eval

type ActionCatalog ¶

type ActionCatalog struct {
	// contains filtered or unexported fields
}

ActionCatalog expands IAM action patterns against the set of known AWS actions. It ports awshound/core/evaluation/iam_policy/catalog.py's ActionCatalog: principal-agnostic data used to expand wildcard actions ("s3:*", "iam:Get*", "*") and the NotAction complement.

The catalog is read-only after construction and safe for concurrent use.

func LoadBundled() (*ActionCatalog, error)

func NewActionCatalog(actionsByService map[string]map[string]string) *ActionCatalog

func (c *ActionCatalog) AllActions() []string

func (c *ActionCatalog) Contains(action string) bool

func (c *ActionCatalog) ExpandPattern(pattern string) []string

type ActionSet ¶

type ActionSet map[string]struct{}

ActionSet is an unordered set of IAM action strings — the Go equivalent of the frozenset[str] the Python engine bundles into each Grant. Set algebra (union/intersection/difference), used when the engine resolves complement grants and applies ceilings, belongs with the engine port, not here.

func NewActionSet(actions ...string) ActionSet

type Bias ¶

type Bias int

Bias selects attacker- or defender-favorable resolution of conditional bits.

const (
	// AttackerBias keeps UNKNOWN allows (as conditional) and drops UNKNOWN denies.
	AttackerBias Bias = iota
	// DefenderBias drops UNKNOWN allows and keeps UNKNOWN denies (as blocking).
	DefenderBias
)

type BiasOutcome ¶

type BiasOutcome int

BiasOutcome is what to do with a statement after its Condition has resolved. Ported from bias.py Outcome (renamed to avoid confusion with PermissionOutcome in types.go).

const (
	// BiasDiscard drops the statement (an Allow that resolved FALSE, or any
	// non-TRUE Deny).
	BiasDiscard BiasOutcome = iota
	// BiasRetainClean keeps the statement unconditionally (its condition
	// resolved TRUE).
	BiasRetainClean
	// BiasRetainConditional keeps an Allow whose condition resolved UNKNOWN as a
	// conditional grant.
	BiasRetainConditional
)

func ApplyConditionBias(effect Effect, resolution Resolution) BiasOutcome

type CompiledPolicy ¶

type CompiledPolicy struct {
	Grants []Grant
}

CompiledPolicy is a single policy document compiled to bundled grants (catalog-expanded). Ported from iam_policy/model.py CompiledPolicy.

type Condition ¶

type Condition map[string]map[string][]string

Condition is a policy Condition block in AWS's canonical three-level form: operator -> condition key -> values. A single value is normalized to a one-element slice, and a non-string scalar value (a JSON bool or number, both of which AWS accepts) is coerced to its textual form. This mirrors the shape produced by the Python engine's normalize_condition.

func (c *Condition) UnmarshalJSON(data []byte) error

type ContextBuilder ¶

type ContextBuilder func(principalArn, action, resourceArn string) *RequestContext

ContextBuilder builds the RequestContext for a (principal, action, resource) triple — the seam onto store.get_policy_variable_context, which the Python resource evaluators call to resolve policy variables in Resource patterns and condition keys. A nil ContextBuilder (or one that returns nil) yields a blank context in which every key is UNKNOWN, matching the Python None-context path under attacker-favorable bias.

type ContextFactory ¶

type ContextFactory func() *RequestContext

ContextFactory lazily builds the RequestContext for a resolution. Ported from statement_resolution.py's ContextFactory. It is invoked only when at least one matched statement has a Condition, keeping the unconditional hot path free of the (expensive) context build. A nil factory is treated as the Python default (a blank context), which under attacker bias yields allowed=true with the full condition residual retained.

type Decision ¶

type Decision struct{ Allowed, Conditional *roaring.Bitmap }

Decision is a resolved authorization result: the Allowed set and the subset of it that is conditional.

func Compose(identity, resource Decision, class ResourceClass, sameAcct *roaring.Bitmap) Decision

func (d Decision) Ceiling(allow *roaring.Bitmap) Decision

type DirectConstraintEvaluator ¶

type DirectConstraintEvaluator interface {
	CheckDirectGrantConstraints(principalArn, action, resourceArn string, ctx *RequestContext) *PermissionCheckResult
	CheckDirectGrantConstraintsDenyOnly(principalArn, action, resourceArn string, ctx *RequestContext) *PermissionCheckResult
}

DirectConstraintEvaluator applies identity-side explicit denies, permission boundaries, and organization guardrails after a resource policy supplied the Allow.

type Effect ¶

type Effect string

Effect is a policy statement's effect. Ported from iam_policy/model.py Effect; the string values match the raw "Effect" field of a policy statement.

const (
	EffectAllow Effect = "Allow"
	EffectDeny  Effect = "Deny"
)

type EffectivePermissions ¶

type EffectivePermissions struct {
	AllowByAction         []*EffectiveStatement
	DenyByAction          []*EffectiveStatement
	IdentityAllowByAction []*EffectiveStatement
	BoundaryAllowByAction []*EffectiveStatement
	ScpAllowByAction      []*EffectiveStatement
	RcpAllowByAction      []*EffectiveStatement
	HasBoundary           bool
	HasSCP                bool
	HasRCP                bool
	ScpAllowPermitsAll    bool
	RcpAllowPermitsAll    bool
	// IdentityActionScope is the de-duplicated finite action selectors from the
	// identity policy. Complement denies consult it for the original implicit-vs-
	// explicit deny classification without retaining every resource grant.
	IdentityActionScope []ActionSet
}

EffectivePermissions is a principal's compact effective permission set. The field names identify the represented layer; each holds its logical statements once and compression builds action views lazily.

AllowByAction and DenyByAction are the final, ceiling-baked indexes the query layer resolves. The remaining indexes are kept separately so the deny cause is recoverable at query time without a second evaluation pass: IdentityAllowByAction is what the identity policies alone granted (pre-ceiling), and the guardrail indexes are each guardrail's own permitted set (boundary as-is; SCP/RCP intersected across their attach levels). When a query is denied, comparing these tells a boundary/SCP/RCP clip apart from an implicit deny.

HasBoundary/HasSCP/HasRCP record which guardrails were actually applied, so an absent guardrail (empty permitted set) is not mistaken for one that blocks everything. ScpAllowPermitsAll/RcpAllowPermitsAll flag a guardrail whose own permitted set is every action (e.g. only FullAWSAccess at every level), carried as a flag instead of a ~20k-entry index; deny-cause then treats it as covering any action without consulting the (intentionally empty) index.

func NewEffectivePermissions() *EffectivePermissions

type EffectiveStatement ¶

type EffectiveStatement struct {
	Actions     ActionSet
	Resource    *string
	NotResource *string
	Condition   Condition
	Source      string
	// Complement means Actions is the exclusion set: the statement applies to
	// every catalog action except those entries. Keeping this symbolic through
	// compression avoids expanding Action:"*" into one cached statement per AWS
	// action for every principal.
	Complement bool
	// IdentityScoped limits a complement deny to actions named by at least one
	// identity allow. The query layer tests its already-compact identity index,
	// avoiding both a materialized union and a retained per-grant scope slice.
	IdentityScoped bool
}

EffectiveStatement is a bundled statement in a principal's effective permissions (pattern-based). Ported from iam_policy/model.py EffectiveStatement. Its Actions set stays attached so compressed permissions can build only the action views the graph actually queries.

type Factor ¶

type Factor struct{ Allow, CondAllow, Deny, CondDeny *roaring.Bitmap }

Factor is a tri-state authorization result over one coordinate space (dense int ids — principals or resources), carried as four roaring bit-planes.

func (f Factor) Resolve(b Bias) Decision

attacker: allowed = (allow ∨ condAllow) ANDNOT deny
defender: allowed =  allow            ANDNOT (deny ∨ condDeny)

type Grant ¶

type Grant struct {
	Actions     ActionSet
	Resource    *string
	NotResource *string
	Condition   Condition
	Source      string
	Effect      Effect
	Complement  bool
}

Grant is one bundled (action-set, resource, condition, source) unit from a compiled policy. Ported from iam_policy/model.py Grant.

Complement flips the meaning of Actions to exclusion: the grant then applies to every action EXCEPT those in Actions. It is the symbolic form for Action:"*" (complement of the empty set) and NotAction:[E] (complement of E), so the ~20k-action catalog is never materialized in a compiled grant. The engine keeps complements symbolic through lazy action lookup, so concrete indexes stay small. Complement=false is the ordinary "exactly these actions" grant.

Resource and NotResource are nil when the statement omitted them (the Python None); a non-nil pointer holds the glob pattern (which may itself be "*"). AWS treats Resource and NotResource as mutually exclusive within a statement. Condition is nil when the statement had none; otherwise it is the normalized operator->key->values block, which must hold in addition to the action and resource matching.

type IamPolicyEngine ¶

type IamPolicyEngine struct {
	// contains filtered or unexported fields
}

IamPolicyEngine compiles IAM policy documents into bundled grants and combines a principal's identity policies, permissions boundary, SCPs, and RCPs into queryable effective permissions. Ported from awshound/core/evaluation/iam_policy/engine.py IamPolicyEngine.

It is independent of the rest of AWSHound and depends only on the action catalog. The catalog is read-only after construction, so an IamPolicyEngine is safe for concurrent use.

func NewIamPolicyEngine(catalog *ActionCatalog) *IamPolicyEngine

func (e *IamPolicyEngine) Combine(identity, boundary *CompiledPolicy, scpLevels, rcpLevels [][]*CompiledPolicy) *EffectivePermissions

func (e *IamPolicyEngine) Compile(doc *Policy, source string) *CompiledPolicy

type IdentityEvaluator ¶

type IdentityEvaluator interface {
	CanPerformAction(principalArn, action, resourceArn string) PermissionCheckResult
}

IdentityEvaluator is the identity-policy side the S3 and Lambda resource evaluators compose with. It is the single method the Python evaluators need from their `iam_evaluator: PolicyEvaluator`: whether a principal's identity policies (with permissions boundary, SCP, and RCP ceilings already applied) allow an action on a resource.

The identity kernel's *PolicyEvaluator does NOT satisfy this interface directly: its CanPerformAction carries an extra *RequestContext argument and returns a *PermissionCheckResult. Callers adapt it with IdentityFunc — a closure that supplies the context and dereferences the result — as internal/build/edges does (its iamIdentity helper) when wiring the S3 and Lambda evaluators.

type IdentityFunc ¶

type IdentityFunc func(principalArn, action, resourceArn string) PermissionCheckResult

IdentityFunc adapts a plain function to the IdentityEvaluator interface, so a bound method whose signature does not exactly match (or a test stub) can be supplied without a wrapper type.

func (f IdentityFunc) CanPerformAction(principalArn, action, resourceArn string) PermissionCheckResult

type LambdaAccessCheckResult ¶

type LambdaAccessCheckResult struct {
	Allowed               bool
	IAMAllowed            bool
	ResourcePolicyAllowed bool
	Denied                bool
	DenySource            string
	AllowSources          []string
	Conditions            []map[string]any
	HasConditions         bool
}

LambdaAccessCheckResult is the outcome of a Lambda access evaluation across IAM and the function resource policy. Ported field-for-field from lambda_resource_policy_evaluator.LambdaAccessCheckResult.

type LambdaEvaluator ¶

type LambdaEvaluator struct {
	// contains filtered or unexported fields
}

LambdaEvaluator evaluates Lambda access across IAM policies and function resource policies. Ported from lambda_resource_policy_evaluator.LambdaResourcePolicyEvaluator.

It is read-only after construction and, provided the IdentityEvaluator and ContextBuilder it holds are safe for concurrent use, is safe for concurrent queries.

func NewLambdaEvaluator(
	identity IdentityEvaluator,
	functionResourcePolicies map[string]*Policy,
	contextBuilder ContextBuilder,
	constraints ...DirectConstraintEvaluator,
) *LambdaEvaluator

func (e *LambdaEvaluator) EvaluateLambdaResourcePolicy(principalArn, functionArn string) LambdaAccessCheckResult

type MatchedStatement ¶

type MatchedStatement struct {
	Condition Condition
	Source    string
}

MatchedStatement is a policy statement already matched to the (action, resource) under evaluation, carrying just the condition and audit source the arbiter needs. Ported from statement_resolution.py MatchedStatement.

Condition is nil for an unconditional statement. Source is the audit label (an ARN, or e.g. "trust/0"). The Python fast paths duck-type on Statement instances to avoid a wrapper allocation; the Go engine instead builds a slice of these small value structs, which is a single backing-array allocation.

type PermissionCheckResult ¶

type PermissionCheckResult struct {
	Allowed        bool
	Denied         bool
	Conditions     []map[string]any
	AllowSources   []string
	DenySources    []string
	Outcome        PermissionOutcome
	BlockingSource string
}

PermissionCheckResult is the result of checking whether a principal can perform an action on a resource. Ported from core/models/types.py.

Allowed and Denied keep their exact prior meaning; Outcome is additive attack-path enrichment. A zero-value Outcome ("") should be read as OutcomeImplicitDeny, the Python dataclass default. BlockingSource is the ARN of the policy/guardrail responsible for a deny outcome (the explicit-deny source, or the blocking boundary/SCP/RCP), or "" when not applicable (the Python None).

type PermissionOutcome ¶

type PermissionOutcome string

PermissionOutcome explains why a permission check resolved the way it did. Ported from core/models/types.py PermissionOutcome (a StrEnum).

AWS produces semantically distinct "no" outcomes that matter for attack-path analysis: an explicit deny is a durable control (bypass means editing a policy), an implicit deny means nothing grants it (bypass means adding a permission), and a ceiling clip means an identity grant exists but a boundary or SCP/RCP guardrail removes it (bypass means changing the guardrail).

OutcomeDeniedByRCP has no counterpart in the Python enum, which folds RCP denials into DENIED_BY_SCP (its single org-guardrail bucket, see policy_evaluator._classify_deny). The Go port gives Resource Control Policies their own outcome so attack-path enrichment can name the exact blocking guardrail kind.

const (
	OutcomeAllowed          PermissionOutcome = "ALLOWED"
	OutcomeExplicitDeny     PermissionOutcome = "EXPLICIT_DENY"
	OutcomeImplicitDeny     PermissionOutcome = "IMPLICIT_DENY"
	OutcomeDeniedByBoundary PermissionOutcome = "DENIED_BY_BOUNDARY"
	OutcomeDeniedBySCP      PermissionOutcome = "DENIED_BY_SCP"
	OutcomeDeniedByRCP      PermissionOutcome = "DENIED_BY_RCP"
)

type Policy ¶

type Policy struct {
	Version    string
	Statements []Statement
}

Policy is a parsed AWS IAM policy document — an identity policy, a resource policy, or a role trust policy. AWS lets the top-level "Statement" be a single object or an array; both parse into Statements.

func ParsePolicyDocument(doc string) (*Policy, error)

func ParseResourcePolicy(raw []byte) (*Policy, error)

func (p *Policy) UnmarshalJSON(data []byte) error

type PolicyEvaluator ¶

type PolicyEvaluator struct {
	// contains filtered or unexported fields
}

PolicyEvaluator is the query layer over the IAM policy engine: it answers "can principal X perform action Y on resource Z?" and "does role R's trust policy admit principal P?" for the whole store. Ported from AWSHound's core/evaluation/policy_evaluator.py PolicyEvaluator together with the compressed-permissions cache (compressed_permissions.py) and the per-principal warm path of core/models/account_data.py (get_permissions, _compute_principal_key, bundle loading, SCP/RCP level construction).

For a principal it resolves the identity policies (inline + attached-managed + group-inherited for users), the permissions boundary, and the account's ordered SCP/RCP levels from the store's public API, runs the engine's Compile/Combine, then compresses each effective statement to roaring bitmaps of ARN int-ids via the shared ArnIndex (ResolvePattern). The result is cached per principal by a content fingerprint so principals with fingerprint-equal inputs share a single entry (the Python two-level dedup cache).

Deliberate, decision-preserving divergences from the Python ¶

• RCP denials get their own PermissionOutcome (OutcomeDeniedByRCP) rather than folding into DENIED_BY_SCP, matching types.go's documented intent.
• The per-principal fingerprint keys on the raw (source, document) inputs (not Python's normalized content hash). This is stricter — two principals share an entry only when their sources and documents are byte-identical — which yields slightly less sharing but guarantees byte-identical outputs including AllowSources/BlockingSource. Allow/deny decisions are unchanged.
• The request context for a check is built lazily from the store inside CanPerformAction/CheckTrustPolicy (buildPolicyVarContext, the port of store.get_policy_variable_context), so callers pass only Python's per-call request_context overlay (e.g. iam:PassedToService) as ctx, or nil for none.

The cache-build partial resolution (cache_build_resolution.py filter_statements_inplace) IS ported, so account-scoped conditions are pre-resolved identically to the Python cache and the result does not depend on the caller populating account/org keys in ctx.

A PolicyEvaluator is safe for concurrent use once the store is populated (the query phase); its caches are guarded and its scan-once indexes assume the store is stable during evaluation (ingestion has completed).

func NewPolicyEvaluator(st *store.Store) (*PolicyEvaluator, error)

func NewPolicyEvaluatorWithEngine(st *store.Store, engine *IamPolicyEngine) *PolicyEvaluator

func (pe *PolicyEvaluator) CanPerformAction(principalArn, action, resourceArn string, ctx *RequestContext) *PermissionCheckResult

func (pe *PolicyEvaluator) CanPerformActionPattern(principalArn, action, resourcePattern string, ctx *RequestContext) *PermissionCheckResult

func (pe *PolicyEvaluator) CheckDirectGrantConstraints(principalArn, action, resourceArn string, ctx *RequestContext) *PermissionCheckResult

func (pe *PolicyEvaluator) CheckDirectGrantConstraintsDenyOnly(principalArn, action, resourceArn string, ctx *RequestContext) *PermissionCheckResult

func (pe *PolicyEvaluator) CheckDirectSameAccountTrustPolicy(role *model.RoleDetail, principalArn string, ctx *RequestContext) *TrustCheckResult

func (pe *PolicyEvaluator) CheckTrustPolicy(role *model.RoleDetail, principalArn string, ctx *RequestContext) *TrustCheckResult

func (pe *PolicyEvaluator) IdentityFactor(action, resourceArn string, principals []string) Factor

func (pe *PolicyEvaluator) PrincipalActionMasksAnyResource(actions []string) map[uint32]uint64

func (pe *PolicyEvaluator) PrincipalsWithAction(action, resourcePattern string) *roaring.Bitmap

func (pe *PolicyEvaluator) PrincipalsWithActionAll(action string) *roaring.Bitmap

func (pe *PolicyEvaluator) PrincipalsWithActionAnyResource(action string) *roaring.Bitmap

func (pe *PolicyEvaluator) PrincipalsWithAnyActionAnyResource(actions []string) *roaring.Bitmap

func (pe *PolicyEvaluator) ResourcePolicyContext(principalArn, action, resourceArn string) *RequestContext

func (pe *PolicyEvaluator) RoleDirectSameAccountTrustBitmap(role *model.RoleDetail, action string) *roaring.Bitmap

func (pe *PolicyEvaluator) RoleTrustBitmap(role *model.RoleDetail, action string) *roaring.Bitmap

func (pe *PolicyEvaluator) TrustFactor(role *model.RoleDetail, principals []string) Factor

type Principal ¶

type Principal struct {
	// Wildcard is true when the block was the bare JSON string "*"; the keyed
	// slices below are then empty.
	Wildcard      bool
	AWS           []string
	Service       []string
	Federated     []string
	CanonicalUser []string
}

Principal is the Principal (or NotPrincipal) block of a resource/trust policy statement. AWS allows a bare "*" (anyone/anonymous) or an object keyed by principal type; each key's value may be a single string or an array.

func (p *Principal) UnmarshalJSON(data []byte) error

type PublicAccessBlock ¶

type PublicAccessBlock struct {
	BlockPublicAcls       bool
	IgnorePublicAcls      bool
	BlockPublicPolicy     bool
	RestrictPublicBuckets bool
}

PublicAccessBlock is an S3 Block Public Access setting, used both per-bucket and account-wide. Ported from the BPA dict the Python merges; the four flags mirror the AWS response.

type RequestContext ¶

type RequestContext struct {
	Values         map[string]string
	KnownKeys      map[string]bool
	PrincipalTags  map[string]string
	ResourceTags   map[string]string
	PrincipalKnown bool
	ResourceKnown  bool
	OrgDataKnown   bool
}

RequestContext is the known request-context data used to resolve condition keys and substitute policy variables. Ported field-for-field from core/evaluation/policy_variables.py PolicyVariableContext.

It answers, for a given (principal, action, resource) under evaluation, "what value(s) does condition key aws:X take?" — but only for the keys AWSHound statically knows. The tri-state mapping of a key to PRESENT/ABSENT/UNKNOWN is produced by resolveKey (conditions.go); this type only holds the raw data and the *Known flags that drive that mapping.

The *Known flags distinguish "we ingested the data and the key is genuinely absent" (Known=true, value missing -> ABSENT -> the atom sees None and the condition typically resolves FALSE) from "we did not ingest the data so we cannot tell" (Known=false -> UNKNOWN, where attacker-favorable bias takes over). The zero value (nil maps, all flags false) is a valid blank context in which every key resolves to UNKNOWN; reads from its nil maps are safe.

Values and KnownKeys keys are lower-cased. KnownKeys records service-specific keys whose presence/absence this request form can determine. Tag names in PrincipalTags/ResourceTags keep their original case (AWS tag keys are case-sensitive). The store/context-builder layer populates these fields.

type Resolution ¶

type Resolution int

Resolution is the tristate result of statically evaluating a Condition (block, key, or value). Ported from conditions/resolution.py.

ResolutionUnknown means the evaluator could not statically determine the outcome — typically because a required context key is unknowable (e.g. aws:SourceIp) or because the relevant data was not ingested. It is the zero value, so an unset Resolution defaults to the conservative "unknown".

const (
	ResolutionUnknown Resolution = iota
	ResolutionTrue
	ResolutionFalse
)

func ResolveCondition(cond Condition, ctx *RequestContext) Resolution

func (a Resolution) And(b Resolution) Resolution

func (a Resolution) Not() Resolution

func (a Resolution) Or(b Resolution) Resolution

func (r Resolution) String() string

type ResourceClass ¶

type ResourceClass int

ResourceClass selects how a resource's admit-decision composes with the identity decision (§5.4 of docs/authorization-tensor.md).

const (
	// IdentityGoverned: no resource policy; access is identity ∧ same-account.
	IdentityGoverned ResourceClass = iota
	// MandatoryPolicy: resource policy always required (role trust); access is
	// identity ∧ resource, even same-account.
	MandatoryPolicy
	// OptionalUnion: same-account access is identity ∨ resource (a resource-policy
	// grant alone suffices), cross-account is identity ∧ resource (S3, KMS).
	OptionalUnion
)

type S3ACL ¶

type S3ACL struct {
	Grants []S3ACLGrant
}

S3ACL is a bucket ACL — the meaningful subset (its grants) of a GetBucketAcl response. Ported from the ACL dict the Python evaluator consumes.

type S3ACLGrant ¶

type S3ACLGrant struct {
	Grantee    S3ACLGrantee
	Permission string
}

S3ACLGrant pairs a grantee with the permission it was granted ("READ", "WRITE", "READ_ACP", "WRITE_ACP", "FULL_CONTROL").

type S3ACLGrantee ¶

type S3ACLGrantee struct {
	Type string
	ID   string
	URI  string
}

S3ACLGrantee identifies who an ACL grant is for. Type is the grantee kind ("CanonicalUser", "Group", …); a Group grantee carries a URI (the AllUsers / AuthenticatedUsers group). Ported from the ACL grantee dict the Python reads.

type S3AccessCheckResult ¶

type S3AccessCheckResult struct {
	Allowed              bool
	IAMAllowed           bool
	BucketPolicyAllowed  bool
	ACLAllowed           bool
	Denied               bool
	DenySource           string
	AllowSources         []string
	Conditions           []map[string]any
	HasConditions        bool
	RequiresBucketPolicy bool
}

S3AccessCheckResult is the outcome of an S3 access evaluation across every control mechanism. Ported field-for-field from s3_policy_evaluator.S3AccessCheckResult.

type S3BucketConfig ¶

type S3BucketConfig struct {
	BucketArn         string
	BucketPolicy      *Policy
	ACL               *S3ACL
	BlockPublicAccess *PublicAccessBlock
	OwnershipControls string
	OwnerAccountID    string
}

S3BucketConfig is the resource-control configuration for one bucket. Ported from s3_policy_evaluator.S3BucketConfig.

BucketPolicy is the parsed bucket policy (parse the raw, NON-url-encoded JSON via ParseResourcePolicy), nil when the bucket has none. ACL and BlockPublicAccess are nil when absent. OwnershipControls is the object-ownership setting ("BucketOwnerEnforced" disables ACLs entirely), "" when unset. OwnerAccountID is the bucket owner's account — the basis for cross-account determination; the caller sets it to the account the bucket was collected from.

type S3Evaluator ¶

type S3Evaluator struct {
	// contains filtered or unexported fields
}

S3Evaluator evaluates S3 access across IAM policies, bucket policies, ACLs, and Block Public Access. Ported from s3_policy_evaluator.S3PolicyEvaluator (the bucket_configs constructor path; the deprecated per-parameter path — and with it the object-level ACL override, which that path never populated under the runtime's bucket_configs wiring — is intentionally omitted).

It is read-only after construction and, provided the IdentityEvaluator and ContextBuilder it holds are themselves safe for concurrent use, is safe for concurrent queries.

func NewS3Evaluator(
	identity IdentityEvaluator,
	bucketConfigs map[string]*S3BucketConfig,
	accountPublicAccessBlocks map[string]*PublicAccessBlock,
	contextBuilder ContextBuilder,
	constraints ...DirectConstraintEvaluator,
) *S3Evaluator

func (e *S3Evaluator) BucketACLMayAllowAny(bucketArn string, actions []string) bool

func (e *S3Evaluator) BucketACLMayAllowMask(bucketArn string, actions []string) uint64

func (e *S3Evaluator) BucketPolicyMayAllowAny(bucketArn, principalArn string, actions []string) bool

func (e *S3Evaluator) BucketPolicyMayAllowMask(bucketArn, principalArn string, actions []string) uint64

func (e *S3Evaluator) CrossAccountAccessAlwaysBlocked(bucketArn string) bool

func (e *S3Evaluator) EvaluateS3Access(principalArn, action, resourceArn string) S3AccessCheckResult

type Statement ¶

type Statement struct {
	Sid          string
	Effect       string
	Action       []string
	NotAction    []string
	Resource     []string
	NotResource  []string
	Principal    *Principal
	NotPrincipal *Principal
	Condition    Condition
}

Statement is one statement of a policy document. Action/NotAction/Resource/ NotResource are normalized to slices even when the document used a bare string; a nil slice means the key was absent, while a non-nil empty slice means it was present but empty. Principal/NotPrincipal are nil unless present (resource and trust policies only). Condition is nil when absent.

Effect is the raw "Allow"/"Deny" string (the engine maps it to the Effect enum when compiling).

func (st *Statement) UnmarshalJSON(data []byte) error

type StatementResolutionResult ¶

type StatementResolutionResult struct {
	Allowed      bool
	Denied       bool
	Conditions   []map[string]any
	AllowSources []string
	DenySources  []string
}

StatementResolutionResult is the outcome of resolving a set of matched allow/deny statements. Ported from statement_resolution.py StatementResolutionResult. Conditions is the auditable trace of every evaluated gating condition (resolved-true and unknown/defaulted alike), regardless of which branch ultimately grants; AllowSources reflects the deciding branch.

func ResolveMatchedStatements(matchedAllows, matchedDenies []MatchedStatement, contextFactory ContextFactory) StatementResolutionResult

type TrustCheckResult ¶

type TrustCheckResult struct {
	Trusted    bool
	Conditions []map[string]any
}

TrustCheckResult is the result of checking whether a role's trust policy allows a principal. Ported from core/models/types.py.

func EvaluateFederatedTrust(doc *Policy, providerArn, action string, ctxFactory ContextFactory) TrustCheckResult

type TrustMatchFn ¶

type TrustMatchFn func(p *Principal, targetArn string) bool

TrustMatchFn matches a statement's Principal block against a candidate target ARN. Ported from trust_evaluator.TrustMatchFn. The two implementations are TrustPrincipalMatches (IAM principals, Principal.AWS) and TrustFederatedMatches (federation providers, Principal.Federated).