
+                            attr: {
+                                key: 'terraform.kind',
+                                in: ['resource', 'data'],
+                            },
+                        },
+                        {
+                            attr: {
+                                key: 'terraform.resource',
+                                startsWith: 'aws_iam_',
+                            },
+                        },
+                        {
+                            attr: {
+                                key: 'terraform.moduleAddress',
+                                exists: true,
+                            },
+                        },
+                    ],
+                },
+                options: {
+                    hints: {
+                        label: {
+                            end: {
+                                from: 'terraform.name',
+                            },
+                        },
+                    },
+                },
+            },
+        });
+        expect(phases[2]?.rules[0]).toStrictEqual({
+            id: 'RemoveNodeAndReconnectEdges',
+            config: {
+                node: {
+                    attr: {
+                        key: 'terraform.resource',
+                        in: ['aws_iam_role_policy_attachment', 'aws_iam_policy_attachment'],
+                    },
+                },
+            },
+        });
+        expect(phases[3]?.rules[0]).toStrictEqual({
+            id: 'RemoveNodeAndReconnectEdges',
+            config: {
+                node: {
+                    and: [
+                        {
+                            attr: {
+                                key: 'terraform.resource',
+                                startsWith: 'aws_iam_',
+                            },
+                        },
+                        {
+                            not: {
+                                attr: {
+                                    key: 'terraform.resource',
+                                    in: ['aws_iam_role'],
+                                },
+                            },
+                        },
+                    ],
+                },
+            },
+        });
+        expect(phases[4]?.rules).toHaveLength(9);
+        expect(phases[4]?.rules.every((rule) => rule.id === 'EdgeReverse')).toBe(true);
+    });
+    it('shoud keep attachments and policies when configured for roles_policies', () => {
+        const phases = buildPhases({
+            mode: 'roles_policies',
+            attachments: 'keep',
+        });
+        expect(phases).toHaveLength(4);
+        expect(phases[0]?.phase).toBe('normalize');
+        expect(phases[0]?.rules).toHaveLength(9);
+        expect(phases[1]?.phase).toBe('main');
+        expect(phases[1]?.rules[0]?.id).toBe('NodeProperties');
+        expect(phases[2]?.phase).toBe('main');
+        expect(phases[2]?.rules[0]).toStrictEqual({
+            id: 'RemoveNodeAndReconnectEdges',
+            config: {
+                node: {
+                    and: [
+                        {
+                            attr: {
+                                key: 'terraform.resource',
+                                startsWith: 'aws_iam_',
+                            },
+                        },
+                        {
+                            not: {
+                                attr: {
+                                    key: 'terraform.resource',
+                                    in: [
+                                        'aws_iam_role',
+                                        'aws_iam_policy',
+                                        'aws_iam_role_policy',
+                                        'aws_iam_role_policy_attachment',
+                                        'aws_iam_policy_attachment',
+                                    ],
+                                },
+                            },
+                        },
+                    ],
+                },
+            },
+        });
+        expect(phases[3]?.phase).toBe('cleanup');
+        expect(phases[3]?.rules.every((rule) => rule.id === 'EdgeReverse')).toBe(true);
+    });
+    it('shoud build no phases for full mode defaults', () => {
+        const phases = buildPhases({
+            mode: 'full',
+        });
+        expect(phases).toHaveLength(3);
+        expect(phases[0]?.phase).toBe('normalize');
+        expect(phases[0]?.rules).toHaveLength(9);
+        expect(phases[1]?.phase).toBe('main');
+        expect(phases[1]?.rules[0]?.id).toBe('NodeProperties');
+        expect(phases[2]?.phase).toBe('cleanup');
+        expect(phases[2]?.rules.every((rule) => rule.id === 'EdgeReverse')).toBe(true);
+    });
+    it('shoud support convert_to_edge attachments with policy document removal in full mode', () => {
+        const phases = buildPhases({
+            mode: 'full',
+            attachments: 'convert_to_edge',
+            policyDocuments: 'none',
+        });
+        expect(phases.map((phase) => phase.phase)).toStrictEqual([
+            'normalize',
+            'main',
+            'main',
+            'main',
+            'main',
+            'cleanup',
+        ]);
+        expect(phases.map((phase) => phase.rules[0]?.id)).toStrictEqual([
+            'EdgeReverse',
+            'NodeProperties',
+            'ConvertNodeToEdge',
+            'RemoveNodeAndReconnectEdges',
+            'RemoveNodeAndReconnectEdges',
+            'EdgeReverse',
+        ]);
+        expect(phases[4]?.rules[0]).toStrictEqual({
+            id: 'RemoveNodeAndReconnectEdges',
+            config: {
+                node: {
+                    attr: {
+                        key: 'terraform.resource',
+                        eq: 'aws_iam_policy_document',
+                    },
+                },
+            },
+        });
+    });
+    it('shoud keep only trust policy documents when trust_only is configured', () => {
+        const phases = buildPhases({
+            mode: 'full',
+            policyDocuments: 'trust_only',
+        });
+        expect(phases).toHaveLength(4);
+        expect(phases[0]?.phase).toBe('normalize');
+        expect(phases[0]?.rules).toHaveLength(9);
+        expect(phases[1]?.phase).toBe('main');
+        expect(phases[1]?.rules[0]?.id).toBe('NodeProperties');
+        expect(phases[2]?.phase).toBe('main');
+        expect(phases[2]?.rules[0]).toStrictEqual({
+            id: 'RemoveNodeAndReconnectEdges',
+            config: {
+                node: {
+                    and: [
+                        {
+                            attr: {
+                                key: 'terraform.resource',
+                                eq: 'aws_iam_policy_document',
+                            },
+                        },
+                        {
+                            not: {
+                                or: [
+                                    {
+                                        edge: {
+                                            in: {
+                                                attr: {
+                                                    key: 'terraform.resource',
+                                                    eq: 'aws_iam_role',
+                                                },
+                                            },
+                                        },
+                                    },
+                                    {
+                                        edge: {
+                                            out: {
+                                                attr: {
+                                                    key: 'terraform.resource',
+                                                    eq: 'aws_iam_role',
+                                                },
+                                            },
+                                        },
+                                    },
+                                ],
+                            },
+                        },
+                    ],
+                },
+            },
+        });
+        expect(phases[3]?.phase).toBe('cleanup');
+        expect(phases[3]?.rules.every((rule) => rule.id === 'EdgeReverse')).toBe(true);
+    });
+    it('shoud keep policy documents in non-full trust_only mode', () => {
+        const phases = buildPhases({
+            mode: 'roles_only',
+            policyDocuments: 'trust_only',
+        });
+        expect(phases.map((phase) => phase.phase)).toStrictEqual([
+            'normalize',
+            'main',
+            'main',
+            'main',
+            'main',
+            'cleanup',
+        ]);
+        expect(phases[3]?.rules[0]).toStrictEqual({
+            id: 'RemoveNodeAndReconnectEdges',
+            config: {
+                node: {
+                    and: [
+                        {
+                            attr: {
+                                key: 'terraform.resource',
+                                startsWith: 'aws_iam_',
+                            },
+                        },
+                        {
+                            not: {
+                                attr: {
+                                    key: 'terraform.resource',
+                                    in: ['aws_iam_role', 'aws_iam_policy_document'],
+                                },
+                            },
+                        },
+                    ],
+                },
+            },
+        });
+        expect(phases[4]?.rules[0]).toStrictEqual({
+            id: 'RemoveNodeAndReconnectEdges',
+            config: {
+                node: {
+                    and: [
+                        {
+                            attr: {
+                                key: 'terraform.resource',
+                                eq: 'aws_iam_policy_document',
+                            },
+                        },
+                        {
+                            not: {
+                                or: [
+                                    {
+                                        edge: {
+                                            in: {
+                                                attr: {
+                                                    key: 'terraform.resource',
+                                                    eq: 'aws_iam_role',
+                                                },
+                                            },
+                                        },
+                                    },
+                                    {
+                                        edge: {
+                                            out: {
+                                                attr: {
+                                                    key: 'terraform.resource',
+                                                    eq: 'aws_iam_role',
+                                                },
+                                            },
+                                        },
+                                    },
+                                ],
+                            },
+                        },
+                    ],
+                },
+            },
+        });
+    });
+    it('shoud throw for invalid option values', () => {
+        const plugin = new AwsIam_js_1.AwsIamGraphPlugin();
+        expect(() => plugin.build({
+            options: { mode: 'invalid' },
+            namedRules: new core_1.NamedRuleRegistry(),
+            namedRuleSets: new core_1.NamedRuleSetRegistry(),
+        })).toThrow(`${AwsIam_js_1.AwsIamGraphPlugin.id} options.mode must be one of: roles_only, roles_policies, full`);
+        expect(() => plugin.build({
+            options: {
+                removeOrphans: 'yes',
+            },
+            namedRules: new core_1.NamedRuleRegistry(),
+            namedRuleSets: new core_1.NamedRuleSetRegistry(),
+        })).toThrow(`${AwsIam_js_1.AwsIamGraphPlugin.id} options.removeOrphans must be a boolean`);
+    });
+    it('shoud throw for invalid attachment mode values', () => {
+        const plugin = new AwsIam_js_1.AwsIamGraphPlugin();
+        expect(() => plugin.build({
+            options: {
+                attachments: 'invalid',
+            },
+            namedRules: new core_1.NamedRuleRegistry(),
+            namedRuleSets: new core_1.NamedRuleSetRegistry(),
+        })).toThrow(`${AwsIam_js_1.AwsIamGraphPlugin.id} options.attachments must be one of: remove, convert_to_edge, keep`);
+    });
+    it('shoud throw for invalid policy document mode values', () => {
+        const plugin = new AwsIam_js_1.AwsIamGraphPlugin();
+        expect(() => plugin.build({
+            options: {
+                policyDocuments: 'invalid',
+            },
+            namedRules: new core_1.NamedRuleRegistry(),
+            namedRuleSets: new core_1.NamedRuleSetRegistry(),
+        })).toThrow(`${AwsIam_js_1.AwsIamGraphPlugin.id} options.policyDocuments must be one of: none, trust_only, all`);
+    });
+    it('shoud keep attachment resources when full mode is configured as keep', () => {
+        const phases = buildPhases({
+            mode: 'full',
+            attachments: 'keep',
+        });
+        expect(phases).toHaveLength(3);
+        expect(phases.map((phase) => phase.phase)).toStrictEqual(['normalize', 'main', 'cleanup']);
+        expect(phases[1]?.rules).toHaveLength(1);
+        expect(phases[1]?.rules[0]?.id).toBe('NodeProperties');
+        expect(phases[2]?.rules).toHaveLength(9);
+        expect(phases[2]?.rules.every((rule) => rule.id === 'EdgeReverse')).toBe(true);
+    });
+    it('shoud remove attachment nodes explicitly when full mode uses remove', () => {
+        const phases = buildPhases({
+            mode: 'full',
+            attachments: 'remove',
+        });
+        expect(phases).toHaveLength(4);
+        expect(phases.map((phase) => phase.phase)).toStrictEqual([
+            'normalize',
+            'main',
+            'main',
+            'cleanup',
+        ]);
+        expect(phases[2]?.rules[0]).toStrictEqual({
+            id: 'RemoveNodeAndReconnectEdges',
+            config: {
+                node: {
+                    attr: {
+                        key: 'terraform.resource',
+                        in: ['aws_iam_role_policy_attachment', 'aws_iam_policy_attachment'],
+                    },
+                },
+            },
+        });
+    });
+    it('shoud add a final orphan cleanup phase when removeOrphans is enabled', () => {
+        const phases = buildPhases({
+            mode: 'roles_only',
+            removeOrphans: true,
+        });
+        expect(phases).toHaveLength(6);
+        expect(phases.map((phase) => phase.phase)).toStrictEqual([
+            'normalize',
+            'main',
+            'main',
+            'main',
+            'cleanup',
+            'cleanup',
+        ]);
+        expect(phases[5]?.rules[0]).toStrictEqual({
+            id: 'RemoveLeafChain',
+            config: {
+                node: {
+                    or: [
+                        {
+                            and: [
+                                {
+                                    attr: {
+                                        key: 'terraform.kind',
+                                        eq: 'resource',
+                                    },
+                                },
+                                {
+                                    attr: {
+                                        key: 'terraform.resource',
+                                        in: [
+                                            'aws_iam_role',
+                                            'aws_iam_policy',
+                                            'aws_iam_role_policy',
+                                            'aws_iam_role_policy_attachment',
+                                            'aws_iam_policy_attachment',
+                                        ],
+                                    },
+                                },
+                            ],
+                        },
+                        {
+                            and: [
+                                {
+                                    attr: {
+                                        key: 'terraform.kind',
+                                        eq: 'data',
+                                    },
+                                },
+                                {
+                                    attr: {
+                                        key: 'terraform.resource',
+                                        in: ['aws_iam_policy_document', 'aws_iam_policy'],
+                                    },
+                                },
+                            ],
+                        },
+                    ],
+                },
+            },
+        });
+    });
+    it('shoud not add orphan cleanup when removeOrphans is false', () => {
+        const phases = buildPhases({
+            mode: 'roles_only',
+            removeOrphans: false,
+        });
+        expect(phases).toHaveLength(5);
+        expect(phases.map((phase) => phase.phase)).toContain('cleanup');
+        expect(phases.map((phase) => phase.rules[0]?.id)).not.toContain('RemoveLeafChain');
+        expect(phases[4]?.rules[0]?.id).toBe('EdgeReverse');
+    });
+});

package/dist/cjs/plugins/AwsS3.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsS3 = void 0;
+const core_1 = require("@terra-graph/core");
+const namespaces_js_1 = require("../namespaces.js");
+const S3_DEFAULT_KEEP_RESOURCES = ['aws_s3_bucket', 'aws_s3_bucket_notification'];
+// TODO: this feels like part of conventions not a usefule plugin
+class AwsS3 extends core_1.GraphPlugin {
+    static id = (0, namespaces_js_1.pluginId)(`aws.${AwsS3.name}`);
+    constructor(options = {}) {
+        const keepResources = Array.isArray(options.keepResources)
+            ? options.keepResources
+            : S3_DEFAULT_KEEP_RESOURCES;
+        super(AwsS3.id, {
+            keepResources: [...keepResources],
+        });
+    }
+    build({ options, }) {
+        const keepResources = Array.isArray(options.keepResources)
+            ? options.keepResources
+            : S3_DEFAULT_KEEP_RESOURCES;
+        return {
+            phases: [
+                {
+                    phase: 'pre',
+                    rules: [
+                        new core_1.RemoveNodeAndReconnectEdges({
+                            node: {
+                                and: [
+                                    {
+                                        attr: {
+                                            key: 'terraform.resource',
+                                            startsWith: 'aws_s3_',
+                                        },
+                                    },
+                                    {
+                                        not: {
+                                            attr: {
+                                                key: 'terraform.resource',
+                                                in: keepResources,
+                                            },
+                                        },
+                                    },
+                                ],
+                            },
+                        }),
+                        // new EdgeReverse({
+                        //   edge: {
+                        //     from: {
+                        //       attr: {
+                        //         key: 'terraform.resource',
+                        //         eq: 'aws_s3_bucket',
+                        //       },
+                        //     },
+                        //     to: {
+                        //       attr: {
+                        //         key: 'terraform.resource',
+                        //         eq: 'aws_s3_bucket_notification',
+                        //       },
+                        //     },
+                        //   },
+                        // }),
+                    ],
+                },
+                {
+                    phase: 'pre',
+                    rules: [
+                        new core_1.RemoveNode({
+                            node: {
+                                and: [
+                                    {
+                                        attr: {
+                                            key: 'terraform.resource',
+                                            eq: 'aws_s3_bucket_object',
+                                        },
+                                    },
+                                    {
+                                        not: {
+                                            attr: {
+                                                key: 'terraform.resource',
+                                                in: keepResources,
+                                            },
+                                        },
+                                    },
+                                ],
+                            },
+                        }),
+                    ],
+                },
+                {
+                    phase: 'main',
+                    rules: [
+                    // new ConvertNodeToEdge({
+                    //   node: {
+                    //     attr: {
+                    //       key: 'terraform.resource',
+                    //       eq: 'aws_s3_bucket_notification',
+                    //     },
+                    //   },
+                    // }),
+                    ],
+                },
+            ],
+        };
+    }
+}
+exports.AwsS3 = AwsS3;

package/dist/cjs/plugins/AwsS3.test.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@terra-graph/core");
+const AwsS3_js_1 = require("./AwsS3.js");
+const buildPhases = (options = {}) => {
+    const plugin = new AwsS3_js_1.AwsS3();
+    const result = plugin.build({
+        options,
+        namedRules: new core_1.NamedRuleRegistry(),
+        namedRuleSets: new core_1.NamedRuleSetRegistry(),
+    });
+    return (result.phases ?? []).map((phase) => ({
+        phase: phase.phase,
+        rules: phase.rules.map((rule) => rule.serialize()),
+    }));
+};
+describe('AwsS3.build', () => {
+    it('shoud remove non-default s3 resources and keep aws_s3_bucket and notifications', () => {
+        const phases = buildPhases();
+        expect(phases).toHaveLength(3);
+        expect(phases.map((phase) => phase.phase)).toStrictEqual(['pre', 'pre', 'main']);
+        expect(phases[0]?.rules[0]).toStrictEqual({
+            id: 'RemoveNodeAndReconnectEdges',
+            config: {
+                node: {
+                    and: [
+                        {
+                            attr: {
+                                key: 'terraform.resource',
+                                startsWith: 'aws_s3_',
+                            },
+                        },
+                        {
+                            not: {
+                                attr: {
+                                    key: 'terraform.resource',
+                                    in: ['aws_s3_bucket', 'aws_s3_bucket_notification'],
+                                },
+                            },
+                        },
+                    ],
+                },
+            },
+        });
+        expect(phases[1]?.rules[0]).toStrictEqual({
+            id: 'RemoveNode',
+            config: {
+                node: {
+                    and: [
+                        {
+                            attr: {
+                                key: 'terraform.resource',
+                                eq: 'aws_s3_bucket_object',
+                            },
+                        },
+                        {
+                            not: {
+                                attr: {
+                                    key: 'terraform.resource',
+                                    in: ['aws_s3_bucket', 'aws_s3_bucket_notification'],
+                                },
+                            },
+                        },
+                    ],
+                },
+            },
+        });
+        expect(phases[2]?.rules).toHaveLength(0);
+    });
+    it('shoud keep custom resources when keepResources is configured', () => {
+        const keepResources = ['aws_s3_bucket', 'aws_s3_access_point'];
+        const phases = buildPhases({ keepResources });
+        expect(phases[0]?.rules[0]).toStrictEqual({
+            id: 'RemoveNodeAndReconnectEdges',
+            config: {
+                node: {
+                    and: [
+                        {
+                            attr: {
+                                key: 'terraform.resource',
+                                startsWith: 'aws_s3_',
+                            },
+                        },
+                        {
+                            not: {
+                                attr: {
+                                    key: 'terraform.resource',
+                                    in: keepResources,
+                                },
+                            },
+                        },
+                    ],
+                },
+            },
+        });
+    });
+    it('shoud use custom constructor keepResources when provided', () => {
+        const keepResources = ['aws_s3_bucket', 'aws_s3_bucket_notification', 'aws_s3_access_point'];
+        const plugin = new AwsS3_js_1.AwsS3({ keepResources });
+        expect(plugin.defaults).toStrictEqual({ keepResources });
+    });
+});