@cloud-copilot/iam-simulate
Version:
Simulate evaluation of AWS IAM policies
37 lines • 1.9 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.allowedContextKeysForRequest = allowedContextKeysForRequest;
const iam_data_1 = require("@cloud-copilot/iam-data");
const globalConditionKeys_js_1 = require("../global_conditions/globalConditionKeys.js");
const util_js_1 = require("../util.js");
/**
* Get the allowed context keys for a request.
*
* @param service The service the action belongs to
* @param action The action to get the allowed context keys for
* @param resource The resource the action is being performed on
* @returns The allowed context keys for the request as lower case strings
* @throws error if the service or action does not exist
*/
async function allowedContextKeysForRequest(service, action, resource) {
const actionDetails = await (0, iam_data_1.iamActionDetails)(service, action);
const actionConditionKeys = (0, util_js_1.lowerCaseAll)(actionDetails.conditionKeys);
const isWildCardOnly = await (0, util_js_1.isWildcardOnlyAction)(service, action);
if (isWildCardOnly) {
return [...actionConditionKeys, ...(0, globalConditionKeys_js_1.allGlobalConditionKeys)()];
}
const resourceTypes = await (0, util_js_1.getResourceTypesForAction)(service, action, resource);
if (resourceTypes.length === 0) {
throw new Error(`No resource types found for action ${action} on service ${service}`);
}
else if (resourceTypes.length > 1) {
throw new Error(`Multiple resource types found for action ${action} on service ${service}`);
}
const resourceTypeConditions = actionDetails.resourceTypes.find((rt) => rt.name === resourceTypes[0].key).conditionKeys;
return [
...(0, util_js_1.lowerCaseAll)(resourceTypeConditions),
...actionConditionKeys,
...(0, globalConditionKeys_js_1.allGlobalConditionKeys)()
];
}
//# sourceMappingURL=contextKeys.js.map