aws-iam-ls 0.0.0

package/src/lib/iam-policy/partitions.d.ts

@@ -0,0 +1,116 @@
+export declare const partitions: {
+    readonly aws: {
+        readonly name: "AWS Commercial Regions";
+        readonly regions: readonly [{
+            readonly id: "us-east-1";
+            readonly name: "US East (N. Virginia)";
+        }, {
+            readonly id: "us-east-2";
+            readonly name: "US East (Ohio)";
+        }, {
+            readonly id: "us-west-1";
+            readonly name: "US West (N. California)";
+        }, {
+            readonly id: "us-west-2";
+            readonly name: "US West (Oregon)";
+        }, {
+            readonly id: "af-south-1";
+            readonly name: "Africa (Cape Town)";
+        }, {
+            readonly id: "ap-east-1";
+            readonly name: "Asia Pacific (Hong Kong)";
+        }, {
+            readonly id: "ap-south-1";
+            readonly name: "Asia Pacific (Mumbai)";
+        }, {
+            readonly id: "ap-south-2";
+            readonly name: "Asia Pacific (Hyderabad)";
+        }, {
+            readonly id: "ap-southeast-1";
+            readonly name: "Asia Pacific (Singapore)";
+        }, {
+            readonly id: "ap-southeast-2";
+            readonly name: "Asia Pacific (Sydney)";
+        }, {
+            readonly id: "ap-southeast-3";
+            readonly name: "Asia Pacific (Jakarta)";
+        }, {
+            readonly id: "ap-southeast-4";
+            readonly name: "Asia Pacific (Melbourne)";
+        }, {
+            readonly id: "ap-southeast-5";
+            readonly name: "Asia Pacific (Malaysia)";
+        }, {
+            readonly id: "ap-northeast-1";
+            readonly name: "Asia Pacific (Tokyo)";
+        }, {
+            readonly id: "ap-northeast-2";
+            readonly name: "Asia Pacific (Seoul)";
+        }, {
+            readonly id: "ap-northeast-3";
+            readonly name: "Asia Pacific (Osaka)";
+        }, {
+            readonly id: "ca-central-1";
+            readonly name: "Canada (Central)";
+        }, {
+            readonly id: "ca-west-1";
+            readonly name: "Canada West (Calgary)";
+        }, {
+            readonly id: "eu-central-1";
+            readonly name: "Europe (Frankfurt)";
+        }, {
+            readonly id: "eu-central-2";
+            readonly name: "Europe (Zurich)";
+        }, {
+            readonly id: "eu-west-1";
+            readonly name: "Europe (Ireland)";
+        }, {
+            readonly id: "eu-west-2";
+            readonly name: "Europe (London)";
+        }, {
+            readonly id: "eu-west-3";
+            readonly name: "Europe (Paris)";
+        }, {
+            readonly id: "eu-south-1";
+            readonly name: "Europe (Milan)";
+        }, {
+            readonly id: "eu-south-2";
+            readonly name: "Europe (Spain)";
+        }, {
+            readonly id: "eu-north-1";
+            readonly name: "Europe (Stockholm)";
+        }, {
+            readonly id: "il-central-1";
+            readonly name: "Israel (Tel Aviv)";
+        }, {
+            readonly id: "me-south-1";
+            readonly name: "Middle East (Bahrain)";
+        }, {
+            readonly id: "me-central-1";
+            readonly name: "Middle East (UAE)";
+        }, {
+            readonly id: "sa-east-1";
+            readonly name: "South America (São Paulo)";
+        }];
+    };
+    readonly 'aws-us-gov': {
+        readonly name: "AWS GovCloud (US) Regions";
+        readonly regions: readonly [{
+            readonly id: "us-gov-west-1";
+            readonly name: "AWS GovCloud (US-West)";
+        }, {
+            readonly id: "us-gov-east-1";
+            readonly name: "AWS GovCloud (US-East)";
+        }];
+    };
+    readonly 'aws-cn': {
+        readonly name: "AWS China Regions";
+        readonly regions: readonly [{
+            readonly id: "cn-north-1";
+            readonly name: "China (Beijing)";
+        }, {
+            readonly id: "cn-northwest-1";
+            readonly name: "China (Ningxia)";
+        }];
+    };
+};

package/src/lib/iam-policy/partitions.js

@@ -0,0 +1,51 @@
+export const partitions = {
+    aws: {
+        name: 'AWS Commercial Regions',
+        regions: [
+            { id: 'us-east-1', name: 'US East (N. Virginia)' },
+            { id: 'us-east-2', name: 'US East (Ohio)' },
+            { id: 'us-west-1', name: 'US West (N. California)' },
+            { id: 'us-west-2', name: 'US West (Oregon)' },
+            { id: 'af-south-1', name: 'Africa (Cape Town)' },
+            { id: 'ap-east-1', name: 'Asia Pacific (Hong Kong)' },
+            { id: 'ap-south-1', name: 'Asia Pacific (Mumbai)' },
+            { id: 'ap-south-2', name: 'Asia Pacific (Hyderabad)' },
+            { id: 'ap-southeast-1', name: 'Asia Pacific (Singapore)' },
+            { id: 'ap-southeast-2', name: 'Asia Pacific (Sydney)' },
+            { id: 'ap-southeast-3', name: 'Asia Pacific (Jakarta)' },
+            { id: 'ap-southeast-4', name: 'Asia Pacific (Melbourne)' },
+            { id: 'ap-southeast-5', name: 'Asia Pacific (Malaysia)' },
+            { id: 'ap-northeast-1', name: 'Asia Pacific (Tokyo)' },
+            { id: 'ap-northeast-2', name: 'Asia Pacific (Seoul)' },
+            { id: 'ap-northeast-3', name: 'Asia Pacific (Osaka)' },
+            { id: 'ca-central-1', name: 'Canada (Central)' },
+            { id: 'ca-west-1', name: 'Canada West (Calgary)' },
+            { id: 'eu-central-1', name: 'Europe (Frankfurt)' },
+            { id: 'eu-central-2', name: 'Europe (Zurich)' },
+            { id: 'eu-west-1', name: 'Europe (Ireland)' },
+            { id: 'eu-west-2', name: 'Europe (London)' },
+            { id: 'eu-west-3', name: 'Europe (Paris)' },
+            { id: 'eu-south-1', name: 'Europe (Milan)' },
+            { id: 'eu-south-2', name: 'Europe (Spain)' },
+            { id: 'eu-north-1', name: 'Europe (Stockholm)' },
+            { id: 'il-central-1', name: 'Israel (Tel Aviv)' },
+            { id: 'me-south-1', name: 'Middle East (Bahrain)' },
+            { id: 'me-central-1', name: 'Middle East (UAE)' },
+            { id: 'sa-east-1', name: 'South America (São Paulo)' },
+        ],
+    },
+    'aws-us-gov': {
+        name: 'AWS GovCloud (US) Regions',
+        regions: [
+            { id: 'us-gov-west-1', name: 'AWS GovCloud (US-West)' },
+            { id: 'us-gov-east-1', name: 'AWS GovCloud (US-East)' },
+        ],
+    },
+    'aws-cn': {
+        name: 'AWS China Regions',
+        regions: [
+            { id: 'cn-north-1', name: 'China (Beijing)' },
+            { id: 'cn-northwest-1', name: 'China (Ningxia)' },
+        ],
+    },
+};

package/src/lib/iam-policy/principals.d.ts

@@ -0,0 +1,21 @@
+export declare const principalTypes: {
+    readonly aws: {
+        readonly value: "AWS";
+        readonly description: "An AWS account root user, IAM user, or IAM role.";
+        readonly patterns: readonly ["*", "${Account}", "arn:${Partition}:iam::${Account}:root", "arn:${Partition}:iam::${Account}:role/${RoleName}", "arn:${Partition}:sts::${Account}:assumed-role/${RoleName}/${RoleSessionName}", "arn:${Partition}:iam::${Account}:user/${UserName}", "arn:${Partition}:iam::${Account}:federated-user/${UserName}"];
+    };
+    readonly canonicalUser: {
+        readonly value: "CanonicalUser";
+        readonly description: "An Amazon S3 canonical user ID.";
+    };
+    readonly federated: {
+        readonly value: "Federated";
+        readonly description: "A SAML provider or an OpenID Connect provider.";
+        readonly patterns: readonly ["cognito-identity.amazonaws.com", "www.amazon.com", "graph.facebook.com", "accounts.google.com", "arn:${Partition}:iam::${Account}:oidc-provider/${OidcProviderUrl}", "arn:${Partition}:iam::${Account}:saml-provider/${SamlProviderName}"];
+    };
+    readonly service: {
+        readonly value: "Service";
+        readonly description: "An AWS service principal.";
+        readonly patterns: string[];
+    };
+};

package/src/lib/iam-policy/principals.js

@@ -0,0 +1,37 @@
+import { ServiceReference } from "./reference/services.js";
+export const principalTypes = {
+    aws: {
+        value: 'AWS',
+        description: 'An AWS account root user, IAM user, or IAM role.',
+        patterns: [
+            `*`,
+            `\${Account}`,
+            `arn:\${Partition}:iam::\${Account}:root`,
+            `arn:\${Partition}:iam::\${Account}:role/\${RoleName}`,
+            `arn:\${Partition}:sts::\${Account}:assumed-role/\${RoleName}/\${RoleSessionName}`,
+            `arn:\${Partition}:iam::\${Account}:user/\${UserName}`,
+            `arn:\${Partition}:iam::\${Account}:federated-user/\${UserName}`,
+        ],
+    },
+    canonicalUser: {
+        value: 'CanonicalUser',
+        description: 'An Amazon S3 canonical user ID.',
+    },
+    federated: {
+        value: 'Federated',
+        description: 'A SAML provider or an OpenID Connect provider.',
+        patterns: [
+            'cognito-identity.amazonaws.com',
+            'www.amazon.com',
+            'graph.facebook.com',
+            'accounts.google.com',
+            `arn:\${Partition}:iam::\${Account}:oidc-provider/\${OidcProviderUrl}`,
+            `arn:\${Partition}:iam::\${Account}:saml-provider/\${SamlProviderName}`,
+        ],
+    },
+    service: {
+        value: 'Service',
+        description: 'An AWS service principal.',
+        patterns: ServiceReference.getServicePrincipals(),
+    },
+};

package/src/lib/iam-policy/reference/services.d.ts

@@ -0,0 +1,22 @@
+import type { Action, ConditionKey, GlobalConditionKey, ServiceData } from './types.ts';
+export declare class ServiceReference {
+    #private;
+    static getServiceData(service: string): ServiceData;
+    static getServicePrincipals(): string[];
+    static getAllActions(): Array<string>;
+    static getAllServices(): Array<string>;
+    static getActionsForService(service: string): Array<string>;
+    static getConditionKeysForActions(actions: string[]): Array<{
+        name: string;
+        types: string[];
+    }>;
+    static getGlobalConditionKeys(): Array<GlobalConditionKey>;
+    static getAction(service: string, actionName: string): Action | undefined;
+    static getConditionKey(service: string, keyName: string): ConditionKey | undefined;
+    static getResourcesForActions(actions: string[]): Map<string, {
+        service: string;
+        name: string;
+        arn: string;
+        conditionKeys: Array<string>;
+    }>;
+}

package/src/lib/iam-policy/reference/services.js

@@ -0,0 +1,99 @@
+import { readFileSync } from 'node:fs';
+export class ServiceReference {
+    static #serviceDataMap = {};
+    static #allActions;
+    static #allServices;
+    static #servicePrincipals;
+    static #globalConditionKeys;
+    static getServiceData(service) {
+        if (!ServiceReference.#serviceDataMap[service]) {
+            ServiceReference.#serviceDataMap[service] = JSON.parse(readFileSync(`${import.meta.dirname}/../../../data/servicereference/services/${service}.json`, 'utf-8'));
+        }
+        return ServiceReference.#serviceDataMap[service];
+    }
+    static getServicePrincipals() {
+        if (!ServiceReference.#servicePrincipals) {
+            ServiceReference.#servicePrincipals = JSON.parse(readFileSync(`${import.meta.dirname}/../../../data/servicereference/service-principals.json`, 'utf-8'));
+        }
+        return ServiceReference.#servicePrincipals;
+    }
+    static getAllActions() {
+        if (!ServiceReference.#allActions) {
+            ServiceReference.#allActions = JSON.parse(readFileSync(`${import.meta.dirname}/../../../data/servicereference/actions.json`, 'utf-8'));
+        }
+        return ServiceReference.#allActions;
+    }
+    static getAllServices() {
+        if (!ServiceReference.#allServices) {
+            ServiceReference.#allServices = JSON.parse(readFileSync(`${import.meta.dirname}/../../../data/servicereference/services.json`, 'utf-8'));
+        }
+        return ServiceReference.#allServices;
+    }
+    static getActionsForService(service) {
+        return Object.keys(ServiceReference.getServiceData(service).actions);
+    }
+    static getConditionKeysForActions(actions) {
+        const keys = new Map();
+        for (const action of actions) {
+            const [service, actionName] = action.split(':');
+            const serviceData = ServiceReference.getServiceData(service);
+            const actionDef = serviceData.actions[actionName];
+            if (actionDef?.conditionKeys) {
+                for (const keyName of actionDef.conditionKeys) {
+                    if (!keys.has(keyName)) {
+                        const keyDef = serviceData.conditionKeys[keyName];
+                        keys.set(keyName, keyDef?.types ?? []);
+                    }
+                }
+            }
+        }
+        const sorted = [...keys.entries()].sort((a, b) => a[0].localeCompare(b[0]));
+        return sorted.map(([name, types]) => ({ name, types }));
+    }
+    static getGlobalConditionKeys() {
+        if (!ServiceReference.#globalConditionKeys) {
+            ServiceReference.#globalConditionKeys = JSON.parse(readFileSync(`${import.meta.dirname}/../../../data/condition-keys/global.json`, 'utf-8'));
+        }
+        return ServiceReference.#globalConditionKeys;
+    }
+    static getAction(service, actionName) {
+        try {
+            return ServiceReference.getServiceData(service).actions[actionName];
+        }
+        catch {
+            return undefined;
+        }
+    }
+    static getConditionKey(service, keyName) {
+        try {
+            return ServiceReference.getServiceData(service).conditionKeys[keyName];
+        }
+        catch {
+            return undefined;
+        }
+    }
+    static getResourcesForActions(actions) {
+        const resources = new Map();
+        for (const action of actions) {
+            const [service, actionName] = action.split(':');
+            const serviceData = ServiceReference.getServiceData(service);
+            const actionDef = serviceData.actions[actionName];
+            if (!actionDef?.resources)
+                continue;
+            for (const actionResource of actionDef.resources) {
+                const resourceDef = serviceData.resources.find((r) => r.name === actionResource.name);
+                if (resourceDef) {
+                    for (const arn of resourceDef.arnFormats) {
+                        resources.set(arn, {
+                            service,
+                            name: resourceDef.name,
+                            arn,
+                            conditionKeys: resourceDef.conditionKeys,
+                        });
+                    }
+                }
+            }
+        }
+        return resources;
+    }
+}

package/src/lib/iam-policy/reference/types.d.ts

@@ -0,0 +1,71 @@
+export type Services = Array<{
+    service: string;
+    url: string;
+}>;
+export type GlobalConditionKey = {
+    name: string;
+    valueType: 'single' | 'multi';
+    availability: string;
+    description: string;
+};
+export type RawReference = {
+    Name: string;
+    Version: string;
+    Operations: Array<unknown>;
+    Actions: Array<{
+        Name: string;
+        Annotations: {
+            Properties: {
+                IsList: boolean;
+                IsPermissionManagement: boolean;
+                IsTaggingOnly: boolean;
+                IsWrite: boolean;
+            };
+        };
+        SupportedBy: {
+            'IAM Access Analyzer Policy Generation': boolean;
+            'IAM Action Last Accessed': boolean;
+        };
+        Resources?: Array<{
+            Name: string;
+        }>;
+        ActionConditionKeys?: Array<string>;
+    }>;
+    Resources?: Array<{
+        Name: string;
+        ARNFormats: Array<string>;
+        ConditionKeys?: Array<string>;
+    }>;
+    ConditionKeys: Array<{
+        Name: string;
+        Types: Array<string>;
+    }>;
+};
+export type ServiceData = {
+    name: string;
+    actions: Record<string, Action>;
+    resources: Array<{
+        name: string;
+        arnFormats: Array<string>;
+        conditionKeys: Array<string>;
+    }>;
+    conditionKeys: Record<string, ConditionKey>;
+};
+export type Action = {
+    conditionKeys: Array<string>;
+    resources: Array<{
+        name: string;
+    }>;
+    description?: string;
+    accessLevel?: string;
+    resourceTypes?: Array<{
+        name: string;
+        required: boolean;
+    }>;
+    dependentActions?: Array<string>;
+    permissionOnly?: boolean;
+};
+export type ConditionKey = {
+    types: Array<string>;
+    description?: string;
+};

package/src/lib/iam-policy/reference/types.js

@@ -0,0 +1 @@
+export {};

package/src/lib/iam-policy/statement-keys.d.ts

@@ -0,0 +1,8 @@
+type PolicyElement = {
+    policyTypes: Array<'identity' | 'resource'>;
+    description: string;
+    group: string;
+    hclKey: string;
+};
+export declare const StatementKeys: Record<string, PolicyElement>;
+export {};

package/src/lib/iam-policy/statement-keys.js

@@ -0,0 +1,159 @@
+export const StatementKeys = {
+    Sid: {
+        policyTypes: ['identity', 'resource'],
+        description: `An optional identifier for a policy statement.
+Use it as a descriptive label to distinguish statements within a policy.
+
+The \`Sid\` value must be unique within a policy document.
+It may only contain ASCII uppercase letters (A-Z), lowercase letters (a-z), and numbers (0-9).
+
+In services that support an \`Id\` element (such as SQS and SNS), the \`Sid\` serves as a sub-ID of the policy document's \`Id\`.
+These services may require \`Sid\` and enforce additional uniqueness constraints — consult the service-specific documentation.
+
+> **Note:** The IAM API does not expose the \`Sid\`.
+> You cannot retrieve a specific statement by its ID.`,
+        hclKey: 'sid',
+        group: 'sid',
+    },
+    Effect: {
+        policyTypes: ['identity', 'resource'],
+        description: `A required element that specifies whether the statement allows or explicitly denies access.
+Valid values are \`Allow\` and \`Deny\` (case-sensitive).
+
+By default, access to resources is implicitly denied.
+Set \`Effect\` to \`Allow\` to grant access.
+Set \`Effect\` to \`Deny\` to explicitly deny access — an explicit deny always overrides any allow.`,
+        hclKey: 'effect',
+        group: 'effect',
+    },
+    Principal: {
+        policyTypes: ['resource'],
+        description: `Specifies the principal that is allowed or denied access to a resource.
+Required in resource-based policies (e.g. S3 bucket policies, KMS key policies, role trust policies).
+Cannot be used in identity-based policies — the principal is implicitly the identity the policy is attached to.
+
+The value can be an AWS account, IAM user, IAM role, federated identity, AWS service, or canonical user:
+
+- **AWS account** — \`{ "AWS": "arn:aws:iam::123456789012:root" }\` or \`{ "AWS": "123456789012" }\`
+- **IAM role** — \`{ "AWS": "arn:aws:iam::123456789012:role/role-name" }\`
+- **IAM user** — \`{ "AWS": "arn:aws:iam::123456789012:user/user-name" }\`
+- **AWS service** — \`{ "Service": "ecs.amazonaws.com" }\`
+- **Federated (OIDC/SAML)** — \`{ "Federated": "cognito-identity.amazonaws.com" }\` or a SAML provider ARN
+- **Canonical user** — \`{ "CanonicalUser": "64-char-hex-id" }\` (S3-specific, equivalent to an account ID)
+- **All principals** — \`"*"\` or \`{ "AWS": "*" }\`
+
+Use arrays to specify multiple principals of the same type.
+Multiple principals are evaluated as a logical OR.
+
+> **Warning:** Using \`"Principal": "*"\` with \`"Effect": "Allow"\` grants public access.
+> Always scope with a \`Condition\` element unless public access is intended.
+
+> **Note:** IAM resolves role and user ARNs in trust policies to unique principal IDs.
+> If you delete and recreate the role or user, the trust relationship breaks.
+> Use the \`aws:PrincipalArn\` condition key to avoid this.`,
+        group: 'principal',
+        hclKey: 'principals',
+    },
+    NotPrincipal: {
+        policyTypes: ['resource'],
+        description: `Matches every principal *except* the ones specified.
+Must be used with \`"Effect": "Deny"\` — using it with \`"Effect": "Allow"\` is not supported.
+Only valid in resource-based policies; not supported in identity-based policies, role trust policies, SCPs, or RCPs.
+
+When specifying an IAM user or role, you must also include the account ARN.
+Otherwise the policy may deny access to the entire account.
+
+> **Warning:** Do not use \`NotPrincipal\` with \`Deny\` for principals that have a permissions boundary attached.
+> The \`NotPrincipal\` element will always deny those principals regardless of the values specified.
+
+> **Recommended alternative:** Use \`"Principal": "*"\` with a \`Condition\` using \`ArnNotEquals\` on \`aws:PrincipalArn\` (or \`StringNotEquals\` on \`aws:PrincipalServiceName\` for services).
+> AWS does not recommend \`NotPrincipal\` for new resource-based policies due to the difficulty of troubleshooting interactions across multiple policy types.`,
+        group: 'principal',
+        hclKey: 'not_principals',
+    },
+    Action: {
+        policyTypes: ['identity', 'resource'],
+        description: `Specifies the actions that the statement allows or denies.
+Each statement must include either \`Action\` or \`NotAction\`.
+
+Actions use the format \`service:action\` (e.g. \`s3:GetObject\`, \`iam:CreateUser\`).
+Action names are case-insensitive.
+Use an array to specify multiple actions.
+
+Wildcards are supported:
+- \`*\` matches any combination of characters (e.g. \`s3:*\` for all S3 actions, \`iam:*AccessKey*\` for all access key actions)
+- \`?\` matches any single character`,
+        group: 'action',
+        hclKey: 'actions',
+    },
+    NotAction: {
+        policyTypes: ['identity', 'resource'],
+        description: `Matches every action *except* the ones specified.
+Each statement must include either \`Action\` or \`NotAction\`.
+
+With \`"Effect": "Allow"\`, grants access to all applicable actions except those listed.
+With \`"Effect": "Deny"\`, denies all applicable actions except those listed.
+The \`Resource\` element determines which actions and services are applicable.
+
+> **Warning:** \`NotAction\` with \`"Effect": "Allow"\` can grant more permissions than intended, since it allows all actions not explicitly excluded — including actions in other services.
+> Prefer using \`NotAction\` with \`"Effect": "Deny"\` to restrict access while still requiring explicit allows elsewhere.`,
+        group: 'action',
+        hclKey: 'not_actions',
+    },
+    Resource: {
+        policyTypes: ['identity', 'resource'],
+        description: `Specifies the object or objects that the statement applies to.
+Each statement must include either \`Resource\` or \`NotResource\`.
+
+Resources are identified by ARN (e.g. \`arn:aws:s3:::my-bucket/*\`).
+The ARN format varies by service — consult the service documentation for the correct format.
+Use an array to specify multiple resources.
+
+Wildcards are supported within ARNs:
+
+- \`*\` matches any combination of characters, including \`/\`
+- \`?\` matches any single character
+- Wildcards cannot be used in the service segment of an ARN
+
+Some actions do not support resource-level permissions.
+In those cases, use \`"Resource": "*"\` to apply the statement to all resources.
+
+Policy variables (e.g. \`\${aws:username}\`) can be used in the resource-specific portion of the ARN.`,
+        group: 'resource',
+        hclKey: 'resources',
+    },
+    NotResource: {
+        policyTypes: ['identity', 'resource'],
+        description: `Matches every resource *except* the ones specified.
+Each statement must include either \`Resource\` or \`NotResource\`.
+
+With \`"Effect": "Deny"\`, denies access to all resources except those listed.
+With \`"Effect": "Allow"\`, grants access to all resources except those listed.
+
+> **Warning:** \`NotResource\` with \`"Effect": "Allow"\` can grant far more permissions than intended — including actions across other services and resources.
+> Never combine \`"Effect": "Allow"\`, \`"Action": "*"\`, and \`NotResource\`, as this grants access to nearly everything in the account.
+> Prefer using \`NotResource\` with \`"Effect": "Deny"\`.`,
+        group: 'resource',
+        hclKey: 'not_resources',
+    },
+    Condition: {
+        policyTypes: ['identity', 'resource'],
+        description: `An optional element that specifies conditions under which the statement is in effect.
+
+The structure is \`{ "Operator": { "ConditionKey": "Value" } }\`:
+- **Condition operator** — the type of comparison (e.g. \`StringEquals\`, \`ArnLike\`, \`IpAddress\`, \`NumericLessThan\`, \`Bool\`, \`Null\`)
+- **Condition key** — a value from the request context to evaluate (e.g. \`aws:SourceIp\`, \`s3:prefix\`, \`aws:PrincipalArn\`)
+- **Condition value** — the value to compare against
+
+Condition keys are either **global** (prefixed with \`aws:\`, available across all services) or **service-specific** (prefixed with the service namespace).
+Condition key names are case-insensitive; values are case-sensitive unless using a case-insensitive operator like \`StringEqualsIgnoreCase\`.
+
+When multiple values are specified for a single key, they are evaluated as **OR**.
+When multiple keys or operators are specified, they are evaluated as **AND**.
+
+If a condition key is not present in the request context, it does not match — except when using \`ForAllValues\`, which may return true for a missing key.
+Use the \`Null\` condition operator to explicitly check whether a key exists.`,
+        hclKey: 'condition',
+        group: 'condition',
+    },
+};

package/src/lib/iam-policy/wildcard.d.ts

@@ -0,0 +1,2 @@
+export declare function wildcardToRegExp(pattern: string): RegExp;
+export declare function expandActionPattern(pattern: string): string[];

package/src/lib/iam-policy/wildcard.js

@@ -0,0 +1,14 @@
+import { ServiceReference } from "./reference/services.js";
+export function wildcardToRegExp(pattern) {
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    const regexStr = escaped.replace(/\*/g, '.*').replace(/\?/g, '.');
+    return new RegExp(`^${regexStr}$`, 'i');
+}
+export function expandActionPattern(pattern) {
+    const allActions = ServiceReference.getAllActions();
+    if (!pattern.includes('*') && !pattern.includes('?')) {
+        return allActions.some((a) => a.toLowerCase() === pattern.toLowerCase()) ? [pattern] : [];
+    }
+    const regex = wildcardToRegExp(pattern);
+    return allActions.filter((a) => regex.test(a));
+}

package/src/lib/treesitter/base.d.ts

@@ -0,0 +1,35 @@
+import type { Language, Tree } from 'web-tree-sitter';
+export type Position = {
+    line: number;
+    column: number;
+};
+export type PolicyFormat = 'standard' | 'hcl-block';
+export type CursorContext = {
+    keys: string[];
+    role: 'key' | 'value';
+    partial: string;
+    policyFormat: PolicyFormat;
+};
+export type StatementContext = {
+    Sid?: string;
+    Effect?: string;
+    Action?: string[];
+    NotAction?: string[];
+    Resource?: string[];
+    NotResource?: string[];
+    Principal?: Record<string, string[]> | string;
+    NotPrincipal?: Record<string, string[]> | string;
+    Condition?: Record<string, Record<string, string[]>>;
+};
+export declare class TreeBase {
+    #private;
+    constructor(language: Language);
+    getTree(uri: string): Tree | undefined;
+    openDocument(uri: string, content: string): void;
+    updateDocument(uri: string, content: string): void;
+    closeDocument(uri: string): void;
+    getNodeAtPosition(uri: string, position: Position): import("web-tree-sitter").Node | null;
+    getCursorContext(_uri: string, _position: Position): CursorContext | null;
+    getStatementContext(_uri: string, _position: Position): StatementContext | null;
+    getSiblingKeys(_uri: string, _position: Position): string[];
+}