aws-why 0.1.0__py3-none-win_amd64.whl

aws_why-0.1.0.dist-info/METADATA

@@ -0,0 +1,132 @@
+Metadata-Version: 2.4
+Name: aws-why
+Version: 0.1.0
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Rust
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Systems Administration
+License-File: LICENSE
+Summary: Run AWS CLI commands and explain authorization failures with evidence
+Keywords: aws,iam,cli,security,authorization
+Home-Page: https://github.com/kraftaa/aws-why
+License-Expression: MIT
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
+Project-URL: Documentation, https://github.com/kraftaa/aws-why#readme
+Project-URL: Issues, https://github.com/kraftaa/aws-why/issues
+Project-URL: Source, https://github.com/kraftaa/aws-why
+
+# aws-why
+
+`aws-why` runs an AWS CLI command unchanged. If the command fails, it classifies the failure and explains an authorization denial using the strongest evidence AWS made available.
+
+```console
+$ aws-why run -- aws s3 cp test.csv s3://prod-data/test.csv
+upload failed: ... AccessDenied ...
+
+ACCESS DENIED
+
+Identity
+  account: 123456789012
+  principal: DataEngineer
+  session: example-session
+
+Failed operation
+  s3:PutObject
+
+Resource
+  arn:aws:s3:::prod-data/test.csv
+
+Cause
+  a permissions boundary blocks the action
+
+Evidence
+  AWS error response (reported by AWS)
+```
+
+The tool does not treat every AWS failure as IAM. Expired credentials, missing configuration, network errors, and missing resources get distinct results.
+
+## Install and use
+
+The normal installation does not require Rust or Cargo. Install the native executable in an isolated environment with `pipx`:
+
+```console
+pipx install aws-why
+aws-why run -- aws sts get-caller-identity
+aws-why run --json -- aws s3api get-object --bucket example --key report.csv report.csv
+```
+
+Or use `uv`:
+
+```console
+uv tool install aws-why
+```
+
+Release wheels contain the compiled executable; Python is only the distribution mechanism. Wheels are built for macOS on Apple Silicon and Intel, Linux on ARM64 and x86-64, and Windows x86-64.
+
+The command after `--` is executed with exactly the supplied argument vector and inherited environment. `stdin` is inherited and human-mode `stdout` is streamed. `stderr` is held in a secure temporary file until the result is classified. On success, `aws-why` adds no output. It returns the wrapped command's exit code.
+
+In `--json` mode, successful command output is replayed from secure temporary files. For failures, command output is replaced with one JSON diagnostic object on stdout so CI consumers can parse it reliably. Replay is capped at 64 MiB for stdout and 8 MiB for stderr; analysis retains only the final 1 MiB of stderr.
+
+Each follow-up AWS call has a five-second timeout by default. Change it with `--diagnostic-timeout <seconds>`.
+
+## Evidence hierarchy
+
+`aws-why` stops at the first useful source:
+
+1. AWS `GetRequestAuthorizationDetails`, when the error contains an authorization ID and the API is supported and permitted.
+2. An encoded authorization message decoded through STS.
+3. The AWS service's denial message.
+4. IAM principal-policy simulation when identity, action, and resource are known.
+5. `UNKNOWN`.
+
+Every action/resource result has its own evidence source and confidence:
+
+- `verified`: AWS returned the authorization evaluation for the live request.
+- `reported`: the live AWS error explicitly named the cause.
+- `simulated`: IAM simulation produced the result but did not reproduce the request.
+- `incomplete`: there was not enough evidence for an exact cause.
+
+Simulation is never presented as proof that the live request will succeed. It can omit live request conditions, resource policies, endpoint policies, role chaining, and other enforcement layers.
+
+## AWS context and diagnostic permissions
+
+Diagnostic calls use the same credential environment plus the wrapped command's explicit `--profile` and `--region`, but they ignore configured custom endpoints and always use the normal AWS endpoint resolver. Follow-up calls are skipped entirely when the original command uses `--no-sign-request` or an explicit `--endpoint-url`.
+
+Generated diagnostics redact encoded authorization payloads, common AWS access-key/token formats, and terminal control characters. The wrapped command still runs with its inherited environment and can print any data it chooses—for example, `aws sts get-session-token` prints credentials by design. Do not use `aws-why` to run an untrusted executable, and protect captured CI output as you would ordinary AWS CLI output.
+
+AWS may require these permissions for stronger explanations:
+
+- `sts:GetCallerIdentity`
+- `iam:GetRequestAuthorizationDetails`
+- `sts:DecodeAuthorizationMessage`
+- `iam:SimulatePrincipalPolicy`
+
+The original command still runs if none of those diagnostic permissions are available; the result simply becomes less specific.
+
+## Current scope
+
+The action/resource parser is intentionally optimized for S3, Secrets Manager, KMS, IAM, and STS. AWS authorization IDs are not currently returned by every service or API. Cross-organization details can also be withheld by AWS. In those cases, `aws-why` reports the known identity/action/resource and says that the exact denial reason is unknown.
+
+`aws-why` recognizes only a direct `aws` executable. Shell pipelines and commands such as `sh -c 'aws ...'` still execute, but follow-up AWS diagnostics are not attempted because their effective AWS context cannot be recovered safely.
+
+## Development
+
+```console
+cargo fmt --check
+cargo test
+cargo clippy --all-targets --all-features -- -D warnings
+maturin build --release --bindings bin
+```
+
+The end-to-end tests use a temporary fake AWS executable and never contact AWS.
+
+Tagged releases build platform-specific wheels and publish them through PyPI Trusted Publishing. Before the first public release, configure this repository as a trusted publisher for the `aws-why` PyPI project with environment name `pypi`, require maintainer approval on that GitHub environment, protect release tags, and push a tag matching the Cargo version, such as `v0.1.0`. The workflow rejects tags that do not match the Cargo package version, and every third-party action is pinned to an immutable commit.
+

aws_why-0.1.0.dist-info/RECORD

@@ -0,0 +1,5 @@
+aws_why-0.1.0.data\scripts\aws-why.exe,sha256=l0SpTyptpRp98iZOfN93-Urrw1XCOhomfNWzl6dPJUM,2351104
+aws_why-0.1.0.dist-info\METADATA,sha256=SlDDKQTNBLUkOJZuqP6F9vKCuQJd9Zu-dJ541C7aFGc,6616
+aws_why-0.1.0.dist-info\WHEEL,sha256=jsSEiVNsW1dJj5gDaReR40i7mhgBjWtms6nAD6EViXU,94
+aws_why-0.1.0.dist-info\licenses\LICENSE,sha256=XKKSDU9WlUEAyPNlRhq6e2xhVNpJc097JwPZJ1rUnRE,1077
+aws_why-0.1.0.dist-info\RECORD,,

aws_why-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: maturin (1.11.5)
+Root-Is-Purelib: false
+Tag: py3-none-win_amd64

aws_why-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.