1import * as iam from "@distilled.cloud/aws/iam";
2import * as Effect from "effect/Effect";
3import { isResolved } from "../../Diff.ts";
4import * as Provider from "../../Provider.ts";
5import { Resource } from "../../Resource.ts";
6import type { Providers } from "../Providers.ts";
7
8export interface AccountAliasProps {
9 /**
10 * The AWS account alias to manage.
11 */
12 accountAlias: string;
13}
14
15export interface AccountAlias extends Resource<
16 "AWS.IAM.AccountAlias",
17 AccountAliasProps,
18 {
19 /** The alias assigned to the AWS account. */
20 accountAlias: string;
21 },
22 never,
23 Providers
24> {}
25
26/**
27 * The singleton IAM account alias for an AWS account.
28 *
29 * `AccountAlias` manages the one account-level alias that customizes the AWS
30 * sign-in URL for the current account.
31 * ### Managing Account Identity
32 * **Example:** Set the Account Alias
33 * ```typescript
34 * const alias = yield* AccountAlias("AccountAlias", {
35 * accountAlias: "my-company-prod",
36 * });
37 * ```
38 *
39 * @resource
40 */
41export const AccountAlias = Resource<AccountAlias>("AWS.IAM.AccountAlias");
42
43const readAccountAlias = Effect.gen(function* () {
44 const response = yield* iam.listAccountAliases({});
45 return response.AccountAliases?.[0];
46});
47
48export const AccountAliasProvider = () =>
49 Provider.succeed(AccountAlias, {
50 stables: ["accountAlias"],
51 diff: Effect.fn(function* ({ olds, news }) {
52 if (!isResolved(news)) return;
53 if (olds.accountAlias !== news.accountAlias) {
54 return { action: "replace" } as const;
55 }
56 }),
57 read: Effect.fn(function* () {
58 const accountAlias = yield* readAccountAlias;
59 if (!accountAlias) {
60 return undefined;
61 }
62 return { accountAlias };
63 }),
64 // Account singleton: an AWS account has at most one alias. Enumerate the
65 // single alias (if set) as a one-element array, or [] when none is set.
66 list: Effect.fn(function* () {
67 const accountAlias = yield* readAccountAlias;
68 return accountAlias ? [{ accountAlias }] : [];
69 }),
70 reconcile: Effect.fn(function* ({ news, session }) {
71 // Observe — the account alias is a singleton; the only way to know
72 // which alias is set is to list and take the first entry.
73 const existing = yield* readAccountAlias;
74
75 // Ensure / Sync — IAM only allows a single alias per account, so
76 // applying the desired alias is just `createAccountAlias`. If a
77 // different alias already exists, replace it by creating the new one
78 // and deleting the old (the API also supports overwriting in a
79 // single call but we keep delete idempotent).
80 if (existing !== news.accountAlias) {
81 yield* iam.createAccountAlias({
82 AccountAlias: news.accountAlias,
83 });
84 if (existing && existing !== news.accountAlias) {
85 yield* iam
86 .deleteAccountAlias({
87 AccountAlias: existing,
88 })
89 .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
90 }
91 }
92
93 yield* session.note(news.accountAlias);
94 return { accountAlias: news.accountAlias };
95 }),
96 delete: Effect.fn(function* ({ output }) {
97 yield* iam
98 .deleteAccountAlias({
99 AccountAlias: output.accountAlias,
100 })
101 .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
102 }),
103 });