fixes to schema, cleanup

Author: hjaraujof

src/services/iamPolicy/schema.graphql

@@ -8,7 +8,7 @@ type awsIamPolicy implements awsBaseService @key(fields: "id") {
   iamRoles: [awsIamRole] @hasInverse(field: iamAttachedPolicies)
   iamGroups: [awsIamGroup] @hasInverse(field: iamAttachedPolicies)
   iamUsers: [awsIamUser] @hasInverse(field: iamAttachedPolicies)
-  permissionboundaryOf: [awsIamRole] @hasInverse(field: iamPermissionBoundaryPolicy)
+  permissionBoundaryOf: [awsIamRole] @hasInverse(field: iamPermissionBoundaryPolicy)
 }
 
 type awsIamJSONPolicy

src/services/iamRole/data.ts

@@ -9,7 +9,6 @@ import IAM, {
   GetAccountAuthorizationDetailsResponse,
   GetRoleResponse,
   ListAttachedRolePoliciesResponse,
-  ListRolePoliciesResponse,
   ListRolesResponse,
   ListRoleTagsResponse,
   Role,
@@ -44,8 +43,7 @@ export interface RawAwsIamRole extends Omit<Role, 'Tags'> {
   region: string
   Tags?: TagMap
   PermissionsBoundaryArn: string
-  InlinePoliciesName: string[]
-  InlinePoliciesDocuments: string[]
+  InlinePolicies: Array<{ name: string; document: string }>
 }
 
 const roleByRoleName = async (
@@ -103,32 +101,6 @@ const tagsByRoleName = async (
     )
   })
 
-const policiesByRoleName = async (
-  iam: IAM,
-  { RoleName }: Role
-): Promise<{ RoleName: string; Policies: string[] }> =>
-  new Promise(resolve => {
-    iam.listRolePolicies(
-      { RoleName },
-      (err: AWSError, data: ListRolePoliciesResponse) => {
-        if (err) {
-          errorLog.generateAwsErrorLog({
-            functionName: 'iam:listRolePolicies',
-            err,
-          })
-        }
-
-        if (!isEmpty(data)) {
-          const { PolicyNames = [] } = data
-
-          resolve({ RoleName, Policies: PolicyNames })
-        }
-
-        resolve(null)
-      }
-    )
-  })
-
 const managedPoliciesByRoleName = async (
   iam: IAM,
   { RoleName }: Role
@@ -196,7 +168,6 @@ export const listIamRoles = async ({
 }): Promise<RawAwsIamRole[]> =>
   new Promise(resolve => {
     const result: RawAwsIamRole[] = []
-    const policiesByRoleNamePromises = []
     const tagsByRoleNamePromises = []
     const managedPoliciesByRoleNamePromises = []
     const roleByRoleNamePromises: Promise<{ RoleName: string; Role: Role }>[] =
@@ -216,15 +187,13 @@ export const listIamRoles = async ({
 
           roles.map(role => {
             tagsByRoleNamePromises.push(tagsByRoleName(iam, role))
-            policiesByRoleNamePromises.push(policiesByRoleName(iam, role))
             managedPoliciesByRoleNamePromises.push(
               managedPoliciesByRoleName(iam, role)
             )
             roleByRoleNamePromises.push(roleByRoleName(iam, role))
           })
 
           const tags = await Promise.all(tagsByRoleNamePromises)
-          const policies = await Promise.all(policiesByRoleNamePromises)
           const managedPolicies = await Promise.all(
             managedPoliciesByRoleNamePromises
           )
@@ -249,11 +218,6 @@ export const listIamRoles = async ({
                   RoleLastUsed: detailedRoles?.find(
                     r => r?.RoleName === RoleName
                   )?.Role.RoleLastUsed,
-                  InlinePoliciesName:
-                    policies
-                      ?.filter(p => p?.RoleName === RoleName)
-                      .map(p => p.Policies)
-                      .reduce((current, acc) => [...acc, ...current], []) || [],
                   ManagedPolicies:
                     managedPolicies
                       ?.filter(p => p?.RoleName === RoleName)
@@ -262,9 +226,12 @@ export const listIamRoles = async ({
                   Tags: tags.find(t => t?.RoleName === RoleName)?.Tags || {},
                   PermissionsBoundaryArn:
                     PermissionsBoundary.PermissionsBoundaryArn,
-                  InlinePoliciesDocuments: roleAuthorizationDetails
+                  InlinePolicies: roleAuthorizationDetails
                     .find(rAD => rAD.RoleName === RoleName)
-                    .RolePolicyList.map(rPl => rPl.PolicyDocument),
+                    .RolePolicyList.map(rPl => ({
+                      name: rPl.PolicyName,
+                      document: rPl.PolicyDocument,
+                    })),
                 }
               }
             )

src/services/iamRole/format.ts

@@ -24,8 +24,7 @@ export default ({
     RoleLastUsed,
     AssumeRolePolicyDocument: assumeRolePolicy = '',
     MaxSessionDuration: maxSessionDuration = 0,
-    InlinePoliciesName: inlinePolicies = [],
-    InlinePoliciesDocuments: inlineFormattedPolicies,
+    InlinePolicies: inlinePolicies = [],
     Tags: tags = {},
   } = rawData
 
@@ -44,10 +43,12 @@ export default ({
     rawPolicy: assumeRolePolicy,
     assumeRolePolicy: formatIamJsonPolicy(assumeRolePolicy),
     maxSessionDuration,
-    inlinePolicies,
-    inlineFormattedPolicies: inlineFormattedPolicies.map(p =>
-      formatIamJsonPolicy(p)
-    ),
+    inlinePolicies: inlinePolicies.map(
+      ({ name: inlinePolicyName, document: inlinePolicyDocument }) => ({
+        name: inlinePolicyName,
+        document: formatIamJsonPolicy(inlinePolicyDocument),
+      })
+    ) ?? [],
     tags: roleTags,
   }
   return role

src/services/iamRole/schema.graphql

@@ -1,3 +1,8 @@
+type awsIamRoleInlinePolicy {
+  name: String @search(by: [hash, regexp])
+  document: awsIamJSONPolicy
+}
+
 type awsIamRole implements awsBaseService @key(fields: "id") {
   name: String @search(by: [hash, regexp])
   path: String @search(by: [hash, regexp])
@@ -8,9 +13,7 @@ type awsIamRole implements awsBaseService @key(fields: "id") {
   lastUsedDate: DateTime @search(by: [day])
   maxSessionDuration: Int @search
   tags: [awsRawTag]
-  inlinePolicies: [String]
-  rawInlinePolicies: [String] @search(by: [hash, regexp])
-  inlineFormattedPolicies: [awsIamJSONPolicy]
+  inlinePolicies: [awsIamRoleInlinePolicy]
   cloudFormationStack: [awsCloudFormationStack] @hasInverse(field: iamRole)
   codebuilds: [awsCodebuild] @hasInverse(field: iamRoles)
   configurationRecorder: [awsConfigurationRecorder] @hasInverse(field: iamRole)
@@ -22,7 +25,7 @@ type awsIamRole implements awsBaseService @key(fields: "id") {
   glueJobs: [awsGlueJob] @hasInverse(field: iamRole)
   guardDutyDetectors: [awsGuardDutyDetector] @hasInverse(field: iamRole)
   iamAttachedPolicies: [awsIamPolicy] @hasInverse(field: iamRoles)
-  iamPermissionBoundaryPolicy: [awsIamPolicy] @hasInverse(field: permissionboundaryOf)
+  iamPermissionBoundaryPolicy: [awsIamPolicy] @hasInverse(field: permissionBoundaryOf)
   iamInstanceProfiles: [awsIamInstanceProfile] @hasInverse(field: iamRole)
   managedAirflows: [awsManagedAirflow] @hasInverse(field: iamRoles)
   sageMakerNotebookInstances: [awsSageMakerNotebookInstance]

src/types/generated.ts

@@ -3150,7 +3150,7 @@ export type AwsIamPolicy = AwsBaseService & {
   iamUsers?: Maybe<Array<Maybe<AwsIamUser>>>;
   name?: Maybe<Scalars['String']>;
   path?: Maybe<Scalars['String']>;
-  permissionboundaryOf?: Maybe<Array<Maybe<AwsIamRole>>>;
+  permissionBoundaryOf?: Maybe<Array<Maybe<AwsIamRole>>>;
   policyContent?: Maybe<AwsIamJsonPolicy>;
   rawPolicy?: Maybe<Scalars['String']>;
   tags?: Maybe<Array<Maybe<AwsRawTag>>>;
@@ -3184,16 +3184,14 @@ export type AwsIamRole = AwsBaseService & {
   iamAttachedPolicies?: Maybe<Array<Maybe<AwsIamPolicy>>>;
   iamInstanceProfiles?: Maybe<Array<Maybe<AwsIamInstanceProfile>>>;
   iamPermissionBoundaryPolicy?: Maybe<Array<Maybe<AwsIamPolicy>>>;
-  inlineFormattedPolicies?: Maybe<Array<Maybe<AwsIamJsonPolicy>>>;
-  inlinePolicies?: Maybe<Array<Maybe<Scalars['String']>>>;
+  inlinePolicies?: Maybe<Array<Maybe<AwsIamRoleInlinePolicy>>>;
   kinesisFirehose?: Maybe<Array<Maybe<AwsKinesisFirehose>>>;
   lambda?: Maybe<Array<Maybe<AwsLambda>>>;
   lastUsedDate?: Maybe<Scalars['DateTime']>;
   managedAirflows?: Maybe<Array<Maybe<AwsManagedAirflow>>>;
   maxSessionDuration?: Maybe<Scalars['Int']>;
   name?: Maybe<Scalars['String']>;
   path?: Maybe<Scalars['String']>;
-  rawInlinePolicies?: Maybe<Array<Maybe<Scalars['String']>>>;
   rawPolicy?: Maybe<Scalars['String']>;
   rdsCluster?: Maybe<Array<Maybe<AwsRdsCluster>>>;
   rdsDbInstance?: Maybe<Array<Maybe<AwsRdsDbInstance>>>;
@@ -3203,6 +3201,11 @@ export type AwsIamRole = AwsBaseService & {
   tags?: Maybe<Array<Maybe<AwsRawTag>>>;
 };
 
+export type AwsIamRoleInlinePolicy = {
+  document?: Maybe<AwsIamJsonPolicy>;
+  name?: Maybe<Scalars['String']>;
+};
+
 export type AwsIamSamlProvider = AwsOptionalService & {
   awsCognitoIdentityPool?: Maybe<Array<Maybe<AwsCognitoIdentityPool>>>;
   createdDate?: Maybe<Scalars['String']>;