@cloud-copilot/iam-simulate
Version:
Simulate evaluation of AWS IAM policies
60 lines • 2.16 kB
JavaScript
/**
* Checks if a statement is an identity statement that allows the request.
*
* @param statement The statement to check.
* @returns Whether the statement is an identity statement that allows the request.
*/
export function identityStatementAllows(statement) {
if (statement.resourceMatch &&
statement.actionMatch &&
statement.conditionMatch === 'Match' &&
statement.statement.effect() === 'Allow') {
return true;
}
return false;
}
// export function identityStatementUknownAllow(statement: StatementAnalysis): boolean {
// if(statement.resourceMatch &&
// statement.actionMatch &&
// statement.conditionMatch === 'Unknown' &&
// statement.statement.effect() === 'Allow') {
// return true;
// }
// return false
// }
// export function identityStatementUknownDeny(statement: StatementAnalysis): boolean {
// if(statement.resourceMatch &&
// statement.actionMatch &&
// statement.conditionMatch === 'Unknown' &&
// statement.statement.effect() === 'Deny') {
// return true;
// }
// return false
// }
export function identityStatementExplicitDeny(statement) {
if (statement.resourceMatch &&
statement.actionMatch &&
statement.conditionMatch === 'Match' &&
statement.statement.effect() === 'Deny') {
return true;
}
return false;
}
export function statementMatches(analysis) {
return (analysis.resourceMatch &&
analysis.actionMatch &&
analysis.conditionMatch === 'Match' &&
['Match', 'AccountLevelMatch', 'SessionRoleMatch', 'SessionUserMatch'].includes(analysis.principalMatch));
}
/**
* Determines whether ignored conditions are decisive for a statement and should be reported.
*
* @param analysis the analysis of the statement
* @returns true if the ignored conditions are decisive, false otherwise
*/
export function reportIgnoredConditions(analysis) {
return (analysis.resourceMatch &&
analysis.actionMatch &&
['Match', 'AccountLevelMatch', 'SessionRoleMatch', 'SessionUserMatch'].includes(analysis.principalMatch));
}
//# sourceMappingURL=StatementAnalysis.js.map