alchemy-effect 0.6.0 → 0.6.2

package/src/AWS/IAM/InstanceProfile.ts

@@ -0,0 +1,285 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import { Resource } from "../../Resource.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasTags,
+} from "../../Tags.ts";
+import { toTagRecord } from "./common.ts";
+
+export interface InstanceProfileProps {
+  /**
+   * Name of the instance profile. If omitted, a deterministic name is generated.
+   */
+  instanceProfileName?: string;
+  /**
+   * Optional IAM path prefix.
+   * @default "/"
+   */
+  path?: string;
+  /**
+   * Optional role attached to the instance profile.
+   */
+  roleName?: Input<string>;
+  /**
+   * User-defined tags to apply to the instance profile.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface InstanceProfile extends Resource<
+  "AWS.IAM.InstanceProfile",
+  InstanceProfileProps,
+  {
+    instanceProfileArn: string;
+    instanceProfileName: string;
+    instanceProfileId: string | undefined;
+    path: string | undefined;
+    roleName: string | undefined;
+    tags: Record<string, string>;
+  }
+> {}
+
+/**
+ * An IAM instance profile that can present a role to EC2 instances.
+ *
+ * `InstanceProfile` bridges IAM roles into EC2 so compute instances can assume
+ * the attached role through the instance metadata service.
+ *
+ * @section Attaching Roles to EC2
+ * @example Create an Instance Profile
+ * ```typescript
+ * const role = yield* Role("InstanceRole", {
+ *   assumeRolePolicyDocument: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Principal: { Service: "ec2.amazonaws.com" },
+ *       Action: ["sts:AssumeRole"],
+ *     }],
+ *   },
+ * });
+ *
+ * const profile = yield* InstanceProfile("WebProfile", {
+ *   roleName: role.roleName,
+ * });
+ * ```
+ */
+export const InstanceProfile = Resource<InstanceProfile>(
+  "AWS.IAM.InstanceProfile",
+);
+
+export const InstanceProfileProvider = () =>
+  InstanceProfile.provider.effect(
+    Effect.gen(function* () {
+      const toName = (id: string, props: InstanceProfileProps) =>
+        props.instanceProfileName
+          ? Effect.succeed(props.instanceProfileName)
+          : createPhysicalName({ id, maxLength: 128 });
+
+      const readInstanceProfile = Effect.fn(function* (name: string) {
+        const response = yield* iam
+          .getInstanceProfile({
+            InstanceProfileName: name,
+          })
+          .pipe(
+            Effect.catchTag("NoSuchEntityException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.InstanceProfile;
+      });
+
+      const syncRole = Effect.fn(function* ({
+        profileName,
+        currentRoleName,
+        nextRoleName,
+      }: {
+        profileName: string;
+        currentRoleName: string | undefined;
+        nextRoleName: string | undefined;
+      }) {
+        if (currentRoleName && currentRoleName !== nextRoleName) {
+          yield* iam
+            .removeRoleFromInstanceProfile({
+              InstanceProfileName: profileName,
+              RoleName: currentRoleName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }
+        if (nextRoleName && currentRoleName !== nextRoleName) {
+          yield* iam.addRoleToInstanceProfile({
+            InstanceProfileName: profileName,
+            RoleName: nextRoleName,
+          });
+        }
+      });
+
+      return {
+        stables: [
+          "instanceProfileArn",
+          "instanceProfileName",
+          "instanceProfileId",
+        ],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toName(id, olds ?? ({} as InstanceProfileProps))) !==
+            (yield* toName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if ((olds?.path ?? "/") !== (news.path ?? "/")) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.instanceProfileName ??
+            (yield* toName(id, olds ?? ({} as InstanceProfileProps)));
+          const profile = yield* readInstanceProfile(name);
+          if (!profile?.Arn || !profile.InstanceProfileName) {
+            return undefined;
+          }
+          return {
+            instanceProfileArn: profile.Arn,
+            instanceProfileName: profile.InstanceProfileName,
+            instanceProfileId: profile.InstanceProfileId,
+            path: profile.Path,
+            roleName: profile.Roles?.[0]?.RoleName,
+            tags: toTagRecord(profile.Tags),
+          };
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+          const name = yield* toName(id, news);
+          const tags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+          yield* iam
+            .createInstanceProfile({
+              InstanceProfileName: name,
+              Path: news.path,
+              Tags: createTagsList(tags),
+            })
+            .pipe(
+              Effect.catchTag("EntityAlreadyExistsException", () =>
+                Effect.gen(function* () {
+                  const existing = yield* readInstanceProfile(name);
+                  if (!existing?.Arn) {
+                    return yield* Effect.fail(
+                      new Error(
+                        `Instance profile '${name}' already exists but could not be described`,
+                      ),
+                    );
+                  }
+                  if (!hasTags(tags, existing.Tags)) {
+                    return yield* Effect.fail(
+                      new Error(
+                        `Instance profile '${name}' already exists and is not managed by alchemy`,
+                      ),
+                    );
+                  }
+                }),
+              ),
+            );
+
+          yield* syncRole({
+            profileName: name,
+            currentRoleName: undefined,
+            nextRoleName: news.roleName as string | undefined,
+          });
+
+          const profile = yield* readInstanceProfile(name);
+          if (!profile?.Arn || !profile.InstanceProfileName) {
+            return yield* Effect.fail(
+              new Error(
+                `Instance profile '${name}' was not readable after create`,
+              ),
+            );
+          }
+
+          yield* session.note(profile.Arn);
+          return {
+            instanceProfileArn: profile.Arn,
+            instanceProfileName: profile.InstanceProfileName,
+            instanceProfileId: profile.InstanceProfileId,
+            path: profile.Path,
+            roleName: profile.Roles?.[0]?.RoleName,
+            tags,
+          };
+        }),
+        update: Effect.fn(function* ({ id, news, olds, output, session }) {
+          yield* syncRole({
+            profileName: output.instanceProfileName,
+            currentRoleName: olds.roleName as string | undefined,
+            nextRoleName: news.roleName as string | undefined,
+          });
+
+          const oldTags = {
+            ...(yield* createInternalTags(id)),
+            ...olds.tags,
+          };
+          const newTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+          const { removed, upsert } = diffTags(oldTags, newTags);
+          if (upsert.length > 0) {
+            yield* iam.tagInstanceProfile({
+              InstanceProfileName: output.instanceProfileName,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* iam.untagInstanceProfile({
+              InstanceProfileName: output.instanceProfileName,
+              TagKeys: removed,
+            });
+          }
+
+          const profile = yield* readInstanceProfile(
+            output.instanceProfileName,
+          );
+          yield* session.note(output.instanceProfileArn);
+          return {
+            instanceProfileArn: profile?.Arn ?? output.instanceProfileArn,
+            instanceProfileName:
+              profile?.InstanceProfileName ?? output.instanceProfileName,
+            instanceProfileId:
+              profile?.InstanceProfileId ?? output.instanceProfileId,
+            path: profile?.Path ?? output.path,
+            roleName: profile?.Roles?.[0]?.RoleName,
+            tags: newTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const profile = yield* readInstanceProfile(
+            output.instanceProfileName,
+          );
+          for (const role of profile?.Roles ?? []) {
+            if (role.RoleName) {
+              yield* iam
+                .removeRoleFromInstanceProfile({
+                  InstanceProfileName: output.instanceProfileName,
+                  RoleName: role.RoleName,
+                })
+                .pipe(
+                  Effect.catchTag("NoSuchEntityException", () => Effect.void),
+                );
+            }
+          }
+          yield* iam
+            .deleteInstanceProfile({
+              InstanceProfileName: output.instanceProfileName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+      };
+    }),
+  );

package/src/AWS/IAM/LoginProfile.ts

@@ -0,0 +1,137 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { Resource } from "../../Resource.ts";
+import { unwrapRedactedString } from "./common.ts";
+
+export interface LoginProfileProps {
+  /**
+   * User that owns the console login profile.
+   */
+  userName: string;
+  /**
+   * Console password. AWS never returns this value after create/update.
+   */
+  password: Redacted.Redacted<string> | string;
+  /**
+   * Require a password reset on next sign in.
+   */
+  passwordResetRequired?: boolean;
+}
+
+export interface LoginProfile extends Resource<
+  "AWS.IAM.LoginProfile",
+  LoginProfileProps,
+  {
+    userName: string;
+    createDate: Date | undefined;
+    passwordResetRequired: boolean | undefined;
+  }
+> {}
+
+/**
+ * An IAM console login profile for a user.
+ *
+ * `LoginProfile` manages AWS Management Console access for an IAM user. The
+ * password is write-only, so AWS never returns it during later reads.
+ *
+ * @section Managing Console Access
+ * @example Create a Console Login Profile
+ * ```typescript
+ * const user = yield* User("ConsoleUser", {
+ *   userName: "console-user",
+ * });
+ *
+ * const profile = yield* LoginProfile("ConsoleLogin", {
+ *   userName: user.userName,
+ *   password: Redacted.make("TempPassword123!"),
+ *   passwordResetRequired: true,
+ * });
+ * ```
+ */
+export const LoginProfile = Resource<LoginProfile>("AWS.IAM.LoginProfile");
+
+export const LoginProfileProvider = () =>
+  LoginProfile.provider.succeed({
+    stables: ["userName"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (olds.userName !== news.userName) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const response = yield* iam
+        .getLoginProfile({
+          UserName: output.userName,
+        })
+        .pipe(
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      if (!response?.LoginProfile) {
+        return undefined;
+      }
+      return {
+        userName: response.LoginProfile.UserName,
+        createDate: response.LoginProfile.CreateDate,
+        passwordResetRequired: response.LoginProfile.PasswordResetRequired,
+      };
+    }),
+    create: Effect.fn(function* ({ news, session }) {
+      const response = yield* iam
+        .createLoginProfile({
+          UserName: news.userName,
+          Password: unwrapRedactedString(news.password),
+          PasswordResetRequired: news.passwordResetRequired,
+        })
+        .pipe(
+          Effect.catchTag("EntityAlreadyExistsException", () =>
+            Effect.gen(function* () {
+              yield* iam.updateLoginProfile({
+                UserName: news.userName,
+                Password: unwrapRedactedString(news.password),
+                PasswordResetRequired: news.passwordResetRequired,
+              });
+              return yield* iam.getLoginProfile({
+                UserName: news.userName,
+              });
+            }),
+          ),
+        );
+      yield* session.note(news.userName);
+      return {
+        userName: response.LoginProfile.UserName,
+        createDate: response.LoginProfile.CreateDate,
+        passwordResetRequired: response.LoginProfile.PasswordResetRequired,
+      };
+    }),
+    update: Effect.fn(function* ({ news, output, session }) {
+      yield* iam.updateLoginProfile({
+        UserName: output.userName,
+        Password: unwrapRedactedString(news.password),
+        PasswordResetRequired: news.passwordResetRequired,
+      });
+      const response = yield* iam.getLoginProfile({
+        UserName: output.userName,
+      });
+      yield* session.note(output.userName);
+      return {
+        userName: response.LoginProfile.UserName,
+        createDate: response.LoginProfile.CreateDate,
+        passwordResetRequired: response.LoginProfile.PasswordResetRequired,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* iam
+        .deleteLoginProfile({
+          UserName: output.userName,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+  });

package/src/AWS/IAM/OpenIDConnectProvider.ts

@@ -0,0 +1,192 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { Resource } from "../../Resource.ts";
+import { diffTags } from "../../Tags.ts";
+import { Account } from "../Account.ts";
+import { toTagRecord } from "./common.ts";
+
+export interface OpenIDConnectProviderProps {
+  /**
+   * The identity provider URL.
+   */
+  url: string;
+  /**
+   * Client IDs allowed for the provider.
+   */
+  clientIDList?: string[];
+  /**
+   * Certificate thumbprints for the provider.
+   */
+  thumbprintList?: string[];
+  /**
+   * User-defined tags to apply to the provider.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface OpenIDConnectProvider extends Resource<
+  "AWS.IAM.OpenIDConnectProvider",
+  OpenIDConnectProviderProps,
+  {
+    openIDConnectProviderArn: string;
+    url: string;
+    clientIDList: string[];
+    thumbprintList: string[];
+    tags: Record<string, string>;
+  }
+> {}
+
+/**
+ * An IAM OpenID Connect provider for web identity federation.
+ *
+ * `OpenIDConnectProvider` registers an external OIDC issuer so IAM roles can be
+ * assumed through web identity federation flows such as GitHub Actions.
+ *
+ * @section Federating with OIDC
+ * @example Create a GitHub Actions OIDC Provider
+ * ```typescript
+ * const oidc = yield* OpenIDConnectProvider("GithubOidc", {
+ *   url: "https://token.actions.githubusercontent.com",
+ *   clientIDList: ["sts.amazonaws.com"],
+ *   thumbprintList: ["6938fd4d98bab03faadb97b34396831e3780aea1"],
+ * });
+ * ```
+ */
+export const OpenIDConnectProvider = Resource<OpenIDConnectProvider>(
+  "AWS.IAM.OpenIDConnectProvider",
+);
+
+export const OpenIDConnectProviderProvider = () =>
+  OpenIDConnectProvider.provider.effect(
+    Effect.gen(function* () {
+      const accountId = yield* Account;
+      const oidcArnFromUrl = (url: string) =>
+        `arn:aws:iam::${accountId}:oidc-provider/${url.replace(/^https?:\/\//, "")}`;
+
+      const readProvider = Effect.fn(function* (providerArn: string) {
+        const response = yield* iam
+          .getOpenIDConnectProvider({
+            OpenIDConnectProviderArn: providerArn,
+          })
+          .pipe(
+            Effect.catchTag("NoSuchEntityException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response;
+      });
+
+      return {
+        stables: ["openIDConnectProviderArn"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (olds.url !== news.url) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          const providerArn =
+            output?.openIDConnectProviderArn ?? oidcArnFromUrl(olds.url);
+          const provider = yield* readProvider(providerArn);
+          if (!provider?.Url) {
+            return undefined;
+          }
+          const tags = yield* iam.listOpenIDConnectProviderTags({
+            OpenIDConnectProviderArn: providerArn,
+          });
+          return {
+            openIDConnectProviderArn: providerArn,
+            url: provider.Url,
+            clientIDList: provider.ClientIDList ?? [],
+            thumbprintList: provider.ThumbprintList ?? [],
+            tags: toTagRecord(tags.Tags),
+          };
+        }),
+        create: Effect.fn(function* ({ news, session }) {
+          const created = yield* iam.createOpenIDConnectProvider({
+            Url: news.url,
+            ClientIDList: news.clientIDList,
+            ThumbprintList: news.thumbprintList,
+            Tags: Object.entries(news.tags ?? {}).map(([Key, Value]) => ({
+              Key,
+              Value,
+            })),
+          });
+
+          const providerArn =
+            created.OpenIDConnectProviderArn ?? oidcArnFromUrl(news.url);
+          yield* session.note(providerArn);
+          return {
+            openIDConnectProviderArn: providerArn,
+            url: news.url,
+            clientIDList: news.clientIDList ?? [],
+            thumbprintList: news.thumbprintList ?? [],
+            tags: news.tags ?? {},
+          };
+        }),
+        update: Effect.fn(function* ({ news, olds, output, session }) {
+          const oldClientIds = new Set(olds.clientIDList ?? []);
+          const newClientIds = new Set(news.clientIDList ?? []);
+          for (const clientId of news.clientIDList ?? []) {
+            if (!oldClientIds.has(clientId)) {
+              yield* iam.addClientIDToOpenIDConnectProvider({
+                OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+                ClientID: clientId,
+              });
+            }
+          }
+          for (const clientId of olds.clientIDList ?? []) {
+            if (!newClientIds.has(clientId)) {
+              yield* iam.removeClientIDFromOpenIDConnectProvider({
+                OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+                ClientID: clientId,
+              });
+            }
+          }
+          if (
+            JSON.stringify(olds.thumbprintList ?? []) !==
+            JSON.stringify(news.thumbprintList ?? [])
+          ) {
+            yield* iam.updateOpenIDConnectProviderThumbprint({
+              OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+              ThumbprintList: news.thumbprintList ?? [],
+            });
+          }
+
+          const { removed, upsert } = diffTags(
+            olds.tags ?? {},
+            news.tags ?? {},
+          );
+          if (upsert.length > 0) {
+            yield* iam.tagOpenIDConnectProvider({
+              OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* iam.untagOpenIDConnectProvider({
+              OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(output.openIDConnectProviderArn);
+          return {
+            openIDConnectProviderArn: output.openIDConnectProviderArn,
+            url: output.url,
+            clientIDList: news.clientIDList ?? [],
+            thumbprintList: news.thumbprintList ?? [],
+            tags: news.tags ?? {},
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* iam
+            .deleteOpenIDConnectProvider({
+              OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+      };
+    }),
+  );