alchemy 2.0.0-beta.4 → 2.0.0-beta.41

package/lib/AWS/IAM/Role.js

@@ -0,0 +1,308 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.js";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { createInternalTags, createTagsList, diffTags, hasAlchemyTags, } from "../../Tags.js";
+import { AWSEnvironment } from "../Environment.js";
+import { parsePolicyDocument, stringifyPolicyDocument, toTagRecord, } from "./common.js";
+/**
+ * An IAM role for AWS services and runtimes.
+ *
+ * @section Creating Roles
+ * @example ECS Task Role
+ * ```typescript
+ * const role = yield* Role("TaskRole", {
+ *   assumeRolePolicyDocument: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Principal: { Service: "ecs-tasks.amazonaws.com" },
+ *       Action: ["sts:AssumeRole"],
+ *     }],
+ *   },
+ * });
+ * ```
+ */
+export const Role = Resource("AWS.IAM.Role");
+export const RoleProvider = () => Provider.effect(Role, Effect.gen(function* () {
+    yield* AWSEnvironment;
+    const toRoleName = (id, props = {}) => props.roleName
+        ? Effect.succeed(props.roleName)
+        : createPhysicalName({ id, maxLength: 64 });
+    const readInlinePolicies = Effect.fn(function* (roleName) {
+        const listed = yield* iam.listRolePolicies({
+            RoleName: roleName,
+        });
+        const entries = yield* Effect.all((listed.PolicyNames ?? []).map((policyName) => iam
+            .getRolePolicy({
+            RoleName: roleName,
+            PolicyName: policyName,
+        })
+            .pipe(Effect.map((response) => [
+            policyName,
+            parsePolicyDocument(response.PolicyDocument),
+        ]), Effect.catchTag("NoSuchEntityException", () => Effect.succeed([policyName, undefined])))));
+        return Object.fromEntries(entries.filter((entry) => entry[1] !== undefined));
+    });
+    const readManagedPolicies = Effect.fn(function* (roleName) {
+        const listed = yield* iam.listAttachedRolePolicies({
+            RoleName: roleName,
+        });
+        return (listed.AttachedPolicies ?? [])
+            .map((policy) => policy.PolicyArn)
+            .filter((policyArn) => typeof policyArn === "string");
+    });
+    const readTags = Effect.fn(function* (roleName) {
+        const listed = yield* iam.listRoleTags({
+            RoleName: roleName,
+        });
+        return toTagRecord(listed.Tags);
+    });
+    const syncManagedPolicies = Effect.fn(function* ({ roleName, olds, news, }) {
+        const oldSet = new Set(olds);
+        const newSet = new Set(news);
+        for (const policyArn of news) {
+            if (!oldSet.has(policyArn)) {
+                yield* iam.attachRolePolicy({
+                    RoleName: roleName,
+                    PolicyArn: policyArn,
+                });
+            }
+        }
+        for (const policyArn of olds) {
+            if (!newSet.has(policyArn)) {
+                yield* iam
+                    .detachRolePolicy({
+                    RoleName: roleName,
+                    PolicyArn: policyArn,
+                })
+                    .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+            }
+        }
+    });
+    const syncInlinePolicies = Effect.fn(function* ({ roleName, olds, news, }) {
+        for (const [policyName, document] of Object.entries(news)) {
+            if (JSON.stringify(olds[policyName] ?? null) !==
+                JSON.stringify(document)) {
+                yield* iam.putRolePolicy({
+                    RoleName: roleName,
+                    PolicyName: policyName,
+                    PolicyDocument: stringifyPolicyDocument(document),
+                });
+            }
+        }
+        for (const policyName of Object.keys(olds)) {
+            if (!(policyName in news)) {
+                yield* iam
+                    .deleteRolePolicy({
+                    RoleName: roleName,
+                    PolicyName: policyName,
+                })
+                    .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+            }
+        }
+    });
+    return {
+        stables: ["roleArn", "roleName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+            if (!isResolved(news))
+                return;
+            if ((yield* toRoleName(id, olds ?? {})) !==
+                (yield* toRoleName(id, news ?? {}))) {
+                return { action: "replace" };
+            }
+            if ((olds?.path ?? "/") !== (news.path ?? "/")) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            const roleName = output?.roleName ?? (yield* toRoleName(id, olds ?? {}));
+            const role = yield* iam
+                .getRole({
+                RoleName: roleName,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+            if (!role?.Role) {
+                return undefined;
+            }
+            const [managedPolicyArns, inlinePolicies, tags] = yield* Effect.all([
+                readManagedPolicies(roleName),
+                readInlinePolicies(roleName),
+                readTags(roleName),
+            ]);
+            const assumeRolePolicyDocument = parsePolicyDocument(role.Role.AssumeRolePolicyDocument) ??
+                output?.assumeRolePolicyDocument;
+            if (!assumeRolePolicyDocument) {
+                return undefined;
+            }
+            const attrs = {
+                roleArn: role.Role.Arn,
+                roleName: role.Role.RoleName,
+                roleId: role.Role.RoleId,
+                path: role.Role.Path,
+                assumeRolePolicyDocument,
+                managedPolicyArns,
+                inlinePolicies,
+                description: role.Role.Description,
+                maxSessionDuration: role.Role.MaxSessionDuration,
+                permissionsBoundary: role.Role.PermissionsBoundary?.PermissionsBoundaryArn,
+                tags,
+            };
+            return (yield* hasAlchemyTags(id, tags)) ? attrs : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+            const roleName = output?.roleName ?? (yield* toRoleName(id, news));
+            const desiredTags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            // Observe — read the role from IAM. Absence is signalled by
+            // `NoSuchEntityException`; ownership has already been verified
+            // upstream so adopting a `Unowned` role is the engine's call.
+            let observedRole = yield* iam
+                .getRole({ RoleName: roleName })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+            // Ensure — create the role when missing. A peer reconciler may
+            // have created it concurrently; tolerate that race by reading
+            // the existing role.
+            if (!observedRole?.Role) {
+                observedRole = yield* iam
+                    .createRole({
+                    Path: news.path,
+                    RoleName: roleName,
+                    AssumeRolePolicyDocument: stringifyPolicyDocument(news.assumeRolePolicyDocument),
+                    Description: news.description,
+                    MaxSessionDuration: news.maxSessionDuration,
+                    PermissionsBoundary: news.permissionsBoundary,
+                    Tags: createTagsList(desiredTags),
+                })
+                    .pipe(Effect.catchTag("EntityAlreadyExistsException", () => iam.getRole({ RoleName: roleName })));
+            }
+            const observedAssumePolicy = parsePolicyDocument(observedRole.Role?.AssumeRolePolicyDocument);
+            const observedDescription = observedRole.Role?.Description;
+            const observedMaxSessionDuration = observedRole.Role?.MaxSessionDuration;
+            const observedPermissionsBoundary = observedRole.Role?.PermissionsBoundary?.PermissionsBoundaryArn;
+            // Sync assume-role policy — only call updateAssumeRolePolicy
+            // when the document actually differs.
+            if (JSON.stringify(observedAssumePolicy ?? null) !==
+                JSON.stringify(news.assumeRolePolicyDocument)) {
+                yield* iam.updateAssumeRolePolicy({
+                    RoleName: roleName,
+                    PolicyDocument: stringifyPolicyDocument(news.assumeRolePolicyDocument),
+                });
+            }
+            // Sync description / maxSessionDuration via updateRole.
+            if (observedDescription !== news.description ||
+                observedMaxSessionDuration !== news.maxSessionDuration) {
+                yield* iam.updateRole({
+                    RoleName: roleName,
+                    Description: news.description,
+                    MaxSessionDuration: news.maxSessionDuration,
+                });
+            }
+            // Sync permissions boundary — put when desired, delete when
+            // cleared, no-op when unchanged.
+            if (news.permissionsBoundary !== observedPermissionsBoundary) {
+                if (news.permissionsBoundary) {
+                    yield* iam.putRolePermissionsBoundary({
+                        RoleName: roleName,
+                        PermissionsBoundary: news.permissionsBoundary,
+                    });
+                }
+                else if (observedPermissionsBoundary) {
+                    yield* iam
+                        .deleteRolePermissionsBoundary({
+                        RoleName: roleName,
+                    })
+                        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+                }
+            }
+            // Sync managed and inline policies — observe the live state
+            // and apply only the delta. This is robust to manual edits in
+            // the AWS console and to adoption.
+            const [observedManagedPolicies, observedInlinePolicies] = yield* Effect.all([
+                readManagedPolicies(roleName),
+                readInlinePolicies(roleName),
+            ]);
+            yield* syncManagedPolicies({
+                roleName,
+                olds: observedManagedPolicies,
+                news: news.managedPolicyArns ?? [],
+            });
+            yield* syncInlinePolicies({
+                roleName,
+                olds: observedInlinePolicies,
+                news: news.inlinePolicies ?? {},
+            });
+            // Sync tags against the cloud's actual tags so adoption /
+            // out-of-band tag changes converge.
+            const observedTags = yield* readTags(roleName);
+            const { removed, upsert } = diffTags(observedTags, desiredTags);
+            if (upsert.length > 0) {
+                yield* iam.tagRole({
+                    RoleName: roleName,
+                    Tags: upsert,
+                });
+            }
+            if (removed.length > 0) {
+                yield* iam.untagRole({
+                    RoleName: roleName,
+                    TagKeys: removed,
+                });
+            }
+            // Re-read for fresh attributes after all mutations.
+            const liveRole = yield* iam.getRole({ RoleName: roleName });
+            const roleArn = (liveRole.Role?.Arn ??
+                observedRole.Role?.Arn ??
+                `arn:aws:iam::${(yield* AWSEnvironment).accountId}:role/${roleName}`);
+            yield* session.note(roleArn);
+            return {
+                roleArn,
+                roleName: liveRole.Role?.RoleName ?? roleName,
+                roleId: liveRole.Role?.RoleId ?? observedRole.Role?.RoleId,
+                path: liveRole.Role?.Path ??
+                    observedRole.Role?.Path ??
+                    news.path ??
+                    "/",
+                assumeRolePolicyDocument: news.assumeRolePolicyDocument,
+                managedPolicyArns: news.managedPolicyArns ?? [],
+                inlinePolicies: news.inlinePolicies ?? {},
+                description: liveRole.Role?.Description ?? news.description,
+                maxSessionDuration: liveRole.Role?.MaxSessionDuration ?? news.maxSessionDuration,
+                permissionsBoundary: liveRole.Role?.PermissionsBoundary?.PermissionsBoundaryArn ??
+                    news.permissionsBoundary,
+                tags: desiredTags,
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* iam
+                .deleteRolePermissionsBoundary({
+                RoleName: output.roleName,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+            yield* iam.listRolePolicies({ RoleName: output.roleName }).pipe(Effect.flatMap((policies) => Effect.all((policies.PolicyNames ?? []).map((policyName) => iam
+                .deleteRolePolicy({
+                RoleName: output.roleName,
+                PolicyName: policyName,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void))))));
+            yield* iam
+                .listAttachedRolePolicies({ RoleName: output.roleName })
+                .pipe(Effect.flatMap((policies) => Effect.all((policies.AttachedPolicies ?? []).map((policy) => iam
+                .detachRolePolicy({
+                RoleName: output.roleName,
+                PolicyArn: policy.PolicyArn,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void))))));
+            yield* iam
+                .deleteRole({
+                RoleName: output.roleName,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+    };
+}));
+//# sourceMappingURL=Role.js.map

package/lib/AWS/IAM/Role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Role.js","sourceRoot":"","sources":["../../../src/AWS/IAM/Role.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,GACZ,MAAM,aAAa,CAAC;AAiErB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAO,cAAc,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,EAAE,CAC/B,QAAQ,CAAC,MAAM,CACb,IAAI,EACJ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,cAAc,CAAC;IAEtB,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,QAA+B,EAAE,EAAE,EAAE,CACnE,KAAK,CAAC,QAAQ;QACZ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAEhD,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAgB;QAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACzC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAC/B,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5C,GAAG;aACA,aAAa,CAAC;YACb,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,UAAU;SACvB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,GAAG,CACR,CAAC,QAAQ,EAAE,EAAE,CACX;YACE,UAAU;YACV,mBAAmB,CAAC,QAAQ,CAAC,cAAc,CAAC;SACpC,CACb,EACD,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,CAAU,CAAC,CACjD,CACF,CACJ,CACF,CAAC;QACF,OAAO,MAAM,CAAC,WAAW,CACvB,OAAO,CAAC,MAAM,CACZ,CAAC,KAAK,EAAqC,EAAE,CAC3C,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CACzB,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAgB;QAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC;YACjD,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;aACnC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;aACjC,MAAM,CACL,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAClE,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAgB;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YACrC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC/C,QAAQ,EACR,IAAI,EACJ,IAAI,GAKL;QACC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAE7B,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAC1B,QAAQ,EAAE,QAAQ;oBAClB,SAAS,EAAE,SAAS;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,CAAC,GAAG;qBACP,gBAAgB,CAAC;oBAChB,QAAQ,EAAE,QAAQ;oBAClB,SAAS,EAAE,SAAS;iBACrB,CAAC;qBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5D,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC9C,QAAQ,EACR,IAAI,EACJ,IAAI,GAKL;QACC,KAAK,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,IACE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;gBACxC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EACxB,CAAC;gBACD,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;oBACvB,QAAQ,EAAE,QAAQ;oBAClB,UAAU,EAAE,UAAU;oBACtB,cAAc,EAAE,uBAAuB,CAAC,QAAQ,CAAC;iBAClD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE,CAAC;gBAC1B,KAAK,CAAC,CAAC,GAAG;qBACP,gBAAgB,CAAC;oBAChB,QAAQ,EAAE,QAAQ;oBAClB,UAAU,EAAE,UAAU;iBACvB,CAAC;qBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5D,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IACE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,EACnC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC/C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,QAAQ,GACZ,MAAM,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG;iBACpB,OAAO,CAAC;gBACP,QAAQ,EAAE,QAAQ;aACnB,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;YACJ,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;gBAChB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAClE,mBAAmB,CAAC,QAAQ,CAAC;gBAC7B,kBAAkB,CAAC,QAAQ,CAAC;gBAC5B,QAAQ,CAAC,QAAQ,CAAC;aACnB,CAAC,CAAC;YAEH,MAAM,wBAAwB,GAC5B,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC;gBACvD,MAAM,EAAE,wBAAwB,CAAC;YACnC,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAC9B,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,KAAK,GAAG;gBACZ,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAc;gBACjC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;gBACxB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACpB,wBAAwB;gBACxB,iBAAiB;gBACjB,cAAc;gBACd,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;gBAClC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB;gBAChD,mBAAmB,EACjB,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,sBAAsB;gBACvD,IAAI;aACL,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpE,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3D,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YACnE,MAAM,WAAW,GAAG;gBAClB,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YAEF,4DAA4D;YAC5D,+DAA+D;YAC/D,8DAA8D;YAC9D,IAAI,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG;iBAC1B,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;iBAC/B,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;YAEJ,+DAA+D;YAC/D,8DAA8D;YAC9D,qBAAqB;YACrB,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;gBACxB,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG;qBACtB,UAAU,CAAC;oBACV,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,QAAQ;oBAClB,wBAAwB,EAAE,uBAAuB,CAC/C,IAAI,CAAC,wBAAwB,CAC9B;oBACD,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;oBAC3C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC;iBAClC,CAAC;qBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE,CACnD,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CACpC,CACF,CAAC;YACN,CAAC;YAED,MAAM,oBAAoB,GAAG,mBAAmB,CAC9C,YAAY,CAAC,IAAI,EAAE,wBAAwB,CAC5C,CAAC;YACF,MAAM,mBAAmB,GAAG,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC;YAC3D,MAAM,0BAA0B,GAC9B,YAAY,CAAC,IAAI,EAAE,kBAAkB,CAAC;YACxC,MAAM,2BAA2B,GAC/B,YAAY,CAAC,IAAI,EAAE,mBAAmB,EAAE,sBAAsB,CAAC;YAEjE,6DAA6D;YAC7D,sCAAsC;YACtC,IACE,IAAI,CAAC,SAAS,CAAC,oBAAoB,IAAI,IAAI,CAAC;gBAC5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAC7C,CAAC;gBACD,KAAK,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;oBAChC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,uBAAuB,CACrC,IAAI,CAAC,wBAAwB,CAC9B;iBACF,CAAC,CAAC;YACL,CAAC;YAED,wDAAwD;YACxD,IACE,mBAAmB,KAAK,IAAI,CAAC,WAAW;gBACxC,0BAA0B,KAAK,IAAI,CAAC,kBAAkB,EACtD,CAAC;gBACD,KAAK,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;oBACpB,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;iBAC5C,CAAC,CAAC;YACL,CAAC;YAED,4DAA4D;YAC5D,iCAAiC;YACjC,IAAI,IAAI,CAAC,mBAAmB,KAAK,2BAA2B,EAAE,CAAC;gBAC7D,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBAC7B,KAAK,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;wBACpC,QAAQ,EAAE,QAAQ;wBAClB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;qBAC9C,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,2BAA2B,EAAE,CAAC;oBACvC,KAAK,CAAC,CAAC,GAAG;yBACP,6BAA6B,CAAC;wBAC7B,QAAQ,EAAE,QAAQ;qBACnB,CAAC;yBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5D,CAAC;gBACN,CAAC;YACH,CAAC;YAED,4DAA4D;YAC5D,8DAA8D;YAC9D,mCAAmC;YACnC,MAAM,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,GACrD,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAChB,mBAAmB,CAAC,QAAQ,CAAC;gBAC7B,kBAAkB,CAAC,QAAQ,CAAC;aAC7B,CAAC,CAAC;YACL,KAAK,CAAC,CAAC,mBAAmB,CAAC;gBACzB,QAAQ;gBACR,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,IAAI,CAAC,iBAAiB,IAAI,EAAE;aACnC,CAAC,CAAC;YACH,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBACxB,QAAQ;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;aAChC,CAAC,CAAC;YAEH,0DAA0D;YAC1D,oCAAoC;YACpC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;oBACjB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;oBACnB,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,oDAAoD;YACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG;gBACjC,YAAY,CAAC,IAAI,EAAE,GAAG;gBACtB,gBAAgB,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,SAAS,SAAS,QAAQ,EAAE,CAAY,CAAC;YAEnF,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,QAAQ;gBAC7C,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM;gBAC1D,IAAI,EACF,QAAQ,CAAC,IAAI,EAAE,IAAI;oBACnB,YAAY,CAAC,IAAI,EAAE,IAAI;oBACvB,IAAI,CAAC,IAAI;oBACT,GAAG;gBACL,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,EAAE;gBAC/C,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;gBACzC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC,WAAW;gBAC3D,kBAAkB,EAChB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,IAAI,IAAI,CAAC,kBAAkB;gBAC9D,mBAAmB,EACjB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,sBAAsB;oBAC1D,IAAI,CAAC,mBAAmB;gBAC1B,IAAI,EAAE,WAAW;aAClB,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,GAAG;iBACP,6BAA6B,CAAC;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAErE,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,MAAM,CAAC,GAAG,CACR,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC9C,GAAG;iBACA,gBAAgB,CAAC;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,UAAU;aACvB,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,uBAAuB,EACvB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,CACF,CACJ,CACF,CACF,CACF,CAAC;YAEF,KAAK,CAAC,CAAC,GAAG;iBACP,wBAAwB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;iBACvD,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,MAAM,CAAC,GAAG,CACR,CAAC,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC/C,GAAG;iBACA,gBAAgB,CAAC;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAU;aAC7B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,uBAAuB,EACvB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,CACF,CACJ,CACF,CACF,CACF,CAAC;YAEJ,KAAK,CAAC,CAAC,GAAG;iBACP,UAAU,CAAC;gBACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/AWS/IAM/SAMLProvider.d.ts

@@ -0,0 +1,55 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Redacted from "effect/Redacted";
+import { AWSEnvironment } from "../Environment.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface SAMLProviderProps {
+    /**
+     * The friendly SAML provider name.
+     */
+    name: string;
+    /**
+     * The provider metadata document.
+     */
+    samlMetadataDocument: string;
+    /**
+     * Optional assertion encryption mode.
+     */
+    assertionEncryptionMode?: iam.AssertionEncryptionModeType;
+    /**
+     * Optional private key added during creation/update.
+     */
+    addPrivateKey?: Redacted.Redacted<string> | string;
+    /**
+     * User-defined tags.
+     */
+    tags?: Record<string, string>;
+}
+export interface SAMLProvider extends Resource<"AWS.IAM.SAMLProvider", SAMLProviderProps, {
+    samlProviderArn: string;
+    name: string;
+    samlProviderUUID: string | undefined;
+    samlMetadataDocument: string | undefined;
+    assertionEncryptionMode: iam.AssertionEncryptionModeType | undefined;
+    tags: Record<string, string>;
+}, never, Providers> {
+}
+/**
+ * An IAM SAML identity provider.
+ *
+ * `SAMLProvider` registers a SAML metadata document so IAM roles can trust an
+ * external workforce or application identity provider.
+ *
+ * @section Federating with SAML
+ * @example Create a SAML Identity Provider
+ * ```typescript
+ * const provider = yield* SAMLProvider("WorkforceSaml", {
+ *   name: "workforce-saml",
+ *   samlMetadataDocument: "<EntityDescriptor>...</EntityDescriptor>",
+ * });
+ * ```
+ */
+export declare const SAMLProvider: import("../../Resource.ts").ResourceClass<SAMLProvider>;
+export declare const SAMLProviderProvider: () => import("effect/Layer").Layer<Provider.Provider<SAMLProvider>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials | AWSEnvironment>;
+//# sourceMappingURL=SAMLProvider.d.ts.map

package/lib/AWS/IAM/SAMLProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SAMLProvider.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/SAMLProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAEhD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjD,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,uBAAuB,CAAC,EAAE,GAAG,CAAC,2BAA2B,CAAC;IAC1D;;OAEG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACnD;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,sBAAsB,EACtB,iBAAiB,EACjB;IACE,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,uBAAuB,EAAE,GAAG,CAAC,2BAA2B,GAAG,SAAS,CAAC;IACrE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,yDAAiD,CAAC;AAE3E,eAAO,MAAM,oBAAoB,6TA2J7B,CAAC"}

package/lib/AWS/IAM/SAMLProvider.js

@@ -0,0 +1,158 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { AWSEnvironment } from "../Environment.js";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { createInternalTags, diffTags, hasTags } from "../../Tags.js";
+import { toTagRecord, unwrapRedactedString } from "./common.js";
+/**
+ * An IAM SAML identity provider.
+ *
+ * `SAMLProvider` registers a SAML metadata document so IAM roles can trust an
+ * external workforce or application identity provider.
+ *
+ * @section Federating with SAML
+ * @example Create a SAML Identity Provider
+ * ```typescript
+ * const provider = yield* SAMLProvider("WorkforceSaml", {
+ *   name: "workforce-saml",
+ *   samlMetadataDocument: "<EntityDescriptor>...</EntityDescriptor>",
+ * });
+ * ```
+ */
+export const SAMLProvider = Resource("AWS.IAM.SAMLProvider");
+export const SAMLProviderProvider = () => Provider.succeed(SAMLProvider, {
+    stables: ["samlProviderArn"],
+    diff: Effect.fn(function* ({ olds, news }) {
+        if (!isResolved(news))
+            return;
+        if (olds.name !== news.name) {
+            return { action: "replace" };
+        }
+    }),
+    read: Effect.fn(function* ({ output }) {
+        if (!output) {
+            return undefined;
+        }
+        const response = yield* iam
+            .getSAMLProvider({
+            SAMLProviderArn: output.samlProviderArn,
+        })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+        if (!response) {
+            return undefined;
+        }
+        const tags = yield* iam.listSAMLProviderTags({
+            SAMLProviderArn: output.samlProviderArn,
+        });
+        return {
+            samlProviderArn: output.samlProviderArn,
+            name: output.name,
+            samlProviderUUID: response.SAMLProviderUUID,
+            samlMetadataDocument: response.SAMLMetadataDocument,
+            assertionEncryptionMode: response.AssertionEncryptionMode,
+            tags: toTagRecord(tags.Tags),
+        };
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output, session }) {
+        const internalTags = yield* createInternalTags(id);
+        const desiredTags = {
+            ...internalTags,
+            ...news.tags,
+        };
+        const accountId = (yield* AWSEnvironment).accountId;
+        const samlProviderArn = output?.samlProviderArn ??
+            `arn:aws:iam::${accountId}:saml-provider/${news.name}`;
+        // Observe — `getSAMLProvider` returns the metadata, encryption
+        // mode, and UUID; absence is `NoSuchEntityException`.
+        let observed = yield* iam
+            .getSAMLProvider({ SAMLProviderArn: samlProviderArn })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+        // Ensure — create when missing. Race with a peer is recovered by
+        // verifying alchemy ownership tags on the existing provider.
+        if (!observed) {
+            const created = yield* iam
+                .createSAMLProvider({
+                Name: news.name,
+                SAMLMetadataDocument: news.samlMetadataDocument,
+                AssertionEncryptionMode: news.assertionEncryptionMode,
+                AddPrivateKey: news.addPrivateKey
+                    ? unwrapRedactedString(news.addPrivateKey)
+                    : undefined,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                    Key,
+                    Value,
+                })),
+            })
+                .pipe(Effect.catchTag("EntityAlreadyExistsException", () => Effect.gen(function* () {
+                const existingTags = yield* iam.listSAMLProviderTags({
+                    SAMLProviderArn: samlProviderArn,
+                });
+                if (!hasTags(internalTags, existingTags.Tags)) {
+                    return yield* Effect.fail(new Error(`SAML provider '${news.name}' already exists and is not managed by alchemy`));
+                }
+                return { SAMLProviderArn: samlProviderArn };
+            })));
+            observed = yield* iam.getSAMLProvider({
+                SAMLProviderArn: created.SAMLProviderArn ?? samlProviderArn,
+            });
+        }
+        else {
+            // Sync metadata / encryption mode — `updateSAMLProvider` is a
+            // partial update; only push the doc when it actually differs.
+            if ((observed.SAMLMetadataDocument ?? undefined) !==
+                news.samlMetadataDocument ||
+                observed.AssertionEncryptionMode !== news.assertionEncryptionMode ||
+                news.addPrivateKey !== undefined) {
+                yield* iam.updateSAMLProvider({
+                    SAMLProviderArn: samlProviderArn,
+                    SAMLMetadataDocument: (observed.SAMLMetadataDocument ?? undefined) !==
+                        news.samlMetadataDocument
+                        ? news.samlMetadataDocument
+                        : undefined,
+                    AssertionEncryptionMode: news.assertionEncryptionMode,
+                    AddPrivateKey: news.addPrivateKey
+                        ? unwrapRedactedString(news.addPrivateKey)
+                        : undefined,
+                });
+            }
+        }
+        // Sync tags against the cloud's actual tags.
+        const observedTagsResp = yield* iam.listSAMLProviderTags({
+            SAMLProviderArn: samlProviderArn,
+        });
+        const observedTags = toTagRecord(observedTagsResp.Tags);
+        const { removed, upsert } = diffTags(observedTags, desiredTags);
+        if (upsert.length > 0) {
+            yield* iam.tagSAMLProvider({
+                SAMLProviderArn: samlProviderArn,
+                Tags: upsert,
+            });
+        }
+        if (removed.length > 0) {
+            yield* iam.untagSAMLProvider({
+                SAMLProviderArn: samlProviderArn,
+                TagKeys: removed,
+            });
+        }
+        yield* session.note(samlProviderArn);
+        return {
+            samlProviderArn,
+            name: news.name,
+            samlProviderUUID: observed?.SAMLProviderUUID ?? output?.samlProviderUUID,
+            samlMetadataDocument: news.samlMetadataDocument,
+            assertionEncryptionMode: news.assertionEncryptionMode,
+            tags: desiredTags,
+        };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        yield* iam
+            .deleteSAMLProvider({
+            SAMLProviderArn: output.samlProviderArn,
+        })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+});
+//# sourceMappingURL=SAMLProvider.js.map

package/lib/AWS/IAM/SAMLProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SAMLProvider.js","sourceRoot":"","sources":["../../../src/AWS/IAM/SAMLProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAwChE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAe,sBAAsB,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE;IAC7B,OAAO,EAAE,CAAC,iBAAiB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,eAAe,CAAC;YACf,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC3C,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QACH,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;SAC7B,CAAC;IACJ,CAAC,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3D,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG;YAClB,GAAG,YAAY;YACf,GAAG,IAAI,CAAC,IAAI;SACb,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC;QACpD,MAAM,eAAe,GACnB,MAAM,EAAE,eAAe;YACvB,gBAAgB,SAAS,kBAAkB,IAAI,CAAC,IAAI,EAAE,CAAC;QAEzD,+DAA+D;QAC/D,sDAAsD;QACtD,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACtB,eAAe,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;aACrD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QAEJ,iEAAiE;QACjE,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG;iBACvB,kBAAkB,CAAC;gBAClB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;gBAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,aAAa,EAAE,IAAI,CAAC,aAAa;oBAC/B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC;oBAC1C,CAAC,CAAC,SAAS;gBACb,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;oBACvD,GAAG;oBACH,KAAK;iBACN,CAAC,CAAC;aACJ,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBACnD,eAAe,EAAE,eAAe;iBACjC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,kBAAkB,IAAI,CAAC,IAAI,gDAAgD,CAC5E,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;YAC9C,CAAC,CAAC,CACH,CACF,CAAC;YACJ,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;gBACpC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,eAAe;aAC5D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,8DAA8D;YAC9D,8DAA8D;YAC9D,IACE,CAAC,QAAQ,CAAC,oBAAoB,IAAI,SAAS,CAAC;gBAC1C,IAAI,CAAC,oBAAoB;gBAC3B,QAAQ,CAAC,uBAAuB,KAAK,IAAI,CAAC,uBAAuB;gBACjE,IAAI,CAAC,aAAa,KAAK,SAAS,EAChC,CAAC;gBACD,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;oBAC5B,eAAe,EAAE,eAAe;oBAChC,oBAAoB,EAClB,CAAC,QAAQ,CAAC,oBAAoB,IAAI,SAAS,CAAC;wBAC5C,IAAI,CAAC,oBAAoB;wBACvB,CAAC,CAAC,IAAI,CAAC,oBAAoB;wBAC3B,CAAC,CAAC,SAAS;oBACf,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,aAAa,EAAE,IAAI,CAAC,aAAa;wBAC/B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC;wBAC1C,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACvD,eAAe,EAAE,eAAe;SACjC,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;gBACzB,eAAe,EAAE,eAAe;gBAChC,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAC3B,eAAe,EAAE,eAAe;gBAChC,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACrC,OAAO;YACL,eAAe;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EACd,QAAQ,EAAE,gBAAgB,IAAI,MAAM,EAAE,gBAAgB;YACxD,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,IAAI,EAAE,WAAW;SAClB,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,GAAG;aACP,kBAAkB,CAAC;YAClB,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;CACH,CAAC,CAAC"}

package/lib/AWS/IAM/SSHPublicKey.d.ts

@@ -0,0 +1,50 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface SSHPublicKeyProps {
+    /**
+     * User that owns the SSH public key.
+     */
+    userName: string;
+    /**
+     * SSH public key body.
+     */
+    sshPublicKeyBody: string;
+    /**
+     * Desired key status.
+     * @default "Active"
+     */
+    status?: iam.StatusType;
+}
+export interface SSHPublicKey extends Resource<"AWS.IAM.SSHPublicKey", SSHPublicKeyProps, {
+    userName: string;
+    sshPublicKeyId: string;
+    fingerprint: string;
+    sshPublicKeyBody: string;
+    status: iam.StatusType;
+    uploadDate: Date | undefined;
+}, never, Providers> {
+}
+/**
+ * An IAM SSH public key for CodeCommit-compatible workflows.
+ *
+ * `SSHPublicKey` uploads and manages a user's public key for services such as
+ * AWS CodeCommit that authenticate through IAM-backed SSH credentials.
+ *
+ * @section Managing SSH Keys
+ * @example Upload an SSH Public Key
+ * ```typescript
+ * const user = yield* User("GitUser", {
+ *   userName: "codecommit-user",
+ * });
+ *
+ * const key = yield* SSHPublicKey("GitKey", {
+ *   userName: user.userName,
+ *   sshPublicKeyBody: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExample codecommit-user",
+ * });
+ * ```
+ */
+export declare const SSHPublicKey: import("../../Resource.ts").ResourceClass<SSHPublicKey>;
+export declare const SSHPublicKeyProvider: () => import("effect/Layer").Layer<Provider.Provider<SSHPublicKey>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=SSHPublicKey.d.ts.map

package/lib/AWS/IAM/SSHPublicKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SSHPublicKey.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/SSHPublicKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAGhD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,sBAAsB,EACtB,iBAAiB,EACjB;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,SAAS,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,yDAAiD,CAAC;AAE3E,eAAO,MAAM,oBAAoB,0OAsG7B,CAAC"}