@cloud-copilot/iam-lens
Version:
Visibility in IAM in and across AWS accounts
69 lines • 3.19 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.getAccountIdForResource = getAccountIdForResource;
exports.getRcpsForResource = getRcpsForResource;
exports.getResourcePolicyForResource = getResourcePolicyForResource;
const iam_utils_1 = require("@cloud-copilot/iam-utils");
/**
* Get the account ID for a given resource ARN. Lookup index if necessary to find the account ID.
*
* @param collectClient the IAM collect client to use for retrieving the account ID
* @param resourceArn the ARN of the resource to get the account ID for
* @returns the account ID for the specified resource, or undefined if not found
*/
async function getAccountIdForResource(collectClient, resourceArn) {
const arnParts = (0, iam_utils_1.splitArnParts)(resourceArn);
let accountId = arnParts.accountId;
if (accountId && accountId !== 'aws') {
return accountId;
}
if (arnParts.service === 's3' && arnParts.resourceType === '') {
const bucketName = arnParts.resourcePath.split('/')[0];
return collectClient.getAccountIdForBucket(bucketName);
}
else if (arnParts.service === 'apigateway' && arnParts.resourceType === 'restapis') {
return collectClient.getAccountIdForRestApi(resourceArn);
}
return undefined;
}
/**
* Get the resource control policies (RCPs) for a given resource ARN.
*
* @param collectClient the IAM collect client to use for retrieving RCPs
* @param resourceArn the ARN of the resource to get RCPs for
* @param resourceAccount the account ID of the resource, if known
* @returns an array of resource control policies for the specified resource
*/
async function getRcpsForResource(collectClient, resourceArn, resourceAccount) {
const accountId = resourceAccount || (await getAccountIdForResource(collectClient, resourceArn));
if (!accountId) {
throw new Error(`Unable to determine account ID for resource ARN: ${resourceArn}`);
}
return collectClient.getRcpHierarchyForAccount(accountId);
}
/**
* Get the resource policy for a resource, if any.
*
* @param collectClient the IAM collect client to use for retrieving the resource policy
* @param resourceArn the ARN of the resource to get the policy for
* @param resourceAccount the account ID of the resource, if known
* @returns the resource policy for the specified resource, or undefined if not found
*/
async function getResourcePolicyForResource(collectClient, resourceArn, resourceAccount) {
//TODO: Should this return a policy object?
const accountId = resourceAccount || (await getAccountIdForResource(collectClient, resourceArn));
if (!accountId) {
throw new Error(`Unable to determine account ID for resource ARN: ${resourceArn}`);
}
const resourcePolicy = await collectClient.getResourcePolicyForArn(resourceArn, accountId);
if (resourcePolicy) {
return resourcePolicy;
}
const ramPolicy = await collectClient.getRamSharePolicyForArn(resourceArn, accountId);
if (ramPolicy) {
return ramPolicy;
}
//TODO: there should be more here for things like glue resources
return undefined;
}
//# sourceMappingURL=resources.js.map