aws-iam-ls 0.0.0

package/src/handlers/completion/statement-key.js

@@ -0,0 +1,41 @@
+import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+import { StatementKeys } from "../../lib/iam-policy/statement-keys.js";
+export function completeStatementKey(location, context) {
+    const statement = context.handler.getStatementContext(context.uri, context.position);
+    const existingKeys = deriveExistingKeys(statement);
+    const existingGroups = new Set();
+    for (const key of existingKeys) {
+        const element = StatementKeys[key];
+        if (element)
+            existingGroups.add(element.group);
+    }
+    const items = [];
+    for (const [name, element] of Object.entries(StatementKeys)) {
+        if (existingKeys.includes(name))
+            continue;
+        if (existingGroups.has(element.group))
+            continue;
+        if (location.partial && !name.toLowerCase().startsWith(location.partial.toLowerCase()))
+            continue;
+        items.push({
+            label: name,
+            kind: CompletionItemKind.Field,
+            documentation: {
+                kind: MarkupKind.Markdown,
+                value: element.description,
+            },
+        });
+    }
+    return { items, isIncomplete: false };
+}
+function deriveExistingKeys(statement) {
+    if (!statement)
+        return [];
+    const keys = [];
+    for (const name of Object.keys(StatementKeys)) {
+        if (name in statement) {
+            keys.push(name);
+        }
+    }
+    return keys;
+}

package/src/lib/iam-policy/condition-operators.d.ts

@@ -0,0 +1,317 @@
+export declare const conditionOperators: {
+    readonly StringEquals: {
+        readonly description: "Exact matching, case sensitive";
+    };
+    readonly StringEqualsIfExists: {
+        readonly description: "Exact matching, case sensitive; true if key is absent";
+    };
+    readonly 'ForAllValues:StringEquals': {
+        readonly description: "All values must match at least one policy value (case sensitive)";
+    };
+    readonly 'ForAnyValue:StringEquals': {
+        readonly description: "At least one value must match a policy value (case sensitive)";
+    };
+    readonly StringNotEquals: {
+        readonly description: "Negated matching, case sensitive";
+    };
+    readonly StringNotEqualsIfExists: {
+        readonly description: "Negated matching, case sensitive; true if key is absent";
+    };
+    readonly 'ForAllValues:StringNotEquals': {
+        readonly description: "None of the values can match any policy value (case sensitive)";
+    };
+    readonly 'ForAnyValue:StringNotEquals': {
+        readonly description: "At least one value must not match any policy value (case sensitive)";
+    };
+    readonly StringEqualsIgnoreCase: {
+        readonly description: "Exact matching, ignoring case";
+    };
+    readonly StringEqualsIgnoreCaseIfExists: {
+        readonly description: "Exact matching, ignoring case; true if key is absent";
+    };
+    readonly 'ForAllValues:StringEqualsIgnoreCase': {
+        readonly description: "All values must match at least one policy value (case insensitive)";
+    };
+    readonly 'ForAnyValue:StringEqualsIgnoreCase': {
+        readonly description: "At least one value must match a policy value (case insensitive)";
+    };
+    readonly StringNotEqualsIgnoreCase: {
+        readonly description: "Negated matching, ignoring case";
+    };
+    readonly StringNotEqualsIgnoreCaseIfExists: {
+        readonly description: "Negated matching, ignoring case; true if key is absent";
+    };
+    readonly 'ForAllValues:StringNotEqualsIgnoreCase': {
+        readonly description: "None of the values can match any policy value (case insensitive)";
+    };
+    readonly 'ForAnyValue:StringNotEqualsIgnoreCase': {
+        readonly description: "At least one value must not match any policy value (case insensitive)";
+    };
+    readonly StringLike: {
+        readonly description: "Case-sensitive matching with wildcard support (* and ?)";
+    };
+    readonly StringLikeIfExists: {
+        readonly description: "Wildcard matching; true if key is absent";
+    };
+    readonly 'ForAllValues:StringLike': {
+        readonly description: "All values must match at least one policy value pattern";
+    };
+    readonly 'ForAnyValue:StringLike': {
+        readonly description: "At least one value must match a policy value pattern";
+    };
+    readonly StringNotLike: {
+        readonly description: "Negated case-sensitive matching with wildcard support";
+    };
+    readonly StringNotLikeIfExists: {
+        readonly description: "Negated wildcard matching; true if key is absent";
+    };
+    readonly 'ForAllValues:StringNotLike': {
+        readonly description: "None of the values can match any policy value pattern";
+    };
+    readonly 'ForAnyValue:StringNotLike': {
+        readonly description: "At least one value must not match any policy value pattern";
+    };
+    readonly NumericEquals: {
+        readonly description: "Exact numeric matching";
+    };
+    readonly NumericEqualsIfExists: {
+        readonly description: "Exact numeric matching; true if key is absent";
+    };
+    readonly 'ForAllValues:NumericEquals': {
+        readonly description: "All values must match at least one policy numeric value";
+    };
+    readonly 'ForAnyValue:NumericEquals': {
+        readonly description: "At least one value must match a policy numeric value";
+    };
+    readonly NumericNotEquals: {
+        readonly description: "Negated numeric matching";
+    };
+    readonly NumericNotEqualsIfExists: {
+        readonly description: "Negated numeric matching; true if key is absent";
+    };
+    readonly 'ForAllValues:NumericNotEquals': {
+        readonly description: "None of the values can match any policy numeric value";
+    };
+    readonly 'ForAnyValue:NumericNotEquals': {
+        readonly description: "At least one value must not match any policy numeric value";
+    };
+    readonly NumericLessThan: {
+        readonly description: "Less than matching";
+    };
+    readonly NumericLessThanIfExists: {
+        readonly description: "Less than matching; true if key is absent";
+    };
+    readonly 'ForAllValues:NumericLessThan': {
+        readonly description: "All values must be less than the policy value";
+    };
+    readonly 'ForAnyValue:NumericLessThan': {
+        readonly description: "At least one value must be less than the policy value";
+    };
+    readonly NumericLessThanEquals: {
+        readonly description: "Less than or equals matching";
+    };
+    readonly NumericLessThanEqualsIfExists: {
+        readonly description: "Less than or equals matching; true if key is absent";
+    };
+    readonly 'ForAllValues:NumericLessThanEquals': {
+        readonly description: "All values must be less than or equal to the policy value";
+    };
+    readonly 'ForAnyValue:NumericLessThanEquals': {
+        readonly description: "At least one value must be less than or equal to the policy value";
+    };
+    readonly NumericGreaterThan: {
+        readonly description: "Greater than matching";
+    };
+    readonly NumericGreaterThanIfExists: {
+        readonly description: "Greater than matching; true if key is absent";
+    };
+    readonly 'ForAllValues:NumericGreaterThan': {
+        readonly description: "All values must be greater than the policy value";
+    };
+    readonly 'ForAnyValue:NumericGreaterThan': {
+        readonly description: "At least one value must be greater than the policy value";
+    };
+    readonly NumericGreaterThanEquals: {
+        readonly description: "Greater than or equals matching";
+    };
+    readonly NumericGreaterThanEqualsIfExists: {
+        readonly description: "Greater than or equals matching; true if key is absent";
+    };
+    readonly 'ForAllValues:NumericGreaterThanEquals': {
+        readonly description: "All values must be greater than or equal to the policy value";
+    };
+    readonly 'ForAnyValue:NumericGreaterThanEquals': {
+        readonly description: "At least one value must be greater than or equal to the policy value";
+    };
+    readonly DateEquals: {
+        readonly description: "Matching a specific date";
+    };
+    readonly DateEqualsIfExists: {
+        readonly description: "Date matching; true if key is absent";
+    };
+    readonly 'ForAllValues:DateEquals': {
+        readonly description: "All values must match a policy date value";
+    };
+    readonly 'ForAnyValue:DateEquals': {
+        readonly description: "At least one value must match a policy date value";
+    };
+    readonly DateNotEquals: {
+        readonly description: "Negated date matching";
+    };
+    readonly DateNotEqualsIfExists: {
+        readonly description: "Negated date matching; true if key is absent";
+    };
+    readonly 'ForAllValues:DateNotEquals': {
+        readonly description: "None of the values can match any policy date value";
+    };
+    readonly 'ForAnyValue:DateNotEquals': {
+        readonly description: "At least one value must not match any policy date value";
+    };
+    readonly DateLessThan: {
+        readonly description: "Matching before a specific date and time";
+    };
+    readonly DateLessThanIfExists: {
+        readonly description: "Before date matching; true if key is absent";
+    };
+    readonly 'ForAllValues:DateLessThan': {
+        readonly description: "All values must be before the policy date";
+    };
+    readonly 'ForAnyValue:DateLessThan': {
+        readonly description: "At least one value must be before the policy date";
+    };
+    readonly DateLessThanEquals: {
+        readonly description: "Matching at or before a specific date and time";
+    };
+    readonly DateLessThanEqualsIfExists: {
+        readonly description: "At or before date matching; true if key is absent";
+    };
+    readonly 'ForAllValues:DateLessThanEquals': {
+        readonly description: "All values must be at or before the policy date";
+    };
+    readonly 'ForAnyValue:DateLessThanEquals': {
+        readonly description: "At least one value must be at or before the policy date";
+    };
+    readonly DateGreaterThan: {
+        readonly description: "Matching after a specific date and time";
+    };
+    readonly DateGreaterThanIfExists: {
+        readonly description: "After date matching; true if key is absent";
+    };
+    readonly 'ForAllValues:DateGreaterThan': {
+        readonly description: "All values must be after the policy date";
+    };
+    readonly 'ForAnyValue:DateGreaterThan': {
+        readonly description: "At least one value must be after the policy date";
+    };
+    readonly DateGreaterThanEquals: {
+        readonly description: "Matching at or after a specific date and time";
+    };
+    readonly DateGreaterThanEqualsIfExists: {
+        readonly description: "At or after date matching; true if key is absent";
+    };
+    readonly 'ForAllValues:DateGreaterThanEquals': {
+        readonly description: "All values must be at or after the policy date";
+    };
+    readonly 'ForAnyValue:DateGreaterThanEquals': {
+        readonly description: "At least one value must be at or after the policy date";
+    };
+    readonly Bool: {
+        readonly description: "Boolean matching (true or false)";
+    };
+    readonly BoolIfExists: {
+        readonly description: "Boolean matching; true if key is absent";
+    };
+    readonly 'ForAllValues:Bool': {
+        readonly description: "All values must match the policy boolean";
+    };
+    readonly 'ForAnyValue:Bool': {
+        readonly description: "At least one value must match the policy boolean";
+    };
+    readonly BinaryEquals: {
+        readonly description: "Byte-for-byte comparison of base-64 encoded binary values";
+    };
+    readonly BinaryEqualsIfExists: {
+        readonly description: "Binary value matching; true if key is absent";
+    };
+    readonly 'ForAllValues:BinaryEquals': {
+        readonly description: "All values must match a policy binary value";
+    };
+    readonly 'ForAnyValue:BinaryEquals': {
+        readonly description: "At least one value must match a policy binary value";
+    };
+    readonly IpAddress: {
+        readonly description: "Matching a specific IP address or CIDR range";
+    };
+    readonly IpAddressIfExists: {
+        readonly description: "IP address matching; true if key is absent";
+    };
+    readonly 'ForAllValues:IpAddress': {
+        readonly description: "All values must match a policy IP address or CIDR range";
+    };
+    readonly 'ForAnyValue:IpAddress': {
+        readonly description: "At least one value must match a policy IP address or CIDR range";
+    };
+    readonly NotIpAddress: {
+        readonly description: "All IP addresses except the specified IP address or CIDR range";
+    };
+    readonly NotIpAddressIfExists: {
+        readonly description: "Negated IP address matching; true if key is absent";
+    };
+    readonly 'ForAllValues:NotIpAddress': {
+        readonly description: "All values must not match any policy IP address or CIDR range";
+    };
+    readonly 'ForAnyValue:NotIpAddress': {
+        readonly description: "At least one value must not match any policy IP address or CIDR range";
+    };
+    readonly ArnEquals: {
+        readonly description: "Case-sensitive ARN matching";
+    };
+    readonly ArnEqualsIfExists: {
+        readonly description: "ARN matching; true if key is absent";
+    };
+    readonly 'ForAllValues:ArnEquals': {
+        readonly description: "All values must match at least one policy ARN";
+    };
+    readonly 'ForAnyValue:ArnEquals': {
+        readonly description: "At least one value must match a policy ARN";
+    };
+    readonly ArnLike: {
+        readonly description: "Case-sensitive ARN matching with wildcard support (* and ?)";
+    };
+    readonly ArnLikeIfExists: {
+        readonly description: "ARN wildcard matching; true if key is absent";
+    };
+    readonly 'ForAllValues:ArnLike': {
+        readonly description: "All values must match at least one policy ARN pattern";
+    };
+    readonly 'ForAnyValue:ArnLike': {
+        readonly description: "At least one value must match a policy ARN pattern";
+    };
+    readonly ArnNotEquals: {
+        readonly description: "Negated case-sensitive ARN matching";
+    };
+    readonly ArnNotEqualsIfExists: {
+        readonly description: "Negated ARN matching; true if key is absent";
+    };
+    readonly 'ForAllValues:ArnNotEquals': {
+        readonly description: "None of the values can match any policy ARN";
+    };
+    readonly 'ForAnyValue:ArnNotEquals': {
+        readonly description: "At least one value must not match any policy ARN";
+    };
+    readonly ArnNotLike: {
+        readonly description: "Negated case-sensitive ARN matching with wildcard support";
+    };
+    readonly ArnNotLikeIfExists: {
+        readonly description: "Negated ARN wildcard matching; true if key is absent";
+    };
+    readonly 'ForAllValues:ArnNotLike': {
+        readonly description: "None of the values can match any policy ARN pattern";
+    };
+    readonly 'ForAnyValue:ArnNotLike': {
+        readonly description: "At least one value must not match any policy ARN pattern";
+    };
+    readonly Null: {
+        readonly description: "Checks whether a condition key is present (true if absent, false if present)";
+    };
+};

package/src/lib/iam-policy/condition-operators.js

@@ -0,0 +1,129 @@
+export const conditionOperators = {
+    // String
+    StringEquals: { description: 'Exact matching, case sensitive' },
+    StringEqualsIfExists: { description: 'Exact matching, case sensitive; true if key is absent' },
+    'ForAllValues:StringEquals': { description: 'All values must match at least one policy value (case sensitive)' },
+    'ForAnyValue:StringEquals': { description: 'At least one value must match a policy value (case sensitive)' },
+    StringNotEquals: { description: 'Negated matching, case sensitive' },
+    StringNotEqualsIfExists: { description: 'Negated matching, case sensitive; true if key is absent' },
+    'ForAllValues:StringNotEquals': { description: 'None of the values can match any policy value (case sensitive)' },
+    'ForAnyValue:StringNotEquals': { description: 'At least one value must not match any policy value (case sensitive)' },
+    StringEqualsIgnoreCase: { description: 'Exact matching, ignoring case' },
+    StringEqualsIgnoreCaseIfExists: { description: 'Exact matching, ignoring case; true if key is absent' },
+    'ForAllValues:StringEqualsIgnoreCase': {
+        description: 'All values must match at least one policy value (case insensitive)',
+    },
+    'ForAnyValue:StringEqualsIgnoreCase': {
+        description: 'At least one value must match a policy value (case insensitive)',
+    },
+    StringNotEqualsIgnoreCase: { description: 'Negated matching, ignoring case' },
+    StringNotEqualsIgnoreCaseIfExists: { description: 'Negated matching, ignoring case; true if key is absent' },
+    'ForAllValues:StringNotEqualsIgnoreCase': {
+        description: 'None of the values can match any policy value (case insensitive)',
+    },
+    'ForAnyValue:StringNotEqualsIgnoreCase': {
+        description: 'At least one value must not match any policy value (case insensitive)',
+    },
+    StringLike: { description: 'Case-sensitive matching with wildcard support (* and ?)' },
+    StringLikeIfExists: { description: 'Wildcard matching; true if key is absent' },
+    'ForAllValues:StringLike': { description: 'All values must match at least one policy value pattern' },
+    'ForAnyValue:StringLike': { description: 'At least one value must match a policy value pattern' },
+    StringNotLike: { description: 'Negated case-sensitive matching with wildcard support' },
+    StringNotLikeIfExists: { description: 'Negated wildcard matching; true if key is absent' },
+    'ForAllValues:StringNotLike': { description: 'None of the values can match any policy value pattern' },
+    'ForAnyValue:StringNotLike': { description: 'At least one value must not match any policy value pattern' },
+    // Numeric
+    NumericEquals: { description: 'Exact numeric matching' },
+    NumericEqualsIfExists: { description: 'Exact numeric matching; true if key is absent' },
+    'ForAllValues:NumericEquals': { description: 'All values must match at least one policy numeric value' },
+    'ForAnyValue:NumericEquals': { description: 'At least one value must match a policy numeric value' },
+    NumericNotEquals: { description: 'Negated numeric matching' },
+    NumericNotEqualsIfExists: { description: 'Negated numeric matching; true if key is absent' },
+    'ForAllValues:NumericNotEquals': { description: 'None of the values can match any policy numeric value' },
+    'ForAnyValue:NumericNotEquals': { description: 'At least one value must not match any policy numeric value' },
+    NumericLessThan: { description: 'Less than matching' },
+    NumericLessThanIfExists: { description: 'Less than matching; true if key is absent' },
+    'ForAllValues:NumericLessThan': { description: 'All values must be less than the policy value' },
+    'ForAnyValue:NumericLessThan': { description: 'At least one value must be less than the policy value' },
+    NumericLessThanEquals: { description: 'Less than or equals matching' },
+    NumericLessThanEqualsIfExists: { description: 'Less than or equals matching; true if key is absent' },
+    'ForAllValues:NumericLessThanEquals': { description: 'All values must be less than or equal to the policy value' },
+    'ForAnyValue:NumericLessThanEquals': {
+        description: 'At least one value must be less than or equal to the policy value',
+    },
+    NumericGreaterThan: { description: 'Greater than matching' },
+    NumericGreaterThanIfExists: { description: 'Greater than matching; true if key is absent' },
+    'ForAllValues:NumericGreaterThan': { description: 'All values must be greater than the policy value' },
+    'ForAnyValue:NumericGreaterThan': { description: 'At least one value must be greater than the policy value' },
+    NumericGreaterThanEquals: { description: 'Greater than or equals matching' },
+    NumericGreaterThanEqualsIfExists: { description: 'Greater than or equals matching; true if key is absent' },
+    'ForAllValues:NumericGreaterThanEquals': {
+        description: 'All values must be greater than or equal to the policy value',
+    },
+    'ForAnyValue:NumericGreaterThanEquals': {
+        description: 'At least one value must be greater than or equal to the policy value',
+    },
+    // Date
+    DateEquals: { description: 'Matching a specific date' },
+    DateEqualsIfExists: { description: 'Date matching; true if key is absent' },
+    'ForAllValues:DateEquals': { description: 'All values must match a policy date value' },
+    'ForAnyValue:DateEquals': { description: 'At least one value must match a policy date value' },
+    DateNotEquals: { description: 'Negated date matching' },
+    DateNotEqualsIfExists: { description: 'Negated date matching; true if key is absent' },
+    'ForAllValues:DateNotEquals': { description: 'None of the values can match any policy date value' },
+    'ForAnyValue:DateNotEquals': { description: 'At least one value must not match any policy date value' },
+    DateLessThan: { description: 'Matching before a specific date and time' },
+    DateLessThanIfExists: { description: 'Before date matching; true if key is absent' },
+    'ForAllValues:DateLessThan': { description: 'All values must be before the policy date' },
+    'ForAnyValue:DateLessThan': { description: 'At least one value must be before the policy date' },
+    DateLessThanEquals: { description: 'Matching at or before a specific date and time' },
+    DateLessThanEqualsIfExists: { description: 'At or before date matching; true if key is absent' },
+    'ForAllValues:DateLessThanEquals': { description: 'All values must be at or before the policy date' },
+    'ForAnyValue:DateLessThanEquals': { description: 'At least one value must be at or before the policy date' },
+    DateGreaterThan: { description: 'Matching after a specific date and time' },
+    DateGreaterThanIfExists: { description: 'After date matching; true if key is absent' },
+    'ForAllValues:DateGreaterThan': { description: 'All values must be after the policy date' },
+    'ForAnyValue:DateGreaterThan': { description: 'At least one value must be after the policy date' },
+    DateGreaterThanEquals: { description: 'Matching at or after a specific date and time' },
+    DateGreaterThanEqualsIfExists: { description: 'At or after date matching; true if key is absent' },
+    'ForAllValues:DateGreaterThanEquals': { description: 'All values must be at or after the policy date' },
+    'ForAnyValue:DateGreaterThanEquals': { description: 'At least one value must be at or after the policy date' },
+    // Boolean
+    Bool: { description: 'Boolean matching (true or false)' },
+    BoolIfExists: { description: 'Boolean matching; true if key is absent' },
+    'ForAllValues:Bool': { description: 'All values must match the policy boolean' },
+    'ForAnyValue:Bool': { description: 'At least one value must match the policy boolean' },
+    // Binary
+    BinaryEquals: { description: 'Byte-for-byte comparison of base-64 encoded binary values' },
+    BinaryEqualsIfExists: { description: 'Binary value matching; true if key is absent' },
+    'ForAllValues:BinaryEquals': { description: 'All values must match a policy binary value' },
+    'ForAnyValue:BinaryEquals': { description: 'At least one value must match a policy binary value' },
+    // IP address
+    IpAddress: { description: 'Matching a specific IP address or CIDR range' },
+    IpAddressIfExists: { description: 'IP address matching; true if key is absent' },
+    'ForAllValues:IpAddress': { description: 'All values must match a policy IP address or CIDR range' },
+    'ForAnyValue:IpAddress': { description: 'At least one value must match a policy IP address or CIDR range' },
+    NotIpAddress: { description: 'All IP addresses except the specified IP address or CIDR range' },
+    NotIpAddressIfExists: { description: 'Negated IP address matching; true if key is absent' },
+    'ForAllValues:NotIpAddress': { description: 'All values must not match any policy IP address or CIDR range' },
+    'ForAnyValue:NotIpAddress': { description: 'At least one value must not match any policy IP address or CIDR range' },
+    // ARN
+    ArnEquals: { description: 'Case-sensitive ARN matching' },
+    ArnEqualsIfExists: { description: 'ARN matching; true if key is absent' },
+    'ForAllValues:ArnEquals': { description: 'All values must match at least one policy ARN' },
+    'ForAnyValue:ArnEquals': { description: 'At least one value must match a policy ARN' },
+    ArnLike: { description: 'Case-sensitive ARN matching with wildcard support (* and ?)' },
+    ArnLikeIfExists: { description: 'ARN wildcard matching; true if key is absent' },
+    'ForAllValues:ArnLike': { description: 'All values must match at least one policy ARN pattern' },
+    'ForAnyValue:ArnLike': { description: 'At least one value must match a policy ARN pattern' },
+    ArnNotEquals: { description: 'Negated case-sensitive ARN matching' },
+    ArnNotEqualsIfExists: { description: 'Negated ARN matching; true if key is absent' },
+    'ForAllValues:ArnNotEquals': { description: 'None of the values can match any policy ARN' },
+    'ForAnyValue:ArnNotEquals': { description: 'At least one value must not match any policy ARN' },
+    ArnNotLike: { description: 'Negated case-sensitive ARN matching with wildcard support' },
+    ArnNotLikeIfExists: { description: 'Negated ARN wildcard matching; true if key is absent' },
+    'ForAllValues:ArnNotLike': { description: 'None of the values can match any policy ARN pattern' },
+    'ForAnyValue:ArnNotLike': { description: 'At least one value must not match any policy ARN pattern' },
+    // Null
+    Null: { description: 'Checks whether a condition key is present (true if absent, false if present)' },
+};

package/src/lib/iam-policy/location.d.ts

@@ -0,0 +1,71 @@
+import type { CursorContext } from '../treesitter/base.ts';
+export type StatementKeyLocation = {
+    type: 'statement-key';
+    partial: string;
+};
+export type StatementBlockLocation = {
+    type: 'statement-block';
+    partial: string;
+};
+export type EffectValueLocation = {
+    type: 'effect-value';
+    partial: string;
+};
+export type ActionValueLocation = {
+    type: 'action-value';
+    partial: string;
+};
+export type ResourceValueLocation = {
+    type: 'resource-value';
+    partial: string;
+};
+export type PrincipalValueLocation = {
+    type: 'principal-value';
+    partial: string;
+};
+export type PrincipalTypeLocation = {
+    type: 'principal-type';
+    partial: string;
+};
+export type PrincipalBlockLocation = {
+    type: 'principal-block';
+    partial: string;
+};
+export type PrincipalBlockTypeLocation = {
+    type: 'principal-block-type';
+    partial: string;
+};
+export type PrincipalBlockIdentifierLocation = {
+    type: 'principal-block-identifier';
+    principalType: string | null;
+    partial: string;
+};
+export type PrincipalTypedValueLocation = {
+    type: 'principal-typed-value';
+    principalType: string;
+    partial: string;
+};
+export type ConditionBlockLocation = {
+    type: 'condition-block';
+    partial: string;
+};
+export type ConditionOperatorLocation = {
+    type: 'condition-operator';
+    partial: string;
+};
+export type ConditionKeyLocation = {
+    type: 'condition-key';
+    operator: string;
+    partial: string;
+};
+export type ConditionValueLocation = {
+    type: 'condition-value';
+    operator: string;
+    key: string;
+    partial: string;
+};
+export type UnknownLocation = {
+    type: 'unknown';
+};
+export type PolicyLocation = StatementKeyLocation | StatementBlockLocation | EffectValueLocation | ActionValueLocation | ResourceValueLocation | PrincipalValueLocation | PrincipalTypeLocation | PrincipalBlockLocation | PrincipalBlockTypeLocation | PrincipalBlockIdentifierLocation | PrincipalTypedValueLocation | ConditionBlockLocation | ConditionOperatorLocation | ConditionKeyLocation | ConditionValueLocation | UnknownLocation;
+export declare function resolvePolicyLocation(context: CursorContext): PolicyLocation;

package/src/lib/iam-policy/location.js

@@ -0,0 +1,82 @@
+const snakeToPascal = {
+    sid: 'Sid',
+    effect: 'Effect',
+    principals: 'Principal',
+    not_principals: 'NotPrincipal',
+    actions: 'Action',
+    not_actions: 'NotAction',
+    resources: 'Resource',
+    not_resources: 'NotResource',
+    condition: 'Condition',
+};
+const cfnIntrinsicPattern = /^(Fn::|Ref$)/;
+export function resolvePolicyLocation(context) {
+    const isHclBlock = context.policyFormat === 'hcl-block';
+    const keys = context.keys.filter((key) => !cfnIntrinsicPattern.test(key));
+    const statementKey = isHclBlock ? (snakeToPascal[keys[0]] ?? keys[0]) : keys[0];
+    if (keys.length === 0 && context.role === 'key') {
+        if (isHclBlock)
+            return { type: 'statement-block', partial: context.partial };
+        return { type: 'statement-key', partial: context.partial };
+    }
+    if (keys.length === 1 && context.role === 'value') {
+        if (statementKey === 'Effect')
+            return { type: 'effect-value', partial: context.partial };
+        if (statementKey === 'Action' || statementKey === 'NotAction')
+            return { type: 'action-value', partial: context.partial };
+        if (statementKey === 'Resource' || statementKey === 'NotResource')
+            return { type: 'resource-value', partial: context.partial };
+        if (statementKey === 'Principal' || statementKey === 'NotPrincipal')
+            return { type: 'principal-value', partial: context.partial };
+        if (statementKey === 'Condition')
+            return { type: 'condition-operator', partial: context.partial };
+    }
+    if (keys.length === 1 && context.role === 'key') {
+        if (statementKey === 'Principal' || statementKey === 'NotPrincipal') {
+            if (isHclBlock) {
+                return { type: 'principal-block', partial: context.partial };
+            }
+            return { type: 'principal-type', partial: context.partial };
+        }
+        if (statementKey === 'Condition') {
+            if (isHclBlock)
+                return { type: 'condition-block', partial: context.partial };
+            return { type: 'condition-operator', partial: context.partial };
+        }
+    }
+    if ((keys.length === 2 || keys.length === 3) && context.role === 'value') {
+        if (statementKey === 'Principal' || statementKey === 'NotPrincipal') {
+            if (isHclBlock && keys[1] === 'type') {
+                return { type: 'principal-block-type', partial: context.partial };
+            }
+            if (isHclBlock && keys[1] === 'identifiers') {
+                return { type: 'principal-block-identifier', principalType: keys[2] ?? null, partial: context.partial };
+            }
+            if (keys.length === 2) {
+                return { type: 'principal-typed-value', principalType: keys[1], partial: context.partial };
+            }
+        }
+    }
+    if (keys.length === 2 && context.role === 'value') {
+        if (statementKey === 'Condition' && isHclBlock && keys[1] === 'test') {
+            return { type: 'condition-operator', partial: context.partial };
+        }
+        if (statementKey === 'Condition' && isHclBlock && keys[1] === 'variable') {
+            return { type: 'condition-key', operator: '', partial: context.partial };
+        }
+        if (statementKey === 'Condition' && !isHclBlock) {
+            return { type: 'condition-key', operator: keys[1], partial: context.partial };
+        }
+    }
+    if (keys.length === 2 && context.role === 'key') {
+        if (statementKey === 'Condition') {
+            return { type: 'condition-key', operator: keys[1], partial: context.partial };
+        }
+    }
+    if (keys.length === 3 && context.role === 'value') {
+        if (statementKey === 'Condition') {
+            return { type: 'condition-value', operator: keys[1], key: keys[2], partial: context.partial };
+        }
+    }
+    return { type: 'unknown' };
+}