alchemy 2.0.0-beta.test-export-fix-4 → 2.0.0-cli-bundle-fix.1

package/lib/AWS/IAM/InstanceProfile.js

@@ -0,0 +1,194 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { createInternalTags, createTagsList, diffTags, hasTags, } from "../../Tags.js";
+import { toTagRecord } from "./common.js";
+/**
+ * An IAM instance profile that can present a role to EC2 instances.
+ *
+ * `InstanceProfile` bridges IAM roles into EC2 so compute instances can assume
+ * the attached role through the instance metadata service.
+ *
+ * @section Attaching Roles to EC2
+ * @example Create an Instance Profile
+ * ```typescript
+ * const role = yield* Role("InstanceRole", {
+ *   assumeRolePolicyDocument: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Principal: { Service: "ec2.amazonaws.com" },
+ *       Action: ["sts:AssumeRole"],
+ *     }],
+ *   },
+ * });
+ *
+ * const profile = yield* InstanceProfile("WebProfile", {
+ *   roleName: role.roleName,
+ * });
+ * ```
+ */
+export const InstanceProfile = Resource("AWS.IAM.InstanceProfile");
+export const InstanceProfileProvider = () => Provider.effect(InstanceProfile, Effect.gen(function* () {
+    const toName = (id, props) => props.instanceProfileName
+        ? Effect.succeed(props.instanceProfileName)
+        : createPhysicalName({ id, maxLength: 128 });
+    const readInstanceProfile = Effect.fn(function* (name) {
+        const response = yield* iam
+            .getInstanceProfile({
+            InstanceProfileName: name,
+        })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+        return response?.InstanceProfile;
+    });
+    const syncRole = Effect.fn(function* ({ profileName, currentRoleName, nextRoleName, }) {
+        if (currentRoleName && currentRoleName !== nextRoleName) {
+            yield* iam
+                .removeRoleFromInstanceProfile({
+                InstanceProfileName: profileName,
+                RoleName: currentRoleName,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }
+        if (nextRoleName && currentRoleName !== nextRoleName) {
+            yield* iam.addRoleToInstanceProfile({
+                InstanceProfileName: profileName,
+                RoleName: nextRoleName,
+            });
+        }
+    });
+    return {
+        stables: [
+            "instanceProfileArn",
+            "instanceProfileName",
+            "instanceProfileId",
+        ],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+            if (!isResolved(news))
+                return;
+            if ((yield* toName(id, olds ?? {})) !==
+                (yield* toName(id, news))) {
+                return { action: "replace" };
+            }
+            if ((olds?.path ?? "/") !== (news.path ?? "/")) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            const name = output?.instanceProfileName ??
+                (yield* toName(id, olds ?? {}));
+            const profile = yield* readInstanceProfile(name);
+            if (!profile?.Arn || !profile.InstanceProfileName) {
+                return undefined;
+            }
+            return {
+                instanceProfileArn: profile.Arn,
+                instanceProfileName: profile.InstanceProfileName,
+                instanceProfileId: profile.InstanceProfileId,
+                path: profile.Path,
+                roleName: profile.Roles?.[0]?.RoleName,
+                tags: toTagRecord(profile.Tags),
+            };
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+            const name = yield* toName(id, news);
+            const tags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            yield* iam
+                .createInstanceProfile({
+                InstanceProfileName: name,
+                Path: news.path,
+                Tags: createTagsList(tags),
+            })
+                .pipe(Effect.catchTag("EntityAlreadyExistsException", () => Effect.gen(function* () {
+                const existing = yield* readInstanceProfile(name);
+                if (!existing?.Arn) {
+                    return yield* Effect.fail(new Error(`Instance profile '${name}' already exists but could not be described`));
+                }
+                if (!hasTags(tags, existing.Tags)) {
+                    return yield* Effect.fail(new Error(`Instance profile '${name}' already exists and is not managed by alchemy`));
+                }
+            })));
+            yield* syncRole({
+                profileName: name,
+                currentRoleName: undefined,
+                nextRoleName: news.roleName,
+            });
+            const profile = yield* readInstanceProfile(name);
+            if (!profile?.Arn || !profile.InstanceProfileName) {
+                return yield* Effect.fail(new Error(`Instance profile '${name}' was not readable after create`));
+            }
+            yield* session.note(profile.Arn);
+            return {
+                instanceProfileArn: profile.Arn,
+                instanceProfileName: profile.InstanceProfileName,
+                instanceProfileId: profile.InstanceProfileId,
+                path: profile.Path,
+                roleName: profile.Roles?.[0]?.RoleName,
+                tags,
+            };
+        }),
+        update: Effect.fn(function* ({ id, news, olds, output, session }) {
+            yield* syncRole({
+                profileName: output.instanceProfileName,
+                currentRoleName: olds.roleName,
+                nextRoleName: news.roleName,
+            });
+            const oldTags = {
+                ...(yield* createInternalTags(id)),
+                ...olds.tags,
+            };
+            const newTags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            const { removed, upsert } = diffTags(oldTags, newTags);
+            if (upsert.length > 0) {
+                yield* iam.tagInstanceProfile({
+                    InstanceProfileName: output.instanceProfileName,
+                    Tags: upsert,
+                });
+            }
+            if (removed.length > 0) {
+                yield* iam.untagInstanceProfile({
+                    InstanceProfileName: output.instanceProfileName,
+                    TagKeys: removed,
+                });
+            }
+            const profile = yield* readInstanceProfile(output.instanceProfileName);
+            yield* session.note(output.instanceProfileArn);
+            return {
+                instanceProfileArn: profile?.Arn ?? output.instanceProfileArn,
+                instanceProfileName: profile?.InstanceProfileName ?? output.instanceProfileName,
+                instanceProfileId: profile?.InstanceProfileId ?? output.instanceProfileId,
+                path: profile?.Path ?? output.path,
+                roleName: profile?.Roles?.[0]?.RoleName,
+                tags: newTags,
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const profile = yield* readInstanceProfile(output.instanceProfileName);
+            for (const role of profile?.Roles ?? []) {
+                if (role.RoleName) {
+                    yield* iam
+                        .removeRoleFromInstanceProfile({
+                        InstanceProfileName: output.instanceProfileName,
+                        RoleName: role.RoleName,
+                    })
+                        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+                }
+            }
+            yield* iam
+                .deleteInstanceProfile({
+                InstanceProfileName: output.instanceProfileName,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+    };
+}));
+//# sourceMappingURL=InstanceProfile.js.map

package/lib/AWS/IAM/InstanceProfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InstanceProfile.js","sourceRoot":"","sources":["../../../src/AWS/IAM/InstanceProfile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,OAAO,GACR,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAqC1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CACrC,yBAAyB,CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAC1C,QAAQ,CAAC,MAAM,CACb,eAAe,EACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,KAA2B,EAAE,EAAE,CACzD,KAAK,CAAC,mBAAmB;QACvB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAC3C,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAEjD,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAY;QAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,kBAAkB,CAAC;YAClB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,OAAO,QAAQ,EAAE,eAAe,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EACpC,WAAW,EACX,eAAe,EACf,YAAY,GAKb;QACC,IAAI,eAAe,IAAI,eAAe,KAAK,YAAY,EAAE,CAAC;YACxD,KAAK,CAAC,CAAC,GAAG;iBACP,6BAA6B,CAAC;gBAC7B,mBAAmB,EAAE,WAAW;gBAChC,QAAQ,EAAE,eAAe;aAC1B,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,YAAY,IAAI,eAAe,KAAK,YAAY,EAAE,CAAC;YACrD,KAAK,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC;gBAClC,mBAAmB,EAAE,WAAW;gBAChC,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE;YACP,oBAAoB;YACpB,qBAAqB;YACrB,mBAAmB;SACpB;QACD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IACE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAK,EAA2B,CAAC,CAAC;gBACzD,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EACzB,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC/C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,IAAI,GACR,MAAM,EAAE,mBAAmB;gBAC3B,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAK,EAA2B,CAAC,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAClD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO;gBACL,kBAAkB,EAAE,OAAO,CAAC,GAAG;gBAC/B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ;gBACtC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAChC,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG;gBACX,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,KAAK,CAAC,CAAC,GAAG;iBACP,qBAAqB,CAAC;gBACrB,mBAAmB,EAAE,IAAI;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;aAC3B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;gBAClD,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;oBACnB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,qBAAqB,IAAI,6CAA6C,CACvE,CACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,qBAAqB,IAAI,gDAAgD,CAC1E,CACF,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CACH,CACF,CAAC;YAEJ,KAAK,CAAC,CAAC,QAAQ,CAAC;gBACd,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,SAAS;gBAC1B,YAAY,EAAE,IAAI,CAAC,QAA8B;aAClD,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAClD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,qBAAqB,IAAI,iCAAiC,CAC3D,CACF,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO;gBACL,kBAAkB,EAAE,OAAO,CAAC,GAAG;gBAC/B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ;gBACtC,IAAI;aACL,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9D,KAAK,CAAC,CAAC,QAAQ,CAAC;gBACd,WAAW,EAAE,MAAM,CAAC,mBAAmB;gBACvC,eAAe,EAAE,IAAI,CAAC,QAA8B;gBACpD,YAAY,EAAE,IAAI,CAAC,QAA8B;aAClD,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;oBAC5B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;oBAC/C,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBAC9B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;oBAC/C,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACxC,MAAM,CAAC,mBAAmB,CAC3B,CAAC;YACF,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC/C,OAAO;gBACL,kBAAkB,EAAE,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC,kBAAkB;gBAC7D,mBAAmB,EACjB,OAAO,EAAE,mBAAmB,IAAI,MAAM,CAAC,mBAAmB;gBAC5D,iBAAiB,EACf,OAAO,EAAE,iBAAiB,IAAI,MAAM,CAAC,iBAAiB;gBACxD,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;gBAClC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ;gBACvC,IAAI,EAAE,OAAO;aACd,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACxC,MAAM,CAAC,mBAAmB,CAC3B,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBACxC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,KAAK,CAAC,CAAC,GAAG;yBACP,6BAA6B,CAAC;wBAC7B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;wBAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC;yBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5D,CAAC;gBACN,CAAC;YACH,CAAC;YACD,KAAK,CAAC,CAAC,GAAG;iBACP,qBAAqB,CAAC;gBACrB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;aAChD,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/AWS/IAM/LoginProfile.d.ts

@@ -0,0 +1,47 @@
+import * as Redacted from "effect/Redacted";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface LoginProfileProps {
+    /**
+     * User that owns the console login profile.
+     */
+    userName: string;
+    /**
+     * Console password. AWS never returns this value after create/update.
+     */
+    password: Redacted.Redacted<string> | string;
+    /**
+     * Require a password reset on next sign in.
+     */
+    passwordResetRequired?: boolean;
+}
+export interface LoginProfile extends Resource<"AWS.IAM.LoginProfile", LoginProfileProps, {
+    userName: string;
+    createDate: Date | undefined;
+    passwordResetRequired: boolean | undefined;
+}, never, Providers> {
+}
+/**
+ * An IAM console login profile for a user.
+ *
+ * `LoginProfile` manages AWS Management Console access for an IAM user. The
+ * password is write-only, so AWS never returns it during later reads.
+ *
+ * @section Managing Console Access
+ * @example Create a Console Login Profile
+ * ```typescript
+ * const user = yield* User("ConsoleUser", {
+ *   userName: "console-user",
+ * });
+ *
+ * const profile = yield* LoginProfile("ConsoleLogin", {
+ *   userName: user.userName,
+ *   password: Redacted.make("TempPassword123!"),
+ *   passwordResetRequired: true,
+ * });
+ * ```
+ */
+export declare const LoginProfile: import("../../Resource.ts").ResourceClass<LoginProfile>;
+export declare const LoginProfileProvider: () => import("effect/Layer").Layer<Provider.Provider<LoginProfile>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=LoginProfile.d.ts.map

package/lib/AWS/IAM/LoginProfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginProfile.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/LoginProfile.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC7C;;OAEG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,sBAAsB,EACtB,iBAAiB,EACjB;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,SAAS,CAAC;IAC7B,qBAAqB,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5C,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,yDAAiD,CAAC;AAE3E,eAAO,MAAM,oBAAoB,0OAkF7B,CAAC"}

package/lib/AWS/IAM/LoginProfile.js

@@ -0,0 +1,104 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { unwrapRedactedString } from "./common.js";
+/**
+ * An IAM console login profile for a user.
+ *
+ * `LoginProfile` manages AWS Management Console access for an IAM user. The
+ * password is write-only, so AWS never returns it during later reads.
+ *
+ * @section Managing Console Access
+ * @example Create a Console Login Profile
+ * ```typescript
+ * const user = yield* User("ConsoleUser", {
+ *   userName: "console-user",
+ * });
+ *
+ * const profile = yield* LoginProfile("ConsoleLogin", {
+ *   userName: user.userName,
+ *   password: Redacted.make("TempPassword123!"),
+ *   passwordResetRequired: true,
+ * });
+ * ```
+ */
+export const LoginProfile = Resource("AWS.IAM.LoginProfile");
+export const LoginProfileProvider = () => Provider.succeed(LoginProfile, {
+    stables: ["userName"],
+    diff: Effect.fn(function* ({ olds, news }) {
+        if (!isResolved(news))
+            return;
+        if (olds.userName !== news.userName) {
+            return { action: "replace" };
+        }
+    }),
+    read: Effect.fn(function* ({ output }) {
+        if (!output) {
+            return undefined;
+        }
+        const response = yield* iam
+            .getLoginProfile({
+            UserName: output.userName,
+        })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+        if (!response?.LoginProfile) {
+            return undefined;
+        }
+        return {
+            userName: response.LoginProfile.UserName,
+            createDate: response.LoginProfile.CreateDate,
+            passwordResetRequired: response.LoginProfile.PasswordResetRequired,
+        };
+    }),
+    create: Effect.fn(function* ({ news, session }) {
+        const response = yield* iam
+            .createLoginProfile({
+            UserName: news.userName,
+            Password: unwrapRedactedString(news.password),
+            PasswordResetRequired: news.passwordResetRequired,
+        })
+            .pipe(Effect.catchTag("EntityAlreadyExistsException", () => Effect.gen(function* () {
+            yield* iam.updateLoginProfile({
+                UserName: news.userName,
+                Password: unwrapRedactedString(news.password),
+                PasswordResetRequired: news.passwordResetRequired,
+            });
+            return yield* iam.getLoginProfile({
+                UserName: news.userName,
+            });
+        })));
+        yield* session.note(news.userName);
+        return {
+            userName: response.LoginProfile.UserName,
+            createDate: response.LoginProfile.CreateDate,
+            passwordResetRequired: response.LoginProfile.PasswordResetRequired,
+        };
+    }),
+    update: Effect.fn(function* ({ news, output, session }) {
+        yield* iam.updateLoginProfile({
+            UserName: output.userName,
+            Password: unwrapRedactedString(news.password),
+            PasswordResetRequired: news.passwordResetRequired,
+        });
+        const response = yield* iam.getLoginProfile({
+            UserName: output.userName,
+        });
+        yield* session.note(output.userName);
+        return {
+            userName: response.LoginProfile.UserName,
+            createDate: response.LoginProfile.CreateDate,
+            passwordResetRequired: response.LoginProfile.PasswordResetRequired,
+        };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        yield* iam
+            .deleteLoginProfile({
+            UserName: output.userName,
+        })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+});
+//# sourceMappingURL=LoginProfile.js.map

package/lib/AWS/IAM/LoginProfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginProfile.js","sourceRoot":"","sources":["../../../src/AWS/IAM/LoginProfile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AA6BnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAe,sBAAsB,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE;IAC7B,OAAO,EAAE,CAAC,UAAU,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,eAAe,CAAC;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ;YACxC,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,UAAU;YAC5C,qBAAqB,EAAE,QAAQ,CAAC,YAAY,CAAC,qBAAqB;SACnE,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,kBAAkB,CAAC;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC7C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC7C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;aAClD,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;gBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CACF,CAAC;QACJ,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ;YACxC,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,UAAU;YAC5C,qBAAqB,EAAE,QAAQ,CAAC,YAAY,CAAC,qBAAqB;SACnE,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QACpD,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC7C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QACH,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ;YACxC,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,UAAU;YAC5C,qBAAqB,EAAE,QAAQ,CAAC,YAAY,CAAC,qBAAqB;SACnE,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,GAAG;aACP,kBAAkB,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;CACH,CAAC,CAAC"}

package/lib/AWS/IAM/OpenIDConnectProvider.d.ts

@@ -0,0 +1,49 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { AWSEnvironment } from "../Environment.ts";
+export interface OpenIDConnectProviderProps {
+    /**
+     * The identity provider URL.
+     */
+    url: string;
+    /**
+     * Client IDs allowed for the provider.
+     */
+    clientIDList?: string[];
+    /**
+     * Certificate thumbprints for the provider.
+     */
+    thumbprintList?: string[];
+    /**
+     * User-defined tags to apply to the provider.
+     */
+    tags?: Record<string, string>;
+}
+export interface OpenIDConnectProvider extends Resource<"AWS.IAM.OpenIDConnectProvider", OpenIDConnectProviderProps, {
+    openIDConnectProviderArn: string;
+    url: string;
+    clientIDList: string[];
+    thumbprintList: string[];
+    tags: Record<string, string>;
+}, never, Providers> {
+}
+/**
+ * An IAM OpenID Connect provider for web identity federation.
+ *
+ * `OpenIDConnectProvider` registers an external OIDC issuer so IAM roles can be
+ * assumed through web identity federation flows such as GitHub Actions.
+ *
+ * @section Federating with OIDC
+ * @example Create a GitHub Actions OIDC Provider
+ * ```typescript
+ * const oidc = yield* OpenIDConnectProvider("GithubOidc", {
+ *   url: "https://token.actions.githubusercontent.com",
+ *   clientIDList: ["sts.amazonaws.com"],
+ *   thumbprintList: ["6938fd4d98bab03faadb97b34396831e3780aea1"],
+ * });
+ * ```
+ */
+export declare const OpenIDConnectProvider: import("../../Resource.ts").ResourceClass<OpenIDConnectProvider>;
+export declare const OpenIDConnectProviderProvider: () => import("effect/Layer").Layer<Provider.Provider<OpenIDConnectProvider>, never, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials | AWSEnvironment>;
+//# sourceMappingURL=OpenIDConnectProvider.d.ts.map

package/lib/AWS/IAM/OpenIDConnectProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenIDConnectProvider.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/OpenIDConnectProvider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAsB,SAAQ,QAAQ,CACrD,+BAA+B,EAC/B,0BAA0B,EAC1B;IACE,wBAAwB,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,kEAEjC,CAAC;AAEF,eAAO,MAAM,6BAA6B,oQAqIvC,CAAC"}

package/lib/AWS/IAM/OpenIDConnectProvider.js

@@ -0,0 +1,140 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { diffTags } from "../../Tags.js";
+import { AWSEnvironment } from "../Environment.js";
+import { toTagRecord } from "./common.js";
+/**
+ * An IAM OpenID Connect provider for web identity federation.
+ *
+ * `OpenIDConnectProvider` registers an external OIDC issuer so IAM roles can be
+ * assumed through web identity federation flows such as GitHub Actions.
+ *
+ * @section Federating with OIDC
+ * @example Create a GitHub Actions OIDC Provider
+ * ```typescript
+ * const oidc = yield* OpenIDConnectProvider("GithubOidc", {
+ *   url: "https://token.actions.githubusercontent.com",
+ *   clientIDList: ["sts.amazonaws.com"],
+ *   thumbprintList: ["6938fd4d98bab03faadb97b34396831e3780aea1"],
+ * });
+ * ```
+ */
+export const OpenIDConnectProvider = Resource("AWS.IAM.OpenIDConnectProvider");
+export const OpenIDConnectProviderProvider = () => Provider.effect(OpenIDConnectProvider, Effect.gen(function* () {
+    const { accountId } = yield* AWSEnvironment;
+    const oidcArnFromUrl = (url) => `arn:aws:iam::${accountId}:oidc-provider/${url.replace(/^https?:\/\//, "")}`;
+    const readProvider = Effect.fn(function* (providerArn) {
+        const response = yield* iam
+            .getOpenIDConnectProvider({
+            OpenIDConnectProviderArn: providerArn,
+        })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+        return response;
+    });
+    return {
+        stables: ["openIDConnectProviderArn"],
+        diff: Effect.fn(function* ({ olds, news }) {
+            if (!isResolved(news))
+                return;
+            if (olds.url !== news.url) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+            const providerArn = output?.openIDConnectProviderArn ?? oidcArnFromUrl(olds.url);
+            const provider = yield* readProvider(providerArn);
+            if (!provider?.Url) {
+                return undefined;
+            }
+            const tags = yield* iam.listOpenIDConnectProviderTags({
+                OpenIDConnectProviderArn: providerArn,
+            });
+            return {
+                openIDConnectProviderArn: providerArn,
+                url: provider.Url,
+                clientIDList: provider.ClientIDList ?? [],
+                thumbprintList: provider.ThumbprintList ?? [],
+                tags: toTagRecord(tags.Tags),
+            };
+        }),
+        create: Effect.fn(function* ({ news, session }) {
+            const created = yield* iam.createOpenIDConnectProvider({
+                Url: news.url,
+                ClientIDList: news.clientIDList,
+                ThumbprintList: news.thumbprintList,
+                Tags: Object.entries(news.tags ?? {}).map(([Key, Value]) => ({
+                    Key,
+                    Value,
+                })),
+            });
+            const providerArn = created.OpenIDConnectProviderArn ?? oidcArnFromUrl(news.url);
+            yield* session.note(providerArn);
+            return {
+                openIDConnectProviderArn: providerArn,
+                url: news.url,
+                clientIDList: news.clientIDList ?? [],
+                thumbprintList: news.thumbprintList ?? [],
+                tags: news.tags ?? {},
+            };
+        }),
+        update: Effect.fn(function* ({ news, olds, output, session }) {
+            const oldClientIds = new Set(olds.clientIDList ?? []);
+            const newClientIds = new Set(news.clientIDList ?? []);
+            for (const clientId of news.clientIDList ?? []) {
+                if (!oldClientIds.has(clientId)) {
+                    yield* iam.addClientIDToOpenIDConnectProvider({
+                        OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+                        ClientID: clientId,
+                    });
+                }
+            }
+            for (const clientId of olds.clientIDList ?? []) {
+                if (!newClientIds.has(clientId)) {
+                    yield* iam.removeClientIDFromOpenIDConnectProvider({
+                        OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+                        ClientID: clientId,
+                    });
+                }
+            }
+            if (JSON.stringify(olds.thumbprintList ?? []) !==
+                JSON.stringify(news.thumbprintList ?? [])) {
+                yield* iam.updateOpenIDConnectProviderThumbprint({
+                    OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+                    ThumbprintList: news.thumbprintList ?? [],
+                });
+            }
+            const { removed, upsert } = diffTags(olds.tags ?? {}, news.tags ?? {});
+            if (upsert.length > 0) {
+                yield* iam.tagOpenIDConnectProvider({
+                    OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+                    Tags: upsert,
+                });
+            }
+            if (removed.length > 0) {
+                yield* iam.untagOpenIDConnectProvider({
+                    OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+                    TagKeys: removed,
+                });
+            }
+            yield* session.note(output.openIDConnectProviderArn);
+            return {
+                openIDConnectProviderArn: output.openIDConnectProviderArn,
+                url: output.url,
+                clientIDList: news.clientIDList ?? [],
+                thumbprintList: news.thumbprintList ?? [],
+                tags: news.tags ?? {},
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* iam
+                .deleteOpenIDConnectProvider({
+                OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+    };
+}));
+//# sourceMappingURL=OpenIDConnectProvider.js.map

package/lib/AWS/IAM/OpenIDConnectProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenIDConnectProvider.js","sourceRoot":"","sources":["../../../src/AWS/IAM/OpenIDConnectProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAmC1C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAC3C,+BAA+B,CAChC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,EAAE,CAChD,QAAQ,CAAC,MAAM,CACb,qBAAqB,EACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IAC5C,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,EAAE,CACrC,gBAAgB,SAAS,kBAAkB,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC;IAE/E,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAmB;QAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,wBAAwB,CAAC;YACxB,wBAAwB,EAAE,WAAW;SACtC,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,0BAA0B,CAAC;QACrC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACzC,MAAM,WAAW,GACf,MAAM,EAAE,wBAAwB,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;gBACnB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC;gBACpD,wBAAwB,EAAE,WAAW;aACtC,CAAC,CAAC;YACH,OAAO;gBACL,wBAAwB,EAAE,WAAW;gBACrC,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;gBACzC,cAAc,EAAE,QAAQ,CAAC,cAAc,IAAI,EAAE;gBAC7C,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;aAC7B,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;gBACrD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3D,GAAG;oBACH,KAAK;iBACN,CAAC,CAAC;aACJ,CAAC,CAAC;YAEH,MAAM,WAAW,GACf,OAAO,CAAC,wBAAwB,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/D,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,OAAO;gBACL,wBAAwB,EAAE,WAAW;gBACrC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;gBACrC,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;gBACzC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;aACtB,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;YACtD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChC,KAAK,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC;wBAC5C,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;wBACzD,QAAQ,EAAE,QAAQ;qBACnB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChC,KAAK,CAAC,CAAC,GAAG,CAAC,uCAAuC,CAAC;wBACjD,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;wBACzD,QAAQ,EAAE,QAAQ;qBACnB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IACE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,EACzC,CAAC;gBACD,KAAK,CAAC,CAAC,GAAG,CAAC,qCAAqC,CAAC;oBAC/C,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;oBACzD,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAClC,IAAI,CAAC,IAAI,IAAI,EAAE,EACf,IAAI,CAAC,IAAI,IAAI,EAAE,CAChB,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC;oBAClC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;oBACzD,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;oBACpC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;oBACzD,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACrD,OAAO;gBACL,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;gBACzD,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;gBACrC,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;gBACzC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;aACtB,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,GAAG;iBACP,2BAA2B,CAAC;gBAC3B,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;aAC1D,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/AWS/IAM/Policy.d.ts

@@ -0,0 +1,84 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+export interface PolicyDocument {
+    Version: "2012-10-17";
+    Statement: PolicyStatement[];
+}
+export interface PolicyStatement {
+    Effect: "Allow" | "Deny";
+    Sid?: string;
+    Action: string[];
+    Resource?: string | string[];
+    Condition?: Record<string, Record<string, string | string[]>>;
+    Principal?: Record<string, string | string[]>;
+    NotPrincipal?: Record<string, string | string[]>;
+    NotAction?: string[];
+    NotResource?: string[];
+}
+export type PolicyName = string;
+export type PolicyArn = `arn:aws:iam::${AccountID}:policy/${string}`;
+export interface PolicyProps {
+    /**
+     * Name of the managed policy. If omitted, a deterministic name is generated.
+     */
+    policyName?: string;
+    /**
+     * Optional IAM path prefix for the policy.
+     * @default "/"
+     */
+    path?: string;
+    /**
+     * The JSON IAM policy document.
+     */
+    policyDocument: PolicyDocument;
+    /**
+     * Optional description for the policy.
+     */
+    description?: string;
+    /**
+     * User-defined tags to apply to the managed policy.
+     */
+    tags?: Record<string, string>;
+}
+export interface Policy extends Resource<"AWS.IAM.Policy", PolicyProps, {
+    policyArn: PolicyArn;
+    policyName: PolicyName;
+    policyId: string | undefined;
+    path: string | undefined;
+    defaultVersionId: string | undefined;
+    attachmentCount: number | undefined;
+    permissionsBoundaryUsageCount: number | undefined;
+    isAttachable: boolean | undefined;
+    description: string | undefined;
+    policyDocument: PolicyDocument;
+    tags: Record<string, string>;
+}, never, Providers> {
+}
+/**
+ * A customer-managed IAM policy.
+ *
+ * `Policy` owns the lifecycle of the policy metadata and its default version,
+ * rotating versions on updates while keeping the current document attached to a
+ * stable policy ARN.
+ *
+ * @section Creating Policies
+ * @example Managed Policy
+ * ```typescript
+ * const policy = yield* Policy("AppPolicy", {
+ *   policyDocument: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Action: ["s3:GetObject"],
+ *       Resource: ["arn:aws:s3:::my-bucket/*"],
+ *     }],
+ *   },
+ * });
+ * ```
+ */
+export declare const Policy: import("../../Resource.ts").ResourceClass<Policy>;
+export declare const PolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<Policy>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials | AWSEnvironment>;
+//# sourceMappingURL=Policy.d.ts.map