feat(aws): add IAM to Cloud Explorer

[thomhurst]

Summary

• add the generic identity Cloud Explorer category and Identity sidebar entry
• implement account-scoped AWS IAM user list, create, delete, and inspect operations through the cloud SPI
• add IAM schema validation, pagination, normalized resource metadata, documentation, and adapter/route coverage

Type of change

• Bug fix (fix:)
• New feature / service UI (feat:)
• Breaking change (feat!: or fix!:)
• Docs / chore

Area

• Frontend (packages/frontend)
• API / Cloud Proxy (packages/api)
• Cloud Explorer adapter / schema
• Build / CI / Docker

Verification

• pnpm lint
• pnpm type-check
• pnpm test — 173 tests passed
• pnpm build
• HTTP smoke check: AWS services reports identity available and /cloud-explorer/aws/identity returns 200
• Tested against AWS IAM via Floci core (:4566)

Checklist

• pnpm lint, pnpm type-check, pnpm test, and pnpm build pass locally
• New or updated tests added where it makes sense (bun test in packages/api)
• No fake/mock data added — unwired states stay empty or show an explicit placeholder
• Commit messages / PR title follow Conventional Commits

Closes #79

[greptile-apps]

Greptile Summary

This PR wires up AWS IAM user management into the multi-cloud Cloud Explorer, following the established schema-driven SPI pattern end-to-end. It adds the identity service catalog entry, a schema with username and path field validation, the AwsIamAdapter with paginated list/get/create/delete, proper typed-error propagation, and the IAM SDK client in the per-account client set.

• Backend: AwsIamAdapter implements all four advertised operations, throws typed errors (ValidationError, NotFoundError, ConflictError) for known failure modes, and lets unhandled AWS SDK errors propagate to the route-level mapAwsSdkError mapper — consistent with every other adapter in the codebase.
• Schema: iamSchema.ts exports a single awsIamSchema() function with a self-consistent username regex ({1,64} length in the pattern itself), separate path validation, and capability declarations that match what the adapter actually implements.
• Frontend: Only a "Create user" label addition and the iam-user type in the resource union were needed; the generic DynamicResourceView handles everything else from the schema.

Confidence Score: 5/5

• Safe to merge. The change is a well-scoped addition of a single adapter that follows the existing multi-cloud SPI pattern without modifying any shared infrastructure.
• All four advertised operations are implemented and tested. Typed errors are thrown for every known failure mode (missing user, conflict on delete, invalid input), and raw SDK errors fall through to the existing route-level mapper. The schema, adapter, registration, and frontend type are consistent with each other and with the rest of the codebase. No regressions to existing adapters are introduced.
• No files require special attention.

Important Files Changed

Filename	Overview
packages/api/src/adapter-aws/AwsIamAdapter.ts	Implements CloudServiceAdapter for AWS IAM users (list, get, create, delete) with proper typed error handling, pagination guard, and client-side search filtering. Previous issues with ConflictError and ValidationError are resolved.
packages/api/src/adapter-aws/AwsIamAdapter.test.ts	Comprehensive unit tests covering all adapter operations including pagination, search, not-found, conflict, validation, and error mapping. All paths are exercised with a fake client.
packages/api/src/cloud-spi/iamSchema.ts	Defines IAM schema with correctly consolidated username pattern (length baked into regex) and separate path validation. Capabilities, columns, and filters follow the SPI contract.
packages/api/src/cloudProxy.ts	AwsIamAdapter is correctly registered with the per-account IAM client. No issues.
packages/api/src/cloud-spi/serviceCatalog.ts	identity service added to SERVICE_CATALOG under Security group with order:5. iconKey 'iam' will fall back to a generic icon if unmapped, which is acceptable.
packages/frontend/src/components/DynamicResourceView.tsx	Only adds a "Create user" label for aws:identity in resourceCreateLabel. No bespoke panel required; the generic DynamicFormRenderer handles the IAM create form correctly.

Sequence Diagram

sequenceDiagram
    participant Browser as Browser (React :4500)
    participant API as Hono API (:4501)
    participant Registry as CloudAdapterRegistry
    participant Adapter as AwsIamAdapter
    participant IAM as AWS IAM SDK (:4566)

    Browser->>API: GET /clouds/aws/identity/schema
    API->>Registry: adapter("aws:identity").schema()
    Registry->>Adapter: schema()
    Adapter-->>Browser: awsIamSchema (fields, columns, capabilities)

    Browser->>API: "GET /clouds/aws/identity/resources?search=alice"
    API->>Registry: "adapter("aws:identity").list({search})"
    Registry->>Adapter: "list({search})"
    loop paginate (max 50 pages)
        Adapter->>IAM: "ListUsersCommand({Marker})"
        IAM-->>Adapter: "{Users[], IsTruncated, Marker}"
    end
    Adapter-->>Browser: CloudResource[] (client-side filtered)

    Browser->>API: "POST /clouds/aws/identity/resources {userName, path}"
    API->>Registry: adapter("aws:identity").create(input)
    Adapter->>Adapter: "validate userName & path"
    Adapter->>IAM: "CreateUserCommand({UserName, Path})"
    IAM-->>Adapter: "{User}"
    Adapter-->>Browser: CloudResource

    Browser->>API: DELETE /clouds/aws/identity/resources/:id
    API->>Registry: adapter("aws:identity").delete(id)
    Adapter->>IAM: "DeleteUserCommand({UserName: id})"
    alt user not found
        IAM-->>Adapter: NoSuchEntityException
        Adapter-->>Browser: 404 NotFoundError
    else user has attached resources
        IAM-->>Adapter: DeleteConflictException
        Adapter-->>Browser: 409 ConflictError (with guidance)
    else success
        IAM-->>Adapter: "{}"
        Adapter-->>Browser: 204
    end

Loading

_{Reviews (10): Last reviewed commit: "chore: merge upstream main" | Re-trigger Greptile}

[hectorvent]

Thanks @thomhurst. This is the only AWS adapter in the repo that actually paginates, and you covered the IsTruncated loop with a real two-page test rather than a claim. Complete registration, honest region: null, route tests included. Strongest wiring of the batch.

Before merge

• CI just started (first-contribution gate); needs green. Merge order vs #153 is ours; if it lands after, identity collapses into a single catalog row, which is the cheap path.
• Smallest real fix worth doing now: delete() on a missing user surfaces as 502. IAM's NoSuchEntityException message doesn't contain "not found", so it dodges the normalizer. You already added errorName dispatch; two more lines map it to 404.

Nits: the IAM-specific DeleteConflictException copy sits in the generic normalizer, better thrown typed from the adapter; a max-pages guard on the ListUsers loop; the username and path rules exist in schema and adapter with nothing keeping them in sync; template Type and Area boxes.

Thanks again!

[thomhurst]

Thanks @hectorvent — all addressed in 1abc1f3:

• delete() on a missing user is now a 404: NoSuchEntityException is matched by errorName rather than message text, so it no longer dodges the normalizer into a 502.
• The IAM-specific delete-conflict copy moved out of the shared normalizer and into the adapter as a typed ResourceConflictError, with ResourceNotFoundError for the above.
• ListUsers pagination now has a page cap so a runtime that always sets IsTruncated cannot spin.
• The user name and path rules are single-sourced from the schema, so the adapter and schema cannot drift.
• Committed the missing @aws-sdk/client-iam bun lockfile entry.

Template Type and Area boxes are filled. Merge order vs #153 is yours — if it lands first I'll collapse identity into a single catalog row.

[hectorvent]

Thanks @thomhurst, this follow-up closes out everything from the last pass. bun.lock now carries the @aws-sdk/client-iam entry (that was the CI failure), NoSuchEntityException surfaces as a proper 404 via a typed error in the adapter, the delete conflict copy moved out of the shared normalizer into the adapter, the ListUsers loop has a page cap, and the user name and path rules are single-sourced from the schema. The merge onto current main also lands identity the new way: one catalog row in the Security group with no frontend nav edits. Nothing left on my list.

One heads up on timing: PR #162 (opened today) also adds an AWS IAM adapter. That collision is on us for not marking #79 as claimed once your PR was open, not on either of you, so I will pick a direction. Your branch being current with main and already through review should make that call straightforward.

CI just needs the workflow runs approved again after the new push; once green this looks ready from my side. Thanks for the fast turnaround!

[hectorvent]

Thank you for the rebases and for typing the empty-create path as a RuntimeError while you were in there; that closes the last bare Error in the adapter. I rebuilt the stack at c52dc26: creating a user returns the ARN and user id, a duplicate is a typed 409, a bad name is a typed 400, and the table and "Create user" button render from the schema. CI is green and the branch is mergeable.

#162 overlaps with this one, and picking between them is mine to do; I will follow up there. No blockers from my side.

[hectorvent]

🎉 This PR is included in version 0.4.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀