truemark-cdk-lib 1.25.0 → 1.26.0

package/dist/aws-directory-service/index.d.ts

@@ -0,0 +1 @@
+export * from './lib/index';

package/dist/aws-directory-service/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/index"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXdzLWRpcmVjdG9yeS1zZXJ2aWNlL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSw4Q0FBNEIiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2xpYi9pbmRleCc7XG4iXX0=

package/dist/aws-directory-service/lib/directory-group.d.ts

@@ -0,0 +1,63 @@
+import type { Construct } from 'constructs';
+import { ExtendedConstruct, type ExtendedConstructProps } from '../../aws-cdk';
+/**
+ * Active Directory group scope.
+ */
+export type DirectoryGroupScope = 'DomainLocal' | 'Global' | 'Universal' | 'BuiltinLocal';
+/**
+ * Active Directory group type.
+ */
+export type DirectoryGroupType = 'Distribution' | 'Security';
+/**
+ * Properties for DirectoryGroup.
+ */
+export interface DirectoryGroupProps extends ExtendedConstructProps {
+    /**
+     * ID of the AWS Managed Microsoft AD directory the group is created in.
+     * Pattern: `d-[0-9a-f]{10}`.
+     */
+    readonly directoryId: string;
+    /**
+     * The group's SAMAccountName. Must be unique within the directory and at most
+     * 20 characters.
+     */
+    readonly groupName: string;
+    /**
+     * Scope of the group.
+     *
+     * @default - the directory default ('Global')
+     */
+    readonly groupScope?: DirectoryGroupScope;
+    /**
+     * Type of the group.
+     *
+     * @default - the directory default ('Security')
+     */
+    readonly groupType?: DirectoryGroupType;
+    /**
+     * SAMAccountNames of users, groups, or computers to add as members of the group.
+     * Members must already exist in the directory; this construct does not create them.
+     *
+     * @default - no members are added
+     */
+    readonly members?: string[];
+}
+/**
+ * Manages an Active Directory group and its memberships in an AWS Managed
+ * Microsoft AD directory using the AWS Directory Service Data API.
+ *
+ * The Directory Service Data API has no native CloudFormation support, so the
+ * group and each membership are managed with custom resources.
+ *
+ * Note: the custom resource Lambda must have the `DirectoryServiceData` client
+ * available in its runtime AWS SDK (Node.js 20+). Directory Service Data write
+ * operations are scoped to your organizational unit (OU), Managed Microsoft AD
+ * only, and available in the directory's primary Region only.
+ */
+export declare class DirectoryGroup extends ExtendedConstruct {
+    /**
+     * The SAMAccountName of the managed group.
+     */
+    readonly groupName: string;
+    constructor(scope: Construct, id: string, props: DirectoryGroupProps);
+}

package/dist/aws-directory-service/lib/directory-group.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DirectoryGroup = void 0;
+const iam = require("aws-cdk-lib/aws-iam");
+const cr = require("aws-cdk-lib/custom-resources");
+const aws_cdk_1 = require("../../aws-cdk");
+const truemark_1 = require("../../truemark");
+/**
+ * Manages an Active Directory group and its memberships in an AWS Managed
+ * Microsoft AD directory using the AWS Directory Service Data API.
+ *
+ * The Directory Service Data API has no native CloudFormation support, so the
+ * group and each membership are managed with custom resources.
+ *
+ * Note: the custom resource Lambda must have the `DirectoryServiceData` client
+ * available in its runtime AWS SDK (Node.js 20+). Directory Service Data write
+ * operations are scoped to your organizational unit (OU), Managed Microsoft AD
+ * only, and available in the directory's primary Region only.
+ */
+class DirectoryGroup extends aws_cdk_1.ExtendedConstruct {
+    constructor(scope, id, props) {
+        var _a;
+        super(scope, id, {
+            standardTags: aws_cdk_1.StandardTags.merge(props.standardTags, truemark_1.LibStandardTags),
+        });
+        this.groupName = props.groupName;
+        const group = new cr.AwsCustomResource(this, 'Group', {
+            onCreate: {
+                service: 'DirectoryServiceData',
+                action: 'CreateGroup',
+                parameters: {
+                    DirectoryId: props.directoryId,
+                    SAMAccountName: props.groupName,
+                    ...(props.groupScope ? { GroupScope: props.groupScope } : {}),
+                    ...(props.groupType ? { GroupType: props.groupType } : {}),
+                },
+                physicalResourceId: cr.PhysicalResourceId.of(`${props.directoryId}/${props.groupName}`),
+                // ConflictException: the group already exists — treat as a no-op.
+                ignoreErrorCodesMatching: 'ConflictException',
+            },
+            onDelete: {
+                service: 'DirectoryServiceData',
+                action: 'DeleteGroup',
+                parameters: {
+                    DirectoryId: props.directoryId,
+                    SAMAccountName: props.groupName,
+                },
+                // ResourceNotFoundException / AccessDeniedException: group already gone or
+                // outside our OU — safe to ignore so stack teardown is not blocked.
+                ignoreErrorCodesMatching: 'ResourceNotFoundException|AccessDeniedException',
+            },
+            policy: cr.AwsCustomResourcePolicy.fromStatements([
+                new iam.PolicyStatement({
+                    effect: iam.Effect.ALLOW,
+                    actions: ['ds-data:CreateGroup', 'ds-data:DeleteGroup'],
+                    resources: ['*'],
+                }),
+            ]),
+        });
+        for (const member of (_a = props.members) !== null && _a !== void 0 ? _a : []) {
+            const membership = new cr.AwsCustomResource(this, `Member${member}`, {
+                onCreate: {
+                    service: 'DirectoryServiceData',
+                    action: 'AddGroupMember',
+                    parameters: {
+                        DirectoryId: props.directoryId,
+                        GroupName: props.groupName,
+                        MemberName: member,
+                    },
+                    physicalResourceId: cr.PhysicalResourceId.of(`${props.directoryId}/${props.groupName}/${member}`),
+                    // ConflictException: member already in the group — treat as a no-op.
+                    ignoreErrorCodesMatching: 'ConflictException',
+                },
+                onDelete: {
+                    service: 'DirectoryServiceData',
+                    action: 'RemoveGroupMember',
+                    parameters: {
+                        DirectoryId: props.directoryId,
+                        GroupName: props.groupName,
+                        MemberName: member,
+                    },
+                    ignoreErrorCodesMatching: 'ResourceNotFoundException|AccessDeniedException',
+                },
+                policy: cr.AwsCustomResourcePolicy.fromStatements([
+                    new iam.PolicyStatement({
+                        effect: iam.Effect.ALLOW,
+                        actions: ['ds-data:AddGroupMember', 'ds-data:RemoveGroupMember'],
+                        resources: ['*'],
+                    }),
+                ]),
+            });
+            // The group must exist before members can be added.
+            membership.node.addDependency(group);
+        }
+    }
+}
+exports.DirectoryGroup = DirectoryGroup;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGlyZWN0b3J5LWdyb3VwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2F3cy1kaXJlY3Rvcnktc2VydmljZS9saWIvZGlyZWN0b3J5LWdyb3VwLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJDQUEyQztBQUMzQyxtREFBbUQ7QUFFbkQsMkNBSXVCO0FBQ3ZCLDZDQUErQztBQXVEL0M7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCxNQUFhLGNBQWUsU0FBUSwyQkFBaUI7SUFNbkQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUEwQjs7UUFDbEUsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDZixZQUFZLEVBQUUsc0JBQVksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLFlBQVksRUFBRSwwQkFBZSxDQUFDO1NBQ3RFLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxTQUFTLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUVqQyxNQUFNLEtBQUssR0FBRyxJQUFJLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFO1lBQ3BELFFBQVEsRUFBRTtnQkFDUixPQUFPLEVBQUUsc0JBQXNCO2dCQUMvQixNQUFNLEVBQUUsYUFBYTtnQkFDckIsVUFBVSxFQUFFO29CQUNWLFdBQVcsRUFBRSxLQUFLLENBQUMsV0FBVztvQkFDOUIsY0FBYyxFQUFFLEtBQUssQ0FBQyxTQUFTO29CQUMvQixHQUFHLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsRUFBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVUsRUFBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7b0JBQzNELEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztpQkFDekQ7Z0JBQ0Qsa0JBQWtCLEVBQUUsRUFBRSxDQUFDLGtCQUFrQixDQUFDLEVBQUUsQ0FDMUMsR0FBRyxLQUFLLENBQUMsV0FBVyxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FDMUM7Z0JBQ0Qsa0VBQWtFO2dCQUNsRSx3QkFBd0IsRUFBRSxtQkFBbUI7YUFDOUM7WUFDRCxRQUFRLEVBQUU7Z0JBQ1IsT0FBTyxFQUFFLHNCQUFzQjtnQkFDL0IsTUFBTSxFQUFFLGFBQWE7Z0JBQ3JCLFVBQVUsRUFBRTtvQkFDVixXQUFXLEVBQUUsS0FBSyxDQUFDLFdBQVc7b0JBQzlCLGNBQWMsRUFBRSxLQUFLLENBQUMsU0FBUztpQkFDaEM7Z0JBQ0QsMkVBQTJFO2dCQUMzRSxvRUFBb0U7Z0JBQ3BFLHdCQUF3QixFQUN0QixpREFBaUQ7YUFDcEQ7WUFDRCxNQUFNLEVBQUUsRUFBRSxDQUFDLHVCQUF1QixDQUFDLGNBQWMsQ0FBQztnQkFDaEQsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO29CQUN0QixNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO29CQUN4QixPQUFPLEVBQUUsQ0FBQyxxQkFBcUIsRUFBRSxxQkFBcUIsQ0FBQztvQkFDdkQsU0FBUyxFQUFFLENBQUMsR0FBRyxDQUFDO2lCQUNqQixDQUFDO2FBQ0gsQ0FBQztTQUNILENBQUMsQ0FBQztRQUVILEtBQUssTUFBTSxNQUFNLElBQUksTUFBQSxLQUFLLENBQUMsT0FBTyxtQ0FBSSxFQUFFLEVBQUUsQ0FBQztZQUN6QyxNQUFNLFVBQVUsR0FBRyxJQUFJLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLEVBQUUsU0FBUyxNQUFNLEVBQUUsRUFBRTtnQkFDbkUsUUFBUSxFQUFFO29CQUNSLE9BQU8sRUFBRSxzQkFBc0I7b0JBQy9CLE1BQU0sRUFBRSxnQkFBZ0I7b0JBQ3hCLFVBQVUsRUFBRTt3QkFDVixXQUFXLEVBQUUsS0FBSyxDQUFDLFdBQVc7d0JBQzlCLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUzt3QkFDMUIsVUFBVSxFQUFFLE1BQU07cUJBQ25CO29CQUNELGtCQUFrQixFQUFFLEVBQUUsQ0FBQyxrQkFBa0IsQ0FBQyxFQUFFLENBQzFDLEdBQUcsS0FBSyxDQUFDLFdBQVcsSUFBSSxLQUFLLENBQUMsU0FBUyxJQUFJLE1BQU0sRUFBRSxDQUNwRDtvQkFDRCxxRUFBcUU7b0JBQ3JFLHdCQUF3QixFQUFFLG1CQUFtQjtpQkFDOUM7Z0JBQ0QsUUFBUSxFQUFFO29CQUNSLE9BQU8sRUFBRSxzQkFBc0I7b0JBQy9CLE1BQU0sRUFBRSxtQkFBbUI7b0JBQzNCLFVBQVUsRUFBRTt3QkFDVixXQUFXLEVBQUUsS0FBSyxDQUFDLFdBQVc7d0JBQzlCLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUzt3QkFDMUIsVUFBVSxFQUFFLE1BQU07cUJBQ25CO29CQUNELHdCQUF3QixFQUN0QixpREFBaUQ7aUJBQ3BEO2dCQUNELE1BQU0sRUFBRSxFQUFFLENBQUMsdUJBQXVCLENBQUMsY0FBYyxDQUFDO29CQUNoRCxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7d0JBQ3RCLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7d0JBQ3hCLE9BQU8sRUFBRSxDQUFDLHdCQUF3QixFQUFFLDJCQUEyQixDQUFDO3dCQUNoRSxTQUFTLEVBQUUsQ0FBQyxHQUFHLENBQUM7cUJBQ2pCLENBQUM7aUJBQ0gsQ0FBQzthQUNILENBQUMsQ0FBQztZQUNILG9EQUFvRDtZQUNwRCxVQUFVLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2QyxDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBekZELHdDQXlGQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGlhbSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCAqIGFzIGNyIGZyb20gJ2F3cy1jZGstbGliL2N1c3RvbS1yZXNvdXJjZXMnO1xuaW1wb3J0IHR5cGUge0NvbnN0cnVjdH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQge1xuICBFeHRlbmRlZENvbnN0cnVjdCxcbiAgdHlwZSBFeHRlbmRlZENvbnN0cnVjdFByb3BzLFxuICBTdGFuZGFyZFRhZ3MsXG59IGZyb20gJy4uLy4uL2F3cy1jZGsnO1xuaW1wb3J0IHtMaWJTdGFuZGFyZFRhZ3N9IGZyb20gJy4uLy4uL3RydWVtYXJrJztcblxuLyoqXG4gKiBBY3RpdmUgRGlyZWN0b3J5IGdyb3VwIHNjb3BlLlxuICovXG5leHBvcnQgdHlwZSBEaXJlY3RvcnlHcm91cFNjb3BlID1cbiAgfCAnRG9tYWluTG9jYWwnXG4gIHwgJ0dsb2JhbCdcbiAgfCAnVW5pdmVyc2FsJ1xuICB8ICdCdWlsdGluTG9jYWwnO1xuXG4vKipcbiAqIEFjdGl2ZSBEaXJlY3RvcnkgZ3JvdXAgdHlwZS5cbiAqL1xuZXhwb3J0IHR5cGUgRGlyZWN0b3J5R3JvdXBUeXBlID0gJ0Rpc3RyaWJ1dGlvbicgfCAnU2VjdXJpdHknO1xuXG4vKipcbiAqIFByb3BlcnRpZXMgZm9yIERpcmVjdG9yeUdyb3VwLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIERpcmVjdG9yeUdyb3VwUHJvcHMgZXh0ZW5kcyBFeHRlbmRlZENvbnN0cnVjdFByb3BzIHtcbiAgLyoqXG4gICAqIElEIG9mIHRoZSBBV1MgTWFuYWdlZCBNaWNyb3NvZnQgQUQgZGlyZWN0b3J5IHRoZSBncm91cCBpcyBjcmVhdGVkIGluLlxuICAgKiBQYXR0ZXJuOiBgZC1bMC05YS1mXXsxMH1gLlxuICAgKi9cbiAgcmVhZG9ubHkgZGlyZWN0b3J5SWQ6IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIGdyb3VwJ3MgU0FNQWNjb3VudE5hbWUuIE11c3QgYmUgdW5pcXVlIHdpdGhpbiB0aGUgZGlyZWN0b3J5IGFuZCBhdCBtb3N0XG4gICAqIDIwIGNoYXJhY3RlcnMuXG4gICAqL1xuICByZWFkb25seSBncm91cE5hbWU6IHN0cmluZztcblxuICAvKipcbiAgICogU2NvcGUgb2YgdGhlIGdyb3VwLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIHRoZSBkaXJlY3RvcnkgZGVmYXVsdCAoJ0dsb2JhbCcpXG4gICAqL1xuICByZWFkb25seSBncm91cFNjb3BlPzogRGlyZWN0b3J5R3JvdXBTY29wZTtcblxuICAvKipcbiAgICogVHlwZSBvZiB0aGUgZ3JvdXAuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gdGhlIGRpcmVjdG9yeSBkZWZhdWx0ICgnU2VjdXJpdHknKVxuICAgKi9cbiAgcmVhZG9ubHkgZ3JvdXBUeXBlPzogRGlyZWN0b3J5R3JvdXBUeXBlO1xuXG4gIC8qKlxuICAgKiBTQU1BY2NvdW50TmFtZXMgb2YgdXNlcnMsIGdyb3Vwcywgb3IgY29tcHV0ZXJzIHRvIGFkZCBhcyBtZW1iZXJzIG9mIHRoZSBncm91cC5cbiAgICogTWVtYmVycyBtdXN0IGFscmVhZHkgZXhpc3QgaW4gdGhlIGRpcmVjdG9yeTsgdGhpcyBjb25zdHJ1Y3QgZG9lcyBub3QgY3JlYXRlIHRoZW0uXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gbm8gbWVtYmVycyBhcmUgYWRkZWRcbiAgICovXG4gIHJlYWRvbmx5IG1lbWJlcnM/OiBzdHJpbmdbXTtcbn1cblxuLyoqXG4gKiBNYW5hZ2VzIGFuIEFjdGl2ZSBEaXJlY3RvcnkgZ3JvdXAgYW5kIGl0cyBtZW1iZXJzaGlwcyBpbiBhbiBBV1MgTWFuYWdlZFxuICogTWljcm9zb2Z0IEFEIGRpcmVjdG9yeSB1c2luZyB0aGUgQVdTIERpcmVjdG9yeSBTZXJ2aWNlIERhdGEgQVBJLlxuICpcbiAqIFRoZSBEaXJlY3RvcnkgU2VydmljZSBEYXRhIEFQSSBoYXMgbm8gbmF0aXZlIENsb3VkRm9ybWF0aW9uIHN1cHBvcnQsIHNvIHRoZVxuICogZ3JvdXAgYW5kIGVhY2ggbWVtYmVyc2hpcCBhcmUgbWFuYWdlZCB3aXRoIGN1c3RvbSByZXNvdXJjZXMuXG4gKlxuICogTm90ZTogdGhlIGN1c3RvbSByZXNvdXJjZSBMYW1iZGEgbXVzdCBoYXZlIHRoZSBgRGlyZWN0b3J5U2VydmljZURhdGFgIGNsaWVudFxuICogYXZhaWxhYmxlIGluIGl0cyBydW50aW1lIEFXUyBTREsgKE5vZGUuanMgMjArKS4gRGlyZWN0b3J5IFNlcnZpY2UgRGF0YSB3cml0ZVxuICogb3BlcmF0aW9ucyBhcmUgc2NvcGVkIHRvIHlvdXIgb3JnYW5pemF0aW9uYWwgdW5pdCAoT1UpLCBNYW5hZ2VkIE1pY3Jvc29mdCBBRFxuICogb25seSwgYW5kIGF2YWlsYWJsZSBpbiB0aGUgZGlyZWN0b3J5J3MgcHJpbWFyeSBSZWdpb24gb25seS5cbiAqL1xuZXhwb3J0IGNsYXNzIERpcmVjdG9yeUdyb3VwIGV4dGVuZHMgRXh0ZW5kZWRDb25zdHJ1Y3Qge1xuICAvKipcbiAgICogVGhlIFNBTUFjY291bnROYW1lIG9mIHRoZSBtYW5hZ2VkIGdyb3VwLlxuICAgKi9cbiAgcmVhZG9ubHkgZ3JvdXBOYW1lOiBzdHJpbmc7XG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IERpcmVjdG9yeUdyb3VwUHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQsIHtcbiAgICAgIHN0YW5kYXJkVGFnczogU3RhbmRhcmRUYWdzLm1lcmdlKHByb3BzLnN0YW5kYXJkVGFncywgTGliU3RhbmRhcmRUYWdzKSxcbiAgICB9KTtcblxuICAgIHRoaXMuZ3JvdXBOYW1lID0gcHJvcHMuZ3JvdXBOYW1lO1xuXG4gICAgY29uc3QgZ3JvdXAgPSBuZXcgY3IuQXdzQ3VzdG9tUmVzb3VyY2UodGhpcywgJ0dyb3VwJywge1xuICAgICAgb25DcmVhdGU6IHtcbiAgICAgICAgc2VydmljZTogJ0RpcmVjdG9yeVNlcnZpY2VEYXRhJyxcbiAgICAgICAgYWN0aW9uOiAnQ3JlYXRlR3JvdXAnLFxuICAgICAgICBwYXJhbWV0ZXJzOiB7XG4gICAgICAgICAgRGlyZWN0b3J5SWQ6IHByb3BzLmRpcmVjdG9yeUlkLFxuICAgICAgICAgIFNBTUFjY291bnROYW1lOiBwcm9wcy5ncm91cE5hbWUsXG4gICAgICAgICAgLi4uKHByb3BzLmdyb3VwU2NvcGUgPyB7R3JvdXBTY29wZTogcHJvcHMuZ3JvdXBTY29wZX0gOiB7fSksXG4gICAgICAgICAgLi4uKHByb3BzLmdyb3VwVHlwZSA/IHtHcm91cFR5cGU6IHByb3BzLmdyb3VwVHlwZX0gOiB7fSksXG4gICAgICAgIH0sXG4gICAgICAgIHBoeXNpY2FsUmVzb3VyY2VJZDogY3IuUGh5c2ljYWxSZXNvdXJjZUlkLm9mKFxuICAgICAgICAgIGAke3Byb3BzLmRpcmVjdG9yeUlkfS8ke3Byb3BzLmdyb3VwTmFtZX1gLFxuICAgICAgICApLFxuICAgICAgICAvLyBDb25mbGljdEV4Y2VwdGlvbjogdGhlIGdyb3VwIGFscmVhZHkgZXhpc3RzIOKAlCB0cmVhdCBhcyBhIG5vLW9wLlxuICAgICAgICBpZ25vcmVFcnJvckNvZGVzTWF0Y2hpbmc6ICdDb25mbGljdEV4Y2VwdGlvbicsXG4gICAgICB9LFxuICAgICAgb25EZWxldGU6IHtcbiAgICAgICAgc2VydmljZTogJ0RpcmVjdG9yeVNlcnZpY2VEYXRhJyxcbiAgICAgICAgYWN0aW9uOiAnRGVsZXRlR3JvdXAnLFxuICAgICAgICBwYXJhbWV0ZXJzOiB7XG4gICAgICAgICAgRGlyZWN0b3J5SWQ6IHByb3BzLmRpcmVjdG9yeUlkLFxuICAgICAgICAgIFNBTUFjY291bnROYW1lOiBwcm9wcy5ncm91cE5hbWUsXG4gICAgICAgIH0sXG4gICAgICAgIC8vIFJlc291cmNlTm90Rm91bmRFeGNlcHRpb24gLyBBY2Nlc3NEZW5pZWRFeGNlcHRpb246IGdyb3VwIGFscmVhZHkgZ29uZSBvclxuICAgICAgICAvLyBvdXRzaWRlIG91ciBPVSDigJQgc2FmZSB0byBpZ25vcmUgc28gc3RhY2sgdGVhcmRvd24gaXMgbm90IGJsb2NrZWQuXG4gICAgICAgIGlnbm9yZUVycm9yQ29kZXNNYXRjaGluZzpcbiAgICAgICAgICAnUmVzb3VyY2VOb3RGb3VuZEV4Y2VwdGlvbnxBY2Nlc3NEZW5pZWRFeGNlcHRpb24nLFxuICAgICAgfSxcbiAgICAgIHBvbGljeTogY3IuQXdzQ3VzdG9tUmVzb3VyY2VQb2xpY3kuZnJvbVN0YXRlbWVudHMoW1xuICAgICAgICBuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICAgIGFjdGlvbnM6IFsnZHMtZGF0YTpDcmVhdGVHcm91cCcsICdkcy1kYXRhOkRlbGV0ZUdyb3VwJ10sXG4gICAgICAgICAgcmVzb3VyY2VzOiBbJyonXSxcbiAgICAgICAgfSksXG4gICAgICBdKSxcbiAgICB9KTtcblxuICAgIGZvciAoY29uc3QgbWVtYmVyIG9mIHByb3BzLm1lbWJlcnMgPz8gW10pIHtcbiAgICAgIGNvbnN0IG1lbWJlcnNoaXAgPSBuZXcgY3IuQXdzQ3VzdG9tUmVzb3VyY2UodGhpcywgYE1lbWJlciR7bWVtYmVyfWAsIHtcbiAgICAgICAgb25DcmVhdGU6IHtcbiAgICAgICAgICBzZXJ2aWNlOiAnRGlyZWN0b3J5U2VydmljZURhdGEnLFxuICAgICAgICAgIGFjdGlvbjogJ0FkZEdyb3VwTWVtYmVyJyxcbiAgICAgICAgICBwYXJhbWV0ZXJzOiB7XG4gICAgICAgICAgICBEaXJlY3RvcnlJZDogcHJvcHMuZGlyZWN0b3J5SWQsXG4gICAgICAgICAgICBHcm91cE5hbWU6IHByb3BzLmdyb3VwTmFtZSxcbiAgICAgICAgICAgIE1lbWJlck5hbWU6IG1lbWJlcixcbiAgICAgICAgICB9LFxuICAgICAgICAgIHBoeXNpY2FsUmVzb3VyY2VJZDogY3IuUGh5c2ljYWxSZXNvdXJjZUlkLm9mKFxuICAgICAgICAgICAgYCR7cHJvcHMuZGlyZWN0b3J5SWR9LyR7cHJvcHMuZ3JvdXBOYW1lfS8ke21lbWJlcn1gLFxuICAgICAgICAgICksXG4gICAgICAgICAgLy8gQ29uZmxpY3RFeGNlcHRpb246IG1lbWJlciBhbHJlYWR5IGluIHRoZSBncm91cCDigJQgdHJlYXQgYXMgYSBuby1vcC5cbiAgICAgICAgICBpZ25vcmVFcnJvckNvZGVzTWF0Y2hpbmc6ICdDb25mbGljdEV4Y2VwdGlvbicsXG4gICAgICAgIH0sXG4gICAgICAgIG9uRGVsZXRlOiB7XG4gICAgICAgICAgc2VydmljZTogJ0RpcmVjdG9yeVNlcnZpY2VEYXRhJyxcbiAgICAgICAgICBhY3Rpb246ICdSZW1vdmVHcm91cE1lbWJlcicsXG4gICAgICAgICAgcGFyYW1ldGVyczoge1xuICAgICAgICAgICAgRGlyZWN0b3J5SWQ6IHByb3BzLmRpcmVjdG9yeUlkLFxuICAgICAgICAgICAgR3JvdXBOYW1lOiBwcm9wcy5ncm91cE5hbWUsXG4gICAgICAgICAgICBNZW1iZXJOYW1lOiBtZW1iZXIsXG4gICAgICAgICAgfSxcbiAgICAgICAgICBpZ25vcmVFcnJvckNvZGVzTWF0Y2hpbmc6XG4gICAgICAgICAgICAnUmVzb3VyY2VOb3RGb3VuZEV4Y2VwdGlvbnxBY2Nlc3NEZW5pZWRFeGNlcHRpb24nLFxuICAgICAgICB9LFxuICAgICAgICBwb2xpY3k6IGNyLkF3c0N1c3RvbVJlc291cmNlUG9saWN5LmZyb21TdGF0ZW1lbnRzKFtcbiAgICAgICAgICBuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgICAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgICAgICAgICBhY3Rpb25zOiBbJ2RzLWRhdGE6QWRkR3JvdXBNZW1iZXInLCAnZHMtZGF0YTpSZW1vdmVHcm91cE1lbWJlciddLFxuICAgICAgICAgICAgcmVzb3VyY2VzOiBbJyonXSxcbiAgICAgICAgICB9KSxcbiAgICAgICAgXSksXG4gICAgICB9KTtcbiAgICAgIC8vIFRoZSBncm91cCBtdXN0IGV4aXN0IGJlZm9yZSBtZW1iZXJzIGNhbiBiZSBhZGRlZC5cbiAgICAgIG1lbWJlcnNoaXAubm9kZS5hZGREZXBlbmRlbmN5KGdyb3VwKTtcbiAgICB9XG4gIH1cbn1cbiJdfQ==

package/dist/aws-directory-service/lib/index.d.ts

@@ -0,0 +1,3 @@
+export * from './directory-group';
+export * from './managed-ad';
+export * from './simple-ad';

package/dist/aws-directory-service/lib/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./directory-group"), exports);
+__exportStar(require("./managed-ad"), exports);
+__exportStar(require("./simple-ad"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvYXdzLWRpcmVjdG9yeS1zZXJ2aWNlL2xpYi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsb0RBQWtDO0FBQ2xDLCtDQUE2QjtBQUM3Qiw4Q0FBNEIiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2RpcmVjdG9yeS1ncm91cCc7XG5leHBvcnQgKiBmcm9tICcuL21hbmFnZWQtYWQnO1xuZXhwb3J0ICogZnJvbSAnLi9zaW1wbGUtYWQnO1xuIl19

package/dist/aws-directory-service/lib/managed-ad.d.ts

@@ -0,0 +1,229 @@
+import type { SecretValue } from 'aws-cdk-lib';
+import { RemovalPolicy } from 'aws-cdk-lib';
+import * as directoryservice from 'aws-cdk-lib/aws-directoryservice';
+import type * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import type { Construct } from 'constructs';
+import { ExtendedConstruct, type ExtendedConstructProps } from '../../aws-cdk';
+/**
+ * Edition of an AWS Managed Microsoft AD directory.
+ */
+export type ManagedAdEdition = 'Standard' | 'Enterprise';
+/**
+ * RADIUS-based MFA configuration for a Managed Microsoft AD directory.
+ * Requires a RADIUS server reachable from the directory's VPC.
+ */
+export interface ManagedAdRadiusProps {
+    /**
+     * IP addresses or DNS names of the RADIUS server(s).
+     * Provide two entries for redundancy.
+     */
+    readonly radiusServers: string[];
+    /**
+     * Shared secret between the directory and the RADIUS server.
+     * Use SecretValue.secretsManager() or SecretValue.ssmSecure() — do not use unsafePlainText.
+     */
+    readonly sharedSecret: SecretValue;
+    /**
+     * UDP port for RADIUS authentication requests.
+     *
+     * @default 1812
+     */
+    readonly radiusPort?: number;
+    /**
+     * Timeout in seconds for each RADIUS request. Must be between 1 and 20.
+     *
+     * @default 20
+     */
+    readonly radiusTimeout?: number;
+    /**
+     * Number of times a RADIUS request is retried after a timeout. Must be between 0 and 10.
+     *
+     * @default 0
+     */
+    readonly radiusRetries?: number;
+    /**
+     * RADIUS authentication protocol.
+     *
+     * @default 'MS-CHAPv2'
+     */
+    readonly authenticationProtocol?: 'PAP' | 'CHAP' | 'MS-CHAPv1' | 'MS-CHAPv2';
+    /**
+     * Text label shown to users when prompted for their MFA token.
+     *
+     * @default 'MFA'
+     */
+    readonly displayLabel?: string;
+    /**
+     * Whether to pass the same username to the RADIUS server as used for directory authentication.
+     * Set to false when the RADIUS server expects a different username format.
+     *
+     * @default false
+     */
+    readonly useSameUsername?: boolean;
+}
+/**
+ * Single sign-on configuration for a Managed Microsoft AD directory.
+ * Enabling SSO allows users to access AWS applications and the directory access
+ * URL without re-entering their credentials.
+ */
+export interface ManagedAdSsoProps {
+    /**
+     * Alias for the directory access URL — produces `https://<alias>.awsapps.com`.
+     * Aliases are permanent: once created they cannot be changed or removed for the
+     * lifetime of the directory.
+     *
+     * @default - no alias is created and SSO uses the directory ID URL
+     */
+    readonly alias?: string;
+}
+/**
+ * CloudWatch Logs forwarding configuration for a Managed Microsoft AD directory.
+ * Forwards the directory's security event logs to a CloudWatch log group.
+ */
+export interface ManagedAdLogForwardingProps {
+    /**
+     * Name of the CloudWatch log group that receives directory security logs.
+     *
+     * @default - an auto-generated name is used
+     */
+    readonly logGroupName?: string;
+    /**
+     * Retention period for the directory log group.
+     *
+     * @default logs.RetentionDays.ONE_YEAR
+     */
+    readonly retention?: logs.RetentionDays;
+    /**
+     * Removal policy for the log group when the directory is removed.
+     *
+     * @default RemovalPolicy.RETAIN
+     */
+    readonly removalPolicy?: RemovalPolicy;
+}
+/**
+ * Cross-account sharing configuration for a Managed Microsoft AD directory.
+ * Shares the directory with other AWS accounts so they can launch directory-aware
+ * resources (e.g. WorkSpaces) against it.
+ */
+export interface ManagedAdSharingProps {
+    /**
+     * AWS account IDs the directory is shared with.
+     */
+    readonly targetAccountIds: string[];
+    /**
+     * Sharing method. Use ORGANIZATIONS to share within an AWS Organization without
+     * a handshake, or HANDSHAKE to send a sharing request the target must accept.
+     *
+     * @default 'HANDSHAKE'
+     */
+    readonly shareMethod?: 'ORGANIZATIONS' | 'HANDSHAKE';
+    /**
+     * A directory share message sent to the target accounts (HANDSHAKE only).
+     *
+     * @default - no message
+     */
+    readonly shareNotes?: string;
+}
+/**
+ * Properties for ManagedAd.
+ */
+export interface ManagedAdProps extends ExtendedConstructProps {
+    /**
+     * Fully qualified domain name for the directory. Example: 'corp.example.com'.
+     */
+    readonly domainName: string;
+    /**
+     * Admin password for the directory. Should come from Secrets Manager.
+     * Use SecretValue.secretsManager() — do not use unsafePlainText in production.
+     */
+    readonly password: SecretValue;
+    /**
+     * VPC the directory controllers are deployed into.
+     */
+    readonly vpc: ec2.IVpc;
+    /**
+     * Subnets the directory controllers are placed in. At least two subnets in
+     * different Availability Zones are required; only the first two are used.
+     */
+    readonly subnets: ec2.ISubnet[];
+    /**
+     * Short NetBIOS name for the directory. Example: 'CORP'.
+     *
+     * @default - derived by AWS from the domain name
+     */
+    readonly shortName?: string;
+    /**
+     * Edition of the Managed Microsoft AD.
+     *
+     * @default 'Standard'
+     */
+    readonly edition?: ManagedAdEdition;
+    /**
+     * RADIUS-based multi-factor authentication configuration.
+     *
+     * @default - RADIUS MFA is not enabled
+     */
+    readonly radius?: ManagedAdRadiusProps;
+    /**
+     * Single sign-on configuration.
+     *
+     * @default - SSO is not enabled
+     */
+    readonly sso?: ManagedAdSsoProps;
+    /**
+     * CloudWatch Logs forwarding configuration.
+     *
+     * @default - directory logs are not forwarded
+     */
+    readonly logForwarding?: ManagedAdLogForwardingProps;
+    /**
+     * Cross-account sharing configuration.
+     *
+     * @default - the directory is not shared
+     */
+    readonly sharing?: ManagedAdSharingProps;
+}
+/**
+ * Creates an AWS Managed Microsoft AD directory.
+ *
+ * Wraps the L1 {@link directoryservice.CfnMicrosoftAD} with TrueMark standard
+ * tagging and validation, and layers on optional RADIUS MFA, single sign-on,
+ * CloudWatch log forwarding, and cross-account sharing — each implemented with
+ * custom resources because they have no native CloudFormation support.
+ *
+ * The resulting {@link directoryId} can be consumed by directory-aware constructs
+ * such as Amazon WorkSpaces.
+ */
+export declare class ManagedAd extends ExtendedConstruct {
+    /**
+     * The underlying CloudFormation Managed Microsoft AD resource.
+     */
+    readonly microsoftAd: directoryservice.CfnMicrosoftAD;
+    /**
+     * The directory ID, e.g. 'd-xxxxxxxxxx'.
+     */
+    readonly directoryId: string;
+    /**
+     * The CloudWatch log group receiving directory security logs.
+     * Only set when logForwarding is configured.
+     */
+    readonly logGroup?: logs.ILogGroup;
+    constructor(scope: Construct, id: string, props: ManagedAdProps);
+    /**
+     * Enables RADIUS MFA on the directory via the Directory Service API.
+     */
+    private enableRadius;
+    /**
+     * Enables single sign-on and, if requested, creates the directory access URL alias.
+     */
+    private enableSso;
+    /**
+     * Creates a CloudWatch log group and subscribes the directory's security logs to it.
+     */
+    private enableLogForwarding;
+    /**
+     * Shares the directory with the configured target accounts.
+     */
+    private enableSharing;
+}