@cloud-copilot/iam-simulate/dist/esm/principal/principal.d.ts

Simulate evaluation of AWS IAM policies

import { Principal, Statement } from '@cloud-copilot/iam-policy';
import { SimulationParameters } from '../core_engine/CoreSimulatorEngine.js';
import { PrincipalExplain, StatementExplain } from '../explain/statementExplain.js';
import { AwsRequest } from '../request/request.js';
interface PrincipalAnalysis {
    explain: PrincipalExplain;
    ignoredRoleSessionName?: boolean;
}
export type PrincipalMatchResult = 'Match' | 'NoMatch' | 'AccountLevelMatch' | 'SessionRoleMatch' | 'SessionUserMatch';
/**
 * Check to see if a request matches a Principal element in an IAM policy statement
 *
 * @param request the request to check
 * @param principal the list of principals in the Principal element of the Statement
 * @returns if the request matches the Principal element, and if so, how it matches
 */
export declare function requestMatchesPrincipal(request: AwsRequest, principal: Principal[], simulationParameters: SimulationParameters, allowOrDeny: 'Allow' | 'Deny'): {
    matches: PrincipalMatchResult;
    explains: PrincipalExplain[];
    ignoredRoleSessionName?: boolean;
};
/**
 * Check to see if a request matches a NotPrincipal element in an IAM policy statement
 *
 * @param request the request to check
 * @param notPrincipal the list of principals in the NotPrincipal element of the Statement
 * @returns
 */
export declare function requestMatchesNotPrincipal(request: AwsRequest, notPrincipal: Principal[], simulationParameters: SimulationParameters, allowOrDeny: 'Allow' | 'Deny'): {
    matches: PrincipalMatchResult;
    explains: PrincipalExplain[];
};
/**
 * Check to see if a request matches a principal statement
 *
 * @param request the request to check
 * @param principalStatement the principal statement to check the request against
 * @returns if the request matches the principal statement, and if so, how it matches
 */
export declare function requestMatchesPrincipalStatement(request: AwsRequest, principalStatement: Principal, simulationParameters: SimulationParameters, allowOrDeny: 'Allow' | 'Deny'): PrincipalAnalysis;
/**
 * Get a user ARN from a federated user ARN
 *
 * @param federatedUserArn the federated user ARN
 * @returns the user ARN for the federated user ARN
 */
export declare function userArnFromFederatedUserArn(federatedUserArn: string): string;
/**
 * Check if a request matches the Resource or NotResource elements of a statement.
 *
 * @param request the request to check
 * @param statement the statement to check against
 * @returns true if the request matches the resources in the statement, false otherwise
 */
export declare function requestMatchesStatementPrincipals(request: AwsRequest, statement: Statement, simulationParameters: SimulationParameters): {
    matches: PrincipalMatchResult;
    details: Pick<StatementExplain, 'principals' | 'notPrincipals'>;
    ignoredRoleSessionName?: boolean;
};
export {};
//# sourceMappingURL=principal.d.ts.map