@cloud-copilot/iam-lens/dist/cjs/collect/client.d.ts

Visibility in IAM in and across AWS accounts

import { type AwsIamStore } from '@cloud-copilot/iam-collect';
import { type Policy, type ValidatedPolicy } from '@cloud-copilot/iam-policy';
import BitSet from 'bitset';
export interface SimulationOrgPolicies {
    orgIdentifier: string;
    policies: {
        name: string;
        policy: ValidatedPolicy<{
            name: string;
        }>;
    }[];
}
interface IamUserMetadata {
    arn: string;
    path: string;
    permissionBoundary: string;
    id: string;
    name: string;
    created: string;
}
export interface OrgPolicy {
    arn: string;
    name: string;
    policy: ValidatedPolicy<{
        name: string;
    }>;
}
export interface ManagedPolicy {
    arn: string;
    name: string;
    policy: ValidatedPolicy<{
        name: string;
    }>;
}
export interface InlinePolicy {
    name: string;
    policy: ValidatedPolicy<{
        name: string;
    }>;
}
interface OrgAccount {
    ou: string;
    rcps: string[];
    scps: string[];
}
type OrgAccounts = Record<string, OrgAccount>;
interface OrgUnitDetails {
    parent: string | undefined;
    scps: string[];
    rcps: string[];
}
type OrgUnits = Record<string, OrgUnitDetails>;
export type OrgPolicyType = 'scps' | 'rcps';
interface OrganizationMetadata {
    id: string;
    arn: string;
    rootOu: string;
    rootAccountArn: string;
    rootAccountId: string;
    features: {
        AISERVICES_OPT_OUT_POLICY?: boolean;
        BACKUP_POLICY?: boolean;
        RESOURCE_CONTROL_POLICY?: boolean;
        SERVICE_CONTROL_POLICY?: boolean;
        TAG_POLICY?: boolean;
    };
}
interface OrgStructureNode {
    children?: OrgStructure | undefined;
    accounts?: string[] | undefined;
}
interface OrgStructure {
    [key: string]: OrgStructureNode;
}
export interface VpcIndex {
    vpcs: Record<string, {
        arn: string;
        endpoints: {
            id: string;
            service: string;
        }[];
    }>;
    endpoints: Record<string, {
        arn: string;
        vpc: string;
    }>;
}
type Service = string;
type Action = string;
export type ServiceIamActionCache = {
    action?: Record<Action, BitSet>;
    notAction?: Record<Action, BitSet>;
};
export type IamActionCache = {
    prefix: string;
    principals: string[];
    accounts: Record<string, number[]>;
    action: Record<Service, Record<Action, BitSet>>;
    notAction: Record<Service, Record<Action, BitSet>>;
};
/**
 * Options for the IamCollectClient.
 */
export interface IamCollectClientOptions {
    /**
     * Which {@link CacheProvider} to use for caching results.
     */
    cacheProvider?: CacheProvider;
}
/**
 * An interface for a cache provider that can be used to cache results.
 */
export interface CacheProvider {
    withCache<T>(cacheKey: string, fetcher: () => Promise<T>): Promise<T>;
}
/**
 * A cache provider that stores results in memory for a single worker.
 */
export declare class InMemoryCacheProvider implements CacheProvider {
    private cache;
    withCache<T>(cacheKey: string, fetcher: () => Promise<T>): Promise<T>;
}
/**
 * A cache provider that does not cache results.
 */
export declare class NoCacheProvider implements CacheProvider {
    withCache<T>(cacheKey: string, fetcher: () => Promise<T>): Promise<T>;
}
/**
 * A client for simplifying access to the IAM collect data store.
 */
export declare class IamCollectClient {
    private storageClient;
    private cacheProvider;
    /**
     * Creates a new instance of the IamCollectClient.
     *
     * @param storageClient the iam-collect storage client to use for data access
     * @param clientOptions optional configuration options for the client. By default, uses an in-memory cache provider.
     */
    constructor(storageClient: AwsIamStore, clientOptions?: IamCollectClientOptions);
    getStore(): AwsIamStore;
    /**
     * Returns the cache provider used by this client.
     *
     * @returns The {@link CacheProvider} instance in use.
     */
    getCacheProvider(): CacheProvider;
    private withCache;
    /**
     * Checks if an account exists in the store.
     * @param accountId The ID of the account to check.
     * @returns True if the account exists, false otherwise.
     */
    accountExists(accountId: string): Promise<boolean>;
    /**
     * Get all account IDs in the store.
     *
     * @returns all account IDs in the store
     */
    allAccounts(): Promise<string[]>;
    /**
     * Checks if a principal exists in the store.
     * @param principalArn The ARN of the principal to check.
     * @returns True if the principal exists, false otherwise.
     */
    principalExists(principalArn: string): Promise<boolean>;
    /**
     * Gets the SCP Hierarchy for an account. The first element is the root, the last element is the account itself.
     * @param accountId The ID of the account to get the SCP Hierarchy for.
     * @returns The SCP Hierarchy for the account.
     */
    getScpHierarchyForAccount(accountId: string): Promise<SimulationOrgPolicies[]>;
    /**
     * Gets the policy hierarchy for an account for a given policy type.
     * @param accountId The ID of the account.
     * @param policyType The type of policy ('scps' or 'rcps').
     * @returns The policy hierarchy for the account.
     */
    getOrgPolicyHierarchyForAccount(accountId: string, policyType: OrgPolicyType): Promise<SimulationOrgPolicies[]>;
    /**
     * Gets the OUs for an account. The first element is the root,
     * the last element is the parent OU of the account.
     * @param accountId The ID of the account to get the OUs for.
     * @returns The OUs for the account.
     */
    getOrgUnitHierarchyForAccount(accountId: string): Promise<string[]>;
    /**
     * Gets the org unit ID for an account.
     * @param accountId The ID of the account.
     * @returns The org unit ID for the account, or undefined if not found.
     */
    getOrgUnitIdForAccount(accountId: string): Promise<string | undefined>;
    /**
     * Gets the parent org unit ID for a given org unit.
     * @param orgId The ID of the organization.
     * @param ouId The ID of the org unit.
     * @returns The parent org unit ID, or undefined if not found.
     */
    getParentOrgUnitIdForOrgUnit(orgId: string, ouId: string): Promise<string | undefined>;
    /**
     * Gets the SCPs for an account.
     * @param accountId The ID of the account.
     * @returns The SCPs for the account.
     */
    getScpsForAccount(accountId: string): Promise<OrgPolicy[]>;
    /**
     * Gets the org policies for an account for a given policy type.
     * @param accountId The ID of the account.
     * @param policyType The type of policy ('scps' or 'rcps').
     * @returns The org policies for the account.
     */
    getOrgPoliciesForAccount(accountId: string, policyType: OrgPolicyType): Promise<OrgPolicy[]>;
    /**
     * Gets the account data for an organization.
     * @param orgId The ID of the organization.
     * @returns The account data for the organization.
     */
    getAccountDataForOrg(orgId: string): Promise<OrgAccounts | undefined>;
    /**
     * Gets the org units data for an organization.
     * @param orgId The ID of the organization.
     * @returns The org units data for the organization.
     */
    getOrgUnitsDataForOrg(orgId: string): Promise<OrgUnits>;
    /**
     * Gets a specific org policy.
     * @param orgId The ID of the organization.
     * @param policyType The type of policy ('scps' or 'rcps').
     * @param policyArn The ARN of the policy.
     * @returns The org policy.
     */
    getOrgPolicy(orgId: string, policyType: OrgPolicyType, policyArn: string): Promise<OrgPolicy>;
    /**
     * Gets the RCPs for an account.
     * @param accountId The ID of the account.
     * @returns The RCPs for the account.
     */
    getRcpsForAccount(accountId: string): Promise<OrgPolicy[]>;
    /**
     * Gets the RCP hierarchy for an account.
     * @param accountId The ID of the account.
     * @returns The RCP hierarchy for the account.
     */
    getRcpHierarchyForAccount(accountId: string): Promise<SimulationOrgPolicies[]>;
    /**
     * Gets the SCPs for an org unit.
     * @param orgId The ID of the organization.
     * @param orgUnitId The ID of the org unit.
     * @returns The SCPs for the org unit.
     */
    getScpsForOrgUnit(orgId: string, orgUnitId: string): Promise<OrgPolicy[]>;
    /**
     * Gets the org policies for an org unit for a given policy type.
     * @param orgId The ID of the organization.
     * @param orgUnitId The ID of the org unit.
     * @param policyType The type of policy ('scps' or 'rcps').
     * @returns The org policies for the org unit.
     */
    getOrgPoliciesForOrgUnit(orgId: string, orgUnitId: string, policyType: OrgPolicyType): Promise<OrgPolicy[]>;
    /**
     * Gets the RCPs for an org unit.
     * @param orgId The ID of the organization.
     * @param orgUnitId The ID of the org unit.
     * @returns The RCPs for the org unit.
     */
    getRcpsForOrgUnit(orgId: string, orgUnitId: string): Promise<OrgPolicy[]>;
    /**
     * Gets the org ID for an account.
     * @param accountId The ID of the account.
     * @returns The org ID for the account, or undefined if not found.
     */
    getOrgIdForAccount(accountId: string): Promise<string | undefined>;
    getIndex<T>(indexName: string, defaultValue: T): Promise<{
        lockId: string;
        data: T;
    }>;
    /**
     * Get the account ID for a given S3 bucket name.
     *
     * @param bucketName The name of the bucket.
     * @returns The account ID for the bucket, or undefined if not found.
     */
    getAccountIdForBucket(bucketName: string): Promise<string | undefined>;
    /**
     * Check if ABAC is enabled for a specific S3 bucket
     *
     * @param accountId The account ID of the bucket
     * @param bucketOrObjectArn The ARN of the bucket or object
     * @returns true if ABAC is enabled for the bucket, false otherwise
     */
    getAbacEnabledForBucket(accountId: string, bucketOrObjectArn: string): Promise<boolean>;
    /**
     * Gets the account ID for a given API Gateway ARN.
     * @param apiArn The ARN of the API Gateway.
     * @returns The account ID for the API Gateway, or undefined if not found.
     */
    getAccountIdForRestApi(apiArn: string): Promise<string | undefined>;
    /**
     * Gets the managed policies attached to a user.
     * @param userArn The ARN of the user.
     * @returns The managed policies for the user.
     */
    getManagedPoliciesForUser(userArn: string): Promise<ManagedPolicy[]>;
    getManagedPolicy(accountId: string, policyArn: string): Promise<ManagedPolicy>;
    /**
     * Gets the inline policies attached to a user.
     * @param userArn The ARN of the user.
     * @returns The inline policies for the user.
     */
    getInlinePoliciesForUser(userArn: string): Promise<InlinePolicy[]>;
    /**
     * Gets metadata for an IAM user.
     *
     * @param userArn the ARN of the user.
     * @returns the metadata for the user, or undefined if not found.
     */
    getIamUserMetadata(userArn: string): Promise<IamUserMetadata | undefined>;
    /**
     * Gets the permissions boundary policy attached to a user, if any.
     *
     * @param userArn The ARN of the user.
     * @returns The permissions boundary policy as an OrgPolicy, or undefined if none is set.
     */
    getPermissionsBoundaryForUser(userArn: string): Promise<ManagedPolicy | undefined>;
    /**
     * Gets the group ARNs that the user is a member of.
     * @param userArn The ARN of the user.
     * @returns An array of group ARNs the user belongs to.
     */
    getGroupsForUser(userArn: string): Promise<string[]>;
    /**
     * Gets the managed policies attached to a group.
     *
     * @param groupArn The ARN of the group.
     * @returns The managed policies for the group.
     */
    getManagedPoliciesForGroup(groupArn: string): Promise<ManagedPolicy[]>;
    /**
     * Get the inline policies attached to a group.
     *
     * @param groupArn the ARN of the group.
     * @returns the inline policies for the group.
     */
    getInlinePoliciesForGroup(groupArn: string): Promise<InlinePolicy[]>;
    /**
     * Gets the managed policies attached to a role.
     * @param roleArn the ARN of the role.
     * @returns the managed policies attached to the role.
     */
    getManagedPoliciesForRole(roleArn: string): Promise<ManagedPolicy[]>;
    /**
     * Get the inline policies attached to a role.
     *
     * @param roleArn the ARN of the role.
     * @returns the inline policies for the role.
     */
    getInlinePoliciesForRole(roleArn: string): Promise<InlinePolicy[]>;
    /**
     * Get the permissions boundary policy attached to a role, if any.
     * @param roleArn the ARN of the role.
     * @returns the permissions boundary policy as a ManagedPolicy, or undefined if none is set.
     */
    getPermissionsBoundaryForRole(roleArn: string): Promise<ManagedPolicy | undefined>;
    /**
     * Get the metadata for an organization.
     *
     * @param organizationId the id of the organization
     * @returns the metadata for the organization
     */
    getOrganizationMetadata(organizationId: string): Promise<OrganizationMetadata>;
    /**
     * Gets the resource policy for a given resource ARN and account.
     *
     * @param resourceArn The ARN of the resource.
     * @param accountId The ID of the account.
     * @returns The resource policy, or undefined if not found.
     */
    getResourcePolicyForArn(resourceArn: string, accountId: string): Promise<ValidatedPolicy<{
        name: string;
    }> | undefined>;
    /**
     * Gets the RAM share policy for a given resource ARN and account.
     *
     * @param resourceArn The ARN of the resource.
     * @param accountId The ID of the account.
     * @returns The RAM share policy, or undefined if not found.
     */
    getRamSharePolicyForArn(resourceArn: string, accountId: string): Promise<ValidatedPolicy<{
        name: string;
    }> | undefined>;
    /**
     * Gets the tags for a given resource ARN and account.
     *
     * @param resourceArn The ARN of the resource.
     * @param accountId The ID of the account.
     * @returns an object to indicate if the resource is present and its tags (if any)
     */
    getTagsForResource(resourceArn: string, accountId: string): Promise<{
        present: boolean;
        tags: Record<string, string>;
    }>;
    /**
     * Gets a unique ID for an IAM resource based on its ARN and account ID.
     * Used specifically for IAM Users and Roles
     *
     * @param resourceArn the ARN of the IAM resource
     * @param accountId the ID of the account the resource belongs to
     * @returns a unique ID for the resource, or undefined if not found
     */
    getUniqueIdForIamResource(resourceArn: string): Promise<string | undefined>;
    /**
     * Get the account IDs for an organization.
     *
     * @param organizationId the ID of the organization
     * @returns a tuple containing a boolean indicating success and an array of account IDs
     */
    getAccountsForOrganization(organizationId: string): Promise<[boolean, string[]]>;
    /**
     * Get the organization structure or an organization.
     *
     * @param orgId the ID of the organization
     * @returns returns the organization structure or undefined if not found
     */
    getOrganizationStructure(orgId: string): Promise<OrgStructure | undefined>;
    /**
     * Get the accounts for a given organization path, includes
     * accounts directly under the OU and in child OUs.
     *
     * @param orgId the ID of the organization
     * @param ouIds the ids of the organizational units in the path
     * @returns a tuple containing a boolean indicating success and an array of account IDs
     */
    getAccountsForOrgPath(orgId: string, ouIds: string[]): Promise<[boolean, string[]]>;
    /**
     * Get all the principals (users and roles) in a given account.
     *
     * @param accountId the ID of the account
     * @returns a list of all principal ARNs in the account
     */
    getAllPrincipalsInAccount(accountId: string): Promise<string[]>;
    /**
     * Get the VPC endpoint policy for a given VPC endpoint ARN.
     *
     * @param vpcEndpointArn the ARN of the VPC endpoint
     * @returns the VPC endpoint policy, or undefined if not found
     */
    getVpcEndpointPolicyForArn(vpcEndpointArn: string): Promise<ValidatedPolicy<{
        name: string;
    }> | undefined>;
    /**
     * Get the ARN of a VPC endpoint given its ID.
     * @param vpcEndpointId the ID of the VPC endpoint
     * @returns the ARN of the VPC endpoint, or undefined if not found
     */
    getVpcEndpointArnForVpcEndpointId(vpcEndpointId: string): Promise<string | undefined>;
    /**
     * Gets the VPC endpoint ID for a given VPC ID and service name.
     *
     * @param vpcIdOrArn the ID or ARN of the VPC
     * @param service the service name of the VPC endpoint (e.g., s3, ec2, etc.)
     * @returns the VPC endpoint ID, or undefined if not found
     */
    getVpcEndpointIdForVpcService(vpcIdOrArn: string, service: string): Promise<string | undefined>;
    /**
     * Lookup the VPC ID for a given VPC endpoint ID.
     *
     * @param vpcEndpointId the ID of the VPC endpoint
     * @returns the VPC ID, or undefined if not found
     */
    getVpcIdForVpcEndpointId(vpcEndpointId: string): Promise<string | undefined>;
    /**
     * Lookup the VPC ARN for a given VPC endpoint ID.
     *
     * @param vpcEndpointId the ID of the VPC endpoint
     * @returns the VPC ARN, or undefined if not found
     */
    getVpcArnForVpcEndpointId(vpcEndpointId: string): Promise<string | undefined>;
    /**
     * Lookup the account ID for a given VPC endpoint ID.
     *
     * @param vpcEndpointId the ID of the VPC endpoint
     * @returns the account ID, or undefined if not found
     */
    getAccountIdForVpcEndpointId(vpcEndpointId: string): Promise<string | undefined>;
    /**
     * Get the organization ID for a given VPC endpoint ID.
     *
     * @param vpcEndpointId the ID of the VPC endpoint
     * @returns the organization ID, or undefined if not found
     */
    getOrgIdForVpcEndpointId(vpcEndpointId: string): Promise<string | undefined>;
    /**
     * Get the organization unit hierarchy for a given VPC endpoint ID.
     *
     * @param vpcEndpointId the ID of the VPC endpoint
     * @returns the organization unit hierarchy, or undefined if not found
     */
    getOrgUnitHierarchyForVpcEndpointId(vpcEndpointId: string): Promise<string[] | undefined>;
    /**
     * Get all the policies for a principal that should be used to populate the cache
     *
     * @param collectClient The IAM collect client to use for data access
     * @param accountId The ID of the account
     * @param principalArn The ARN of the principal
     * @returns An array of policies for the principal
     */
    getAllowPoliciesForPrincipal(principalArn: string): Promise<Policy[]>;
    savePrincipalIndex(type: string, principalIndex: any): Promise<void>;
    getPrincipalIndex(type: string): Promise<Partial<IamActionCache> | IamActionCache['accounts'] | IamActionCache['principals'] | IamActionCache['action'][string] | IamActionCache['notAction'] | undefined>;
    principalIndexExists(): Promise<boolean>;
    /**
     * Get the principals that may have permission to perform a specific action.
     *
     * If the data is available it will return a subset of principals that may
     * have permission to perform the action. If the data is not available, it
     * will return undefined.
     *
     * @param allFromAccount The account ID from which to include all principals in the result, regardless of the action filter. When `undefined`, no account receives this treatment — only principals matching the action filter are returned.
     * @param accountIds The list of account IDs to check for principals that may have permission to perform the specified action. Only principals from these accounts that may have the action allowed will be included.
     * @param action The action to check.
     * @returns A list of principals that may have permission to perform the action, or undefined if the data is not available.
     */
    getPrincipalsWithActionAllowed(allFromAccount: string | undefined, accountIds: string[], action: string): Promise<string[] | undefined>;
    listResources(accountId: string, service: string, resourceType: string, region: string | undefined): Promise<string[]>;
}
export {};
//# sourceMappingURL=client.d.ts.map