cdk-iam-floyd
Version:
AWS IAM policy statement generator with fluent interface for AWS CDK
80 lines • 9.54 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.SsoOauth = void 0;
const shared_1 = require("../../shared");
/**
* Statement provider for service [sso-oauth](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycenteroidcservice.html).
*
* @param sid [SID](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html) of the statement
*/
class SsoOauth extends shared_1.PolicyStatement {
/**
* Grants permission to create and return OAuth 2.0 access tokens and refresh tokens for authorized client applications. These tokens might contain defined scopes that specify permissions such as `read:profile` or `write:data`
*
* Access Level: Write
*
* Dependent actions:
* - kms:Decrypt
*
* https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/API_CreateTokenWithIAM.html
*/
toCreateTokenWithIAM() {
return this.to('CreateTokenWithIAM');
}
/**
* Grants permission to validate and retrieve information about active OAuth 2.0 access tokens and refresh tokens, including their associated scopes and permissions. This permission is used only by AWS managed applications and is not documented in the IAM Identity Center OIDC API Reference
*
* Access Level: Write
*
* Dependent actions:
* - kms:Decrypt
*
* https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-resource-based-policies.html
*/
toIntrospectTokenWithIAM() {
return this.to('IntrospectTokenWithIAM');
}
/**
* Grants permission to revoke OAuth 2.0 access tokens and refresh tokens, invalidating them before their normal expiration. This permission is used only by AWS managed applications and is not documented in the IAM Identity Center OIDC API Reference
*
* Access Level: Write
*
* Dependent actions:
* - kms:Decrypt
*
* https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-resource-based-policies.html
*/
toRevokeTokenWithIAM() {
return this.to('RevokeTokenWithIAM');
}
/**
* Adds a resource of type Application to the statement
*
* https://docs.aws.amazon.com/singlesignon/latest/userguide/get-started-enable-identity-center.html
*
* @param instanceId - Identifier for the instanceId.
* @param applicationId - Identifier for the applicationId.
* @param accountId - Account of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's account.
* @param partition - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to `aws`, unless using the CDK, where the default is the current Stack's partition.
*/
onApplication(instanceId, applicationId, accountId, partition) {
return this.on(`arn:${partition ?? this.defaultPartition}:sso::${accountId ?? this.defaultAccount}:application/${instanceId}/${applicationId}`);
}
/**
* Statement provider for service [sso-oauth](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycenteroidcservice.html).
*
*/
constructor(props) {
super(props);
this.servicePrefix = 'sso-oauth';
this.accessLevelList = {
Write: [
'CreateTokenWithIAM',
'IntrospectTokenWithIAM',
'RevokeTokenWithIAM'
]
};
}
}
exports.SsoOauth = SsoOauth;
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWFtaWRlbnRpdHljZW50ZXJvaWRjc2VydmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImlhbWlkZW50aXR5Y2VudGVyb2lkY3NlcnZpY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQ0EseUNBQStDO0FBRy9DOzs7O0dBSUc7QUFDSCxNQUFhLFFBQVMsU0FBUSx3QkFBZTtJQUczQzs7Ozs7Ozs7O09BU0c7SUFDSSxvQkFBb0I7UUFDekIsT0FBTyxJQUFJLENBQUMsRUFBRSxDQUFDLG9CQUFvQixDQUFDLENBQUM7SUFDdkMsQ0FBQztJQUVEOzs7Ozs7Ozs7T0FTRztJQUNJLHdCQUF3QjtRQUM3QixPQUFPLElBQUksQ0FBQyxFQUFFLENBQUMsd0JBQXdCLENBQUMsQ0FBQztJQUMzQyxDQUFDO0lBRUQ7Ozs7Ozs7OztPQVNHO0lBQ0ksb0JBQW9CO1FBQ3pCLE9BQU8sSUFBSSxDQUFDLEVBQUUsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3ZDLENBQUM7SUFVRDs7Ozs7Ozs7O09BU0c7SUFDSSxhQUFhLENBQUMsVUFBa0IsRUFBRSxhQUFxQixFQUFFLFNBQWtCLEVBQUUsU0FBa0I7UUFDcEcsT0FBTyxJQUFJLENBQUMsRUFBRSxDQUFDLE9BQVEsU0FBUyxJQUFJLElBQUksQ0FBQyxnQkFBaUIsU0FBVSxTQUFTLElBQUksSUFBSSxDQUFDLGNBQWUsZ0JBQWlCLFVBQVcsSUFBSyxhQUFjLEVBQUUsQ0FBQyxDQUFDO0lBQzFKLENBQUM7SUFFRDs7O09BR0c7SUFDSCxZQUFZLEtBQWdDO1FBQzFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztRQXZFUixrQkFBYSxHQUFHLFdBQVcsQ0FBQztRQTRDekIsb0JBQWUsR0FBb0I7WUFDM0MsS0FBSyxFQUFFO2dCQUNMLG9CQUFvQjtnQkFDcEIsd0JBQXdCO2dCQUN4QixvQkFBb0I7YUFDckI7U0FDRixDQUFDO0lBc0JGLENBQUM7Q0FDRjtBQTFFRCw0QkEwRUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBBY2Nlc3NMZXZlbExpc3QgfSBmcm9tICcuLi8uLi9zaGFyZWQvYWNjZXNzLWxldmVsJztcbmltcG9ydCB7IFBvbGljeVN0YXRlbWVudCB9IGZyb20gJy4uLy4uL3NoYXJlZCc7XG5pbXBvcnQgeyBhd3NfaWFtIGFzIGlhbSB9IGZyb20gXCJhd3MtY2RrLWxpYlwiO1xuXG4vKipcbiAqIFN0YXRlbWVudCBwcm92aWRlciBmb3Igc2VydmljZSBbc3NvLW9hdXRoXShodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vc2VydmljZS1hdXRob3JpemF0aW9uL2xhdGVzdC9yZWZlcmVuY2UvbGlzdF9hd3NpYW1pZGVudGl0eWNlbnRlcm9pZGNzZXJ2aWNlLmh0bWwpLlxuICpcbiAqIEBwYXJhbSBzaWQgW1NJRF0oaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL0lBTS9sYXRlc3QvVXNlckd1aWRlL3JlZmVyZW5jZV9wb2xpY2llc19lbGVtZW50c19zaWQuaHRtbCkgb2YgdGhlIHN0YXRlbWVudFxuICovXG5leHBvcnQgY2xhc3MgU3NvT2F1dGggZXh0ZW5kcyBQb2xpY3lTdGF0ZW1lbnQge1xuICBwdWJsaWMgc2VydmljZVByZWZpeCA9ICdzc28tb2F1dGgnO1xuXG4gIC8qKlxuICAgKiBHcmFudHMgcGVybWlzc2lvbiB0byBjcmVhdGUgYW5kIHJldHVybiBPQXV0aCAyLjAgYWNjZXNzIHRva2VucyBhbmQgcmVmcmVzaCB0b2tlbnMgZm9yIGF1dGhvcml6ZWQgY2xpZW50IGFwcGxpY2F0aW9ucy4gVGhlc2UgdG9rZW5zIG1pZ2h0IGNvbnRhaW4gZGVmaW5lZCBzY29wZXMgdGhhdCBzcGVjaWZ5IHBlcm1pc3Npb25zIHN1Y2ggYXMgYHJlYWQ6cHJvZmlsZWAgb3IgYHdyaXRlOmRhdGFgXG4gICAqXG4gICAqIEFjY2VzcyBMZXZlbDogV3JpdGVcbiAgICpcbiAgICogRGVwZW5kZW50IGFjdGlvbnM6XG4gICAqIC0ga21zOkRlY3J5cHRcbiAgICpcbiAgICogaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL3NpbmdsZXNpZ25vbi9sYXRlc3QvT0lEQ0FQSVJlZmVyZW5jZS9BUElfQ3JlYXRlVG9rZW5XaXRoSUFNLmh0bWxcbiAgICovXG4gIHB1YmxpYyB0b0NyZWF0ZVRva2VuV2l0aElBTSgpIHtcbiAgICByZXR1cm4gdGhpcy50bygnQ3JlYXRlVG9rZW5XaXRoSUFNJyk7XG4gIH1cblxuICAvKipcbiAgICogR3JhbnRzIHBlcm1pc3Npb24gdG8gdmFsaWRhdGUgYW5kIHJldHJpZXZlIGluZm9ybWF0aW9uIGFib3V0IGFjdGl2ZSBPQXV0aCAyLjAgYWNjZXNzIHRva2VucyBhbmQgcmVmcmVzaCB0b2tlbnMsIGluY2x1ZGluZyB0aGVpciBhc3NvY2lhdGVkIHNjb3BlcyBhbmQgcGVybWlzc2lvbnMuIFRoaXMgcGVybWlzc2lvbiBpcyB1c2VkIG9ubHkgYnkgQVdTIG1hbmFnZWQgYXBwbGljYXRpb25zIGFuZCBpcyBub3QgZG9jdW1lbnRlZCBpbiB0aGUgSUFNIElkZW50aXR5IENlbnRlciBPSURDIEFQSSBSZWZlcmVuY2VcbiAgICpcbiAgICogQWNjZXNzIExldmVsOiBXcml0ZVxuICAgKlxuICAgKiBEZXBlbmRlbnQgYWN0aW9uczpcbiAgICogLSBrbXM6RGVjcnlwdFxuICAgKlxuICAgKiBodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vc2luZ2xlc2lnbm9uL2xhdGVzdC91c2VyZ3VpZGUvaWFtLWF1dGgtYWNjZXNzLXVzaW5nLXJlc291cmNlLWJhc2VkLXBvbGljaWVzLmh0bWxcbiAgICovXG4gIHB1YmxpYyB0b0ludHJvc3BlY3RUb2tlbldpdGhJQU0oKSB7XG4gICAgcmV0dXJuIHRoaXMudG8oJ0ludHJvc3BlY3RUb2tlbldpdGhJQU0nKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBHcmFudHMgcGVybWlzc2lvbiB0byByZXZva2UgT0F1dGggMi4wIGFjY2VzcyB0b2tlbnMgYW5kIHJlZnJlc2ggdG9rZW5zLCBpbnZhbGlkYXRpbmcgdGhlbSBiZWZvcmUgdGhlaXIgbm9ybWFsIGV4cGlyYXRpb24uIFRoaXMgcGVybWlzc2lvbiBpcyB1c2VkIG9ubHkgYnkgQVdTIG1hbmFnZWQgYXBwbGljYXRpb25zIGFuZCBpcyBub3QgZG9jdW1lbnRlZCBpbiB0aGUgSUFNIElkZW50aXR5IENlbnRlciBPSURDIEFQSSBSZWZlcmVuY2VcbiAgICpcbiAgICogQWNjZXNzIExldmVsOiBXcml0ZVxuICAgKlxuICAgKiBEZXBlbmRlbnQgYWN0aW9uczpcbiAgICogLSBrbXM6RGVjcnlwdFxuICAgKlxuICAgKiBodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vc2luZ2xlc2lnbm9uL2xhdGVzdC91c2VyZ3VpZGUvaWFtLWF1dGgtYWNjZXNzLXVzaW5nLXJlc291cmNlLWJhc2VkLXBvbGljaWVzLmh0bWxcbiAgICovXG4gIHB1YmxpYyB0b1Jldm9rZVRva2VuV2l0aElBTSgpIHtcbiAgICByZXR1cm4gdGhpcy50bygnUmV2b2tlVG9rZW5XaXRoSUFNJyk7XG4gIH1cblxuICBwcm90ZWN0ZWQgYWNjZXNzTGV2ZWxMaXN0OiBBY2Nlc3NMZXZlbExpc3QgPSB7XG4gICAgV3JpdGU6IFtcbiAgICAgICdDcmVhdGVUb2tlbldpdGhJQU0nLFxuICAgICAgJ0ludHJvc3BlY3RUb2tlbldpdGhJQU0nLFxuICAgICAgJ1Jldm9rZVRva2VuV2l0aElBTSdcbiAgICBdXG4gIH07XG5cbiAgLyoqXG4gICAqIEFkZHMgYSByZXNvdXJjZSBvZiB0eXBlIEFwcGxpY2F0aW9uIHRvIHRoZSBzdGF0ZW1lbnRcbiAgICpcbiAgICogaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL3NpbmdsZXNpZ25vbi9sYXRlc3QvdXNlcmd1aWRlL2dldC1zdGFydGVkLWVuYWJsZS1pZGVudGl0eS1jZW50ZXIuaHRtbFxuICAgKlxuICAgKiBAcGFyYW0gaW5zdGFuY2VJZCAtIElkZW50aWZpZXIgZm9yIHRoZSBpbnN0YW5jZUlkLlxuICAgKiBAcGFyYW0gYXBwbGljYXRpb25JZCAtIElkZW50aWZpZXIgZm9yIHRoZSBhcHBsaWNhdGlvbklkLlxuICAgKiBAcGFyYW0gYWNjb3VudElkIC0gQWNjb3VudCBvZiB0aGUgcmVzb3VyY2U7IGRlZmF1bHRzIHRvIGAqYCwgdW5sZXNzIHVzaW5nIHRoZSBDREssIHdoZXJlIHRoZSBkZWZhdWx0IGlzIHRoZSBjdXJyZW50IFN0YWNrJ3MgYWNjb3VudC5cbiAgICogQHBhcmFtIHBhcnRpdGlvbiAtIFBhcnRpdGlvbiBvZiB0aGUgQVdTIGFjY291bnQgW2F3cywgYXdzLWNuLCBhd3MtdXMtZ292XTsgZGVmYXVsdHMgdG8gYGF3c2AsIHVubGVzcyB1c2luZyB0aGUgQ0RLLCB3aGVyZSB0aGUgZGVmYXVsdCBpcyB0aGUgY3VycmVudCBTdGFjaydzIHBhcnRpdGlvbi5cbiAgICovXG4gIHB1YmxpYyBvbkFwcGxpY2F0aW9uKGluc3RhbmNlSWQ6IHN0cmluZywgYXBwbGljYXRpb25JZDogc3RyaW5nLCBhY2NvdW50SWQ/OiBzdHJpbmcsIHBhcnRpdGlvbj86IHN0cmluZykge1xuICAgIHJldHVybiB0aGlzLm9uKGBhcm46JHsgcGFydGl0aW9uID8/IHRoaXMuZGVmYXVsdFBhcnRpdGlvbiB9OnNzbzo6JHsgYWNjb3VudElkID8/IHRoaXMuZGVmYXVsdEFjY291bnQgfTphcHBsaWNhdGlvbi8keyBpbnN0YW5jZUlkIH0vJHsgYXBwbGljYXRpb25JZCB9YCk7XG4gIH1cblxuICAvKipcbiAgICogU3RhdGVtZW50IHByb3ZpZGVyIGZvciBzZXJ2aWNlIFtzc28tb2F1dGhdKGh0dHBzOi8vZG9jcy5hd3MuYW1hem9uLmNvbS9zZXJ2aWNlLWF1dGhvcml6YXRpb24vbGF0ZXN0L3JlZmVyZW5jZS9saXN0X2F3c2lhbWlkZW50aXR5Y2VudGVyb2lkY3NlcnZpY2UuaHRtbCkuXG4gICAqXG4gICAqL1xuICBjb25zdHJ1Y3Rvcihwcm9wcz86IGlhbS5Qb2xpY3lTdGF0ZW1lbnRQcm9wcykge1xuICAgIHN1cGVyKHByb3BzKTtcbiAgfVxufVxuIl19