README
¶
IAM Identity Center Portal
Parity grade: B · SDK aws-sdk-go-v2/service/sso@v1.37.0 · last audited 2026-10-12 (94a8059bf)
Coverage
| Metric | Value |
|---|---|
| PARITY entries audited | 4 (4 ok) |
| Known gaps | 2 |
| Structural gaps (can't be emulated) | 1 |
| Deferred items | 0 |
| Resource leaks | clean |
Known gaps
- ListAccountRoles/GetRoleCredentials for an unassigned account or role: answers ResourceNotFoundException "No access"; real AWS reports ForbiddenException, which the pinned SDK does not model (bd: gopherstack-cefu7.3)
- max_result bounds: default 10, cap 1000, below 1 is InvalidRequestException; AWS bounds are not in the SDK (bd: gopherstack-cefu7.3)
Structural gaps
These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.
- Role ARNs and assumed-role ARNs use the emulator's single IAM account; an assignment to another account ID still resolves to a role in the emulator account
More
Documentation
¶
Index ¶
- type AccountInfo
- type Credentials
- type Directory
- type Entitlement
- type Handler
- func (h *Handler) ChaosOperations() []string
- func (h *Handler) ChaosRegions() []string
- func (h *Handler) ChaosServiceName() string
- func (h *Handler) ExtractOperation(c *echo.Context) string
- func (h *Handler) ExtractResource(_ *echo.Context) string
- func (h *Handler) GetSupportedOperations() []string
- func (h *Handler) Handler() echo.HandlerFunc
- func (h *Handler) MatchPriority() int
- func (h *Handler) Name() string
- func (h *Handler) RouteMatcher() service.Matcher
- func (h *Handler) SetDirectory(d Directory)
- func (h *Handler) SetTokenSource(s TokenSource)
- type Provider
- type TokenSource
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AccountInfo ¶
AccountInfo is the display data of an account.
type Credentials ¶
type Credentials struct {
Expiration time.Time
AccessKeyID string
SecretAccessKey string
SessionToken string
}
Credentials are short-lived role credentials.
type Directory ¶
type Directory interface {
Entitlements(subject ssooidc.Subject) ([]Entitlement, error)
AccountInfo(accountID string) AccountInfo
IssueCredentials(e Entitlement, subject ssooidc.Subject) (Credentials, error)
}
Directory resolves entitlements and mints role credentials. Implementations look up sibling services lazily, at call time.
type Entitlement ¶
type Entitlement struct {
AccountID string
PermissionSetArn string
PermissionSetName string
InstanceArn string
}
Entitlement is one permission set assigned to a user (directly or through a group) in an account.
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler is the Echo handler for the IAM Identity Center portal API.
func (*Handler) ChaosOperations ¶
ChaosOperations returns the fault-injectable operations.
func (*Handler) ChaosRegions ¶
ChaosRegions returns the regions served.
func (*Handler) ChaosServiceName ¶
ChaosServiceName returns the lowercase service name for fault rules.
func (*Handler) ExtractOperation ¶
ExtractOperation returns the operation name.
func (*Handler) ExtractResource ¶
ExtractResource returns a fixed label to avoid high-cardinality metrics.
func (*Handler) GetSupportedOperations ¶
GetSupportedOperations returns the supported operations.
func (*Handler) Handler ¶
func (h *Handler) Handler() echo.HandlerFunc
Handler returns the Echo handler.
func (*Handler) MatchPriority ¶
MatchPriority returns the routing priority.
func (*Handler) RouteMatcher ¶
RouteMatcher matches portal calls. The SDK sends them unsigned with the bearer token header, which is what separates them from S3 path-style requests on the same paths.
func (*Handler) SetDirectory ¶
SetDirectory wires the entitlement and credential directory.
func (*Handler) SetTokenSource ¶
func (h *Handler) SetTokenSource(s TokenSource)
SetTokenSource wires the OIDC token validator.
type Provider ¶
type Provider struct{}
Provider implements service.Provider for the IAM Identity Center portal API.
func (*Provider) Init ¶
func (p *Provider) Init(_ *service.AppContext) (service.Registerable, error)
Init builds the handler; the cli wires the token source and directory lazily.
Source Files