Documentation
¶
Overview ¶
Package iampolicystream records IAM evaluation events in a bounded ring buffer, fans them out to live subscribers and derives least-privilege policy suggestions from them.
Index ¶
Constants ¶
const ( DecisionAllow = "allow" DecisionDeny = "deny" )
Decision values recorded on an Event.
const ( ReasonIdentityPolicy = "identity-policy" ReasonResourcePolicy = "resource-policy" ReasonPermissionBound = "permission-boundary" ReasonImplicitDeny = "implicit-deny" ReasonUnresolvedCaller = "unresolved-principal" )
Deny-reason values recorded on an Event.
const (
// DefaultCapacity is the ring size used when New is given a non-positive capacity.
DefaultCapacity = 2000
)
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Event ¶
type Event struct {
Time time.Time `json:"timestamp"`
RequestID string `json:"requestId,omitempty"`
Service string `json:"service"`
Operation string `json:"operation"`
Action string `json:"action"`
Resource string `json:"resource"`
Principal string `json:"principal"`
Decision string `json:"decision"`
Reason string `json:"reason,omitempty"`
MatchedSid string `json:"matchedSid,omitempty"`
MatchedBy string `json:"matchedBy,omitempty"`
Suggested *Policy `json:"suggestedPolicy,omitempty"`
ConditionKey []string `json:"conditionKeys,omitempty"`
Seq uint64 `json:"seq"`
StatementIdx int `json:"matchedStatementIndex"`
PolicyIdx int `json:"matchedPolicyIndex"`
Enforced bool `json:"enforced"`
}
Event is one evaluated request.
type Filter ¶
type Filter struct {
Since time.Time
Decision string
Service string
Principal string
AfterSeq uint64
}
Filter selects events; zero fields match everything.
type Policy ¶
Policy is an IAM policy document.
func StatementFor ¶
StatementFor returns the minimal Allow policy permitting action on resource.
type Recorder ¶
type Recorder struct {
// contains filtered or unexported fields
}
Recorder is a bounded, concurrency-safe event ring with live fan-out.
func (*Recorder) Dropped ¶
Dropped reports how many live deliveries were skipped due to slow subscribers.
func (*Recorder) Record ¶
Record stamps e with a sequence number, stores it and notifies subscribers. A subscriber whose buffer is full misses the event rather than blocking.
func (*Recorder) Snapshot ¶
Snapshot returns the retained events, oldest first, that pass keep (nil keeps all).
func (*Recorder) Subscribe ¶
Subscribe returns a channel of live events. The subscription ends, and the channel is closed, when ctx is done.
func (*Recorder) Subscribers ¶
Subscribers reports the number of live subscriptions.
type Statement ¶
type Statement struct {
Effect string `json:"Effect"`
Action []string `json:"Action"`
Resource []string `json:"Resource"`
}
Statement is one Allow statement of a suggested policy.
type Suggestion ¶
type Suggestion struct {
Policy Policy `json:"policy"`
BlockedByDeny []string `json:"blockedByExplicitDeny,omitempty"`
EventsConsumed int `json:"eventsConsumed"`
}
Suggestion is a least-privilege policy derived from recorded events.
func Suggest ¶
func Suggest(events []Event, includeAllowed bool) Suggestion
Suggest builds one Allow statement per distinct resource covering every consumed action. Events denied by an explicit Deny or permission boundary cannot be fixed by an identity Allow and are listed in BlockedByDeny. Allowed events are consumed only when includeAllowed is set.
Source Files