Skip to main content
← back to extensions

Aws/iam

@webframp/aws/iamv2026.08.05.1· 1d agoMODELS
01README

Cross-account IAM observation model for role, user, and policy inventory. Factory-pattern discovery fans out across AWS profiles to capture trust policies, access key metadata, permission boundaries, and builds a cross-account trust graph for security analysis.

Produces typed, versioned state queryable via CEL for privilege escalation path analysis, unused permission detection, and external trust mapping.

02Release Notes

2026.08.05.1

Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)

2026.08.02.1

Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)

2026.08.01.1

Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.

2026.07.31.1

Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)

2026.07.29.1

Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).

2026.07.27.1

Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (3 packages)

2026.07.24.1

Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).

03Models1
@webframp/aws/iamv2026.08.05.1aws/iam.ts
fn discover_roles(profiles?: array)
Discover IAM roles across all configured profiles. Captures trust
ArgumentTypeDescription
profiles?arrayOverride: scan only these profiles (default: all configured profiles)
fn discover_users(profiles?: array)
Discover IAM users across all configured profiles. Captures MFA
ArgumentTypeDescription
profiles?arrayOverride: scan only these profiles (default: all configured profiles)
fn discover_policies(profiles?: array)
Discover customer-managed IAM policies across all configured profiles.
ArgumentTypeDescription
profiles?arrayOverride: scan only these profiles (default: all configured profiles)
fn discover_trust_map(profiles?: array)
Build a cross-account trust graph from previously discovered roles.
ArgumentTypeDescription
profiles?arrayOverride: read roles for only these profiles (default: all configured profiles)
fn discover_all(profiles?: array)
Orchestrate full IAM discovery: roles, users, policies, then trust map.
ArgumentTypeDescription
profiles?arrayOverride: scan only these profiles (default: all configured profiles)

Resources

roles(infinite)— IAM roles per account with trust policies and attached permissions
users(infinite)— IAM users per account with MFA status and access key metadata
policies(infinite)— Customer-managed IAM policies per account
trustMap(infinite)— Cross-account trust graph derived from role trust policies
04Previous Versions8
2026.08.02.1

2026.08.02.1

Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)

2026.08.01.1

Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.

2026.07.31.1

Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)

2026.07.29.1

Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).

2026.07.27.1

Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (3 packages)

2026.07.24.1

Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).

2026.08.01.1

2026.08.01.1

Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.

2026.07.31.1

Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)

2026.07.29.1

Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).

2026.07.27.1

Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (3 packages)

2026.07.24.1

Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).

2026.07.29.1

2026.07.29.1

Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).

2026.07.27.1

Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (3 packages)

2026.07.24.1

Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).

2026.07.24.1

2026.07.24.1

Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).

2026.07.21.1

2026.07.21.1

Changed: Bumped AWS SDK dependencies to 3.1091.0 (from 3.1090.0).

Upgrade note: No behavioral changes. Routine dependency maintenance.

2026.07.18.2

2026.07.18.2

Added: An upgrades array entry (no-op) to iam.ts for proper typeVersion tracking on existing instances. No schema or behavior changes.

2026.07.18.1

Changed: Bumped @aws-sdk/client-iam, @aws-sdk/client-sts, and @aws-sdk/credential-providers from 3.1069.0 to 3.1090.0 for dependency freshness. No behavior change.

2026.07.16.1

Fixed: This extension was merged 2026-06-25 (#151) but never actually published — the publish workflow's change-detection missed the manifest version bump in that merge and picked up an unrelated concurrent branch instead. This release is the first real publish; there is no prior published version to compare against.

Added: Cross-account IAM observation model — trust map discovery, access key age tracking, and wildcard/GovCloud/bare-account ARN handling in trust relationships.

2026.07.18.1

2026.07.18.1

Changed: Bumped @aws-sdk/client-iam, @aws-sdk/client-sts, and @aws-sdk/credential-providers from 3.1069.0 to 3.1090.0 for dependency freshness. No behavior change.

2026.07.16.1

Fixed: This extension was merged 2026-06-25 (#151) but never actually published — the publish workflow's change-detection missed the manifest version bump in that merge and picked up an unrelated concurrent branch instead. This release is the first real publish; there is no prior published version to compare against.

Added: Cross-account IAM observation model — trust map discovery, access key age tracking, and wildcard/GovCloud/bare-account ARN handling in trust relationships.

2026.07.16.1

2026.07.16.1

Fixed: This extension was merged 2026-06-25 (#151) but never actually published — the publish workflow's change-detection missed the manifest version bump in that merge and picked up an unrelated concurrent branch instead. This release is the first real publish; there is no prior published version to compare against.

Added: Cross-account IAM observation model — trust map discovery, access key age tracking, and wildcard/GovCloud/bare-account ARN handling in trust relationships.

05Stats
A
100 / 100
Downloads
1
Archive size
263.5 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License declared1/1earned
  • Verified public repository2/2earned
Repository
https://github.com/webframp/swamp-extensions
06Platforms
07Labels
#aws#iam#security#observation