@cloud-copilot/iam-collect
Version:
Collect IAM information from AWS Accounts
189 lines • 9.06 kB
JavaScript
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.SsoDataSync = void 0;
const client_sso_admin_1 = require("@aws-sdk/client-sso-admin");
const client_tools_js_1 = require("../../utils/client-tools.js");
const log_1 = require("@cloud-copilot/log");
const tags_js_1 = require("../../utils/tags.js");
const sync_js_1 = require("../sync.js");
const typedSync_js_1 = require("../typedSync.js");
exports.SsoDataSync = {
awsService: 'sso',
name: 'instances',
execute: async (accountId, region, credentials, storage, endpoint, syncOptions) => {
const client = syncOptions.clientPool.client(client_sso_admin_1.SSOAdminClient, credentials, region, endpoint);
const instances = await (0, client_tools_js_1.withDnsRetry)(async () => {
return (0, typedSync_js_1.paginateResource)(client, client_sso_admin_1.ListInstancesCommand, 'Instances', {
inputKey: 'NextToken',
outputKey: 'NextToken'
});
});
const accountInstances = instances.filter((instance) => instance.OwnerAccountId === accountId && instance.Status === 'ACTIVE');
log_1.log.trace('Found SSO instances', {
accountId,
region,
instances: accountInstances.length
});
const resourceTypeParts = {
service: 'sso',
resourceType: 'instance',
metadata: {
region
}
};
const data = [];
for (const instance of accountInstances) {
const command = new client_sso_admin_1.ListTagsForResourceCommand({
InstanceArn: instance.InstanceArn,
ResourceArn: instance.InstanceArn
});
const results = await (0, client_tools_js_1.runAndCatchAccessDenied)(async () => {
return client.send(command);
});
const tags = (0, tags_js_1.convertTagsToRecord)(results?.Tags);
data.push({
arn: instance.InstanceArn,
metadata: {
name: instance.Name,
identityStoreId: instance.IdentityStoreId,
ownerAccountId: instance.OwnerAccountId,
status: instance.Status,
region,
arn: instance.InstanceArn
},
tags
});
}
await (0, sync_js_1.syncData)(data, storage, accountId, resourceTypeParts, syncOptions.writeOnly);
for (const instance of accountInstances) {
const dataSyncs = createSsoInstanceResourceSyncs(instance, region);
for (const dataSync of dataSyncs) {
await dataSync.execute(accountId, region, credentials, storage, endpoint, syncOptions);
}
}
}
};
function createSsoInstanceResourceSyncs(ssoInstance, region) {
return [
(0, typedSync_js_1.createTypedSyncOperation)('sso', 'permissionSets', (0, typedSync_js_1.createResourceSyncType)({
client: client_sso_admin_1.SSOAdminClient,
command: client_sso_admin_1.ListPermissionSetsCommand,
arguments: (awsId, region) => ({
InstanceArn: ssoInstance.InstanceArn
}),
key: 'PermissionSets',
paginationConfig: {
inputKey: 'NextToken',
outputKey: 'NextToken'
},
resourceTypeParts: (accountId, region) => ({
service: 'sso',
resourceType: 'permissionset',
account: accountId,
metadata: {
region
}
}),
arn: (permissionSet) => permissionSet.name,
extraFields: {
tags: async (client, permissionSet) => {
const command = new client_sso_admin_1.ListTagsForResourceCommand({
InstanceArn: ssoInstance.InstanceArn,
ResourceArn: permissionSet.name
});
const results = await client.send(command);
return results?.Tags;
},
details: async (client, permissionSet) => {
const command = new client_sso_admin_1.DescribePermissionSetCommand({
InstanceArn: ssoInstance.InstanceArn,
PermissionSetArn: permissionSet.name
});
const results = await client.send(command);
return results?.PermissionSet;
},
awsManagedPolicies: async (client, permissionSet) => {
const command = new client_sso_admin_1.ListManagedPoliciesInPermissionSetCommand({
InstanceArn: ssoInstance.InstanceArn,
PermissionSetArn: permissionSet.name
});
const results = await client.send(command);
return results.AttachedManagedPolicies;
},
customerManagedPolicies: async (client, permissionSet, account, region, partition) => {
const results = await (0, typedSync_js_1.paginateResource)(client, client_sso_admin_1.ListCustomerManagedPolicyReferencesInPermissionSetCommand, 'CustomerManagedPolicyReferences', {
inputKey: 'NextToken',
outputKey: 'NextToken'
}, {
InstanceArn: ssoInstance.InstanceArn,
PermissionSetArn: permissionSet.name
});
return results?.map((policy) => ({
...policy,
arn: `arn:${partition}:iam::${account}:policy/${policy.Name}`
}));
},
inlinePolicy: async (client, permissionSet) => {
const command = new client_sso_admin_1.GetInlinePolicyForPermissionSetCommand({
InstanceArn: ssoInstance.InstanceArn,
PermissionSetArn: permissionSet.name
});
const results = await (0, client_tools_js_1.runAndCatch404)(async () => {
const result = await client.send(command);
if (result?.InlinePolicy) {
return JSON.parse(result.InlinePolicy);
}
return undefined;
});
return results;
},
permissionBoundary: async (client, permissionSet) => {
const command = new client_sso_admin_1.GetPermissionsBoundaryForPermissionSetCommand({
InstanceArn: ssoInstance.InstanceArn,
PermissionSetArn: permissionSet.name
});
const permissionBoundary = await (async () => {
try {
const result = await client.send(command);
if (result?.PermissionsBoundary) {
return result.PermissionsBoundary;
}
return undefined;
}
catch (e) {
if (e.name === 'ResourceNotFoundException') {
return undefined;
}
throw e;
}
})();
return permissionBoundary;
},
accounts: async (client, permissionSet) => {
const results = await (0, typedSync_js_1.paginateResource)(client, client_sso_admin_1.ListAccountsForProvisionedPermissionSetCommand, 'AccountIds', {
inputKey: 'NextToken',
outputKey: 'NextToken'
}, {
InstanceArn: ssoInstance.InstanceArn,
PermissionSetArn: permissionSet.name
});
return results;
}
},
tags: (permissionSet) => permissionSet.extraFields.tags,
results: (permissionSet) => ({
metadata: {
name: permissionSet.extraFields.details?.Name,
description: permissionSet.extraFields.details?.Description,
region
},
awsManagedPolicies: permissionSet.extraFields.awsManagedPolicies,
customerManagedPolicies: permissionSet.extraFields.customerManagedPolicies,
inlinePolicy: permissionSet.extraFields.inlinePolicy,
permissionBoundary: permissionSet.extraFields.permissionBoundary,
accounts: permissionSet.extraFields.accounts
})
}))
];
}
//# sourceMappingURL=ssoInstances.js.map