iam

package
v1.1.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 33 Imported by: 0

README

IAM

Parity grade: A · SDK aws-sdk-go-v2/service/iam · last audited 2026-07-11 (6f19cb90) · protocol aws-query -> XML

Coverage

Metric Value
Operations audited 2 (1 ok, 1 partial)
Feature families 4 (4 ok)
Known gaps 2
Deferred items 0
Resource leaks clean
Known gaps
  • comprehensiveBackend uses own sync.Mutex alongside coarse lockmetrics.RWMutex — violates one-coarse-lock rule (bd: gopherstack-gjp). Re-examined sweep 4 — deliberate to avoid a nested b.mu lock-order (comp().snapshot()/restore() are documented to run outside any b.mu critical section); fixing requires folding comprehensiveBackend's maps into the main registry/lock, deferred as an architectural change, not a wire/correctness bug.
  • GetAccountAuthorizationDetails: Marker/MaxItems/Filter request params are parsed but ignored — server always returns the full unfiltered/unpaginated dump with IsTruncated=false. Not a wire-shape violation (SDK's built-in paginator terminates correctly against this since Marker is always absent) and never silently drops data, but diverges from documented AWS behavior for large accounts or Filter-scoped calls (bd: gopherstack-gjp).

More

Documentation

Index

Constants

View Source 
const (
	MFAStatusNotAssigned = "not_assigned" // PENDING_ENABLE / unlinked
	MFAStatusEnabled     = "Active"       // linked via EnableMFADevice
	MFAStatusDeactivated = "Deactivated"  // unlinked via DeactivateMFADevice
)

MFA device status constants mirror AWS IAM virtual MFA device states.

View Source 
const IAMAccountID = config.DefaultAccountID

IAMAccountID is the dummy AWS account ID used in ARNs.

Variables

View Source 
var (
	// ErrUserNotFound is returned when a requested user does not exist.
	ErrUserNotFound = errors.New("NoSuchEntity: user")
	// ErrUserAlreadyExists is returned when creating a user that already exists.
	ErrUserAlreadyExists = errors.New("EntityAlreadyExists")
	// ErrRoleNotFound is returned when a requested role does not exist.
	ErrRoleNotFound = errors.New("NoSuchEntity: role")
	// ErrRoleAlreadyExists is returned when creating a role that already exists.
	ErrRoleAlreadyExists = errors.New("EntityAlreadyExists")
	// ErrPolicyNotFound is returned when a requested policy does not exist.
	ErrPolicyNotFound = errors.New("NoSuchEntity: policy")
	// ErrPolicyAlreadyExists is returned when creating a policy that already exists.
	ErrPolicyAlreadyExists = errors.New("EntityAlreadyExists")
	// ErrGroupNotFound is returned when a requested group does not exist.
	ErrGroupNotFound = errors.New("NoSuchEntity: group")
	// ErrGroupAlreadyExists is returned when creating a group that already exists.
	ErrGroupAlreadyExists = errors.New("EntityAlreadyExists")
	// ErrAccessKeyNotFound is returned when a requested access key does not exist.
	ErrAccessKeyNotFound = errors.New("NoSuchEntity: access key")
	// ErrInstanceProfileNotFound is returned when a requested instance profile does not exist.
	ErrInstanceProfileNotFound = errors.New("NoSuchEntity: instance profile")
	// ErrInstanceProfileAlreadyExists is returned when creating a profile that already exists.
	ErrInstanceProfileAlreadyExists = errors.New("EntityAlreadyExists")
	// ErrInvalidAction is returned when an unknown IAM action is requested.
	ErrInvalidAction = errors.New("InvalidAction")
	// ErrMalformedPolicyDocument is returned when a policy document is not valid JSON.
	ErrMalformedPolicyDocument = errors.New("MalformedPolicyDocument")
	// ErrDeleteConflict is returned when an entity has attached resources that prevent deletion.
	ErrDeleteConflict = errors.New("DeleteConflict")
	// ErrInlinePolicyNotFound is returned when a requested inline policy does not exist.
	ErrInlinePolicyNotFound = errors.New("NoSuchEntity: inline policy")
	// ErrSAMLProviderNotFound is returned when a requested SAML provider does not exist.
	ErrSAMLProviderNotFound = errors.New("NoSuchEntity: SAML provider")
	// ErrSAMLProviderAlreadyExists is returned when creating a SAML provider that already exists.
	ErrSAMLProviderAlreadyExists = errors.New("EntityAlreadyExists")
	// ErrOIDCProviderNotFound is returned when a requested OIDC provider does not exist.
	ErrOIDCProviderNotFound = errors.New("NoSuchEntity: OIDC provider")
	// ErrOIDCProviderAlreadyExists is returned when creating an OIDC provider that already exists.
	ErrOIDCProviderAlreadyExists = errors.New("EntityAlreadyExists")
	// ErrInvalidAuthenticationCode is returned when MFA code is invalid.
	ErrInvalidAuthenticationCode = errors.New("InvalidAuthenticationCode")
	// ErrInvalidInput is returned when an input parameter is invalid.
	ErrInvalidInput = errors.New("InvalidInput")
	// ErrLoginProfileNotFound is returned when a requested login profile does not exist.
	ErrLoginProfileNotFound = errors.New("NoSuchEntity: login profile")
	// ErrLoginProfileAlreadyExists is returned when creating a login profile that already exists.
	ErrLoginProfileAlreadyExists = errors.New("EntityAlreadyExists")
	// ErrInvalidOIDCProviderURL is returned when an OIDC provider URL cannot be parsed.
	ErrInvalidOIDCProviderURL = errors.New("InvalidInput")
	// ErrInvalidPassword is returned when a password fails validation (e.g., empty).
	ErrInvalidPassword = errors.New("InvalidInput")
	// ErrLimitExceeded is returned when an inline policy or other entity exceeds an AWS quota.
	ErrLimitExceeded = errors.New("LimitExceeded")
	// ErrValidationError is returned when a parameter fails AWS constraint validation (e.g. MaxSessionDuration bounds).
	ErrValidationError = errors.New("ValidationError")
)

Functions

func EnforcementMiddleware 

func EnforcementMiddleware(backend EnforcementBackend, cfg ...EnforcementConfig) echo.MiddlewareFunc

EnforcementMiddleware returns an Echo middleware that enforces IAM policies on every incoming request. It extracts the caller's access key from the SigV4 Authorization header, resolves the associated IAM user, collects all attached policies, and evaluates them against the requested IAM action.

If the access key is not found in the IAM backend (e.g. a test/dummy key), the request is allowed through without enforcement so existing tooling is not disrupted.

Requests to dashboard and internal health-check paths are always allowed.

func EvaluateAssumeRoleTrustPolicy 

func EvaluateAssumeRoleTrustPolicy(
	trustPolicyJSON, principalARN, externalID string, mfaPresent bool, ctx ConditionContext,
) bool

EvaluateAssumeRoleTrustPolicy evaluates a role's trust policy against an AssumeRole request. Returns true if the principal is allowed to assume the role under the given conditions.

Parameters:

  • trustPolicyJSON: the role's AssumeRolePolicyDocument
  • principalARN: the ARN of the entity trying to assume the role
  • externalID: sts:ExternalId value from the request (empty if not provided)
  • mfaPresent: whether MFA was used in the request
  • ctx: additional condition context (e.g. source IP)

func ExtractAccessKeyID 

func ExtractAccessKeyID(r *http.Request) string

ExtractAccessKeyID extracts the AWS access key ID from the SigV4 Authorization header. The expected format is: 

AWS4-HMAC-SHA256 Credential=AKID/date/region/service/aws4_request, ...

func ExtractIAMAction 

func ExtractIAMAction(r *http.Request) string

ExtractIAMAction determines the IAM action string for an HTTP request. Returns the action in "service:Operation" format (e.g., "s3:PutObject", "dynamodb:GetItem"). Returns an empty string if the action cannot be determined.

func SubstituteVariables 

func SubstituteVariables(doc string, ctx ConditionContext) string

SubstituteVariables replaces IAM policy variables in a policy document string with values from the provided ConditionContext.

Supported variables:

  • ${aws:username} → IAM user name
  • ${aws:userid} → IAM user ID
  • ${aws:sourceip} → caller source IP
  • ${aws:PrincipalTag/<key>} → value of a principal tag (empty if absent)
  • ${aws:RequestTag/<key>} → value of a request tag (empty if absent)

Unknown variables are left unchanged to avoid masking policy mistakes.

Types

type AcceptDelegationRequestResponse 

type AcceptDelegationRequestResponse struct {
	XMLName          xml.Name         `xml:"AcceptDelegationRequestResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

AcceptDelegationRequestResponse is the XML response for AcceptDelegationRequest.

type AccessKey 

type AccessKey struct {
	LastUsedDate        *time.Time `json:"LastUsedDate,omitempty"`
	CreateDate          time.Time  `json:"CreateDate"`
	AccessKeyID         string     `json:"AccessKeyId,omitempty"`
	SecretAccessKey     string     `json:"SecretAccessKey,omitempty"`
	UserName            string     `json:"UserName,omitempty"`
	LastUsedRegion      string     `json:"LastUsedRegion,omitempty"`
	LastUsedServiceName string     `json:"LastUsedServiceName,omitempty"`
	Status              string     `json:"Status,omitempty"`
}

AccessKey represents an IAM access key for a user.

type AccessKeyLastUsed 

type AccessKeyLastUsed struct {
	UserName     string `json:"UserName,omitempty"`
	AccessKeyID  string `json:"AccessKeyId,omitempty"`
	LastUsedDate string `json:"LastUsedDate,omitempty"`
	ServiceName  string `json:"ServiceName,omitempty"`
	Region       string `json:"Region,omitempty"`
}

AccessKeyLastUsed contains information about the last time an access key was used.

type AccessKeyLastUsedXML 

type AccessKeyLastUsedXML struct {
	LastUsedDate string `xml:"LastUsedDate"`
	ServiceName  string `xml:"ServiceName"`
	Region       string `xml:"Region"`
}

AccessKeyLastUsedXML is the XML representation for GetAccessKeyLastUsed response.

type AccessKeyMetadataXML 

type AccessKeyMetadataXML struct {
	AccessKeyID string `xml:"AccessKeyId"`
	UserName    string `xml:"UserName"`
	Status      string `xml:"Status"`
	CreateDate  string `xml:"CreateDate"`
}

AccessKeyMetadataXML is the XML representation of IAM AccessKey metadata (no secret).

type AccessKeyXML 

type AccessKeyXML struct {
	AccessKeyID     string `xml:"AccessKeyId"`
	SecretAccessKey string `xml:"SecretAccessKey"`
	UserName        string `xml:"UserName"`
	Status          string `xml:"Status"`
	CreateDate      string `xml:"CreateDate"`
}

AccessKeyXML is the XML representation of an IAM AccessKey.

type AccountAuthorizationDetails 

type AccountAuthorizationDetails struct {
	Users    []UserDetail  `json:"users,omitempty"`
	Groups   []GroupDetail `json:"groups,omitempty"`
	Roles    []RoleDetail  `json:"roles,omitempty"`
	Policies []Policy      `json:"policies,omitempty"`
}

AccountAuthorizationDetails is the full IAM entity dump returned by GetAccountAuthorizationDetails.

type AccountSummary 

type AccountSummary struct {
	Users             int `json:"users,omitempty"`
	Groups            int `json:"groups,omitempty"`
	Roles             int `json:"roles,omitempty"`
	Policies          int `json:"policies,omitempty"`
	InstanceProfiles  int `json:"instanceProfiles,omitempty"`
	AccessKeysPerUser int `json:"accessKeysPerUser,omitempty"`
	ActiveAccessKeys  int `json:"activeAccessKeys,omitempty"`
	AttachedPolicies  int `json:"attachedPolicies,omitempty"`
	AccountAliases    int `json:"accountAliases,omitempty"`
	OIDCProviders     int `json:"oidcProviders,omitempty"`
	SAMLProviders     int `json:"samlProviders,omitempty"`
	MFADevices        int `json:"mfaDevices,omitempty"`
}

AccountSummary holds summary counts for GetAccountSummary.

type AccountSummaryEntry 

type AccountSummaryEntry struct {
	Key   string `xml:"key"`
	Value int    `xml:"value"`
}

AccountSummaryEntry represents a single key-value entry in the account summary map.

type ActionExtractor 

type ActionExtractor interface {
	IAMAction(r *http.Request) string
}

ActionExtractor is an optional interface that service handlers can implement to provide IAM action extraction for their specific request patterns. It is used by the enforcement middleware as a fallback when the global action mapper cannot determine the IAM action (e.g. for REST-based services like Lambda and Route53 that do not use X-Amz-Target or form-encoded bodies).

Each extractor must first check whether the request belongs to its service (e.g. by path prefix) and return "" when the request is not its own.

type AddClientIDToOpenIDConnectProviderResponse 

type AddClientIDToOpenIDConnectProviderResponse struct {
	XMLName          xml.Name         `xml:"AddClientIDToOpenIDConnectProviderResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

AddClientIDToOpenIDConnectProviderResponse is the XML response for AddClientIDToOpenIDConnectProvider.

type AddRoleToInstanceProfileResponse 

type AddRoleToInstanceProfileResponse struct {
	XMLName          xml.Name         `xml:"AddRoleToInstanceProfileResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

AddRoleToInstanceProfileResponse is the XML response for AddRoleToInstanceProfile.

type AddUserToGroupResponse 

type AddUserToGroupResponse struct {
	XMLName          xml.Name         `xml:"AddUserToGroupResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

AddUserToGroupResponse is the XML response for AddUserToGroup.

type AssociateDelegationRequestResponse 

type AssociateDelegationRequestResponse struct {
	XMLName          xml.Name         `xml:"AssociateDelegationRequestResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

AssociateDelegationRequestResponse is the XML response for AssociateDelegationRequest.

type AttachGroupPolicyResponse 

type AttachGroupPolicyResponse struct {
	XMLName          xml.Name         `xml:"AttachGroupPolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

AttachGroupPolicyResponse is the XML response for AttachGroupPolicy.

type AttachRolePolicyResponse 

type AttachRolePolicyResponse struct {
	XMLName          xml.Name         `xml:"AttachRolePolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

AttachRolePolicyResponse is the XML response for AttachRolePolicy.

type AttachUserPolicyResponse 

type AttachUserPolicyResponse struct {
	XMLName          xml.Name         `xml:"AttachUserPolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

AttachUserPolicyResponse is the XML response for AttachUserPolicy.

type AttachedPolicy 

type AttachedPolicy struct {
	PolicyName string `json:"policyName,omitempty"`
	PolicyArn  string `json:"policyArn,omitempty"`
}

AttachedPolicy is a simplified representation of an attached managed policy.

type AttachedPolicyXML 

type AttachedPolicyXML struct {
	PolicyName string `xml:"PolicyName"`
	PolicyArn  string `xml:"PolicyArn"`
}

AttachedPolicyXML is the XML representation of an attached managed policy.

type ChangePasswordResponse 

type ChangePasswordResponse struct {
	XMLName          xml.Name         `xml:"ChangePasswordResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

ChangePasswordResponse is the XML response for ChangePassword.

type ConditionContext 

type ConditionContext struct {
	Extra map[string]string `json:"extra,omitempty"`
	// PrincipalTags are the tags on the calling principal (IAM user/role),
	// exposed to policies as ${aws:PrincipalTag/<key>} and the
	// aws:PrincipalTag/<key> condition key.
	PrincipalTags map[string]string `json:"principalTags,omitempty"`
	// RequestTags are the tags supplied in the current request (e.g. a
	// CreateUser Tags parameter), exposed as ${aws:RequestTag/<key>} and the
	// aws:RequestTag/<key> condition key.
	RequestTags map[string]string `json:"requestTags,omitempty"`
	SourceIP    string            `json:"sourceIP,omitempty"`
	Username    string            `json:"username,omitempty"`
	UserID      string            `json:"userID,omitempty"`
}

ConditionContext holds per-request context values that are resolved against IAM policy Condition blocks. All fields are optional; missing keys simply fail to match condition operators that require them.

type CreateAccessKeyResponse 

type CreateAccessKeyResponse struct {
	XMLName               xml.Name              `xml:"CreateAccessKeyResponse"`
	Xmlns                 string                `xml:"xmlns,attr"`
	CreateAccessKeyResult CreateAccessKeyResult `xml:"CreateAccessKeyResult"`
	ResponseMetadata      ResponseMetadata      `xml:"ResponseMetadata"`
}

CreateAccessKeyResponse is the XML response for CreateAccessKey.

type CreateAccessKeyResult 

type CreateAccessKeyResult struct {
	AccessKey AccessKeyXML `xml:"AccessKey"`
}

CreateAccessKeyResult wraps the created access key.

type CreateAccountAliasResponse 

type CreateAccountAliasResponse struct {
	XMLName          xml.Name         `xml:"CreateAccountAliasResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

CreateAccountAliasResponse is the XML response for CreateAccountAlias.

type CreateDelegationRequestResponse 

type CreateDelegationRequestResponse struct {
	XMLName                       xml.Name                      `xml:"CreateDelegationRequestResponse"`
	Xmlns                         string                        `xml:"xmlns,attr"`
	CreateDelegationRequestResult CreateDelegationRequestResult `xml:"CreateDelegationRequestResult"`
	ResponseMetadata              ResponseMetadata              `xml:"ResponseMetadata"`
}

CreateDelegationRequestResponse is the XML response for CreateDelegationRequest.

type CreateDelegationRequestResult 

type CreateDelegationRequestResult struct {
	DelegationRequest DelegationRequestXML `xml:"DelegationRequest"`
}

CreateDelegationRequestResult wraps the created delegation request.

type CreateGroupResponse 

type CreateGroupResponse struct {
	XMLName           xml.Name          `xml:"CreateGroupResponse"`
	Xmlns             string            `xml:"xmlns,attr"`
	ResponseMetadata  ResponseMetadata  `xml:"ResponseMetadata"`
	CreateGroupResult CreateGroupResult `xml:"CreateGroupResult"`
}

CreateGroupResponse is the XML response for CreateGroup.

type CreateGroupResult 

type CreateGroupResult struct {
	Group GroupXML `xml:"Group"`
}

CreateGroupResult wraps the created group.

type CreateInstanceProfileResponse 

type CreateInstanceProfileResponse struct {
	XMLName                     xml.Name                    `xml:"CreateInstanceProfileResponse"`
	Xmlns                       string                      `xml:"xmlns,attr"`
	ResponseMetadata            ResponseMetadata            `xml:"ResponseMetadata"`
	CreateInstanceProfileResult CreateInstanceProfileResult `xml:"CreateInstanceProfileResult"`
}

CreateInstanceProfileResponse is the XML response for CreateInstanceProfile.

type CreateInstanceProfileResult 

type CreateInstanceProfileResult struct {
	InstanceProfile InstanceProfileXML `xml:"InstanceProfile"`
}

CreateInstanceProfileResult wraps the created instance profile.

type CreateLoginProfileResponse 

type CreateLoginProfileResponse struct {
	XMLName                  xml.Name                 `xml:"CreateLoginProfileResponse"`
	Xmlns                    string                   `xml:"xmlns,attr"`
	ResponseMetadata         ResponseMetadata         `xml:"ResponseMetadata"`
	CreateLoginProfileResult CreateLoginProfileResult `xml:"CreateLoginProfileResult"`
}

CreateLoginProfileResponse is the XML response for CreateLoginProfile.

type CreateLoginProfileResult 

type CreateLoginProfileResult struct {
	LoginProfile LoginProfileXML `xml:"LoginProfile"`
}

CreateLoginProfileResult wraps the created login profile.

type CreateOpenIDConnectProviderResponse 

type CreateOpenIDConnectProviderResponse struct {
	XMLName                           xml.Name                          `xml:"CreateOpenIDConnectProviderResponse"`
	Xmlns                             string                            `xml:"xmlns,attr"`
	CreateOpenIDConnectProviderResult CreateOpenIDConnectProviderResult `xml:"CreateOpenIDConnectProviderResult"`
	ResponseMetadata                  ResponseMetadata                  `xml:"ResponseMetadata"`
}

CreateOpenIDConnectProviderResponse is the XML response for CreateOpenIDConnectProvider.

type CreateOpenIDConnectProviderResult 

type CreateOpenIDConnectProviderResult struct {
	OpenIDConnectProviderArn string `xml:"OpenIDConnectProviderArn"`
}

CreateOpenIDConnectProviderResult wraps the ARN of the created OIDC provider.

type CreatePolicyResponse 

type CreatePolicyResponse struct {
	XMLName            xml.Name           `xml:"CreatePolicyResponse"`
	Xmlns              string             `xml:"xmlns,attr"`
	ResponseMetadata   ResponseMetadata   `xml:"ResponseMetadata"`
	CreatePolicyResult CreatePolicyResult `xml:"CreatePolicyResult"`
}

CreatePolicyResponse is the XML response for CreatePolicy.

type CreatePolicyResult 

type CreatePolicyResult struct {
	Policy PolicyXML `xml:"Policy"`
}

CreatePolicyResult wraps the created policy.

type CreatePolicyVersionResponse 

type CreatePolicyVersionResponse struct {
	XMLName                   xml.Name                  `xml:"CreatePolicyVersionResponse"`
	Xmlns                     string                    `xml:"xmlns,attr"`
	ResponseMetadata          ResponseMetadata          `xml:"ResponseMetadata"`
	CreatePolicyVersionResult CreatePolicyVersionResult `xml:"CreatePolicyVersionResult"`
}

CreatePolicyVersionResponse is the XML response for CreatePolicyVersion.

type CreatePolicyVersionResult 

type CreatePolicyVersionResult struct {
	PolicyVersion PolicyVersionXML `xml:"PolicyVersion"`
}

CreatePolicyVersionResult contains the created policy version details.

type CreateRoleResponse 

type CreateRoleResponse struct {
	XMLName          xml.Name         `xml:"CreateRoleResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
	CreateRoleResult CreateRoleResult `xml:"CreateRoleResult"`
}

CreateRoleResponse is the XML response for CreateRole.

type CreateRoleResult 

type CreateRoleResult struct {
	Role RoleXML `xml:"Role"`
}

CreateRoleResult wraps the created role.

type CreateSAMLProviderResponse 

type CreateSAMLProviderResponse struct {
	XMLName                  xml.Name                 `xml:"CreateSAMLProviderResponse"`
	Xmlns                    string                   `xml:"xmlns,attr"`
	CreateSAMLProviderResult CreateSAMLProviderResult `xml:"CreateSAMLProviderResult"`
	ResponseMetadata         ResponseMetadata         `xml:"ResponseMetadata"`
}

CreateSAMLProviderResponse is the XML response for CreateSAMLProvider.

type CreateSAMLProviderResult 

type CreateSAMLProviderResult struct {
	SAMLProviderArn string `xml:"SAMLProviderArn"`
}

CreateSAMLProviderResult wraps the ARN of the created SAML provider.

type CreateServiceLinkedRoleResponse 

type CreateServiceLinkedRoleResponse struct {
	XMLName                       xml.Name                      `xml:"CreateServiceLinkedRoleResponse"`
	Xmlns                         string                        `xml:"xmlns,attr"`
	ResponseMetadata              ResponseMetadata              `xml:"ResponseMetadata"`
	CreateServiceLinkedRoleResult CreateServiceLinkedRoleResult `xml:"CreateServiceLinkedRoleResult"`
}

CreateServiceLinkedRoleResponse is the XML response for CreateServiceLinkedRole.

type CreateServiceLinkedRoleResult 

type CreateServiceLinkedRoleResult struct {
	Role RoleXML `xml:"Role"`
}

CreateServiceLinkedRoleResult wraps the created role.

type CreateServiceSpecificCredentialResponse 

type CreateServiceSpecificCredentialResponse struct {
	XMLName                               xml.Name `xml:"CreateServiceSpecificCredentialResponse"`
	Xmlns                                 string   `xml:"xmlns,attr"`
	ResponseMetadata                      ResponseMetadata
	CreateServiceSpecificCredentialResult CreateServiceSpecificCredentialResult `xml:"CreateServiceSpecificCredentialResult"` //nolint:lll // AWS XML field name is necessarily long
}

CreateServiceSpecificCredentialResponse is the XML response for CreateServiceSpecificCredential.

type CreateServiceSpecificCredentialResult 

type CreateServiceSpecificCredentialResult struct {
	ServiceSpecificCredential ServiceSpecificCredentialXML `xml:"ServiceSpecificCredential"`
}

CreateServiceSpecificCredentialResult wraps the created credential.

type CreateUserResponse 

type CreateUserResponse struct {
	XMLName          xml.Name         `xml:"CreateUserResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
	CreateUserResult CreateUserResult `xml:"CreateUserResult"`
}

CreateUserResponse is the XML response for CreateUser.

type CreateUserResult 

type CreateUserResult struct {
	User UserXML `xml:"User"`
}

CreateUserResult wraps the created user.

type CreateVirtualMFADeviceResponse 

type CreateVirtualMFADeviceResponse struct {
	XMLName                      xml.Name                     `xml:"CreateVirtualMFADeviceResponse"`
	Xmlns                        string                       `xml:"xmlns,attr"`
	CreateVirtualMFADeviceResult CreateVirtualMFADeviceResult `xml:"CreateVirtualMFADeviceResult"`
	ResponseMetadata             ResponseMetadata             `xml:"ResponseMetadata"`
}

CreateVirtualMFADeviceResponse is the XML response for CreateVirtualMFADevice.

type CreateVirtualMFADeviceResult 

type CreateVirtualMFADeviceResult struct {
	VirtualMFADevice VirtualMFADeviceXML `xml:"VirtualMFADevice"`
}

CreateVirtualMFADeviceResult wraps the created MFA device.

type DelegationRequest 

type DelegationRequest struct {
	CreateDate      time.Time `json:"CreateDate"`
	DelegationID    string    `json:"DelegationId,omitempty"`
	TargetAccountID string    `json:"TargetAccountId,omitempty"`
	Status          string    `json:"Status,omitempty"`
	PolicyArn       string    `json:"PolicyArn,omitempty"`
}

DelegationRequest represents an IAM delegation request (stub).

type DelegationRequestXML 

type DelegationRequestXML struct {
	DelegationID    string `xml:"DelegationId"`
	TargetAccountID string `xml:"TargetAccountId"`
	Status          string `xml:"Status"`
	CreateDate      string `xml:"CreateDate"`
}

DelegationRequestXML is the XML representation of a delegation request.

type DeleteAccessKeyResponse 

type DeleteAccessKeyResponse struct {
	XMLName          xml.Name         `xml:"DeleteAccessKeyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteAccessKeyResponse is the XML response for DeleteAccessKey.

type DeleteAccountAliasResponse 

type DeleteAccountAliasResponse struct {
	XMLName          xml.Name         `xml:"DeleteAccountAliasResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteAccountAliasResponse is the XML response for DeleteAccountAlias.

type DeleteAccountPasswordPolicyResponse 

type DeleteAccountPasswordPolicyResponse struct {
	XMLName          xml.Name         `xml:"DeleteAccountPasswordPolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteAccountPasswordPolicyResponse is the XML response for DeleteAccountPasswordPolicy.

type DeleteGroupPolicyResponse 

type DeleteGroupPolicyResponse struct {
	XMLName          xml.Name         `xml:"DeleteGroupPolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteGroupPolicyResponse is the XML response for DeleteGroupPolicy.

type DeleteGroupResponse 

type DeleteGroupResponse struct {
	XMLName          xml.Name         `xml:"DeleteGroupResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteGroupResponse is the XML response for DeleteGroup.

type DeleteInstanceProfileResponse 

type DeleteInstanceProfileResponse struct {
	XMLName          xml.Name         `xml:"DeleteInstanceProfileResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteInstanceProfileResponse is the XML response for DeleteInstanceProfile.

type DeleteLoginProfileResponse 

type DeleteLoginProfileResponse struct {
	XMLName          xml.Name         `xml:"DeleteLoginProfileResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteLoginProfileResponse is the XML response for DeleteLoginProfile.

type DeleteOpenIDConnectProviderResponse 

type DeleteOpenIDConnectProviderResponse struct {
	XMLName          xml.Name         `xml:"DeleteOpenIDConnectProviderResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteOpenIDConnectProviderResponse is the XML response for DeleteOpenIDConnectProvider.

type DeletePolicyResponse 

type DeletePolicyResponse struct {
	XMLName          xml.Name         `xml:"DeletePolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeletePolicyResponse is the XML response for DeletePolicy.

type DeletePolicyVersionResponse 

type DeletePolicyVersionResponse struct {
	XMLName          xml.Name         `xml:"DeletePolicyVersionResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeletePolicyVersionResponse is the XML response for DeletePolicyVersion.

type DeleteRolePermissionsBoundaryResponse 

type DeleteRolePermissionsBoundaryResponse struct {
	XMLName          xml.Name         `xml:"DeleteRolePermissionsBoundaryResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteRolePermissionsBoundaryResponse is the XML response for DeleteRolePermissionsBoundary.

type DeleteRolePolicyResponse 

type DeleteRolePolicyResponse struct {
	XMLName          xml.Name         `xml:"DeleteRolePolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteRolePolicyResponse is the XML response for DeleteRolePolicy.

type DeleteRoleResponse 

type DeleteRoleResponse struct {
	XMLName          xml.Name         `xml:"DeleteRoleResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteRoleResponse is the XML response for DeleteRole.

type DeleteSAMLProviderResponse 

type DeleteSAMLProviderResponse struct {
	XMLName          xml.Name         `xml:"DeleteSAMLProviderResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteSAMLProviderResponse is the XML response for DeleteSAMLProvider.

type DeleteServiceSpecificCredentialResponse 

type DeleteServiceSpecificCredentialResponse struct {
	XMLName          xml.Name         `xml:"DeleteServiceSpecificCredentialResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteServiceSpecificCredentialResponse is the XML response for DeleteServiceSpecificCredential.

type DeleteUserPermissionsBoundaryResponse 

type DeleteUserPermissionsBoundaryResponse struct {
	XMLName          xml.Name         `xml:"DeleteUserPermissionsBoundaryResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteUserPermissionsBoundaryResponse is the XML response for DeleteUserPermissionsBoundary.

type DeleteUserPolicyResponse 

type DeleteUserPolicyResponse struct {
	XMLName          xml.Name         `xml:"DeleteUserPolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteUserPolicyResponse is the XML response for DeleteUserPolicy.

type DeleteUserResponse 

type DeleteUserResponse struct {
	XMLName          xml.Name         `xml:"DeleteUserResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteUserResponse is the XML response for DeleteUser.

type DeleteVirtualMFADeviceResponse 

type DeleteVirtualMFADeviceResponse struct {
	XMLName          xml.Name         `xml:"DeleteVirtualMFADeviceResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DeleteVirtualMFADeviceResponse is the XML response for DeleteVirtualMFADevice.

type DetachGroupPolicyResponse 

type DetachGroupPolicyResponse struct {
	XMLName          xml.Name         `xml:"DetachGroupPolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DetachGroupPolicyResponse is the XML response for DetachGroupPolicy.

type DetachRolePolicyResponse 

type DetachRolePolicyResponse struct {
	XMLName          xml.Name         `xml:"DetachRolePolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DetachRolePolicyResponse is the XML response for DetachRolePolicy.

type DetachUserPolicyResponse 

type DetachUserPolicyResponse struct {
	XMLName          xml.Name         `xml:"DetachUserPolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

DetachUserPolicyResponse is the XML response for DetachUserPolicy.

type EnforcementBackend 

type EnforcementBackend interface {
	GetUserByAccessKeyID(accessKeyID string) (*User, error)
	GetPoliciesForUser(userName string) ([]string, error)
}

EnforcementBackend is the minimal interface the IAM enforcement middleware requires from the IAM storage backend.

type EnforcementConfig 

type EnforcementConfig struct {
	// Global is the shared AWS configuration state.
	Global *config.GlobalConfig `json:"global,omitempty"`
	// ResourceProviders is a list of backends that can return resource-based
	// policies (e.g. S3 bucket policies, SQS queue policies).
	ResourceProviders []ResourcePolicyProvider `json:"resourceProviders,omitempty"`
	// ActionExtractors is an optional list of per-service extractors consulted
	// when the global ExtractIAMAction function cannot determine the IAM action
	// (e.g. for REST-based services that bypass the standard mappers).
	ActionExtractors []ActionExtractor `json:"actionExtractors,omitempty"`
}

type ErrorResponse 

type ErrorResponse struct {
	XMLName   xml.Name `xml:"ErrorResponse"`
	Xmlns     string   `xml:"xmlns,attr"`
	Error     IAMError `xml:"Error"`
	RequestID string   `xml:"RequestId"`
}

ErrorResponse is the IAM XML error envelope.

type EvalDecisionDetailEntry 

type EvalDecisionDetailEntry struct {
	Key   string `xml:"key"`
	Value string `xml:"value"`
}

EvalDecisionDetailEntry is a single entry in the EvalDecisionDetails map.

type EvaluationResult 

type EvaluationResult int

EvaluationResult is the outcome of IAM policy evaluation. 

const (
	// EvalImplicitDeny means no Allow statement matched — access is denied by default.
	EvalImplicitDeny EvaluationResult = iota
	// EvalAllow means an Allow statement matched and no Deny overrode it.
	EvalAllow
	// EvalExplicitDeny means an explicit Deny statement matched — access is denied.
	EvalExplicitDeny
)

func EvaluatePolicies 

func EvaluatePolicies(policyDocs []string, action, resource string, ctx ConditionContext) EvaluationResult

EvaluatePolicies evaluates a set of policy document JSON strings against a requested action and resource. Returns EvalAllow if any Allow statement matches the action and resource and no Deny statement matches. Returns EvalExplicitDeny if any Deny statement matches. Returns EvalImplicitDeny if no Allow statement matches.

The action is case-insensitive and supports wildcards (* and ?). The resource supports wildcards (* and ?).

ctx carries request-derived context values used to evaluate Condition blocks and to substitute policy variables. Pass an empty ConditionContext{} when no conditions or variables are needed.

type GenerateCredentialReportResponse 

type GenerateCredentialReportResponse struct {
	XMLName                        xml.Name                       `xml:"GenerateCredentialReportResponse"`
	Xmlns                          string                         `xml:"xmlns,attr"`
	GenerateCredentialReportResult GenerateCredentialReportResult `xml:"GenerateCredentialReportResult"`
	ResponseMetadata               ResponseMetadata               `xml:"ResponseMetadata"`
}

GenerateCredentialReportResponse is the XML response for GenerateCredentialReport.

type GenerateCredentialReportResult 

type GenerateCredentialReportResult struct {
	State       string `xml:"State"`
	Description string `xml:"Description,omitempty"`
}

GenerateCredentialReportResult contains the credential report generation state.

type GetAccessKeyLastUsedResponse 

type GetAccessKeyLastUsedResponse struct {
	XMLName                    xml.Name                   `xml:"GetAccessKeyLastUsedResponse"`
	Xmlns                      string                     `xml:"xmlns,attr"`
	ResponseMetadata           ResponseMetadata           `xml:"ResponseMetadata"`
	GetAccessKeyLastUsedResult GetAccessKeyLastUsedResult `xml:"GetAccessKeyLastUsedResult"`
}

GetAccessKeyLastUsedResponse is the XML response for GetAccessKeyLastUsed.

type GetAccessKeyLastUsedResult 

type GetAccessKeyLastUsedResult struct {
	UserName          string               `xml:"UserName"`
	AccessKeyLastUsed AccessKeyLastUsedXML `xml:"AccessKeyLastUsed"`
}

GetAccessKeyLastUsedResult contains the access key last used details.

type GetAccountAuthorizationDetailsResponse 

type GetAccountAuthorizationDetailsResponse struct {
	XMLName                              xml.Name                             `xml:"GetAccountAuthorizationDetailsResponse"` //nolint:lll // long XML element name
	Xmlns                                string                               `xml:"xmlns,attr"`
	ResponseMetadata                     ResponseMetadata                     `xml:"ResponseMetadata"`
	GetAccountAuthorizationDetailsResult GetAccountAuthorizationDetailsResult `xml:"GetAccountAuthorizationDetailsResult"`
}

GetAccountAuthorizationDetailsResponse is the XML response for GetAccountAuthorizationDetails.

type GetAccountAuthorizationDetailsResult 

type GetAccountAuthorizationDetailsResult struct {
	UserDetailList  []UserDetailXML          `xml:"UserDetailList>member"`
	GroupDetailList []GroupDetailXML         `xml:"GroupDetailList>member"`
	RoleDetailList  []RoleDetailXML          `xml:"RoleDetailList>member"`
	Policies        []ManagedPolicyDetailXML `xml:"Policies>member"`
	IsTruncated     bool                     `xml:"IsTruncated"`
}

GetAccountAuthorizationDetailsResult contains all IAM entity details.

type GetAccountPasswordPolicyResponse 

type GetAccountPasswordPolicyResponse struct {
	XMLName                        xml.Name                       `xml:"GetAccountPasswordPolicyResponse"`
	Xmlns                          string                         `xml:"xmlns,attr"`
	ResponseMetadata               ResponseMetadata               `xml:"ResponseMetadata"`
	GetAccountPasswordPolicyResult GetAccountPasswordPolicyResult `xml:"GetAccountPasswordPolicyResult"`
}

GetAccountPasswordPolicyResponse is the XML response for GetAccountPasswordPolicy.

type GetAccountPasswordPolicyResult 

type GetAccountPasswordPolicyResult struct {
	PasswordPolicy PasswordPolicyXML `xml:"PasswordPolicy"`
}

GetAccountPasswordPolicyResult contains the password policy.

type GetAccountSummaryResponse 

type GetAccountSummaryResponse struct {
	XMLName                 xml.Name                `xml:"GetAccountSummaryResponse"`
	Xmlns                   string                  `xml:"xmlns,attr"`
	ResponseMetadata        ResponseMetadata        `xml:"ResponseMetadata"`
	GetAccountSummaryResult GetAccountSummaryResult `xml:"GetAccountSummaryResult"`
}

GetAccountSummaryResponse is the XML response for GetAccountSummary.

type GetAccountSummaryResult 

type GetAccountSummaryResult struct {
	SummaryMap []AccountSummaryEntry `xml:"SummaryMap>entry"`
}

GetAccountSummaryResult contains the account summary map.

type GetContextKeysResponse 

type GetContextKeysResponse struct {
	XMLName              xml.Name             `xml:"GetContextKeysForCustomPolicyResponse"`
	Xmlns                string               `xml:"xmlns,attr"`
	ResponseMetadata     ResponseMetadata     `xml:"ResponseMetadata"`
	GetContextKeysResult GetContextKeysResult `xml:"GetContextKeysForCustomPolicyResult"`
}

GetContextKeysResponse is the XML response for GetContextKeysForCustomPolicy and GetContextKeysForPrincipalPolicy.

type GetContextKeysResult 

type GetContextKeysResult struct {
	ContextKeyNames []string `xml:"ContextKeyNames>member"`
}

GetContextKeysResult contains the distinct condition context keys referenced by the supplied policies.

type GetCredentialReportResponse 

type GetCredentialReportResponse struct {
	XMLName                   xml.Name                  `xml:"GetCredentialReportResponse"`
	Xmlns                     string                    `xml:"xmlns,attr"`
	GetCredentialReportResult GetCredentialReportResult `xml:"GetCredentialReportResult"`
	ResponseMetadata          ResponseMetadata          `xml:"ResponseMetadata"`
}

GetCredentialReportResponse is the XML response for GetCredentialReport.

type GetCredentialReportResult 

type GetCredentialReportResult struct {
	Content       string `xml:"Content"`
	ReportFormat  string `xml:"ReportFormat"`
	GeneratedTime string `xml:"GeneratedTime"`
}

GetCredentialReportResult contains the credential report content.

type GetGroupPolicyResponse 

type GetGroupPolicyResponse struct {
	XMLName              xml.Name             `xml:"GetGroupPolicyResponse"`
	Xmlns                string               `xml:"xmlns,attr"`
	GetGroupPolicyResult GetGroupPolicyResult `xml:"GetGroupPolicyResult"`
	ResponseMetadata     ResponseMetadata     `xml:"ResponseMetadata"`
}

GetGroupPolicyResponse is the XML response for GetGroupPolicy.

type GetGroupPolicyResult 

type GetGroupPolicyResult struct {
	GroupName      string `xml:"GroupName"`
	PolicyName     string `xml:"PolicyName"`
	PolicyDocument string `xml:"PolicyDocument"`
}

GetGroupPolicyResult contains the group inline policy details.

type GetGroupResponse 

type GetGroupResponse struct {
	XMLName          xml.Name         `xml:"GetGroupResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
	GetGroupResult   GetGroupResult   `xml:"GetGroupResult"`
}

GetGroupResponse is the XML response for GetGroup.

type GetGroupResult 

type GetGroupResult struct {
	Group       GroupXML  `xml:"Group"`
	Users       []UserXML `xml:"Users>member"`
	IsTruncated bool      `xml:"IsTruncated"`
}

GetGroupResult wraps a single group.

type GetInstanceProfileResponse 

type GetInstanceProfileResponse struct {
	XMLName                  xml.Name                 `xml:"GetInstanceProfileResponse"`
	Xmlns                    string                   `xml:"xmlns,attr"`
	ResponseMetadata         ResponseMetadata         `xml:"ResponseMetadata"`
	GetInstanceProfileResult GetInstanceProfileResult `xml:"GetInstanceProfileResult"`
}

GetInstanceProfileResponse is the XML response for GetInstanceProfile.

type GetInstanceProfileResult 

type GetInstanceProfileResult struct {
	InstanceProfile InstanceProfileXML `xml:"InstanceProfile"`
}

GetInstanceProfileResult wraps the instance profile.

type GetLoginProfileResponse 

type GetLoginProfileResponse struct {
	XMLName               xml.Name              `xml:"GetLoginProfileResponse"`
	Xmlns                 string                `xml:"xmlns,attr"`
	ResponseMetadata      ResponseMetadata      `xml:"ResponseMetadata"`
	GetLoginProfileResult GetLoginProfileResult `xml:"GetLoginProfileResult"`
}

GetLoginProfileResponse is the XML response for GetLoginProfile.

type GetLoginProfileResult 

type GetLoginProfileResult struct {
	LoginProfile LoginProfileXML `xml:"LoginProfile"`
}

GetLoginProfileResult wraps the login profile.

type GetMFADeviceResponse 

type GetMFADeviceResponse struct {
	XMLName            xml.Name           `xml:"GetMFADeviceResponse"`
	Xmlns              string             `xml:"xmlns,attr"`
	GetMFADeviceResult GetMFADeviceResult `xml:"GetMFADeviceResult"`
	ResponseMetadata   ResponseMetadata   `xml:"ResponseMetadata"`
}

GetMFADeviceResponse is the XML response for GetMFADevice.

type GetMFADeviceResult 

type GetMFADeviceResult struct {
	UserName     string `xml:"UserName,omitempty"`
	SerialNumber string `xml:"SerialNumber"`
	EnableDate   string `xml:"EnableDate"`
}

GetMFADeviceResult contains the details of a single MFA device.

type GetOpenIDConnectProviderResponse 

type GetOpenIDConnectProviderResponse struct {
	XMLName                        xml.Name                       `xml:"GetOpenIDConnectProviderResponse"`
	Xmlns                          string                         `xml:"xmlns,attr"`
	ResponseMetadata               ResponseMetadata               `xml:"ResponseMetadata"`
	GetOpenIDConnectProviderResult GetOpenIDConnectProviderResult `xml:"GetOpenIDConnectProviderResult"`
}

GetOpenIDConnectProviderResponse is the XML response for GetOpenIDConnectProvider.

type GetOpenIDConnectProviderResult 

type GetOpenIDConnectProviderResult struct {
	URL            string   `xml:"Url"`
	CreateDate     string   `xml:"CreateDate"`
	ClientIDList   []string `xml:"ClientIDList>member"`
	ThumbprintList []string `xml:"ThumbprintList>member"`
}

GetOpenIDConnectProviderResult contains OIDC provider details.

type GetPolicyResponse 

type GetPolicyResponse struct {
	XMLName          xml.Name         `xml:"GetPolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
	GetPolicyResult  GetPolicyResult  `xml:"GetPolicyResult"`
}

GetPolicyResponse is the XML response for GetPolicy.

type GetPolicyResult 

type GetPolicyResult struct {
	Policy PolicyXML `xml:"Policy"`
}

GetPolicyResult contains the policy details.

type GetPolicyVersionResponse 

type GetPolicyVersionResponse struct {
	XMLName                xml.Name               `xml:"GetPolicyVersionResponse"`
	Xmlns                  string                 `xml:"xmlns,attr"`
	ResponseMetadata       ResponseMetadata       `xml:"ResponseMetadata"`
	GetPolicyVersionResult GetPolicyVersionResult `xml:"GetPolicyVersionResult"`
}

GetPolicyVersionResponse is the XML response for GetPolicyVersion.

type GetPolicyVersionResult 

type GetPolicyVersionResult struct {
	PolicyVersion PolicyVersionXML `xml:"PolicyVersion"`
}

GetPolicyVersionResult contains the policy version details.

type GetRolePolicyResponse 

type GetRolePolicyResponse struct {
	XMLName             xml.Name            `xml:"GetRolePolicyResponse"`
	Xmlns               string              `xml:"xmlns,attr"`
	GetRolePolicyResult GetRolePolicyResult `xml:"GetRolePolicyResult"`
	ResponseMetadata    ResponseMetadata    `xml:"ResponseMetadata"`
}

GetRolePolicyResponse is the XML response for GetRolePolicy.

type GetRolePolicyResult 

type GetRolePolicyResult struct {
	RoleName       string `xml:"RoleName"`
	PolicyName     string `xml:"PolicyName"`
	PolicyDocument string `xml:"PolicyDocument"`
}

GetRolePolicyResult contains the role inline policy details.

type GetRoleResponse 

type GetRoleResponse struct {
	XMLName          xml.Name         `xml:"GetRoleResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
	GetRoleResult    GetRoleResult    `xml:"GetRoleResult"`
}

GetRoleResponse is the XML response for GetRole.

type GetRoleResult 

type GetRoleResult struct {
	Role RoleXML `xml:"Role"`
}

GetRoleResult wraps a single role.

type GetSAMLProviderResponse 

type GetSAMLProviderResponse struct {
	XMLName               xml.Name              `xml:"GetSAMLProviderResponse"`
	Xmlns                 string                `xml:"xmlns,attr"`
	GetSAMLProviderResult GetSAMLProviderResult `xml:"GetSAMLProviderResult"`
	ResponseMetadata      ResponseMetadata      `xml:"ResponseMetadata"`
}

GetSAMLProviderResponse is the XML response for GetSAMLProvider.

type GetSAMLProviderResult 

type GetSAMLProviderResult struct {
	SAMLMetadataDocument string `xml:"SAMLMetadataDocument"`
	ValidUntil           string `xml:"ValidUntil,omitempty"`
	CreateDate           string `xml:"CreateDate"`
}

GetSAMLProviderResult contains the SAML provider details.

type GetServiceLastAccessedDetailsResponse 

type GetServiceLastAccessedDetailsResponse struct {
	XMLName                             xml.Name                            `xml:"GetServiceLastAccessedDetailsResponse"`
	Xmlns                               string                              `xml:"xmlns,attr"`
	ResponseMetadata                    ResponseMetadata                    `xml:"ResponseMetadata"`
	GetServiceLastAccessedDetailsResult GetServiceLastAccessedDetailsResult `xml:"GetServiceLastAccessedDetailsResult"`
}

GetServiceLastAccessedDetailsResponse is the XML response for GetServiceLastAccessedDetails.

type GetServiceLastAccessedDetailsResult 

type GetServiceLastAccessedDetailsResult struct {
	JobStatus            string                         `xml:"JobStatus"`
	JobCreationDate      string                         `xml:"JobCreationDate"`
	JobCompletionDate    string                         `xml:"JobCompletionDate"`
	ServicesLastAccessed []ServiceLastAccessedDetailXML `xml:"ServicesLastAccessed>member"`
	IsTruncated          bool                           `xml:"IsTruncated"`
}

GetServiceLastAccessedDetailsResult contains the job status and services list.

type GetServiceLinkedRoleDeletionStatusResponse 

type GetServiceLinkedRoleDeletionStatusResponse struct {
	XMLName          xml.Name         `xml:"GetServiceLinkedRoleDeletionStatusResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
	// GetServiceLinkedRoleDeletionStatusResult mirrors the AWS API field name.
	GetServiceLinkedRoleDeletionStatusResult GetServiceLinkedRoleDeletionStatusResult `xml:"GetServiceLinkedRoleDeletionStatusResult"` //nolint:lll // AWS contract
}

GetServiceLinkedRoleDeletionStatusResponse is the XML response for GetServiceLinkedRoleDeletionStatus.

type GetServiceLinkedRoleDeletionStatusResult 

type GetServiceLinkedRoleDeletionStatusResult struct {
	Status string `xml:"Status"`
}

GetServiceLinkedRoleDeletionStatusResult contains the deletion status.

type GetUserPolicyResponse 

type GetUserPolicyResponse struct {
	XMLName             xml.Name            `xml:"GetUserPolicyResponse"`
	Xmlns               string              `xml:"xmlns,attr"`
	GetUserPolicyResult GetUserPolicyResult `xml:"GetUserPolicyResult"`
	ResponseMetadata    ResponseMetadata    `xml:"ResponseMetadata"`
}

GetUserPolicyResponse is the XML response for GetUserPolicy.

type GetUserPolicyResult 

type GetUserPolicyResult struct {
	UserName       string `xml:"UserName"`
	PolicyName     string `xml:"PolicyName"`
	PolicyDocument string `xml:"PolicyDocument"`
}

GetUserPolicyResult contains the user inline policy details.

type GetUserResponse 

type GetUserResponse struct {
	XMLName          xml.Name         `xml:"GetUserResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
	GetUserResult    GetUserResult    `xml:"GetUserResult"`
}

GetUserResponse is the XML response for GetUser.

type GetUserResult 

type GetUserResult struct {
	User UserXML `xml:"User"`
}

GetUserResult wraps a single user.

type Group 

type Group struct {
	Tags       map[string]string `json:"Tags,omitempty"`
	CreateDate time.Time         `json:"CreateDate"`
	GroupName  string            `json:"GroupName,omitempty"`
	GroupID    string            `json:"GroupId,omitempty"`
	Arn        string            `json:"Arn,omitempty"`
	Path       string            `json:"Path,omitempty"`
}

Group represents an IAM group resource.

type GroupDetail 

type GroupDetail struct {
	Group

	AttachedPolicies []AttachedPolicy    `json:"attachedPolicies,omitempty"`
	InlinePolicies   []InlinePolicyEntry `json:"inlinePolicies,omitempty"`
}

GroupDetail holds group data and all associated policies for GetAccountAuthorizationDetails.

type GroupDetailXML 

type GroupDetailXML struct {
	Path                    string                 `xml:"Path"`
	GroupName               string                 `xml:"GroupName"`
	GroupID                 string                 `xml:"GroupId"`
	Arn                     string                 `xml:"Arn"`
	CreateDate              string                 `xml:"CreateDate"`
	GroupPolicyList         []InlinePolicyEntryXML `xml:"GroupPolicyList>member"`
	AttachedManagedPolicies []AttachedPolicyXML    `xml:"AttachedManagedPolicies>member"`
}

GroupDetailXML is the per-group element in GetAccountAuthorizationDetails.

type GroupXML 

type GroupXML struct {
	Path       string   `xml:"Path"`
	GroupName  string   `xml:"GroupName"`
	GroupID    string   `xml:"GroupId"`
	Arn        string   `xml:"Arn"`
	CreateDate string   `xml:"CreateDate"`
	Tags       []TagXML `xml:"Tags>member,omitempty"`
}

GroupXML is the XML representation of an IAM Group.

type Handler 

type Handler struct {
	Backend StorageBackend `json:"backend"`
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for IAM operations.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new IAM handler with the given storage backend.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this IAM instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the IAM action from the request body.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the primary resource name from the IAM request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported IAM operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for IAM requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority for the IAM handler. Higher than Dashboard (50) but lower than DynamoDB/SSM (100).

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Purge 

func (h *Handler) Purge(ctx context.Context, cutoff time.Time)

Purge removes all resources older than the given cutoff time.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all in-memory state from the backend. It is used by the POST /_gopherstack/reset endpoint for CI pipelines and rapid local development.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable. It accepts both the current wrapped format and the legacy format (where data was the raw backend snapshot with no Handler-level wrapper), so older persisted snapshots still load correctly.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches IAM requests. IAM requests are form-encoded POSTs containing the IAM API version.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable. It combines the backend's own snapshot with Handler-level tag state.

type IAMError 

type IAMError struct {
	Code    string `xml:"Code"`
	Message string `xml:"Message"`
	Type    string `xml:"Type"`
}

IAMError (APIError) contains the IAM error code, message, and type.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend implements StorageBackend using in-memory maps.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates a new empty IAM InMemoryBackend with default account ID.

func NewInMemoryBackendWithConfig 

func NewInMemoryBackendWithConfig(accountID string) *InMemoryBackend

NewInMemoryBackendWithConfig creates a new IAM InMemoryBackend with the given account ID.

func (*InMemoryBackend) AcceptDelegationRequest 

func (b *InMemoryBackend) AcceptDelegationRequest(delegationID string) error

AcceptDelegationRequest accepts a delegation request (stub implementation).

func (*InMemoryBackend) AddClientIDToOpenIDConnectProvider 

func (b *InMemoryBackend) AddClientIDToOpenIDConnectProvider(providerArn, clientID string) error

AddClientIDToOpenIDConnectProvider appends a client ID to an existing OIDC provider. If the client ID is already present, the call is idempotent.

func (*InMemoryBackend) AddRoleToInstanceProfile 

func (b *InMemoryBackend) AddRoleToInstanceProfile(instanceProfileName, roleName string) error

AddRoleToInstanceProfile adds a role to an IAM instance profile.

func (*InMemoryBackend) AddUserToGroup 

func (b *InMemoryBackend) AddUserToGroup(groupName, userName string) error

AddUserToGroup adds a user to an IAM group, tracking the membership.

func (*InMemoryBackend) AssociateDelegationRequest 

func (b *InMemoryBackend) AssociateDelegationRequest(delegationID, policyArn string) error

AssociateDelegationRequest associates a delegation request with a policy ARN (stub implementation).

func (*InMemoryBackend) AttachGroupPolicy 

func (b *InMemoryBackend) AttachGroupPolicy(groupName, policyArn string) error

AttachGroupPolicy attaches a policy to a group.

func (*InMemoryBackend) AttachRolePolicy 

func (b *InMemoryBackend) AttachRolePolicy(roleName, policyArn string) error

AttachRolePolicy attaches a policy to a role.

func (*InMemoryBackend) AttachUserPolicy 

func (b *InMemoryBackend) AttachUserPolicy(userName, policyArn string) error

AttachUserPolicy attaches a policy to a user.

func (*InMemoryBackend) ChangePassword 

func (b *InMemoryBackend) ChangePassword(newPassword string) error

ChangePassword changes the IAM user password, validating against the account password policy. In real AWS, this operates on the currently authenticated user.

func (*InMemoryBackend) CreateAccessKey 

func (b *InMemoryBackend) CreateAccessKey(userName string) (*AccessKey, error)

CreateAccessKey creates a new access key for an IAM user.

func (*InMemoryBackend) CreateAccountAlias 

func (b *InMemoryBackend) CreateAccountAlias(alias string) error

CreateAccountAlias creates an account alias for the AWS account. In real AWS, at most one account alias may exist; this implementation allows replacing it.

func (*InMemoryBackend) CreateDelegationRequest 

func (b *InMemoryBackend) CreateDelegationRequest(targetAccountID string) (*DelegationRequest, error)

CreateDelegationRequest creates a delegation request (stub implementation).

func (*InMemoryBackend) CreateGroup 

func (b *InMemoryBackend) CreateGroup(groupName, path string) (*Group, error)

CreateGroup creates a new IAM group.

func (*InMemoryBackend) CreateInstanceProfile 

func (b *InMemoryBackend) CreateInstanceProfile(name, path string) (*InstanceProfile, error)

CreateInstanceProfile creates a new IAM instance profile.

func (*InMemoryBackend) CreateLoginProfile 

func (b *InMemoryBackend) CreateLoginProfile(
	userName, password string, passwordResetRequired bool,
) (*LoginProfile, error)

CreateLoginProfile creates a console login profile for an IAM user. The password is validated but not stored; this is an in-memory mock.

func (*InMemoryBackend) CreateOpenIDConnectProvider 

func (b *InMemoryBackend) CreateOpenIDConnectProvider(
	rawURL string, clientIDs, thumbprints []string,
) (*OIDCProvider, error)

CreateOpenIDConnectProvider creates a new IAM OIDC identity provider.

func (*InMemoryBackend) CreatePolicy 

func (b *InMemoryBackend) CreatePolicy(policyName, path, policyDocument string) (*Policy, error)

CreatePolicy creates a new IAM managed policy.

func (*InMemoryBackend) CreatePolicyVersion 

func (b *InMemoryBackend) CreatePolicyVersion(
	policyArn, policyDocument string, setAsDefault bool,
) (*StoredPolicyVersion, error)

CreatePolicyVersion creates a new version of an existing managed policy. Up to five versions can exist at once (AWS limit); this implementation enforces it. If setAsDefault is true, the new version becomes the default (and the policy document is updated).

func (*InMemoryBackend) CreateRole 

func (b *InMemoryBackend) CreateRole(
	roleName, path, assumeRolePolicyDocument, permissionsBoundary string,
) (*Role, error)

CreateRole creates a new IAM role.

func (*InMemoryBackend) CreateSAMLProvider 

func (b *InMemoryBackend) CreateSAMLProvider(name, samlMetadataDocument string) (*SAMLProvider, error)

CreateSAMLProvider creates a new IAM SAML identity provider. The provider name is used to build the ARN; it must be unique.

func (*InMemoryBackend) CreateServiceLinkedRole 

func (b *InMemoryBackend) CreateServiceLinkedRole(
	awsServiceName, description, customSuffix string,
) (*Role, error)

CreateServiceLinkedRole creates an IAM role that is linked to a specific AWS service. The role name is derived from the service name and optional custom suffix.

func (*InMemoryBackend) CreateServiceSpecificCredential 

func (b *InMemoryBackend) CreateServiceSpecificCredential(
	userName, serviceName string,
) (*ServiceSpecificCredential, error)

CreateServiceSpecificCredential creates service-specific credentials for an IAM user.

func (*InMemoryBackend) CreateUser 

func (b *InMemoryBackend) CreateUser(userName, path, permissionsBoundary string) (*User, error)

CreateUser creates a new IAM user.

func (*InMemoryBackend) CreateVirtualMFADevice 

func (b *InMemoryBackend) CreateVirtualMFADevice(virtualMFADeviceName, path string) (*VirtualMFADevice, error)

CreateVirtualMFADevice creates a virtual MFA device.

func (*InMemoryBackend) CreateVirtualMFADeviceFull 

func (b *InMemoryBackend) CreateVirtualMFADeviceFull(
	virtualMFADeviceName, path string,
) (*VirtualMFADevice, error)

CreateVirtualMFADeviceFull creates a virtual MFA device with QR code and seed data.

func (*InMemoryBackend) DeactivateMFADevice 

func (b *InMemoryBackend) DeactivateMFADevice(userName, serialNumber string) error

DeactivateMFADevice unlinks a virtual MFA device from a user. Returns an error if the device is not currently enabled.

func (*InMemoryBackend) DeleteAccessKey 

func (b *InMemoryBackend) DeleteAccessKey(userName, accessKeyID string) error

DeleteAccessKey deletes an access key by ID.

func (*InMemoryBackend) DeleteAccountAlias 

func (b *InMemoryBackend) DeleteAccountAlias(alias string) error

DeleteAccountAlias removes the specified account alias.

func (*InMemoryBackend) DeleteAccountPasswordPolicy 

func (b *InMemoryBackend) DeleteAccountPasswordPolicy() error

DeleteAccountPasswordPolicy removes the account password policy (resets to default).

func (*InMemoryBackend) DeleteGroup 

func (b *InMemoryBackend) DeleteGroup(groupName string) error

DeleteGroup deletes an IAM group by name.

func (*InMemoryBackend) DeleteGroupPolicy 

func (b *InMemoryBackend) DeleteGroupPolicy(groupName, policyName string) error

DeleteGroupPolicy removes an inline policy from a group.

func (*InMemoryBackend) DeleteInstanceProfile 

func (b *InMemoryBackend) DeleteInstanceProfile(name string) error

DeleteInstanceProfile deletes an IAM instance profile by name.

func (*InMemoryBackend) DeleteLoginProfile 

func (b *InMemoryBackend) DeleteLoginProfile(userName string) error

DeleteLoginProfile removes the console login profile for an IAM user.

func (*InMemoryBackend) DeleteOpenIDConnectProvider 

func (b *InMemoryBackend) DeleteOpenIDConnectProvider(providerArn string) error

DeleteOpenIDConnectProvider removes an OIDC provider by ARN.

func (*InMemoryBackend) DeletePolicy 

func (b *InMemoryBackend) DeletePolicy(policyArn string) error

DeletePolicy deletes an IAM policy by ARN.

func (*InMemoryBackend) DeletePolicyVersion 

func (b *InMemoryBackend) DeletePolicyVersion(policyArn, versionID string) error

DeletePolicyVersion deletes a non-default version of the managed policy.

func (*InMemoryBackend) DeleteRole 

func (b *InMemoryBackend) DeleteRole(roleName string) error

DeleteRole deletes an IAM role by name.

func (*InMemoryBackend) DeleteRolePermissionsBoundary 

func (b *InMemoryBackend) DeleteRolePermissionsBoundary(roleName string) error

DeleteRolePermissionsBoundary clears the permissions boundary on a role.

func (*InMemoryBackend) DeleteRolePolicy 

func (b *InMemoryBackend) DeleteRolePolicy(roleName, policyName string) error

DeleteRolePolicy removes an inline policy from a role.

func (*InMemoryBackend) DeleteSAMLProvider 

func (b *InMemoryBackend) DeleteSAMLProvider(providerArn string) error

DeleteSAMLProvider removes a SAML provider by ARN.

func (*InMemoryBackend) DeleteSSHPublicKey 

func (b *InMemoryBackend) DeleteSSHPublicKey(userName, keyID string) error

DeleteSSHPublicKey removes an SSH public key.

func (*InMemoryBackend) DeleteServerCertificate 

func (b *InMemoryBackend) DeleteServerCertificate(name string) error

DeleteServerCertificate removes a server certificate.

func (*InMemoryBackend) DeleteServiceLinkedRole 

func (b *InMemoryBackend) DeleteServiceLinkedRole(roleName string) error

DeleteServiceLinkedRole deletes a service-linked role, forcibly removing all attached managed and inline policies first. AWS deletes service-linked roles asynchronously; the mock is synchronous — callers receive SUCCEEDED immediately from GetServiceLinkedRoleDeletionStatus.

func (*InMemoryBackend) DeleteServiceSpecificCredential 

func (b *InMemoryBackend) DeleteServiceSpecificCredential(userName, credentialID string) error

DeleteServiceSpecificCredential deletes a service-specific credential.

func (*InMemoryBackend) DeleteSigningCertificate 

func (b *InMemoryBackend) DeleteSigningCertificate(certificateID string) error

DeleteSigningCertificate removes a signing certificate.

func (*InMemoryBackend) DeleteUser 

func (b *InMemoryBackend) DeleteUser(userName string) error

DeleteUser deletes an IAM user by name, removing all associated access keys and login profile.

func (*InMemoryBackend) DeleteUserPermissionsBoundary 

func (b *InMemoryBackend) DeleteUserPermissionsBoundary(userName string) error

DeleteUserPermissionsBoundary clears the permissions boundary on a user.

func (*InMemoryBackend) DeleteUserPolicy 

func (b *InMemoryBackend) DeleteUserPolicy(userName, policyName string) error

DeleteUserPolicy removes an inline policy from a user.

func (*InMemoryBackend) DeleteVirtualMFADevice 

func (b *InMemoryBackend) DeleteVirtualMFADevice(serialNumber string) error

DeleteVirtualMFADevice deletes a virtual MFA device by its serial number.

func (*InMemoryBackend) DetachGroupPolicy 

func (b *InMemoryBackend) DetachGroupPolicy(groupName, policyArn string) error

DetachGroupPolicy detaches a policy from a group.

func (*InMemoryBackend) DetachRolePolicy 

func (b *InMemoryBackend) DetachRolePolicy(roleName, policyArn string) error

DetachRolePolicy detaches a policy from a role.

func (*InMemoryBackend) DetachUserPolicy 

func (b *InMemoryBackend) DetachUserPolicy(userName, policyArn string) error

DetachUserPolicy detaches a policy from a user.

func (*InMemoryBackend) EnableMFADevice 

func (b *InMemoryBackend) EnableMFADevice(userName, serialNumber, authCode1, authCode2 string) error

EnableMFADevice links a virtual MFA device to a user. Returns an error if the device is already enabled (double-enable rejected).

func (*InMemoryBackend) GenerateOrganizationsAccessReport 

func (b *InMemoryBackend) GenerateOrganizationsAccessReport(_ string) string

GenerateOrganizationsAccessReport creates a new org access report job and returns its ID.

func (*InMemoryBackend) GenerateServiceLastAccessedDetailsForEntity 

func (b *InMemoryBackend) GenerateServiceLastAccessedDetailsForEntity(entityARN string) string

GenerateServiceLastAccessedDetailsForEntity creates a new access-advisor job for the given entity ARN.

func (*InMemoryBackend) GetAccessKeyLastUsed 

func (b *InMemoryBackend) GetAccessKeyLastUsed(accessKeyID string) (*AccessKeyLastUsed, error)

GetAccessKeyLastUsed returns last-use information for an access key. Returns real data if the key has been used (via RecordAccessKeyUsage); otherwise returns N/A.

func (*InMemoryBackend) GetAccountAuthorizationDetails 

func (b *InMemoryBackend) GetAccountAuthorizationDetails() AccountAuthorizationDetails

GetAccountAuthorizationDetails returns a full dump of all IAM entities and their policies.

func (*InMemoryBackend) GetAccountPasswordPolicy 

func (b *InMemoryBackend) GetAccountPasswordPolicy() *PasswordPolicy

GetAccountPasswordPolicy returns the current account password policy. Returns a default strict policy when none has been set.

func (*InMemoryBackend) GetAccountSummary 

func (b *InMemoryBackend) GetAccountSummary() AccountSummary

GetAccountSummary returns comprehensive account summary counts.

func (*InMemoryBackend) GetCredentialReport 

func (b *InMemoryBackend) GetCredentialReport() string

GetCredentialReport generates a realistic base64-encoded CSV credential report. Each user row reflects actual login-profile and access-key state.

func (*InMemoryBackend) GetGroup 

func (b *InMemoryBackend) GetGroup(groupName string) (*Group, error)

GetGroup retrieves a single IAM group by name.

func (*InMemoryBackend) GetGroupPolicy 

func (b *InMemoryBackend) GetGroupPolicy(groupName, policyName string) (string, error)

GetGroupPolicy retrieves an inline policy document from a group.

func (*InMemoryBackend) GetGroupUsers 

func (b *InMemoryBackend) GetGroupUsers(groupName string) ([]User, error)

GetGroupUsers returns the users that are members of the given group.

func (*InMemoryBackend) GetInstanceProfile 

func (b *InMemoryBackend) GetInstanceProfile(name string) (*InstanceProfile, error)

GetInstanceProfile retrieves a single IAM instance profile by name.

func (*InMemoryBackend) GetLoginProfile 

func (b *InMemoryBackend) GetLoginProfile(userName string) (*LoginProfile, error)

GetLoginProfile retrieves the console login profile for an IAM user.

func (*InMemoryBackend) GetMFADeviceOwner 

func (b *InMemoryBackend) GetMFADeviceOwner(serialNumber string) string

GetMFADeviceOwner returns the user name that owns the given MFA device, or "".

func (*InMemoryBackend) GetOpenIDConnectProvider 

func (b *InMemoryBackend) GetOpenIDConnectProvider(providerArn string) (*OIDCProvider, error)

GetOpenIDConnectProvider retrieves an OIDC provider by ARN.

func (*InMemoryBackend) GetOrganizationsAccessReport 

func (b *InMemoryBackend) GetOrganizationsAccessReport(jobID string) (string, time.Time, bool)

GetOrganizationsAccessReport retrieves the status of an org access report job.

func (*InMemoryBackend) GetPoliciesForUser 

func (b *InMemoryBackend) GetPoliciesForUser(userName string) ([]string, error)

GetPoliciesForUser returns the policy documents for all policies attached to the named user. Policies that are referenced but not found in the backend are silently skipped.

func (*InMemoryBackend) GetPolicy 

func (b *InMemoryBackend) GetPolicy(policyArn string) (*Policy, error)

GetPolicy returns the policy metadata for the given ARN.

func (*InMemoryBackend) GetPolicyVersion 

func (b *InMemoryBackend) GetPolicyVersion(
	policyArn, versionID string,
) (*StoredPolicyVersion, error)

GetPolicyVersion returns the requested version of a managed policy. If versionID is empty or "v1", the v1 (original) version info is returned.

func (*InMemoryBackend) GetRole 

func (b *InMemoryBackend) GetRole(roleName string) (*Role, error)

GetRole retrieves a single IAM role by name.

func (*InMemoryBackend) GetRoleByArn 

func (b *InMemoryBackend) GetRoleByArn(roleArn string) (*Role, error)

GetRoleByArn retrieves a single IAM role by its full ARN.

func (*InMemoryBackend) GetRolePolicy 

func (b *InMemoryBackend) GetRolePolicy(roleName, policyName string) (string, error)

GetRolePolicy retrieves an inline policy document from a role.

func (*InMemoryBackend) GetSAMLProvider 

func (b *InMemoryBackend) GetSAMLProvider(providerArn string) (*SAMLProvider, error)

GetSAMLProvider retrieves a SAML provider by ARN.

func (*InMemoryBackend) GetSSHPublicKey 

func (b *InMemoryBackend) GetSSHPublicKey(userName, keyID string) (*SSHPublicKey, error)

GetSSHPublicKey retrieves an SSH public key by user name and key ID.

func (*InMemoryBackend) GetServerCertificate 

func (b *InMemoryBackend) GetServerCertificate(name string) (*ServerCertificate, error)

GetServerCertificate retrieves a server certificate by name.

func (*InMemoryBackend) GetServiceLastAccessedDetails 

func (b *InMemoryBackend) GetServiceLastAccessedDetails(jobID string) (string, []ServiceLastAccessedDetail, error)

GetServiceLastAccessedDetails returns the access details for a given job ID. Returns job status and the list of service access details.

func (*InMemoryBackend) GetServiceLinkedRoleDeletionStatus 

func (b *InMemoryBackend) GetServiceLinkedRoleDeletionStatus(deletionTaskID string) (string, error)

GetServiceLinkedRoleDeletionStatus returns the status of a service-linked role deletion task. Gopherstack synchronously deletes service-linked roles, so status is always SUCCEEDED.

func (*InMemoryBackend) GetUser 

func (b *InMemoryBackend) GetUser(userName string) (*User, error)

GetUser retrieves a single IAM user by name.

func (*InMemoryBackend) GetUserByAccessKeyID 

func (b *InMemoryBackend) GetUserByAccessKeyID(accessKeyID string) (*User, error)

GetUserByAccessKeyID returns the User associated with the given access key ID. Returns ErrAccessKeyNotFound if no key with that ID exists.

func (*InMemoryBackend) GetUserPolicy 

func (b *InMemoryBackend) GetUserPolicy(userName, policyName string) (string, error)

GetUserPolicy retrieves an inline policy document from a user.

func (*InMemoryBackend) GetVirtualMFADevice 

func (b *InMemoryBackend) GetVirtualMFADevice(serialNumber string) (VirtualMFADevice, string, error)

GetVirtualMFADevice returns the virtual MFA device with the given serial number along with the user name it is currently assigned to (empty if unassigned). It returns ErrUserNotFound (mapped to NoSuchEntity) when no such device exists.

func (*InMemoryBackend) ListAccessKeys 

func (b *InMemoryBackend) ListAccessKeys(
	userName, marker string,
	maxItems int,
) (page.Page[AccessKey], error)

ListAccessKeys returns a paginated list of access keys for an IAM user.

func (*InMemoryBackend) ListAccountAliases 

func (b *InMemoryBackend) ListAccountAliases() []string

ListAccountAliases returns the current account aliases.

func (*InMemoryBackend) ListAllAccessKeys 

func (b *InMemoryBackend) ListAllAccessKeys() []AccessKey

ListAllAccessKeys returns all access keys (for dashboard).

func (*InMemoryBackend) ListAllGroups 

func (b *InMemoryBackend) ListAllGroups() []Group

ListAllGroups returns all groups (for dashboard).

func (*InMemoryBackend) ListAllInstanceProfiles 

func (b *InMemoryBackend) ListAllInstanceProfiles() []InstanceProfile

ListAllInstanceProfiles returns all instance profiles (for dashboard).

func (*InMemoryBackend) ListAllPolicies 

func (b *InMemoryBackend) ListAllPolicies() []Policy

ListAllPolicies returns all policies (for dashboard).

func (*InMemoryBackend) ListAllRoles 

func (b *InMemoryBackend) ListAllRoles() []Role

ListAllRoles returns all roles (for dashboard).

func (*InMemoryBackend) ListAllUsers 

func (b *InMemoryBackend) ListAllUsers() []User

ListAllUsers returns all users (for dashboard).

func (*InMemoryBackend) ListAttachedGroupPolicies 

func (b *InMemoryBackend) ListAttachedGroupPolicies(groupName string) ([]AttachedPolicy, error)

ListAttachedGroupPolicies returns all policy ARNs attached to the named group.

func (*InMemoryBackend) ListAttachedRolePolicies 

func (b *InMemoryBackend) ListAttachedRolePolicies(roleName string) ([]AttachedPolicy, error)

ListAttachedRolePolicies returns all policy ARNs attached to the named role.

func (*InMemoryBackend) ListAttachedUserPolicies 

func (b *InMemoryBackend) ListAttachedUserPolicies(userName string) ([]AttachedPolicy, error)

ListAttachedUserPolicies returns all policy ARNs attached to the named user.

func (*InMemoryBackend) ListEntitiesForPolicy 

func (b *InMemoryBackend) ListEntitiesForPolicy(policyArn, entityFilter string) (*PolicyEntities, error)

ListEntitiesForPolicy returns the users, groups, and roles that have the specified policy attached.

func (*InMemoryBackend) ListGroupPolicies 

func (b *InMemoryBackend) ListGroupPolicies(groupName string) ([]string, error)

ListGroupPolicies returns sorted inline policy names for a group.

func (*InMemoryBackend) ListGroups 

func (b *InMemoryBackend) ListGroups(marker string, maxItems int) (page.Page[Group], error)

ListGroups returns a paginated list of IAM groups sorted by name.

func (*InMemoryBackend) ListGroupsForUser 

func (b *InMemoryBackend) ListGroupsForUser(userName string) ([]Group, error)

ListGroupsForUser returns all groups that the specified user belongs to.

func (*InMemoryBackend) ListInstanceProfiles 

func (b *InMemoryBackend) ListInstanceProfiles(
	marker string,
	maxItems int,
) (page.Page[InstanceProfile], error)

ListInstanceProfiles returns a paginated list of IAM instance profiles sorted by name.

func (*InMemoryBackend) ListInstanceProfilesForRole 

func (b *InMemoryBackend) ListInstanceProfilesForRole(roleName string) ([]InstanceProfile, error)

ListInstanceProfilesForRole returns all instance profiles that contain the specified role.

func (*InMemoryBackend) ListMFADevicesForUser 

func (b *InMemoryBackend) ListMFADevicesForUser(userName string) ([]VirtualMFADevice, error)

ListMFADevicesForUser returns all MFA devices assigned to a user.

func (*InMemoryBackend) ListOpenIDConnectProviders 

func (b *InMemoryBackend) ListOpenIDConnectProviders() ([]OIDCProvider, error)

ListOpenIDConnectProviders returns all OIDC providers sorted by ARN.

func (*InMemoryBackend) ListPolicies 

func (b *InMemoryBackend) ListPolicies(marker string, maxItems int) (page.Page[Policy], error)

ListPolicies returns a paginated list of IAM policies sorted by name.

func (*InMemoryBackend) ListPolicyVersions 

func (b *InMemoryBackend) ListPolicyVersions(policyArn string) ([]StoredPolicyVersion, error)

ListPolicyVersions returns all stored versions for a managed policy, including v1.

func (*InMemoryBackend) ListRolePolicies 

func (b *InMemoryBackend) ListRolePolicies(roleName string) ([]string, error)

ListRolePolicies returns sorted inline policy names for a role.

func (*InMemoryBackend) ListRoles 

func (b *InMemoryBackend) ListRoles(marker string, maxItems int) (page.Page[Role], error)

ListRoles returns a paginated list of IAM roles sorted by name.

func (*InMemoryBackend) ListSAMLProviders 

func (b *InMemoryBackend) ListSAMLProviders() ([]SAMLProvider, error)

ListSAMLProviders returns all SAML providers sorted by ARN.

func (*InMemoryBackend) ListSSHPublicKeys 

func (b *InMemoryBackend) ListSSHPublicKeys(
	userName, marker string, maxItems int,
) (page.Page[SSHPublicKey], error)

ListSSHPublicKeys returns all SSH public keys for a user.

func (*InMemoryBackend) ListServerCertificates 

func (b *InMemoryBackend) ListServerCertificates(pathPrefix string) ([]ServerCertificate, error)

ListServerCertificates returns server certificates, filtered by path prefix if non-empty.

func (*InMemoryBackend) ListServiceSpecificCredentials 

func (b *InMemoryBackend) ListServiceSpecificCredentials(
	userName, serviceName string,
) ([]ServiceSpecificCredential, error)

ListServiceSpecificCredentials returns service-specific credentials for a user. If serviceName is non-empty, only credentials for that service are returned.

func (*InMemoryBackend) ListSigningCertificates 

func (b *InMemoryBackend) ListSigningCertificates(userName string) ([]SigningCertificate, error)

ListSigningCertificates returns all signing certificates for the given user. If userName is empty, all certificates are returned (admin usage).

func (*InMemoryBackend) ListUserPolicies 

func (b *InMemoryBackend) ListUserPolicies(userName string) ([]string, error)

ListUserPolicies returns sorted inline policy names for a user.

func (*InMemoryBackend) ListUsers 

func (b *InMemoryBackend) ListUsers(marker string, maxItems int) (page.Page[User], error)

ListUsers returns a paginated list of IAM users sorted by name.

func (*InMemoryBackend) ListVirtualMFADevices 

func (b *InMemoryBackend) ListVirtualMFADevices(marker string, maxItems int) (page.Page[VirtualMFADevice], error)

ListVirtualMFADevices returns a paginated list of virtual MFA devices.

func (*InMemoryBackend) OIDCProviderExists 

func (b *InMemoryBackend) OIDCProviderExists(issuerURL string) bool

OIDCProviderExists reports whether an OIDC provider with the given issuer URL exists. The issuer URL may or may not have a trailing slash; both forms are checked. This method implements the sts.OIDCLookup interface.

func (*InMemoryBackend) Purge 

func (b *InMemoryBackend) Purge(ctx context.Context, cutoff time.Time)

Purge removes all resources older than the given cutoff time.

func (*InMemoryBackend) PutGroupPolicy 

func (b *InMemoryBackend) PutGroupPolicy(groupName, policyName, policyDocument string) error

PutGroupPolicy creates or replaces an inline policy on a group.

func (*InMemoryBackend) PutRolePermissionsBoundary 

func (b *InMemoryBackend) PutRolePermissionsBoundary(roleName, policyArn string) error

PutRolePermissionsBoundary sets the permissions boundary on a role.

func (*InMemoryBackend) PutRolePolicy 

func (b *InMemoryBackend) PutRolePolicy(roleName, policyName, policyDocument string) error

PutRolePolicy creates or replaces an inline policy on a role.

func (*InMemoryBackend) PutUserPermissionsBoundary 

func (b *InMemoryBackend) PutUserPermissionsBoundary(userName, policyArn string) error

PutUserPermissionsBoundary sets the permissions boundary on a user.

func (*InMemoryBackend) PutUserPolicy 

func (b *InMemoryBackend) PutUserPolicy(userName, policyName, policyDocument string) error

PutUserPolicy creates or replaces an inline policy on a user.

func (*InMemoryBackend) RecordAccessKeyUsage 

func (b *InMemoryBackend) RecordAccessKeyUsage(accessKeyID, region, serviceName string)

RecordAccessKeyUsage updates the LastUsedDate, LastUsedRegion, and LastUsedServiceName for the given access key. Called from the auth layer on each authenticated request.

func (*InMemoryBackend) RecordServiceAccess 

func (b *InMemoryBackend) RecordServiceAccess(entityARN, serviceNamespace, serviceName string)

RecordServiceAccess records that an entity accessed a service.

func (*InMemoryBackend) RemoveClientIDFromOpenIDConnectProvider 

func (b *InMemoryBackend) RemoveClientIDFromOpenIDConnectProvider(providerArn, clientID string) error

RemoveClientIDFromOpenIDConnectProvider removes a client ID from an OIDC provider.

func (*InMemoryBackend) RemoveRoleFromInstanceProfile 

func (b *InMemoryBackend) RemoveRoleFromInstanceProfile(
	instanceProfileName, roleName string,
) error

RemoveRoleFromInstanceProfile removes a role from an IAM instance profile.

func (*InMemoryBackend) RemoveUserFromGroup 

func (b *InMemoryBackend) RemoveUserFromGroup(groupName, userName string) error

RemoveUserFromGroup removes a user from an IAM group.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all in-memory state from the backend. It is used by the POST /_gopherstack/reset endpoint for CI pipelines and rapid local development.

func (*InMemoryBackend) ResetComprehensiveBackend 

func (b *InMemoryBackend) ResetComprehensiveBackend()

ResetComprehensiveBackend clears all comprehensive backend state. Called from InMemoryBackend.Reset().

func (*InMemoryBackend) ResetServiceSpecificCredentialFull 

func (b *InMemoryBackend) ResetServiceSpecificCredentialFull(
	userName, credentialID string,
) (*ServiceSpecificCredential, error)

ResetServiceSpecificCredentialFull resets a service-specific credential (regenerates password).

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) ResyncMFADevice 

func (b *InMemoryBackend) ResyncMFADevice(userName, serialNumber, authCode1, authCode2 string) error

ResyncMFADevice resynchronizes the named virtual MFA device for a user. AWS validates that the user exists and that the MFA device is associated with that user; the resync itself stores no additional state (no TOTP validation is performed in the mock). It returns ErrUserNotFound (NoSuchEntity) when the user or association is missing.

func (*InMemoryBackend) SetDefaultPolicyVersion 

func (b *InMemoryBackend) SetDefaultPolicyVersion(policyArn, versionID string) error

SetDefaultPolicyVersion sets the specified version as the default for the managed policy.

func (*InMemoryBackend) SimulateCustomPolicy 

func (b *InMemoryBackend) SimulateCustomPolicy(
	policyInputList, permissionsBoundaryPolicyInputList, actionNames, resourceArns []string,
	ctx ConditionContext,
) ([]SimulationResult, error)

SimulateCustomPolicy simulates the effect of one or more custom IAM policies against a set of actions and resources. This is a best-effort simulation — results are authoritative only for policies provided directly.

func (*InMemoryBackend) SimulatePrincipalPolicy 

func (b *InMemoryBackend) SimulatePrincipalPolicy(
	principalArn, callerArn, resourceOwner string,
	resourcePolicyList, actionNames, resourceArns []string, ctx ConditionContext,
) ([]SimulationResult, error)

SimulatePrincipalPolicy evaluates a set of actions against a set of resources for the given principal ARN, returning a result per action×resource pair.

Supported principal ARN formats:

  • arn:aws:iam::<account>:user/<name>
  • arn:aws:iam::<account>:role/<name>

Permission boundaries are enforced: effective permissions = identity policies ∩ boundary. An allow is only returned if both the identity policies allow AND the boundary allows.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) TagGroup 

func (b *InMemoryBackend) TagGroup(groupName string, tags map[string]string) error

TagGroup merges the given key-value pairs into the group's Tags field.

func (*InMemoryBackend) TagPolicy 

func (b *InMemoryBackend) TagPolicy(policyArn string, tags map[string]string) error

TagPolicy merges the given key-value pairs into the policy's Tags field.

func (*InMemoryBackend) TagRole 

func (b *InMemoryBackend) TagRole(roleName string, tags map[string]string) error

TagRole merges the given key-value pairs into the role's Tags field.

func (*InMemoryBackend) TagUser 

func (b *InMemoryBackend) TagUser(userName string, tags map[string]string) error

TagUser merges the given key-value pairs into the user's Tags field.

func (*InMemoryBackend) UntagGroup 

func (b *InMemoryBackend) UntagGroup(groupName string, keys []string) error

UntagGroup removes the given keys from the group's Tags field.

func (*InMemoryBackend) UntagPolicy 

func (b *InMemoryBackend) UntagPolicy(policyArn string, keys []string) error

UntagPolicy removes the given keys from the policy's Tags field.

func (*InMemoryBackend) UntagRole 

func (b *InMemoryBackend) UntagRole(roleName string, keys []string) error

UntagRole removes the given keys from the role's Tags field.

func (*InMemoryBackend) UntagUser 

func (b *InMemoryBackend) UntagUser(userName string, keys []string) error

UntagUser removes the given keys from the user's Tags field.

func (*InMemoryBackend) UpdateAccessKey 

func (b *InMemoryBackend) UpdateAccessKey(userName, accessKeyID, status string) error

UpdateAccessKey updates the status of an access key (Active or Inactive).

func (*InMemoryBackend) UpdateAccountPasswordPolicy 

func (b *InMemoryBackend) UpdateAccountPasswordPolicy(pp PasswordPolicy) error

UpdateAccountPasswordPolicy stores the account password policy.

func (*InMemoryBackend) UpdateAssumeRolePolicy 

func (b *InMemoryBackend) UpdateAssumeRolePolicy(roleName, policyDocument string) error

UpdateAssumeRolePolicy updates the assume-role policy document on a role.

func (*InMemoryBackend) UpdateGroup 

func (b *InMemoryBackend) UpdateGroup(groupName, newPath, newGroupName string) error

UpdateGroup renames a group and/or updates its path.

func (*InMemoryBackend) UpdateLoginProfile 

func (b *InMemoryBackend) UpdateLoginProfile(
	userName, password string, passwordResetRequired bool,
) error

UpdateLoginProfile updates the console login profile for an IAM user.

func (*InMemoryBackend) UpdateOpenIDConnectProviderThumbprint 

func (b *InMemoryBackend) UpdateOpenIDConnectProviderThumbprint(providerArn string, thumbprints []string) error

UpdateOpenIDConnectProviderThumbprint replaces the thumbprint list for an existing OIDC provider.

func (*InMemoryBackend) UpdateRole 

func (b *InMemoryBackend) UpdateRole(roleName, description string) error

UpdateRole updates the description of an IAM role.

func (*InMemoryBackend) UpdateRoleMaxSessionDuration 

func (b *InMemoryBackend) UpdateRoleMaxSessionDuration(
	roleName string,
	maxSessionDuration int32,
) error

UpdateRoleMaxSessionDuration sets the maximum session duration for a role.

func (*InMemoryBackend) UpdateSAMLProvider 

func (b *InMemoryBackend) UpdateSAMLProvider(providerArn, samlMetadataDocument string) (*SAMLProvider, error)

UpdateSAMLProvider replaces the SAML metadata document for an existing provider.

func (*InMemoryBackend) UpdateSSHPublicKey 

func (b *InMemoryBackend) UpdateSSHPublicKey(userName, keyID, status string) error

UpdateSSHPublicKey updates the status of an SSH public key.

func (*InMemoryBackend) UpdateServerCertificate 

func (b *InMemoryBackend) UpdateServerCertificate(name, newName, newPath string) error

UpdateServerCertificate renames a server certificate and/or changes its path.

func (*InMemoryBackend) UpdateServiceSpecificCredential 

func (b *InMemoryBackend) UpdateServiceSpecificCredential(
	userName, credentialID, status string,
) error

UpdateServiceSpecificCredential updates the status of a service-specific credential.

func (*InMemoryBackend) UpdateSigningCertificate 

func (b *InMemoryBackend) UpdateSigningCertificate(certificateID, status string) error

UpdateSigningCertificate changes the status of a signing certificate (Active/Inactive).

func (*InMemoryBackend) UpdateUser 

func (b *InMemoryBackend) UpdateUser(userName, newPath, newUserName string) error

UpdateUser renames a user and/or updates their path. If newUserName is non-empty the user is renamed; if newPath is non-empty the path is updated.

func (*InMemoryBackend) UploadSSHPublicKey 

func (b *InMemoryBackend) UploadSSHPublicKey(userName, body string) (*SSHPublicKey, error)

UploadSSHPublicKey stores an SSH public key for a user.

func (*InMemoryBackend) UploadServerCertificate 

func (b *InMemoryBackend) UploadServerCertificate(name, path, certBody, certChain string) (*ServerCertificate, error)

UploadServerCertificate stores a new server certificate.

func (*InMemoryBackend) UploadSigningCertificate 

func (b *InMemoryBackend) UploadSigningCertificate(userName, body string) (*SigningCertificate, error)

UploadSigningCertificate stores a new X.509 signing certificate for a user.

type InlinePolicyEntry 

type InlinePolicyEntry struct {
	PolicyName     string `json:"policyName,omitempty"`
	PolicyDocument string `json:"policyDocument,omitempty"`
}

InlinePolicyEntry is an inline policy name/document pair used in AccountAuthorizationDetails.

type InlinePolicyEntryXML 

type InlinePolicyEntryXML struct {
	PolicyName     string `xml:"PolicyName"`
	PolicyDocument string `xml:"PolicyDocument"`
}

InlinePolicyEntryXML is an inline policy name/document pair in GetAccountAuthorizationDetails.

type InstanceProfile 

type InstanceProfile struct {
	CreateDate          time.Time `json:"CreateDate"`
	InstanceProfileName string    `json:"InstanceProfileName,omitempty"`
	InstanceProfileID   string    `json:"InstanceProfileId,omitempty"`
	Arn                 string    `json:"Arn,omitempty"`
	Path                string    `json:"Path,omitempty"`
	Roles               []string  `json:"Roles,omitempty"`
}

InstanceProfile represents an IAM instance profile.

type InstanceProfileXML 

type InstanceProfileXML struct {
	Path                string    `xml:"Path"`
	InstanceProfileName string    `xml:"InstanceProfileName"`
	InstanceProfileID   string    `xml:"InstanceProfileId"`
	Arn                 string    `xml:"Arn"`
	CreateDate          string    `xml:"CreateDate"`
	Roles               []RoleXML `xml:"Roles>member"`
}

InstanceProfileXML is the XML representation of an IAM InstanceProfile.

type ListAccessKeysResponse 

type ListAccessKeysResponse struct {
	XMLName              xml.Name             `xml:"ListAccessKeysResponse"`
	Xmlns                string               `xml:"xmlns,attr"`
	ResponseMetadata     ResponseMetadata     `xml:"ResponseMetadata"`
	ListAccessKeysResult ListAccessKeysResult `xml:"ListAccessKeysResult"`
}

ListAccessKeysResponse is the XML response for ListAccessKeys.

type ListAccessKeysResult 

type ListAccessKeysResult struct {
	Marker            string                 `xml:"Marker,omitempty"`
	AccessKeyMetadata []AccessKeyMetadataXML `xml:"AccessKeyMetadata>member"`
	IsTruncated       bool                   `xml:"IsTruncated"`
}

ListAccessKeysResult contains the list of access key metadata.

type ListAccountAliasesResponse 

type ListAccountAliasesResponse struct {
	XMLName                  xml.Name                 `xml:"ListAccountAliasesResponse"`
	Xmlns                    string                   `xml:"xmlns,attr"`
	ResponseMetadata         ResponseMetadata         `xml:"ResponseMetadata"`
	ListAccountAliasesResult ListAccountAliasesResult `xml:"ListAccountAliasesResult"`
}

ListAccountAliasesResponse is the XML response for ListAccountAliases.

type ListAccountAliasesResult 

type ListAccountAliasesResult struct {
	AccountAliases []string `xml:"AccountAliases>member"`
	IsTruncated    bool     `xml:"IsTruncated"`
}

ListAccountAliasesResult contains the list of account aliases.

type ListAttachedGroupPoliciesResponse 

type ListAttachedGroupPoliciesResponse struct {
	XMLName                         xml.Name                        `xml:"ListAttachedGroupPoliciesResponse"`
	Xmlns                           string                          `xml:"xmlns,attr"`
	ResponseMetadata                ResponseMetadata                `xml:"ResponseMetadata"`
	ListAttachedGroupPoliciesResult ListAttachedGroupPoliciesResult `xml:"ListAttachedGroupPoliciesResult"`
}

ListAttachedGroupPoliciesResponse is the XML response for ListAttachedGroupPolicies.

type ListAttachedGroupPoliciesResult 

type ListAttachedGroupPoliciesResult struct {
	AttachedPolicies []AttachedPolicyXML `xml:"AttachedPolicies>member"`
	IsTruncated      bool                `xml:"IsTruncated"`
}

ListAttachedGroupPoliciesResult contains the list of attached policies for a group.

type ListAttachedRolePoliciesResponse 

type ListAttachedRolePoliciesResponse struct {
	XMLName                        xml.Name                       `xml:"ListAttachedRolePoliciesResponse"`
	Xmlns                          string                         `xml:"xmlns,attr"`
	ResponseMetadata               ResponseMetadata               `xml:"ResponseMetadata"`
	ListAttachedRolePoliciesResult ListAttachedRolePoliciesResult `xml:"ListAttachedRolePoliciesResult"`
}

ListAttachedRolePoliciesResponse is the XML response for ListAttachedRolePolicies.

type ListAttachedRolePoliciesResult 

type ListAttachedRolePoliciesResult struct {
	AttachedPolicies []AttachedPolicyXML `xml:"AttachedPolicies>member"`
	IsTruncated      bool                `xml:"IsTruncated"`
}

ListAttachedRolePoliciesResult contains the list of attached policies for a role.

type ListAttachedUserPoliciesResponse 

type ListAttachedUserPoliciesResponse struct {
	XMLName                        xml.Name                       `xml:"ListAttachedUserPoliciesResponse"`
	Xmlns                          string                         `xml:"xmlns,attr"`
	ResponseMetadata               ResponseMetadata               `xml:"ResponseMetadata"`
	ListAttachedUserPoliciesResult ListAttachedUserPoliciesResult `xml:"ListAttachedUserPoliciesResult"`
}

ListAttachedUserPoliciesResponse is the XML response for ListAttachedUserPolicies.

type ListAttachedUserPoliciesResult 

type ListAttachedUserPoliciesResult struct {
	AttachedPolicies []AttachedPolicyXML `xml:"AttachedPolicies>member"`
	IsTruncated      bool                `xml:"IsTruncated"`
}

ListAttachedUserPoliciesResult contains the list of attached policies.

type ListEntitiesForPolicyResponse 

type ListEntitiesForPolicyResponse struct {
	XMLName                     xml.Name                    `xml:"ListEntitiesForPolicyResponse"`
	Xmlns                       string                      `xml:"xmlns,attr"`
	ResponseMetadata            ResponseMetadata            `xml:"ResponseMetadata"`
	ListEntitiesForPolicyResult ListEntitiesForPolicyResult `xml:"ListEntitiesForPolicyResult"`
}

ListEntitiesForPolicyResponse is the XML response for ListEntitiesForPolicy.

type ListEntitiesForPolicyResult 

type ListEntitiesForPolicyResult struct {
	PolicyUsers  []PolicyEntityUser  `xml:"PolicyUsers>member"`
	PolicyGroups []PolicyEntityGroup `xml:"PolicyGroups>member"`
	PolicyRoles  []PolicyEntityRole  `xml:"PolicyRoles>member"`
	IsTruncated  bool                `xml:"IsTruncated"`
}

ListEntitiesForPolicyResult contains the policy entity lists.

type ListGroupPoliciesResponse 

type ListGroupPoliciesResponse struct {
	XMLName                 xml.Name                `xml:"ListGroupPoliciesResponse"`
	Xmlns                   string                  `xml:"xmlns,attr"`
	ResponseMetadata        ResponseMetadata        `xml:"ResponseMetadata"`
	ListGroupPoliciesResult ListGroupPoliciesResult `xml:"ListGroupPoliciesResult"`
}

ListGroupPoliciesResponse is the XML response for ListGroupPolicies.

type ListGroupPoliciesResult 

type ListGroupPoliciesResult struct {
	PolicyNames []string `xml:"PolicyNames>member"`
	IsTruncated bool     `xml:"IsTruncated"`
}

ListGroupPoliciesResult contains the list of inline policy names for a group.

type ListGroupsForUserResponse 

type ListGroupsForUserResponse struct {
	XMLName                 xml.Name                `xml:"ListGroupsForUserResponse"`
	Xmlns                   string                  `xml:"xmlns,attr"`
	ResponseMetadata        ResponseMetadata        `xml:"ResponseMetadata"`
	ListGroupsForUserResult ListGroupsForUserResult `xml:"ListGroupsForUserResult"`
}

ListGroupsForUserResponse is the XML response for ListGroupsForUser.

type ListGroupsForUserResult 

type ListGroupsForUserResult struct {
	Groups      []ListGroupsForUserXML `xml:"Groups>member"`
	IsTruncated bool                   `xml:"IsTruncated"`
}

ListGroupsForUserResult contains the list of groups.

type ListGroupsForUserXML 

type ListGroupsForUserXML struct {
	GroupName  string `xml:"GroupName"`
	GroupID    string `xml:"GroupId"`
	Arn        string `xml:"Arn"`
	Path       string `xml:"Path"`
	CreateDate string `xml:"CreateDate"`
}

ListGroupsForUserXML holds a single group entry returned by ListGroupsForUser.

type ListGroupsResponse 

type ListGroupsResponse struct {
	XMLName          xml.Name         `xml:"ListGroupsResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
	ListGroupsResult ListGroupsResult `xml:"ListGroupsResult"`
}

ListGroupsResponse is the XML response for ListGroups.

type ListGroupsResult 

type ListGroupsResult struct {
	Marker      string     `xml:"Marker,omitempty"`
	Groups      []GroupXML `xml:"Groups>member"`
	IsTruncated bool       `xml:"IsTruncated"`
}

ListGroupsResult contains the list of groups.

type ListInstanceProfilesForRoleResponse 

type ListInstanceProfilesForRoleResponse struct {
	XMLName                           xml.Name                          `xml:"ListInstanceProfilesForRoleResponse"`
	Xmlns                             string                            `xml:"xmlns,attr"`
	ResponseMetadata                  ResponseMetadata                  `xml:"ResponseMetadata"`
	ListInstanceProfilesForRoleResult ListInstanceProfilesForRoleResult `xml:"ListInstanceProfilesForRoleResult"`
}

ListInstanceProfilesForRoleResponse is the XML response for ListInstanceProfilesForRole.

type ListInstanceProfilesForRoleResult 

type ListInstanceProfilesForRoleResult struct {
	InstanceProfiles []InstanceProfileXML `xml:"InstanceProfiles>member"`
	IsTruncated      bool                 `xml:"IsTruncated"`
}

ListInstanceProfilesForRoleResult contains the instance profile list.

type ListInstanceProfilesResponse 

type ListInstanceProfilesResponse struct {
	XMLName                    xml.Name                   `xml:"ListInstanceProfilesResponse"`
	Xmlns                      string                     `xml:"xmlns,attr"`
	ResponseMetadata           ResponseMetadata           `xml:"ResponseMetadata"`
	ListInstanceProfilesResult ListInstanceProfilesResult `xml:"ListInstanceProfilesResult"`
}

ListInstanceProfilesResponse is the XML response for ListInstanceProfiles.

type ListInstanceProfilesResult 

type ListInstanceProfilesResult struct {
	Marker           string               `xml:"Marker,omitempty"`
	InstanceProfiles []InstanceProfileXML `xml:"InstanceProfiles>member"`
	IsTruncated      bool                 `xml:"IsTruncated"`
}

ListInstanceProfilesResult contains the list of instance profiles.

type ListOpenIDConnectProvidersResponse 

type ListOpenIDConnectProvidersResponse struct {
	XMLName                          xml.Name                         `xml:"ListOpenIDConnectProvidersResponse"`
	Xmlns                            string                           `xml:"xmlns,attr"`
	ResponseMetadata                 ResponseMetadata                 `xml:"ResponseMetadata"`
	ListOpenIDConnectProvidersResult ListOpenIDConnectProvidersResult `xml:"ListOpenIDConnectProvidersResult"`
}

ListOpenIDConnectProvidersResponse is the XML response for ListOpenIDConnectProviders.

type ListOpenIDConnectProvidersResult 

type ListOpenIDConnectProvidersResult struct {
	OpenIDConnectProviderList []OIDCProviderListEntryXML `xml:"OpenIDConnectProviderList>member"`
}

ListOpenIDConnectProvidersResult contains the list of OIDC providers.

type ListPoliciesResponse 

type ListPoliciesResponse struct {
	XMLName            xml.Name           `xml:"ListPoliciesResponse"`
	Xmlns              string             `xml:"xmlns,attr"`
	ResponseMetadata   ResponseMetadata   `xml:"ResponseMetadata"`
	ListPoliciesResult ListPoliciesResult `xml:"ListPoliciesResult"`
}

ListPoliciesResponse is the XML response for ListPolicies.

type ListPoliciesResult 

type ListPoliciesResult struct {
	Marker      string      `xml:"Marker,omitempty"`
	Policies    []PolicyXML `xml:"Policies>member"`
	IsTruncated bool        `xml:"IsTruncated"`
}

ListPoliciesResult contains the list of policies.

type ListPolicyVersionsResponse 

type ListPolicyVersionsResponse struct {
	XMLName                  xml.Name                 `xml:"ListPolicyVersionsResponse"`
	Xmlns                    string                   `xml:"xmlns,attr"`
	ResponseMetadata         ResponseMetadata         `xml:"ResponseMetadata"`
	ListPolicyVersionsResult ListPolicyVersionsResult `xml:"ListPolicyVersionsResult"`
}

ListPolicyVersionsResponse is the XML response for ListPolicyVersions.

type ListPolicyVersionsResult 

type ListPolicyVersionsResult struct {
	Versions []PolicyVersionXML `xml:"Versions>member"`
}

ListPolicyVersionsResult contains the policy version list.

type ListRolePoliciesResponse 

type ListRolePoliciesResponse struct {
	XMLName                xml.Name               `xml:"ListRolePoliciesResponse"`
	Xmlns                  string                 `xml:"xmlns,attr"`
	ResponseMetadata       ResponseMetadata       `xml:"ResponseMetadata"`
	ListRolePoliciesResult ListRolePoliciesResult `xml:"ListRolePoliciesResult"`
}

ListRolePoliciesResponse is the XML response for ListRolePolicies.

type ListRolePoliciesResult 

type ListRolePoliciesResult struct {
	PolicyNames []string `xml:"PolicyNames>member"`
	IsTruncated bool     `xml:"IsTruncated"`
}

ListRolePoliciesResult contains the list of inline policy names for a role.

type ListRolesResponse 

type ListRolesResponse struct {
	XMLName          xml.Name         `xml:"ListRolesResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
	ListRolesResult  ListRolesResult  `xml:"ListRolesResult"`
}

ListRolesResponse is the XML response for ListRoles.

type ListRolesResult 

type ListRolesResult struct {
	Marker      string    `xml:"Marker,omitempty"`
	Roles       []RoleXML `xml:"Roles>member"`
	IsTruncated bool      `xml:"IsTruncated"`
}

ListRolesResult contains the list of roles.

type ListSAMLProvidersResponse 

type ListSAMLProvidersResponse struct {
	XMLName                 xml.Name                `xml:"ListSAMLProvidersResponse"`
	Xmlns                   string                  `xml:"xmlns,attr"`
	ResponseMetadata        ResponseMetadata        `xml:"ResponseMetadata"`
	ListSAMLProvidersResult ListSAMLProvidersResult `xml:"ListSAMLProvidersResult"`
}

ListSAMLProvidersResponse is the XML response for ListSAMLProviders.

type ListSAMLProvidersResult 

type ListSAMLProvidersResult struct {
	SAMLProviderList []SAMLProviderListEntryXML `xml:"SAMLProviderList>member"`
}

ListSAMLProvidersResult contains the list of SAML providers.

type ListServiceSpecificCredentialsResponse 

type ListServiceSpecificCredentialsResponse struct {
	XMLName xml.Name                             `xml:"ListServiceSpecificCredentialsResponse"`
	Xmlns   string                               `xml:"xmlns,attr"`
	Meta    ResponseMetadata                     `xml:"ResponseMetadata"`
	Result  ListServiceSpecificCredentialsResult `xml:"ListServiceSpecificCredentialsResult"`
}

ListServiceSpecificCredentialsResponse is the XML response for ListServiceSpecificCredentials.

type ListServiceSpecificCredentialsResult 

type ListServiceSpecificCredentialsResult struct {
	ServiceSpecificCredentials []ServiceSpecificCredentialMetadataXML `xml:"ServiceSpecificCredentials>member"`
}

ListServiceSpecificCredentialsResult contains the list of credentials.

type ListUserPoliciesResponse 

type ListUserPoliciesResponse struct {
	XMLName                xml.Name               `xml:"ListUserPoliciesResponse"`
	Xmlns                  string                 `xml:"xmlns,attr"`
	ResponseMetadata       ResponseMetadata       `xml:"ResponseMetadata"`
	ListUserPoliciesResult ListUserPoliciesResult `xml:"ListUserPoliciesResult"`
}

ListUserPoliciesResponse is the XML response for ListUserPolicies.

type ListUserPoliciesResult 

type ListUserPoliciesResult struct {
	PolicyNames []string `xml:"PolicyNames>member"`
	IsTruncated bool     `xml:"IsTruncated"`
}

ListUserPoliciesResult contains the list of inline policy names for a user.

type ListUsersResponse 

type ListUsersResponse struct {
	XMLName          xml.Name         `xml:"ListUsersResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
	ListUsersResult  ListUsersResult  `xml:"ListUsersResult"`
}

ListUsersResponse is the XML response for ListUsers.

type ListUsersResult 

type ListUsersResult struct {
	Marker      string    `xml:"Marker,omitempty"`
	Users       []UserXML `xml:"Users>member"`
	IsTruncated bool      `xml:"IsTruncated"`
}

ListUsersResult contains the list of users.

type ListVirtualMFADevicesResponse 

type ListVirtualMFADevicesResponse struct {
	XMLName                     xml.Name                    `xml:"ListVirtualMFADevicesResponse"`
	Xmlns                       string                      `xml:"xmlns,attr"`
	ResponseMetadata            ResponseMetadata            `xml:"ResponseMetadata"`
	ListVirtualMFADevicesResult ListVirtualMFADevicesResult `xml:"ListVirtualMFADevicesResult"`
}

ListVirtualMFADevicesResponse is the XML response for ListVirtualMFADevices.

type ListVirtualMFADevicesResult 

type ListVirtualMFADevicesResult struct {
	VirtualMFADevices []VirtualMFADeviceXML `xml:"VirtualMFADevices>member"`
	IsTruncated       bool                  `xml:"IsTruncated"`
}

ListVirtualMFADevicesResult contains the list of virtual MFA devices.

type LoginProfile 

type LoginProfile struct {
	CreateDate            time.Time `json:"CreateDate"`
	UserName              string    `json:"UserName,omitempty"`
	PasswordResetRequired bool      `json:"PasswordResetRequired,omitempty"`
}

LoginProfile represents an IAM user login profile (console access).

type LoginProfileXML 

type LoginProfileXML struct {
	UserName              string `xml:"UserName"`
	CreateDate            string `xml:"CreateDate"`
	PasswordResetRequired bool   `xml:"PasswordResetRequired"`
}

LoginProfileXML is the XML representation of a LoginProfile.

type ManagedPolicyDetailXML 

type ManagedPolicyDetailXML struct {
	PolicyName        string             `xml:"PolicyName"`
	PolicyID          string             `xml:"PolicyId"`
	Arn               string             `xml:"Arn"`
	Path              string             `xml:"Path"`
	CreateDate        string             `xml:"CreateDate"`
	PolicyVersionList []PolicyVersionXML `xml:"PolicyVersionList>member"`
}

ManagedPolicyDetailXML is the per-policy element in GetAccountAuthorizationDetails.

type OIDCProvider 

type OIDCProvider struct {
	CreateDate     time.Time `json:"CreateDate"`
	Arn            string    `json:"Arn,omitempty"`
	URL            string    `json:"Url,omitempty"`
	ClientIDList   []string  `json:"ClientIDList,omitempty"`
	ThumbprintList []string  `json:"ThumbprintList,omitempty"`
}

OIDCProvider represents an IAM OpenID Connect identity provider.

type OIDCProviderListEntryXML 

type OIDCProviderListEntryXML struct {
	Arn string `xml:"Arn"`
}

OIDCProviderListEntryXML is the XML representation of an OIDC provider in list responses.

type PasswordPolicy 

type PasswordPolicy struct {
	MinimumPasswordLength      int  `json:"MinimumPasswordLength,omitempty"`
	MaxPasswordAge             int  `json:"MaxPasswordAge,omitempty"`
	PasswordReusePrevention    int  `json:"PasswordReusePrevention,omitempty"`
	RequireUppercaseCharacters bool `json:"RequireUppercaseCharacters,omitempty"`
	RequireLowercaseCharacters bool `json:"RequireLowercaseCharacters,omitempty"`
	RequireNumbers             bool `json:"RequireNumbers,omitempty"`
	RequireSymbols             bool `json:"RequireSymbols,omitempty"`
	AllowUsersToChangePassword bool `json:"AllowUsersToChangePassword,omitempty"`
	HardExpiry                 bool `json:"HardExpiry,omitempty"`
}

PasswordPolicy represents the IAM account password policy.

type PasswordPolicyXML 

type PasswordPolicyXML struct {
	MinimumPasswordLength      int  `xml:"MinimumPasswordLength"`
	MaxPasswordAge             int  `xml:"MaxPasswordAge,omitempty"`
	PasswordReusePrevention    int  `xml:"PasswordReusePrevention,omitempty"`
	RequireUppercaseCharacters bool `xml:"RequireUppercaseCharacters"`
	RequireLowercaseCharacters bool `xml:"RequireLowercaseCharacters"`
	RequireNumbers             bool `xml:"RequireNumbers"`
	RequireSymbols             bool `xml:"RequireSymbols"`
	AllowUsersToChangePassword bool `xml:"AllowUsersToChangePassword"`
	HardExpiry                 bool `xml:"HardExpiry"`
	ExpirePasswords            bool `xml:"ExpirePasswords"`
}

PasswordPolicyXML is the XML representation of the account password policy.

type PermBoundaryDecisionXML 

type PermBoundaryDecisionXML struct {
	AllowedByPermissionsBoundary bool `xml:"AllowedByPermissionsBoundary"`
}

PermBoundaryDecisionXML carries the boundary evaluation outcome.

type PermissionsBoundaryXML 

type PermissionsBoundaryXML struct {
	PermissionsBoundaryArn  string `xml:"PermissionsBoundaryArn"`
	PermissionsBoundaryType string `xml:"PermissionsBoundaryType"`
}

PermissionsBoundaryXML is the XML representation of a permissions boundary.

type Policy 

type Policy struct {
	Tags             map[string]string `json:"Tags,omitempty"`
	CreateDate       time.Time         `json:"CreateDate"`
	UpdateDate       time.Time         `json:"UpdateDate"`
	PolicyName       string            `json:"PolicyName,omitempty"`
	PolicyID         string            `json:"PolicyId,omitempty"`
	Arn              string            `json:"Arn,omitempty"`
	Path             string            `json:"Path,omitempty"`
	PolicyDocument   string            `json:"PolicyDocument,omitempty"`
	DefaultVersionID string            `json:"DefaultVersionId,omitempty"`
	AttachmentCount  int               `json:"AttachmentCount,omitempty"`
	IsAttachable     bool              `json:"IsAttachable,omitempty"`
}

Policy represents an IAM managed policy resource.

type PolicyDocument 

type PolicyDocument struct {
	Version   string      `json:"Version,omitempty"`
	Statement []Statement `json:"Statement,omitempty"`
}

PolicyDocument is the parsed representation of an IAM policy JSON document.

type PolicyEntities 

type PolicyEntities struct {
	PolicyUsers  []PolicyEntityUser  `json:"PolicyUsers,omitempty"`
	PolicyGroups []PolicyEntityGroup `json:"PolicyGroups,omitempty"`
	PolicyRoles  []PolicyEntityRole  `json:"PolicyRoles,omitempty"`
}

PolicyEntities is the collection of entities attached to a managed policy.

type PolicyEntityGroup 

type PolicyEntityGroup struct {
	GroupName string `xml:"GroupName"`
}

PolicyEntityGroup is a group attached to a managed policy.

type PolicyEntityRole 

type PolicyEntityRole struct {
	RoleName string `xml:"RoleName"`
}

PolicyEntityRole is a role attached to a managed policy.

type PolicyEntityUser 

type PolicyEntityUser struct {
	UserName string `xml:"UserName"`
}

PolicyEntityUser is a user attached to a managed policy.

type PolicyVersionXML 

type PolicyVersionXML struct {
	Document         string `xml:"Document"`
	VersionID        string `xml:"VersionId"`
	CreateDate       string `xml:"CreateDate"`
	IsDefaultVersion bool   `xml:"IsDefaultVersion"`
}

PolicyVersionXML is the XML representation of a policy version.

type PolicyXML 

type PolicyXML struct {
	PolicyName       string   `xml:"PolicyName"`
	PolicyID         string   `xml:"PolicyId"`
	Arn              string   `xml:"Arn"`
	Path             string   `xml:"Path"`
	CreateDate       string   `xml:"CreateDate"`
	UpdateDate       string   `xml:"UpdateDate"`
	DefaultVersionID string   `xml:"DefaultVersionId"`
	Tags             []TagXML `xml:"Tags>member,omitempty"`
	AttachmentCount  int      `xml:"AttachmentCount"`
	IsAttachable     bool     `xml:"IsAttachable"`
}

PolicyXML is the XML representation of an IAM Policy.

type Provider 

type Provider struct{}

Provider implements service.Provider for the IAM service.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the IAM service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the logical name of the provider.

type PutGroupPolicyResponse 

type PutGroupPolicyResponse struct {
	XMLName          xml.Name         `xml:"PutGroupPolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

PutGroupPolicyResponse is the XML response for PutGroupPolicy.

type PutRolePermissionsBoundaryResponse 

type PutRolePermissionsBoundaryResponse struct {
	XMLName          xml.Name         `xml:"PutRolePermissionsBoundaryResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

PutRolePermissionsBoundaryResponse is the XML response for PutRolePermissionsBoundary.

type PutRolePolicyResponse 

type PutRolePolicyResponse struct {
	XMLName          xml.Name         `xml:"PutRolePolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

PutRolePolicyResponse is the XML response for PutRolePolicy.

type PutUserPermissionsBoundaryResponse 

type PutUserPermissionsBoundaryResponse struct {
	XMLName          xml.Name         `xml:"PutUserPermissionsBoundaryResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

PutUserPermissionsBoundaryResponse is the XML response for PutUserPermissionsBoundary.

type PutUserPolicyResponse 

type PutUserPolicyResponse struct {
	XMLName          xml.Name         `xml:"PutUserPolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

PutUserPolicyResponse is the XML response for PutUserPolicy.

type RemoveClientIDFromOpenIDConnectProviderResponse 

type RemoveClientIDFromOpenIDConnectProviderResponse struct {
	XMLName          xml.Name         `xml:"RemoveClientIDFromOpenIDConnectProviderResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

RemoveClientIDFromOpenIDConnectProviderResponse is the XML response for RemoveClientIDFromOpenIDConnectProvider.

type RemoveRoleFromInstanceProfileResponse 

type RemoveRoleFromInstanceProfileResponse struct {
	XMLName          xml.Name         `xml:"RemoveRoleFromInstanceProfileResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

RemoveRoleFromInstanceProfileResponse is the XML response for RemoveRoleFromInstanceProfile.

type RemoveUserFromGroupResponse 

type RemoveUserFromGroupResponse struct {
	XMLName          xml.Name         `xml:"RemoveUserFromGroupResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

RemoveUserFromGroupResponse is the XML response for RemoveUserFromGroup.

type ResourcePolicyProvider 

type ResourcePolicyProvider interface {
	GetResourcePolicy(ctx context.Context, resourceARN string) (string, error)
}

ResourcePolicyProvider is implemented by service backends that support resource-based policies (e.g. S3 bucket policies, SQS queue policies). GetResourcePolicy returns the JSON policy document for the given resource ARN, or ("", nil) when the resource has no policy.

type ResponseMetadata 

type ResponseMetadata struct {
	RequestID string `xml:"RequestId"`
}

ResponseMetadata is embedded in all IAM XML responses.

type Role 

type Role struct {
	Tags                     map[string]string `json:"Tags,omitempty"`
	CreateDate               time.Time         `json:"CreateDate"`
	RoleName                 string            `json:"RoleName,omitempty"`
	RoleID                   string            `json:"RoleId,omitempty"`
	Arn                      string            `json:"Arn,omitempty"`
	Path                     string            `json:"Path,omitempty"`
	AssumeRolePolicyDocument string            `json:"AssumeRolePolicyDocument,omitempty"`
	PermissionsBoundary      string            `json:"PermissionsBoundary,omitempty"`
	Description              string            `json:"Description,omitempty"`
	// MaxSessionDuration is the maximum session duration (in seconds) for role credentials.
	// A value of 0 means the default system maximum applies (43200 seconds / 12 hours).
	MaxSessionDuration int32 `json:"MaxSessionDuration"`
}

Role represents an IAM role resource.

type RoleDetail 

type RoleDetail struct {
	Role

	AttachedPolicies []AttachedPolicy    `json:"attachedPolicies,omitempty"`
	InlinePolicies   []InlinePolicyEntry `json:"inlinePolicies,omitempty"`
	InstanceProfiles []InstanceProfile   `json:"instanceProfiles,omitempty"`
}

RoleDetail holds role data and all associated policies for GetAccountAuthorizationDetails.

type RoleDetailXML 

type RoleDetailXML struct {
	Path                     string                 `xml:"Path"`
	RoleName                 string                 `xml:"RoleName"`
	RoleID                   string                 `xml:"RoleId"`
	Arn                      string                 `xml:"Arn"`
	CreateDate               string                 `xml:"CreateDate"`
	AssumeRolePolicyDocument string                 `xml:"AssumeRolePolicyDocument"`
	RolePolicyList           []InlinePolicyEntryXML `xml:"RolePolicyList>member"`
	AttachedManagedPolicies  []AttachedPolicyXML    `xml:"AttachedManagedPolicies>member"`
	InstanceProfileList      []InstanceProfileXML   `xml:"InstanceProfileList>member"`
}

RoleDetailXML is the per-role element in GetAccountAuthorizationDetails.

type RoleXML 

type RoleXML struct {
	PermissionsBoundary      *PermissionsBoundaryXML `xml:"PermissionsBoundary,omitempty"`
	Path                     string                  `xml:"Path"`
	RoleName                 string                  `xml:"RoleName"`
	RoleID                   string                  `xml:"RoleId"`
	Arn                      string                  `xml:"Arn"`
	CreateDate               string                  `xml:"CreateDate"`
	AssumeRolePolicyDocument string                  `xml:"AssumeRolePolicyDocument"`
	Description              string                  `xml:"Description,omitempty"`
	Tags                     []TagXML                `xml:"Tags>member,omitempty"`
	MaxSessionDuration       int32                   `xml:"MaxSessionDuration"`
}

RoleXML is the XML representation of an IAM Role.

type SAMLProvider 

type SAMLProvider struct {
	CreateDate           time.Time `json:"CreateDate"`
	ValidUntil           time.Time `json:"ValidUntil"`
	Arn                  string    `json:"Arn,omitempty"`
	SAMLMetadataDocument string    `json:"SAMLMetadataDocument,omitempty"`
}

SAMLProvider represents an IAM SAML identity provider.

type SAMLProviderListEntryXML 

type SAMLProviderListEntryXML struct {
	Arn        string `xml:"Arn"`
	ValidUntil string `xml:"ValidUntil,omitempty"`
	CreateDate string `xml:"CreateDate"`
}

SAMLProviderListEntryXML is the XML representation of a SAML provider in list responses.

type SSHPublicKey 

type SSHPublicKey struct {
	UploadDate       time.Time `json:"UploadDate"`
	UserName         string    `json:"UserName,omitempty"`
	SSHPublicKeyID   string    `json:"SSHPublicKeyId,omitempty"`
	SSHPublicKeyBody string    `json:"SSHPublicKeyBody,omitempty"`
	Fingerprint      string    `json:"Fingerprint,omitempty"`
	Status           string    `json:"Status,omitempty"`
}

SSHPublicKey represents an IAM SSH public key for a user.

type ServerCertificate 

type ServerCertificate struct {
	UploadDate            time.Time `json:"UploadDate"`
	ServerCertificateName string    `json:"ServerCertificateName,omitempty"`
	ServerCertificateID   string    `json:"ServerCertificateId,omitempty"`
	Arn                   string    `json:"Arn,omitempty"`
	Path                  string    `json:"Path,omitempty"`
	CertificateBody       string    `json:"CertificateBody,omitempty"`
	CertificateChain      string    `json:"CertificateChain,omitempty"`
}

ServerCertificate represents an IAM server certificate.

type ServiceLastAccessedDetail 

type ServiceLastAccessedDetail struct {
	ServiceName                string    `json:"ServiceName,omitempty"`
	ServiceNamespace           string    `json:"ServiceNamespace,omitempty"`
	LastAuthenticated          time.Time `json:"LastAuthenticated"`
	LastAuthenticatedArn       string    `json:"LastAuthenticatedArn,omitempty"`
	TotalAuthenticatedEntities int       `json:"TotalAuthenticatedEntities,omitempty"`
}

ServiceLastAccessedDetail tracks when a service was last accessed.

type ServiceLastAccessedDetailXML 

type ServiceLastAccessedDetailXML struct {
	ServiceName                string `xml:"ServiceName"`
	ServiceNamespace           string `xml:"ServiceNamespace"`
	LastAuthenticated          string `xml:"LastAuthenticated,omitempty"`
	LastAuthenticatedArn       string `xml:"LastAuthenticatedArn,omitempty"`
	TotalAuthenticatedEntities int    `xml:"TotalAuthenticatedEntities"`
}

ServiceLastAccessedDetailXML is the XML representation of a single service last accessed entry.

type ServiceSpecificCredential 

type ServiceSpecificCredential struct {
	CreateDate                  time.Time `json:"CreateDate"`
	UserName                    string    `json:"UserName,omitempty"`
	ServiceName                 string    `json:"ServiceName,omitempty"`
	ServiceUserName             string    `json:"ServiceUserName,omitempty"`
	ServicePassword             string    `json:"ServicePassword,omitempty"`
	ServiceSpecificCredentialID string    `json:"ServiceSpecificCredentialId,omitempty"`
	Status                      string    `json:"Status,omitempty"`
}

ServiceSpecificCredential represents a service-specific credential for an IAM user.

type ServiceSpecificCredentialMetadataXML 

type ServiceSpecificCredentialMetadataXML struct {
	UserName                    string `xml:"UserName"`
	ServiceName                 string `xml:"ServiceName"`
	ServiceUserName             string `xml:"ServiceUserName"`
	ServiceSpecificCredentialID string `xml:"ServiceSpecificCredentialId"`
	Status                      string `xml:"Status"`
	CreateDate                  string `xml:"CreateDate"`
}

ServiceSpecificCredentialMetadataXML is the XML representation of credential metadata.

type ServiceSpecificCredentialXML 

type ServiceSpecificCredentialXML struct {
	UserName                    string `xml:"UserName"`
	ServiceName                 string `xml:"ServiceName"`
	ServiceUserName             string `xml:"ServiceUserName"`
	ServicePassword             string `xml:"ServicePassword"`
	ServiceSpecificCredentialID string `xml:"ServiceSpecificCredentialId"`
	Status                      string `xml:"Status"`
	CreateDate                  string `xml:"CreateDate"`
}

ServiceSpecificCredentialXML is the XML representation of a service-specific credential.

type SetDefaultPolicyVersionResponse 

type SetDefaultPolicyVersionResponse struct {
	XMLName          xml.Name         `xml:"SetDefaultPolicyVersionResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

SetDefaultPolicyVersionResponse is the XML response for SetDefaultPolicyVersion.

type SetSecurityTokenServicePreferencesResponse 

type SetSecurityTokenServicePreferencesResponse struct {
	XMLName          xml.Name         `xml:"SetSecurityTokenServicePreferencesResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

SetSecurityTokenServicePreferencesResponse is the XML response for SetSecurityTokenServicePreferences.

type SigningCertificate 

type SigningCertificate struct {
	UploadDate      time.Time `json:"UploadDate"`
	CertificateID   string    `json:"CertificateId,omitempty"`
	UserName        string    `json:"UserName,omitempty"`
	CertificateBody string    `json:"CertificateBody,omitempty"`
	Status          string    `json:"Status,omitempty"`
}

SigningCertificate represents an IAM X.509 signing certificate.

type SimulateCustomPolicyResponse 

type SimulateCustomPolicyResponse struct {
	XMLName                    xml.Name                   `xml:"SimulateCustomPolicyResponse"`
	Xmlns                      string                     `xml:"xmlns,attr"`
	ResponseMetadata           ResponseMetadata           `xml:"ResponseMetadata"`
	SimulateCustomPolicyResult SimulateCustomPolicyResult `xml:"SimulateCustomPolicyResult"`
}

SimulateCustomPolicyResponse is the XML response for SimulateCustomPolicy.

type SimulateCustomPolicyResult 

type SimulateCustomPolicyResult struct {
	EvaluationResults []SimulationEvalResultXML `xml:"EvaluationResults>member"`
	IsTruncated       bool                      `xml:"IsTruncated"`
}

SimulateCustomPolicyResult contains all evaluation results for SimulateCustomPolicy.

type SimulatePrincipalPolicyResponse 

type SimulatePrincipalPolicyResponse struct {
	XMLName                       xml.Name                      `xml:"SimulatePrincipalPolicyResponse"`
	Xmlns                         string                        `xml:"xmlns,attr"`
	ResponseMetadata              ResponseMetadata              `xml:"ResponseMetadata"`
	SimulatePrincipalPolicyResult SimulatePrincipalPolicyResult `xml:"SimulatePrincipalPolicyResult"`
}

SimulatePrincipalPolicyResponse is the XML response for SimulatePrincipalPolicy.

type SimulatePrincipalPolicyResult 

type SimulatePrincipalPolicyResult struct {
	EvaluationResults []SimulationEvalResultXML `xml:"EvaluationResults>member"`
	IsTruncated       bool                      `xml:"IsTruncated"`
}

SimulatePrincipalPolicyResult contains all evaluation results.

type SimulationEvalResultXML 

type SimulationEvalResultXML struct {
	// PermissionsBoundaryDecisionDetail is present when the principal has a permissions boundary.
	PermissionsBoundaryDecisionDetail *PermBoundaryDecisionXML  `xml:"PermissionsBoundaryDecisionDetail,omitempty"`
	EvalActionName                    string                    `xml:"EvalActionName"`
	EvalResourceName                  string                    `xml:"EvalResourceName"`
	EvalDecision                      string                    `xml:"EvalDecision"`
	EvalDecisionDetails               []EvalDecisionDetailEntry `xml:"EvalDecisionDetails>entry,omitempty"`
}

SimulationEvalResultXML is a single evaluation result in SimulatePrincipalPolicy.

type SimulationResult 

type SimulationResult struct {
	EvalDecisionDetails          map[string]string `json:"evalDecisionDetails,omitempty"`
	AllowedByPermissionsBoundary *bool             `json:"allowedByPermissionsBoundary,omitempty"`
	ActionName                   string            `json:"actionName,omitempty"`
	ResourceName                 string            `json:"resourceName,omitempty"`
	Decision                     string            `json:"decision,omitempty"`
}

SimulationResult is the outcome of evaluating a single action/resource pair.

type Statement 

type Statement struct {
	// Action can be a single string or a list of strings.
	Action any `json:"Action"`
	// NotAction matches any action NOT in this set (logical negation of Action).
	NotAction any `json:"NotAction"`
	// Resource can be a single string or a list of strings.
	Resource any `json:"Resource"`
	// NotResource matches any resource NOT in this set (logical negation of Resource).
	NotResource any `json:"NotResource"`
	// Condition is a map of operator → contextKey → value(s).
	Condition map[string]map[string]any `json:"Condition,omitempty"`
	// Principal is ignored in enforcement; stored for completeness.
	Principal any    `json:"Principal"`
	Effect    string `json:"Effect,omitempty"`
}

Statement represents a single IAM policy statement.

type StorageBackend 

type StorageBackend interface {
	// Users
	CreateUser(userName, path, permissionsBoundary string) (*User, error)
	DeleteUser(userName string) error
	ListUsers(marker string, maxItems int) (page.Page[User], error)
	GetUser(userName string) (*User, error)

	// Roles
	CreateRole(roleName, path, assumeRolePolicyDocument, permissionsBoundary string) (*Role, error)
	DeleteRole(roleName string) error
	DeleteServiceLinkedRole(roleName string) error
	ListRoles(marker string, maxItems int) (page.Page[Role], error)
	GetRole(roleName string) (*Role, error)
	GetRoleByArn(roleArn string) (*Role, error)
	UpdateRoleMaxSessionDuration(roleName string, maxSessionDuration int32) error

	// Policies
	CreatePolicy(policyName, path, policyDocument string) (*Policy, error)
	DeletePolicy(policyArn string) error
	ListPolicies(marker string, maxItems int) (page.Page[Policy], error)
	AttachUserPolicy(userName, policyArn string) error
	DetachUserPolicy(userName, policyArn string) error
	AttachRolePolicy(roleName, policyArn string) error
	DetachRolePolicy(roleName, policyArn string) error
	ListAttachedUserPolicies(userName string) ([]AttachedPolicy, error)
	ListAttachedRolePolicies(roleName string) ([]AttachedPolicy, error)
	GetPolicy(policyArn string) (*Policy, error)
	ListPolicyVersions(policyArn string) ([]StoredPolicyVersion, error)
	GetPolicyVersion(policyArn, versionID string) (*StoredPolicyVersion, error)

	// Inline Policies - Users
	PutUserPolicy(userName, policyName, policyDocument string) error
	GetUserPolicy(userName, policyName string) (string, error)
	DeleteUserPolicy(userName, policyName string) error
	ListUserPolicies(userName string) ([]string, error)

	// Inline Policies - Roles
	PutRolePolicy(roleName, policyName, policyDocument string) error
	GetRolePolicy(roleName, policyName string) (string, error)
	DeleteRolePolicy(roleName, policyName string) error
	ListRolePolicies(roleName string) ([]string, error)

	// Inline Policies - Groups
	PutGroupPolicy(groupName, policyName, policyDocument string) error
	GetGroupPolicy(groupName, policyName string) (string, error)
	DeleteGroupPolicy(groupName, policyName string) error
	ListGroupPolicies(groupName string) ([]string, error)

	// Permission Boundaries
	PutUserPermissionsBoundary(userName, policyArn string) error
	DeleteUserPermissionsBoundary(userName string) error
	PutRolePermissionsBoundary(roleName, policyArn string) error
	DeleteRolePermissionsBoundary(roleName string) error

	// Groups
	CreateGroup(groupName, path string) (*Group, error)
	DeleteGroup(groupName string) error
	GetGroup(groupName string) (*Group, error)
	GetGroupUsers(groupName string) ([]User, error)
	ListGroups(marker string, maxItems int) (page.Page[Group], error)
	AddUserToGroup(groupName, userName string) error
	RemoveUserFromGroup(groupName, userName string) error
	AttachGroupPolicy(groupName, policyArn string) error
	DetachGroupPolicy(groupName, policyArn string) error
	ListAttachedGroupPolicies(groupName string) ([]AttachedPolicy, error)

	// Assume Role Policy
	UpdateAssumeRolePolicy(roleName, policyDocument string) error

	// Reporting and simulation
	GetAccountAuthorizationDetails() AccountAuthorizationDetails
	SimulatePrincipalPolicy(
		principalArn, callerArn, resourceOwner string,
		resourcePolicyList, actionNames, resourceArns []string,
		ctx ConditionContext,
	) ([]SimulationResult, error)
	GetCredentialReport() string
	GetAccountSummary() AccountSummary

	// Access Keys
	CreateAccessKey(userName string) (*AccessKey, error)
	DeleteAccessKey(userName, accessKeyID string) error
	ListAccessKeys(userName, marker string, maxItems int) (page.Page[AccessKey], error)

	// Instance Profiles
	CreateInstanceProfile(name, path string) (*InstanceProfile, error)
	DeleteInstanceProfile(name string) error
	ListInstanceProfiles(marker string, maxItems int) (page.Page[InstanceProfile], error)
	AddRoleToInstanceProfile(instanceProfileName, roleName string) error
	RemoveRoleFromInstanceProfile(instanceProfileName, roleName string) error

	// SAML Providers
	CreateSAMLProvider(name, samlMetadataDocument string) (*SAMLProvider, error)
	UpdateSAMLProvider(providerArn, samlMetadataDocument string) (*SAMLProvider, error)
	DeleteSAMLProvider(providerArn string) error
	GetSAMLProvider(providerArn string) (*SAMLProvider, error)
	ListSAMLProviders() ([]SAMLProvider, error)

	// OIDC Providers
	CreateOpenIDConnectProvider(
		rawURL string,
		clientIDs, thumbprints []string,
	) (*OIDCProvider, error)
	UpdateOpenIDConnectProviderThumbprint(providerArn string, thumbprints []string) error
	DeleteOpenIDConnectProvider(providerArn string) error
	GetOpenIDConnectProvider(providerArn string) (*OIDCProvider, error)
	ListOpenIDConnectProviders() ([]OIDCProvider, error)

	// Login Profiles
	CreateLoginProfile(userName, password string, passwordResetRequired bool) (*LoginProfile, error)
	UpdateLoginProfile(userName, password string, passwordResetRequired bool) error
	DeleteLoginProfile(userName string) error
	GetLoginProfile(userName string) (*LoginProfile, error)

	// Account Aliases
	CreateAccountAlias(alias string) error
	ListAccountAliases() []string
	DeleteAccountAlias(alias string) error

	// Policy Versions
	CreatePolicyVersion(
		policyArn, policyDocument string,
		setAsDefault bool,
	) (*StoredPolicyVersion, error)
	SetDefaultPolicyVersion(policyArn, versionID string) error
	DeletePolicyVersion(policyArn, versionID string) error

	// Service-Linked Roles
	CreateServiceLinkedRole(awsServiceName, description, customSuffix string) (*Role, error)
	GetServiceLinkedRoleDeletionStatus(deletionTaskID string) (string, error)

	// Service-Specific Credentials
	CreateServiceSpecificCredential(
		userName, serviceName string,
	) (*ServiceSpecificCredential, error)
	ListServiceSpecificCredentials(
		userName, serviceName string,
	) ([]ServiceSpecificCredential, error)
	DeleteServiceSpecificCredential(userName, credentialID string) error
	UpdateServiceSpecificCredential(userName, credentialID, status string) error

	// Virtual MFA Devices
	CreateVirtualMFADevice(virtualMFADeviceName, path string) (*VirtualMFADevice, error)
	CreateVirtualMFADeviceFull(virtualMFADeviceName, path string) (*VirtualMFADevice, error)
	ListVirtualMFADevices(marker string, maxItems int) (page.Page[VirtualMFADevice], error)
	DeleteVirtualMFADevice(serialNumber string) error
	EnableMFADevice(userName, serialNumber, authCode1, authCode2 string) error
	DeactivateMFADevice(userName, serialNumber string) error
	ResyncMFADevice(userName, serialNumber, authCode1, authCode2 string) error
	GetMFADeviceOwner(serialNumber string) string
	GetVirtualMFADevice(serialNumber string) (VirtualMFADevice, string, error)
	ListMFADevicesForUser(userName string) ([]VirtualMFADevice, error)

	// SSH Public Keys
	UploadSSHPublicKey(userName, body string) (*SSHPublicKey, error)
	GetSSHPublicKey(userName, keyID string) (*SSHPublicKey, error)
	ListSSHPublicKeys(userName string, marker string, maxItems int) (page.Page[SSHPublicKey], error)
	UpdateSSHPublicKey(userName, keyID, status string) error
	DeleteSSHPublicKey(userName, keyID string) error

	// Access Advisor
	GenerateServiceLastAccessedDetailsForEntity(entityARN string) string
	GetServiceLastAccessedDetails(
		jobID string,
	) (status string, details []ServiceLastAccessedDetail, err error)
	RecordServiceAccess(entityARN, serviceNamespace, serviceName string)

	// Organizations Access Report
	GenerateOrganizationsAccessReport(entityPath string) string
	GetOrganizationsAccessReport(jobID string) (status string, createdAt time.Time, found bool)

	// Reset service-specific credential password
	ResetServiceSpecificCredentialFull(
		userName, credentialID string,
	) (*ServiceSpecificCredential, error)

	// OIDC provider existence check (implements sts.OIDCLookup)
	OIDCProviderExists(issuerURL string) bool

	// Delegation Requests
	CreateDelegationRequest(targetAccountID string) (*DelegationRequest, error)
	AcceptDelegationRequest(delegationID string) error
	AssociateDelegationRequest(delegationID, policyArn string) error

	// Change Password
	ChangePassword(newPassword string) error

	// OIDC Client IDs
	AddClientIDToOpenIDConnectProvider(providerArn, clientID string) error
	RemoveClientIDFromOpenIDConnectProvider(providerArn, clientID string) error

	// Access Key management
	UpdateAccessKey(userName, accessKeyID, status string) error
	GetAccessKeyLastUsed(accessKeyID string) (*AccessKeyLastUsed, error)
	RecordAccessKeyUsage(accessKeyID, region, serviceName string)

	// Tags on resources (embedded in model, returned with resource)
	TagUser(userName string, tags map[string]string) error
	UntagUser(userName string, keys []string) error
	TagRole(roleName string, tags map[string]string) error
	UntagRole(roleName string, keys []string) error
	TagPolicy(policyArn string, tags map[string]string) error
	UntagPolicy(policyArn string, keys []string) error
	TagGroup(groupName string, tags map[string]string) error
	UntagGroup(groupName string, keys []string) error

	// Signing Certificates
	UploadSigningCertificate(userName, body string) (*SigningCertificate, error)
	ListSigningCertificates(userName string) ([]SigningCertificate, error)
	UpdateSigningCertificate(certificateID, status string) error
	DeleteSigningCertificate(certificateID string) error

	// Server Certificates
	UploadServerCertificate(name, path, certBody, certChain string) (*ServerCertificate, error)
	GetServerCertificate(name string) (*ServerCertificate, error)
	ListServerCertificates(pathPrefix string) ([]ServerCertificate, error)
	UpdateServerCertificate(name, newName, newPath string) error
	DeleteServerCertificate(name string) error

	// Group membership queries
	ListGroupsForUser(userName string) ([]Group, error)

	// Account Password Policy
	GetAccountPasswordPolicy() *PasswordPolicy
	UpdateAccountPasswordPolicy(pp PasswordPolicy) error
	DeleteAccountPasswordPolicy() error

	// Policy entity queries
	ListEntitiesForPolicy(policyArn, entityFilter string) (*PolicyEntities, error)

	// Entity mutations
	UpdateUser(userName, newPath, newUserName string) error
	UpdateRole(roleName, description string) error
	UpdateGroup(groupName, newPath, newGroupName string) error

	// Instance profiles extended
	GetInstanceProfile(name string) (*InstanceProfile, error)
	ListInstanceProfilesForRole(roleName string) ([]InstanceProfile, error)

	// Simulation
	SimulateCustomPolicy(
		policyInputList, permissionsBoundaryPolicyInputList, actionNames, resourceArns []string,
		ctx ConditionContext,
	) ([]SimulationResult, error)

	// Dashboard helpers
	ListAllUsers() []User
	ListAllRoles() []Role
	ListAllPolicies() []Policy
	ListAllGroups() []Group
	ListAllAccessKeys() []AccessKey
	ListAllInstanceProfiles() []InstanceProfile

	// Enforcement helpers
	GetUserByAccessKeyID(accessKeyID string) (*User, error)
	GetPoliciesForUser(userName string) ([]string, error)

	Purge(ctx context.Context, cutoff time.Time)
}

StorageBackend defines the interface for the IAM in-memory store.

type StoredPolicyVersion 

type StoredPolicyVersion struct {
	CreateDate       time.Time `json:"CreateDate"`
	PolicyDocument   string    `json:"PolicyDocument,omitempty"`
	VersionID        string    `json:"VersionId,omitempty"`
	IsDefaultVersion bool      `json:"IsDefaultVersion,omitempty"`
}

StoredPolicyVersion is the in-memory representation of a managed policy version.

type TagXML 

type TagXML struct {
	Key   string `xml:"Key"`
	Value string `xml:"Value"`
}

TagXML is the XML representation of a single IAM tag.

type UpdateAccessKeyResponse 

type UpdateAccessKeyResponse struct {
	XMLName          xml.Name         `xml:"UpdateAccessKeyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

UpdateAccessKeyResponse is the XML response for UpdateAccessKey.

type UpdateAccountPasswordPolicyResponse 

type UpdateAccountPasswordPolicyResponse struct {
	XMLName          xml.Name         `xml:"UpdateAccountPasswordPolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

UpdateAccountPasswordPolicyResponse is the XML response for UpdateAccountPasswordPolicy.

type UpdateAssumeRolePolicyResponse 

type UpdateAssumeRolePolicyResponse struct {
	XMLName          xml.Name         `xml:"UpdateAssumeRolePolicyResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

UpdateAssumeRolePolicyResponse is the XML response for UpdateAssumeRolePolicy.

type UpdateGroupResponse 

type UpdateGroupResponse struct {
	XMLName          xml.Name         `xml:"UpdateGroupResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

UpdateGroupResponse is the XML response for UpdateGroup.

type UpdateLoginProfileResponse 

type UpdateLoginProfileResponse struct {
	XMLName          xml.Name         `xml:"UpdateLoginProfileResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

UpdateLoginProfileResponse is the XML response for UpdateLoginProfile.

type UpdateOpenIDConnectProviderThumbprintResponse 

type UpdateOpenIDConnectProviderThumbprintResponse struct {
	XMLName          xml.Name         `xml:"UpdateOpenIDConnectProviderThumbprintResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

UpdateOpenIDConnectProviderThumbprintResponse is the XML response for UpdateOpenIDConnectProviderThumbprint.

type UpdateRoleDescriptionResponse 

type UpdateRoleDescriptionResponse struct {
	XMLName                     xml.Name                    `xml:"UpdateRoleDescriptionResponse"`
	Xmlns                       string                      `xml:"xmlns,attr"`
	ResponseMetadata            ResponseMetadata            `xml:"ResponseMetadata"`
	UpdateRoleDescriptionResult UpdateRoleDescriptionResult `xml:"UpdateRoleDescriptionResult"`
}

UpdateRoleDescriptionResponse is the XML response for UpdateRoleDescription.

type UpdateRoleDescriptionResult 

type UpdateRoleDescriptionResult struct {
	Role RoleXML `xml:"Role"`
}

UpdateRoleDescriptionResult wraps the updated role.

type UpdateRoleResponse 

type UpdateRoleResponse struct {
	XMLName          xml.Name         `xml:"UpdateRoleResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
	UpdateRoleResult UpdateRoleResult `xml:"UpdateRoleResult"`
}

UpdateRoleResponse is the XML response for UpdateRole.

type UpdateRoleResult 

type UpdateRoleResult struct {
	Role RoleXML `xml:"Role"`
}

UpdateRoleResult wraps the updated role.

type UpdateSAMLProviderResponse 

type UpdateSAMLProviderResponse struct {
	XMLName                  xml.Name                 `xml:"UpdateSAMLProviderResponse"`
	Xmlns                    string                   `xml:"xmlns,attr"`
	UpdateSAMLProviderResult UpdateSAMLProviderResult `xml:"UpdateSAMLProviderResult"`
	ResponseMetadata         ResponseMetadata         `xml:"ResponseMetadata"`
}

UpdateSAMLProviderResponse is the XML response for UpdateSAMLProvider.

type UpdateSAMLProviderResult 

type UpdateSAMLProviderResult struct {
	SAMLProviderArn string `xml:"SAMLProviderArn"`
}

UpdateSAMLProviderResult wraps the ARN of the updated SAML provider.

type UpdateServiceSpecificCredentialResponse 

type UpdateServiceSpecificCredentialResponse struct {
	XMLName          xml.Name         `xml:"UpdateServiceSpecificCredentialResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

UpdateServiceSpecificCredentialResponse is the XML response for UpdateServiceSpecificCredential.

type UpdateUserResponse 

type UpdateUserResponse struct {
	XMLName          xml.Name         `xml:"UpdateUserResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

UpdateUserResponse is the XML response for UpdateUser.

type User 

type User struct {
	Tags                map[string]string `json:"Tags,omitempty"`
	CreateDate          time.Time         `json:"CreateDate"`
	UserName            string            `json:"UserName,omitempty"`
	UserID              string            `json:"UserId,omitempty"`
	Arn                 string            `json:"Arn,omitempty"`
	Path                string            `json:"Path,omitempty"`
	PermissionsBoundary string            `json:"PermissionsBoundary,omitempty"`
}

User represents an IAM user resource.

type UserDetail 

type UserDetail struct {
	User

	AttachedPolicies []AttachedPolicy    `json:"attachedPolicies,omitempty"`
	InlinePolicies   []InlinePolicyEntry `json:"inlinePolicies,omitempty"`
	GroupNames       []string            `json:"groupNames,omitempty"`
}

UserDetail holds user data and all associated policies for GetAccountAuthorizationDetails.

type UserDetailXML 

type UserDetailXML struct {
	Path                    string                 `xml:"Path"`
	UserName                string                 `xml:"UserName"`
	UserID                  string                 `xml:"UserId"`
	Arn                     string                 `xml:"Arn"`
	CreateDate              string                 `xml:"CreateDate"`
	UserPolicyList          []InlinePolicyEntryXML `xml:"UserPolicyList>member"`
	AttachedManagedPolicies []AttachedPolicyXML    `xml:"AttachedManagedPolicies>member"`
	GroupList               []string               `xml:"GroupList>member"`
}

UserDetailXML is the per-user element in GetAccountAuthorizationDetails.

type UserXML 

type UserXML struct {
	PermissionsBoundary *PermissionsBoundaryXML `xml:"PermissionsBoundary,omitempty"`
	Path                string                  `xml:"Path"`
	UserName            string                  `xml:"UserName"`
	UserID              string                  `xml:"UserId"`
	Arn                 string                  `xml:"Arn"`
	CreateDate          string                  `xml:"CreateDate"`
	Tags                []TagXML                `xml:"Tags>member,omitempty"`
}

UserXML is the XML representation of an IAM User.

type VirtualMFADevice 

type VirtualMFADevice struct {
	CreateDate           time.Time `json:"CreateDate"`
	SerialNumber         string    `json:"SerialNumber,omitempty"`
	VirtualMFADeviceName string    `json:"VirtualMFADeviceName,omitempty"`
	Path                 string    `json:"Path,omitempty"`
	// Status tracks the MFA device lifecycle: not_assigned → Active → Deactivated.
	Status           string `json:"Status,omitempty"`
	Base32StringSeed string `json:"Base32StringSeed,omitempty"`
	QRCodePNG        string `json:"QRCodePNG,omitempty"`
}

VirtualMFADevice represents an IAM virtual MFA device.

type VirtualMFADeviceXML 

type VirtualMFADeviceXML struct {
	SerialNumber     string `xml:"SerialNumber"`
	Base32StringSeed string `xml:"Base32StringSeed,omitempty"`
	QRCodePNG        string `xml:"QRCodePNG,omitempty"`
}

VirtualMFADeviceXML is the XML representation of a virtual MFA device.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.