iam

package

v1.10.0 Latest Latest Go to latest Published: Aug 4, 2026 License: MIT Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Viridian-Inc/cloudmock

Links

Open Source Insights

Documentation ¶

Index ¶

func ExtractAccessKeyID(r *http.Request) (string, error)
func WildcardMatch(pattern, value string) bool
type AccessKey
type Decision
type Engine
- func NewEngine() *Engine
type EvalRequest
type EvalResult
type Policy
type Statement
type Store
- func NewStore(accountID string) *Store
type User

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func ExtractAccessKeyID ¶

func ExtractAccessKeyID(r *http.Request) (string, error)

ExtractAccessKeyID parses the AWS SigV4 Authorization header from the request and returns the access key ID embedded in the Credential field.

Expected header format:

AWS4-HMAC-SHA256 Credential=<AKID>/<date>/<region>/<service>/aws4_request, ...

func WildcardMatch ¶

func WildcardMatch(pattern, value string) bool

WildcardMatch reports whether value matches pattern. Supported wildcards:

'*' matches any sequence of characters (including empty)
'?' matches any single character

Types ¶

type AccessKey ¶

type AccessKey struct {
	AccessKeyID     string
	SecretAccessKey string
	UserName        string
	AccountID       string
	IsRoot          bool
}

AccessKey represents an IAM access key and its associated identity.

type Decision ¶

type Decision int

Decision represents the result of an IAM policy evaluation.

const (
	// Deny is the default decision when no policy allows the request,
	// or when an explicit Deny statement matches.
	Deny Decision = iota
	// Allow is returned when at least one Allow statement matches and
	// no Deny statement overrides it.
	Allow
)

type Engine ¶

type Engine struct {
	// contains filtered or unexported fields
}

Engine evaluates IAM policies for principals using AWS IAM semantics.

func NewEngine ¶

func NewEngine() *Engine

NewEngine creates and returns a new Engine.

func (*Engine) AddPolicy ¶

func (e *Engine) AddPolicy(principal string, policy *Policy)

AddPolicy attaches a policy to a principal. Multiple policies may be added for the same principal; they are evaluated together.

func (*Engine) Evaluate ¶

func (e *Engine) Evaluate(req *EvalRequest) *EvalResult

Evaluate applies AWS IAM evaluation logic to the given request:

Root is always allowed.
Collect all statements whose Action and Resource match the request.
If any matching statement has Effect "Deny" → explicit Deny.
If any matching statement has Effect "Allow" → Allow.
Otherwise → implicit Deny.

func (*Engine) RemovePolicies ¶

func (e *Engine) RemovePolicies(principal string)

RemovePolicies removes all policies for a principal.

type EvalRequest ¶

type EvalRequest struct {
	Principal string
	Action    string
	Resource  string
	IsRoot    bool
}

EvalRequest contains the input parameters for a policy evaluation.

type EvalResult ¶

type EvalResult struct {
	Decision         Decision
	Reason           string
	MatchedStatement *Statement
}

EvalResult holds the outcome of an Evaluate call.

type Policy ¶

type Policy struct {
	Version    string      `json:"Version"`
	Statements []Statement `json:"Statement"`
}

Policy is an AWS-style IAM policy document.

type Statement ¶

type Statement struct {
	SID        string                       `json:"Sid,omitempty"`
	Effect     string                       `json:"Effect"` // "Allow" or "Deny"
	Actions    []string                     `json:"Action"`
	Resources  []string                     `json:"Resource"`
	Conditions map[string]map[string]string `json:"Condition,omitempty"`
}

Statement is a single IAM policy statement.

type Store ¶

type Store struct {
	// contains filtered or unexported fields
}

Store holds IAM users and access keys for a single AWS account.

func NewStore ¶

func NewStore(accountID string) *Store

NewStore creates a new Store for the given AWS account ID.

func (*Store) AttachUserPolicy ¶

func (s *Store) AttachUserPolicy(userName, policyName string, policy *Policy) error

AttachUserPolicy attaches a named policy to the given user.

func (*Store) CreateAccessKey ¶

func (s *Store) CreateAccessKey(userName string) (*AccessKey, error)

CreateAccessKey generates a new access key for the named user.

func (*Store) CreateUser ¶

func (s *Store) CreateUser(name string) (*User, error)

CreateUser creates a new IAM user with the given name.

func (*Store) GetUser ¶

func (s *Store) GetUser(name string) (*User, error)

GetUser returns the named user or an error if not found.

func (*Store) GetUserPolicies ¶

func (s *Store) GetUserPolicies(userName string) ([]*Policy, error)

GetUserPolicies returns all policies attached to the named user.

func (*Store) InitRoot ¶

func (s *Store) InitRoot(accessKeyID, secretKey string) error

InitRoot creates a root access key entry for the account.

func (*Store) LookupAccessKey ¶

func (s *Store) LookupAccessKey(accessKeyID string) (*AccessKey, error)

LookupAccessKey returns the AccessKey for the given access key ID.

type User ¶

type User struct {
	Name     string
	ARN      string
	UserID   string
	Policies map[string]*Policy
}

User represents an IAM user in the store.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL