alchemy 2.0.0-beta.test-export-fix-4 → 2.0.0-cli-bundle-fix.1

package/lib/AWS/IAM/Policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Policy.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/Policy.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAOjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASnD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,eAAe,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAChC,MAAM,MAAM,SAAS,GAAG,gBAAgB,SAAS,WAAW,MAAM,EAAE,CAAC;AAErE,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,MAAO,SAAQ,QAAQ,CACtC,gBAAgB,EAChB,WAAW,EACX;IACE,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,6BAA6B,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,cAAc,EAAE,cAAc,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,MAAM,mDAAqC,CAAC;AAEzD,eAAO,MAAM,cAAc,uTAwRxB,CAAC"}

package/lib/AWS/IAM/Policy.js

@@ -0,0 +1,252 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { createInternalTags, createTagsList, diffTags, hasTags, } from "../../Tags.js";
+import { AWSEnvironment } from "../Environment.js";
+import { oldestNondefaultPolicyVersion, parsePolicyDocument, policyArnFromParts, stringifyPolicyDocument, toTagRecord, } from "./common.js";
+/**
+ * A customer-managed IAM policy.
+ *
+ * `Policy` owns the lifecycle of the policy metadata and its default version,
+ * rotating versions on updates while keeping the current document attached to a
+ * stable policy ARN.
+ *
+ * @section Creating Policies
+ * @example Managed Policy
+ * ```typescript
+ * const policy = yield* Policy("AppPolicy", {
+ *   policyDocument: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Action: ["s3:GetObject"],
+ *       Resource: ["arn:aws:s3:::my-bucket/*"],
+ *     }],
+ *   },
+ * });
+ * ```
+ */
+export const Policy = Resource("AWS.IAM.Policy");
+export const PolicyProvider = () => Provider.effect(Policy, Effect.gen(function* () {
+    const { accountId } = yield* AWSEnvironment;
+    const toPolicyName = (id, props) => props.policyName
+        ? Effect.succeed(props.policyName)
+        : createPhysicalName({ id, maxLength: 128 });
+    const toPolicyArn = Effect.fn(function* (id, props) {
+        const policyName = yield* toPolicyName(id, props);
+        return policyArnFromParts({
+            accountId,
+            path: props.path,
+            policyName,
+        });
+    });
+    const readPolicy = Effect.fn(function* (policyArn) {
+        const response = yield* iam
+            .getPolicy({ PolicyArn: policyArn })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+        return response?.Policy;
+    });
+    const readPolicyDocument = Effect.fn(function* ({ policyArn, versionId, }) {
+        if (!versionId) {
+            return undefined;
+        }
+        const response = yield* iam
+            .getPolicyVersion({
+            PolicyArn: policyArn,
+            VersionId: versionId,
+        })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+        return parsePolicyDocument(response?.PolicyVersion?.Document);
+    });
+    const prunePolicyVersions = Effect.fn(function* (policyArn) {
+        const versions = yield* iam.listPolicyVersions({
+            PolicyArn: policyArn,
+        });
+        if ((versions.Versions?.length ?? 0) < 5) {
+            return;
+        }
+        const removable = oldestNondefaultPolicyVersion(versions.Versions);
+        if (!removable?.VersionId) {
+            return;
+        }
+        yield* iam.deletePolicyVersion({
+            PolicyArn: policyArn,
+            VersionId: removable.VersionId,
+        });
+    });
+    return {
+        stables: ["policyArn", "policyName", "policyId"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+            if (!isResolved(news))
+                return;
+            if ((yield* toPolicyName(id, olds ?? {})) !==
+                (yield* toPolicyName(id, news))) {
+                return { action: "replace" };
+            }
+            if ((olds?.path ?? "/") !== (news.path ?? "/")) {
+                return { action: "replace" };
+            }
+            if ((olds?.description ?? undefined) !== (news.description ?? undefined)) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            const policyArn = output?.policyArn ??
+                (yield* toPolicyArn(id, olds ?? {}));
+            const policy = yield* readPolicy(policyArn);
+            if (!policy?.Arn || !policy.PolicyName) {
+                return undefined;
+            }
+            const tags = yield* iam.listPolicyTags({
+                PolicyArn: policy.Arn,
+            });
+            const policyDocument = yield* readPolicyDocument({
+                policyArn: policy.Arn,
+                versionId: policy.DefaultVersionId,
+            });
+            if (!policyDocument) {
+                return undefined;
+            }
+            return {
+                policyArn: policy.Arn,
+                policyName: policy.PolicyName,
+                policyId: policy.PolicyId,
+                path: policy.Path,
+                defaultVersionId: policy.DefaultVersionId,
+                attachmentCount: policy.AttachmentCount,
+                permissionsBoundaryUsageCount: policy.PermissionsBoundaryUsageCount,
+                isAttachable: policy.IsAttachable,
+                description: policy.Description,
+                policyDocument,
+                tags: toTagRecord(tags.Tags),
+            };
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+            const policyName = yield* toPolicyName(id, news);
+            const policyArn = yield* toPolicyArn(id, news);
+            const tags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            const created = yield* iam
+                .createPolicy({
+                PolicyName: policyName,
+                Path: news.path,
+                PolicyDocument: stringifyPolicyDocument(news.policyDocument),
+                Description: news.description,
+                Tags: createTagsList(tags),
+            })
+                .pipe(Effect.catchTag("EntityAlreadyExistsException", () => Effect.gen(function* () {
+                const existing = yield* readPolicy(policyArn);
+                if (!existing?.Arn) {
+                    return yield* Effect.fail(new Error(`Policy '${policyName}' already exists but could not be described`));
+                }
+                const existingTags = yield* iam.listPolicyTags({
+                    PolicyArn: existing.Arn,
+                });
+                if (!hasTags(tags, existingTags.Tags)) {
+                    return yield* Effect.fail(new Error(`Policy '${policyName}' already exists and is not managed by alchemy`));
+                }
+                return { Policy: existing };
+            })));
+            yield* session.note(created.Policy?.Arn ?? policyArn);
+            return {
+                policyArn: (created.Policy?.Arn ?? policyArn),
+                policyName,
+                policyId: created.Policy?.PolicyId,
+                path: created.Policy?.Path ?? news.path ?? "/",
+                defaultVersionId: created.Policy?.DefaultVersionId,
+                attachmentCount: created.Policy?.AttachmentCount,
+                permissionsBoundaryUsageCount: created.Policy?.PermissionsBoundaryUsageCount,
+                isAttachable: created.Policy?.IsAttachable,
+                description: created.Policy?.Description ?? news.description,
+                policyDocument: news.policyDocument,
+                tags,
+            };
+        }),
+        update: Effect.fn(function* ({ id, news, olds, output, session }) {
+            if (JSON.stringify(news.policyDocument) !==
+                JSON.stringify(olds.policyDocument)) {
+                yield* prunePolicyVersions(output.policyArn);
+                const createdVersion = yield* iam.createPolicyVersion({
+                    PolicyArn: output.policyArn,
+                    PolicyDocument: stringifyPolicyDocument(news.policyDocument),
+                    SetAsDefault: true,
+                });
+                if (createdVersion.PolicyVersion?.VersionId) {
+                    yield* iam.setDefaultPolicyVersion({
+                        PolicyArn: output.policyArn,
+                        VersionId: createdVersion.PolicyVersion.VersionId,
+                    });
+                }
+            }
+            const oldTags = {
+                ...(yield* createInternalTags(id)),
+                ...olds.tags,
+            };
+            const newTags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            const { removed, upsert } = diffTags(oldTags, newTags);
+            if (upsert.length > 0) {
+                yield* iam.tagPolicy({
+                    PolicyArn: output.policyArn,
+                    Tags: upsert,
+                });
+            }
+            if (removed.length > 0) {
+                yield* iam.untagPolicy({
+                    PolicyArn: output.policyArn,
+                    TagKeys: removed,
+                });
+            }
+            const policy = yield* readPolicy(output.policyArn);
+            const policyDocument = (yield* readPolicyDocument({
+                policyArn: output.policyArn,
+                versionId: policy?.DefaultVersionId,
+            })) ?? news.policyDocument;
+            yield* session.note(output.policyArn);
+            return {
+                policyArn: output.policyArn,
+                policyName: output.policyName,
+                policyId: policy?.PolicyId ?? output.policyId,
+                path: policy?.Path ?? output.path,
+                defaultVersionId: policy?.DefaultVersionId ?? output.defaultVersionId,
+                attachmentCount: policy?.AttachmentCount ?? output.attachmentCount,
+                permissionsBoundaryUsageCount: policy?.PermissionsBoundaryUsageCount ??
+                    output.permissionsBoundaryUsageCount,
+                isAttachable: policy?.IsAttachable ?? output.isAttachable,
+                description: policy?.Description ?? output.description,
+                policyDocument,
+                tags: newTags,
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const versions = yield* iam
+                .listPolicyVersions({
+                PolicyArn: output.policyArn,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+            for (const version of versions?.Versions ?? []) {
+                if (!version.IsDefaultVersion && version.VersionId) {
+                    yield* iam
+                        .deletePolicyVersion({
+                        PolicyArn: output.policyArn,
+                        VersionId: version.VersionId,
+                    })
+                        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+                }
+            }
+            yield* iam
+                .deletePolicy({
+                PolicyArn: output.policyArn,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+    };
+}));
+//# sourceMappingURL=Policy.js.map

package/lib/AWS/IAM/Policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Policy.js","sourceRoot":"","sources":["../../../src/AWS/IAM/Policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,OAAO,GACR,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,WAAW,GACZ,MAAM,aAAa,CAAC;AAkErB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAS,gBAAgB,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CACjC,QAAQ,CAAC,MAAM,CACb,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IAE5C,MAAM,YAAY,GAAG,CAAC,EAAU,EAAE,KAAkB,EAAE,EAAE,CACtD,KAAK,CAAC,UAAU;QACd,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QAClC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAEjD,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAU,EAAE,KAAkB;QACrE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,kBAAkB,CAAC;YACxB,SAAS;YACT,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU;SACX,CAAc,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAiB;QACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;aACnC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,OAAO,QAAQ,EAAE,MAAM,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC9C,SAAS,EACT,SAAS,GAIV;QACC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;aACxB,gBAAgB,CAAC;YAChB,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,OAAO,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAiB;QAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC7C,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,6BAA6B,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,KAAK,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAC7B,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IACE,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,IAAK,EAAkB,CAAC,CAAC;gBACtD,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAC/B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC/C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,IACE,CAAC,IAAI,EAAE,WAAW,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,EACpE,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,SAAS,GACb,MAAM,EAAE,SAAS;gBACjB,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,IAAK,EAAkB,CAAC,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACvC,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;gBACrC,SAAS,EAAE,MAAM,CAAC,GAAG;aACtB,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBAC/C,SAAS,EAAE,MAAM,CAAC,GAAG;gBACrB,SAAS,EAAE,MAAM,CAAC,gBAAgB;aACnC,CAAC,CAAC;YAEH,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,GAAgB;gBAClC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,6BAA6B,EAAE,MAAM,CAAC,6BAA6B;gBACnE,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,cAAc;gBACd,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;aAC7B,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAChD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG;gBACX,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YAEF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG;iBACvB,YAAY,CAAC;gBACZ,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,cAAc,EAAE,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC5D,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;aAC3B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBAC9C,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;oBACnB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,WAAW,UAAU,6CAA6C,CACnE,CACF,CAAC;gBACJ,CAAC;gBACD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;oBAC7C,SAAS,EAAE,QAAQ,CAAC,GAAG;iBACxB,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,WAAW,UAAU,gDAAgD,CACtE,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC9B,CAAC,CAAC,CACH,CACF,CAAC;YAEJ,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;YAEtD,OAAO;gBACL,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAc;gBAC1D,UAAU;gBACV,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ;gBAClC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG;gBAC9C,gBAAgB,EAAE,OAAO,CAAC,MAAM,EAAE,gBAAgB;gBAClD,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,eAAe;gBAChD,6BAA6B,EAC3B,OAAO,CAAC,MAAM,EAAE,6BAA6B;gBAC/C,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY;gBAC1C,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,IAAI,CAAC,WAAW;gBAC5D,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,IAAI;aACL,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9D,IACE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,EACnC,CAAC;gBACD,KAAK,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC7C,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;oBACpD,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,cAAc,EAAE,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC;oBAC5D,YAAY,EAAE,IAAI;iBACnB,CAAC,CAAC;gBACH,IAAI,cAAc,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC;oBAC5C,KAAK,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;wBACjC,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,SAAS,EAAE,cAAc,CAAC,aAAa,CAAC,SAAS;qBAClD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;oBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACnD,MAAM,cAAc,GAClB,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,EAAE,gBAAgB;aACpC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC;YAE7B,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,MAAM,CAAC,QAAQ;gBAC7C,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;gBACjC,gBAAgB,EACd,MAAM,EAAE,gBAAgB,IAAI,MAAM,CAAC,gBAAgB;gBACrD,eAAe,EAAE,MAAM,EAAE,eAAe,IAAI,MAAM,CAAC,eAAe;gBAClE,6BAA6B,EAC3B,MAAM,EAAE,6BAA6B;oBACrC,MAAM,CAAC,6BAA6B;gBACtC,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY;gBACzD,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,MAAM,CAAC,WAAW;gBACtD,cAAc;gBACd,IAAI,EAAE,OAAO;aACd,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;iBACxB,kBAAkB,CAAC;gBAClB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;YACJ,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;gBAC/C,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;oBACnD,KAAK,CAAC,CAAC,GAAG;yBACP,mBAAmB,CAAC;wBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B,CAAC;yBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5D,CAAC;gBACN,CAAC;YACH,CAAC;YACD,KAAK,CAAC,CAAC,GAAG;iBACP,YAAY,CAAC;gBACZ,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/AWS/IAM/Role.d.ts

@@ -0,0 +1,82 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { PolicyDocument } from "./Policy.ts";
+export type RoleName = string;
+export type RoleArn = `arn:aws:iam::${AccountID}:role/${RoleName}`;
+export interface RoleProps {
+    /**
+     * Name of the role. If omitted, a unique name will be generated.
+     */
+    roleName?: string;
+    /**
+     * Optional IAM path prefix for the role.
+     * @default "/"
+     */
+    path?: string;
+    /**
+     * IAM trust policy for the role.
+     */
+    assumeRolePolicyDocument: PolicyDocument;
+    /**
+     * Managed policy ARNs to attach to the role.
+     */
+    managedPolicyArns?: string[];
+    /**
+     * Inline policies keyed by policy name.
+     */
+    inlinePolicies?: Record<string, PolicyDocument>;
+    /**
+     * Optional description for the role.
+     */
+    description?: string;
+    /**
+     * Maximum session duration in seconds.
+     */
+    maxSessionDuration?: number;
+    /**
+     * Optional managed policy ARN used as the permissions boundary.
+     */
+    permissionsBoundary?: string;
+    /**
+     * User-defined tags to apply to the role.
+     */
+    tags?: Record<string, string>;
+}
+export interface Role extends Resource<"AWS.IAM.Role", RoleProps, {
+    roleArn: RoleArn;
+    roleName: RoleName;
+    roleId: string | undefined;
+    path: string | undefined;
+    assumeRolePolicyDocument: PolicyDocument;
+    managedPolicyArns: string[];
+    inlinePolicies: Record<string, PolicyDocument>;
+    description: string | undefined;
+    maxSessionDuration: number | undefined;
+    permissionsBoundary: string | undefined;
+    tags: Record<string, string>;
+}, never, Providers> {
+}
+/**
+ * An IAM role for AWS services and runtimes.
+ *
+ * @section Creating Roles
+ * @example ECS Task Role
+ * ```typescript
+ * const role = yield* Role("TaskRole", {
+ *   assumeRolePolicyDocument: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Principal: { Service: "ecs-tasks.amazonaws.com" },
+ *       Action: ["sts:AssumeRole"],
+ *     }],
+ *   },
+ * });
+ * ```
+ */
+export declare const Role: import("../../Resource.ts").ResourceClass<Role>;
+export declare const RoleProvider: () => import("effect/Layer").Layer<Provider.Provider<Role>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials | AWSEnvironment>;
+//# sourceMappingURL=Role.d.ts.map

package/lib/AWS/IAM/Role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Role.d.ts","sourceRoot":"","sources":["../../../src/AWS/IAM/Role.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAOjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAOlD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAC9B,MAAM,MAAM,OAAO,GAAG,gBAAgB,SAAS,SAAS,QAAQ,EAAE,CAAC;AAEnE,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,wBAAwB,EAAE,cAAc,CAAC;IACzC;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChD;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,IAAK,SAAQ,QAAQ,CACpC,cAAc,EACd,SAAS,EACT;IACE,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,wBAAwB,EAAE,cAAc,CAAC;IACzC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC/C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,IAAI,iDAAiC,CAAC;AAEnD,eAAO,MAAM,YAAY,qTA+YtB,CAAC"}

package/lib/AWS/IAM/Role.js

@@ -0,0 +1,303 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { createInternalTags, createTagsList, diffTags, hasTags, } from "../../Tags.js";
+import { AWSEnvironment } from "../Environment.js";
+import { parsePolicyDocument, stringifyPolicyDocument, toTagRecord, } from "./common.js";
+/**
+ * An IAM role for AWS services and runtimes.
+ *
+ * @section Creating Roles
+ * @example ECS Task Role
+ * ```typescript
+ * const role = yield* Role("TaskRole", {
+ *   assumeRolePolicyDocument: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Principal: { Service: "ecs-tasks.amazonaws.com" },
+ *       Action: ["sts:AssumeRole"],
+ *     }],
+ *   },
+ * });
+ * ```
+ */
+export const Role = Resource("AWS.IAM.Role");
+export const RoleProvider = () => Provider.effect(Role, Effect.gen(function* () {
+    yield* AWSEnvironment;
+    const toRoleName = (id, props = {}) => props.roleName
+        ? Effect.succeed(props.roleName)
+        : createPhysicalName({ id, maxLength: 64 });
+    const readInlinePolicies = Effect.fn(function* (roleName) {
+        const listed = yield* iam.listRolePolicies({
+            RoleName: roleName,
+        });
+        const entries = yield* Effect.all((listed.PolicyNames ?? []).map((policyName) => iam
+            .getRolePolicy({
+            RoleName: roleName,
+            PolicyName: policyName,
+        })
+            .pipe(Effect.map((response) => [
+            policyName,
+            parsePolicyDocument(response.PolicyDocument),
+        ]), Effect.catchTag("NoSuchEntityException", () => Effect.succeed([policyName, undefined])))));
+        return Object.fromEntries(entries.filter((entry) => entry[1] !== undefined));
+    });
+    const readManagedPolicies = Effect.fn(function* (roleName) {
+        const listed = yield* iam.listAttachedRolePolicies({
+            RoleName: roleName,
+        });
+        return (listed.AttachedPolicies ?? [])
+            .map((policy) => policy.PolicyArn)
+            .filter((policyArn) => typeof policyArn === "string");
+    });
+    const readTags = Effect.fn(function* (roleName) {
+        const listed = yield* iam.listRoleTags({
+            RoleName: roleName,
+        });
+        return toTagRecord(listed.Tags);
+    });
+    const syncManagedPolicies = Effect.fn(function* ({ roleName, olds, news, }) {
+        const oldSet = new Set(olds);
+        const newSet = new Set(news);
+        for (const policyArn of news) {
+            if (!oldSet.has(policyArn)) {
+                yield* iam.attachRolePolicy({
+                    RoleName: roleName,
+                    PolicyArn: policyArn,
+                });
+            }
+        }
+        for (const policyArn of olds) {
+            if (!newSet.has(policyArn)) {
+                yield* iam
+                    .detachRolePolicy({
+                    RoleName: roleName,
+                    PolicyArn: policyArn,
+                })
+                    .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+            }
+        }
+    });
+    const syncInlinePolicies = Effect.fn(function* ({ roleName, olds, news, }) {
+        for (const [policyName, document] of Object.entries(news)) {
+            if (JSON.stringify(olds[policyName] ?? null) !==
+                JSON.stringify(document)) {
+                yield* iam.putRolePolicy({
+                    RoleName: roleName,
+                    PolicyName: policyName,
+                    PolicyDocument: stringifyPolicyDocument(document),
+                });
+            }
+        }
+        for (const policyName of Object.keys(olds)) {
+            if (!(policyName in news)) {
+                yield* iam
+                    .deleteRolePolicy({
+                    RoleName: roleName,
+                    PolicyName: policyName,
+                })
+                    .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+            }
+        }
+    });
+    return {
+        stables: ["roleArn", "roleName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+            if (!isResolved(news))
+                return;
+            if ((yield* toRoleName(id, olds ?? {})) !==
+                (yield* toRoleName(id, news ?? {}))) {
+                return { action: "replace" };
+            }
+            if ((olds?.path ?? "/") !== (news.path ?? "/")) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ output }) {
+            if (!output) {
+                return undefined;
+            }
+            const role = yield* iam
+                .getRole({
+                RoleName: output.roleName,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.succeed(undefined)));
+            if (!role?.Role) {
+                return undefined;
+            }
+            const [managedPolicyArns, inlinePolicies, tags] = yield* Effect.all([
+                readManagedPolicies(output.roleName),
+                readInlinePolicies(output.roleName),
+                readTags(output.roleName),
+            ]);
+            const assumeRolePolicyDocument = parsePolicyDocument(role.Role.AssumeRolePolicyDocument) ??
+                output.assumeRolePolicyDocument;
+            return {
+                roleArn: role.Role.Arn,
+                roleName: role.Role.RoleName,
+                roleId: role.Role.RoleId,
+                path: role.Role.Path,
+                assumeRolePolicyDocument,
+                managedPolicyArns,
+                inlinePolicies,
+                description: role.Role.Description,
+                maxSessionDuration: role.Role.MaxSessionDuration,
+                permissionsBoundary: role.Role.PermissionsBoundary?.PermissionsBoundaryArn,
+                tags,
+            };
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+            const roleName = yield* toRoleName(id, news);
+            const tags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            const created = yield* iam
+                .createRole({
+                Path: news.path,
+                RoleName: roleName,
+                AssumeRolePolicyDocument: stringifyPolicyDocument(news.assumeRolePolicyDocument),
+                Description: news.description,
+                MaxSessionDuration: news.maxSessionDuration,
+                PermissionsBoundary: news.permissionsBoundary,
+                Tags: createTagsList(tags),
+            })
+                .pipe(Effect.catchTag("EntityAlreadyExistsException", () => iam.getRole({ RoleName: roleName }).pipe(Effect.filterOrFail((existing) => hasTags(tags, existing.Role?.Tags), () => new Error(`Role '${roleName}' already exists and is not managed by alchemy`)))));
+            yield* syncManagedPolicies({
+                roleName,
+                olds: [],
+                news: news.managedPolicyArns ?? [],
+            });
+            yield* syncInlinePolicies({
+                roleName,
+                olds: {},
+                news: news.inlinePolicies ?? {},
+            });
+            const roleArn = (created.Role?.Arn ??
+                `arn:aws:iam::${(yield* AWSEnvironment).accountId}:role/${roleName}`);
+            yield* session.note(roleArn);
+            return {
+                roleArn,
+                roleName,
+                roleId: created.Role?.RoleId,
+                path: created.Role?.Path ?? news.path ?? "/",
+                assumeRolePolicyDocument: news.assumeRolePolicyDocument,
+                managedPolicyArns: news.managedPolicyArns ?? [],
+                inlinePolicies: news.inlinePolicies ?? {},
+                description: news.description,
+                maxSessionDuration: news.maxSessionDuration,
+                permissionsBoundary: news.permissionsBoundary,
+                tags,
+            };
+        }),
+        update: Effect.fn(function* ({ id, news, olds, output, session }) {
+            yield* iam.updateAssumeRolePolicy({
+                RoleName: output.roleName,
+                PolicyDocument: stringifyPolicyDocument(news.assumeRolePolicyDocument),
+            });
+            if (news.description !== olds.description ||
+                news.maxSessionDuration !== olds.maxSessionDuration) {
+                yield* iam.updateRole({
+                    RoleName: output.roleName,
+                    Description: news.description,
+                    MaxSessionDuration: news.maxSessionDuration,
+                });
+            }
+            if (news.permissionsBoundary !== olds.permissionsBoundary) {
+                if (news.permissionsBoundary) {
+                    yield* iam.putRolePermissionsBoundary({
+                        RoleName: output.roleName,
+                        PermissionsBoundary: news.permissionsBoundary,
+                    });
+                }
+                else if (olds.permissionsBoundary) {
+                    yield* iam
+                        .deleteRolePermissionsBoundary({
+                        RoleName: output.roleName,
+                    })
+                        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+                }
+            }
+            yield* syncManagedPolicies({
+                roleName: output.roleName,
+                olds: olds.managedPolicyArns ?? [],
+                news: news.managedPolicyArns ?? [],
+            });
+            yield* syncInlinePolicies({
+                roleName: output.roleName,
+                olds: olds.inlinePolicies ?? {},
+                news: news.inlinePolicies ?? {},
+            });
+            const oldTags = {
+                ...(yield* createInternalTags(id)),
+                ...olds.tags,
+            };
+            const newTags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            const { removed, upsert } = diffTags(oldTags, newTags);
+            if (upsert.length > 0) {
+                yield* iam.tagRole({
+                    RoleName: output.roleName,
+                    Tags: upsert,
+                });
+            }
+            if (removed.length > 0) {
+                yield* iam.untagRole({
+                    RoleName: output.roleName,
+                    TagKeys: removed,
+                });
+            }
+            const liveRole = yield* iam.getRole({
+                RoleName: output.roleName,
+            });
+            yield* session.note(output.roleArn);
+            return {
+                roleArn: (liveRole.Role?.Arn ?? output.roleArn),
+                roleName: liveRole.Role?.RoleName ?? output.roleName,
+                roleId: liveRole.Role?.RoleId ?? output.roleId,
+                path: liveRole.Role?.Path ?? output.path,
+                assumeRolePolicyDocument: news.assumeRolePolicyDocument,
+                managedPolicyArns: news.managedPolicyArns ?? [],
+                inlinePolicies: news.inlinePolicies ?? {},
+                description: liveRole.Role?.Description ?? news.description,
+                maxSessionDuration: liveRole.Role?.MaxSessionDuration ?? news.maxSessionDuration,
+                permissionsBoundary: liveRole.Role?.PermissionsBoundary?.PermissionsBoundaryArn ??
+                    news.permissionsBoundary,
+                tags: newTags,
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* iam
+                .deleteRolePermissionsBoundary({
+                RoleName: output.roleName,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+            yield* iam.listRolePolicies({ RoleName: output.roleName }).pipe(Effect.flatMap((policies) => Effect.all((policies.PolicyNames ?? []).map((policyName) => iam
+                .deleteRolePolicy({
+                RoleName: output.roleName,
+                PolicyName: policyName,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void))))));
+            yield* iam
+                .listAttachedRolePolicies({ RoleName: output.roleName })
+                .pipe(Effect.flatMap((policies) => Effect.all((policies.AttachedPolicies ?? []).map((policy) => iam
+                .detachRolePolicy({
+                RoleName: output.roleName,
+                PolicyArn: policy.PolicyArn,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void))))));
+            yield* iam
+                .deleteRole({
+                RoleName: output.roleName,
+            })
+                .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+    };
+}));
+//# sourceMappingURL=Role.js.map