| 1 | import type * as iam from "@distilled.cloud/aws/iam"; |
| 2 | import type * as Effect from "effect/Effect"; |
| 3 | import * as Binding from "../../Binding.ts"; |
| 4 | |
| 5 | /** |
| 6 | * Runtime binding for `iam:SimulatePrincipalPolicy` — evaluate how the |
| 7 | * policies attached to an existing IAM user, group, or role decide a list of |
| 8 | * actions. The "can principal X do Y?" primitive behind access-review |
| 9 | * dashboards and pre-flight permission checks. |
| 10 | * |
| 11 | * The principal (`PolicySourceArn`) is chosen per request — audit tooling |
| 12 | * typically iterates entities discovered at runtime — so the binding takes no |
| 13 | * arguments and grants `iam:SimulatePrincipalPolicy` on `*`. Provide the |
| 14 | * implementation with `Effect.provide(AWS.IAM.SimulatePrincipalPolicyHttp)`. |
| 15 | * |
| 16 | * ### Simulating Policies |
| 17 | * **Example:** Check What a Role May Do |
| 18 | * ```typescript |
| 19 | * // init |
| 20 | * const simulatePrincipalPolicy = yield* IAM.SimulatePrincipalPolicy(); |
| 21 | * |
| 22 | * // runtime |
| 23 | * const { EvaluationResults } = yield* simulatePrincipalPolicy({ |
| 24 | * PolicySourceArn: roleArn, |
| 25 | * ActionNames: ["s3:GetObject", "iam:DeleteRole"], |
| 26 | * }); |
| 27 | * const denied = EvaluationResults?.filter( |
| 28 | * (r) => r.EvalDecision !== "allowed", |
| 29 | * ); |
| 30 | * ``` |
| 31 | * |
| 32 | * @binding |
| 33 | */ |
| 34 | export interface SimulatePrincipalPolicy extends Binding.Service< |
| 35 | SimulatePrincipalPolicy, |
| 36 | "AWS.IAM.SimulatePrincipalPolicy", |
| 37 | () => Effect.Effect< |
| 38 | ( |
| 39 | request: iam.SimulatePrincipalPolicyRequest, |
| 40 | ) => Effect.Effect< |
| 41 | iam.SimulatePolicyResponse, |
| 42 | iam.SimulatePrincipalPolicyError |
| 43 | > |
| 44 | > |
| 45 | > {} |
| 46 | export const SimulatePrincipalPolicy = Binding.Service<SimulatePrincipalPolicy>( |
| 47 | "AWS.IAM.SimulatePrincipalPolicy", |
| 48 | ); |