rolesanywhere

package
v1.1.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 20 Imported by: 0

README

IAM Roles Anywhere

Parity grade: A · SDK aws-sdk-go-v2/service/rolesanywhere@v1.23.0 · last audited 2026-07-13 (59739a9e)

Coverage

Metric Value
Operations audited 30 (28 ok, 2 partial)
Feature families 4 (4 ok)
Known gaps 5
Deferred items 0
Resource leaks clean
Known gaps
  • GetSubject/ListSubjects: subjects store is never populated -- there is no CreateSession endpoint in this service (AWS Roles Anywhere's session-vending API is a separate mTLS-authenticated data-plane API, not SigV4/control-plane, and was out of scope for this audit). SubjectDetail's Credentials/InstanceProperties fields are also unmodeled. Would need its own audit pass if CreateSession is ever added to gopherstack.
  • CreateProfile/UpdateProfile ignore the real acceptRoleSessionName field entirely (not modeled in the Profile struct); low impact since it only affects the separate CreateSession data plane, which gopherstack doesn't implement.
  • TrustAnchorDetail/ProfileDetail's createdBy field (AWS account that created the resource) is not populated; cosmetic, single-account emulator.
  • CreateTrustAnchor accepts a notificationSettings field in the real request (set notifications at creation time); gopherstack silently drops it -- callers must use the separate PutNotificationSettings op after create instead. Not fixed this pass (kept scope to the enabled-field bug, which was the higher-severity ignored-input gap).
  • No tag-count validation (TooManyTagsException) or AccessDeniedException paths -- these are generic AWS exceptions with no evidence they're actually exercised by common client flows against this service; not treated as a stub violation.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrTrustAnchorNotFound is returned when a trust anchor does not exist.
	ErrTrustAnchorNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrTrustAnchorAlreadyExists is returned when creating a duplicate trust anchor.
	ErrTrustAnchorAlreadyExists = awserr.New("ConflictException", awserr.ErrConflict)
	// ErrProfileNotFound is returned when a profile does not exist.
	ErrProfileNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrProfileAlreadyExists is returned when creating a duplicate profile.
	ErrProfileAlreadyExists = awserr.New("ConflictException", awserr.ErrConflict)
	// ErrCrlNotFound is returned when a CRL does not exist.
	ErrCrlNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrCrlAlreadyExists is returned when creating a duplicate CRL.
	ErrCrlAlreadyExists = awserr.New("ConflictException", awserr.ErrConflict)
	// ErrSubjectNotFound is returned when a subject does not exist.
	ErrSubjectNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrValidation is returned on invalid input.
	ErrValidation = awserr.New("ValidationException", awserr.ErrInvalidParameter)
)
View Source 
var ErrNilAppContext = errors.New("rolesanywhere: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type AttributeMapping 

type AttributeMapping struct {
	CertificateField string        `json:"certificateField"`
	MappingRules     []MappingRule `json:"mappingRules"`
}

AttributeMapping maps a certificate field to session attribute rules.

type Crl 

type Crl struct {
	CreatedAt      time.Time `json:"createdAt"`
	UpdatedAt      time.Time `json:"updatedAt"`
	CrlID          string    `json:"crlId"`
	CrlArn         string    `json:"crlArn"`
	Name           string    `json:"name"`
	TrustAnchorArn string    `json:"trustAnchorArn"`

	CrlData []byte `json:"crlData,omitempty"`
	Enabled bool   `json:"enabled"`
	// contains filtered or unexported fields
}

Crl represents an IAM Roles Anywhere Certificate Revocation List.

type Handler 

type Handler struct {
	Backend StorageBackend
}

Handler handles Roles Anywhere HTTP requests.

func NewHandler 

func NewHandler(b StorageBackend) *Handler

NewHandler constructs a new Handler.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset resets the backend.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Roles Anywhere requests by path.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend. Prior to Phase 3.3, Handler had no Snapshot/Restore of its own even though InMemoryBackend fully implemented them: the service registry's persistence setup (see setupPersistence in cli.go) only registers a service.Registerable that also satisfies an inline Snapshot/Restore interface, so RolesAnywhere state was silently never persisted. These two methods close that gap.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend implements StorageBackend using in-memory maps.

trustAnchors, profiles, crls, and subjects were previously map[region]map[id]*T; Phase 3.3 replaces each with a flat *store.Table keyed by the composite "region|id" string (see regionKey), with a companion *store.Index grouping entries by region -- see store_setup.go's registerAllTables doc for the full rationale and why all four are "dirty" (unregistered on registry) tables. tags, attributeMappings, and notificationSettings remain plain region-nested maps: each holds a slice value ([]TagEntry / []AttributeMapping / []NotificationSetting), not a *T, so there is nothing for store.Table to key on.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend constructs a new InMemoryBackend.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the backend's account ID.

func (*InMemoryBackend) CreateProfile 

func (b *InMemoryBackend) CreateProfile(
	ctx context.Context,
	name string,
	roleArns []string,
	tags []TagEntry,
	durationSeconds *int32,
	managedPolicyArns []string,
	sessionPolicy string,
	requireInstanceProperties bool,
) (*Profile, error)

CreateProfile creates a new profile.

func (*InMemoryBackend) CreateTrustAnchor 

func (b *InMemoryBackend) CreateTrustAnchor(
	ctx context.Context,
	name string,
	source TrustAnchorSource,
	tags []TagEntry,
	enabled *bool,
) (*TrustAnchor, error)

CreateTrustAnchor creates a new trust anchor. enabled defaults to true when nil, matching the AWS CreateTrustAnchorRequest.enabled default.

func (*InMemoryBackend) DeleteAttributeMapping 

func (b *InMemoryBackend) DeleteAttributeMapping(
	ctx context.Context,
	profileID, certificateField string,
	specifiers []string,
) (*Profile, error)

DeleteAttributeMapping removes a certificate field mapping (and optional specifiers) from a profile.

func (*InMemoryBackend) DeleteCrl 

func (b *InMemoryBackend) DeleteCrl(ctx context.Context, id string) (*Crl, error)

DeleteCrl removes a CRL.

func (*InMemoryBackend) DeleteProfile 

func (b *InMemoryBackend) DeleteProfile(ctx context.Context, id string) (*Profile, error)

DeleteProfile removes a profile and returns its state immediately before deletion, matching AWS's DeleteProfileResponse.profile.

func (*InMemoryBackend) DeleteTrustAnchor 

func (b *InMemoryBackend) DeleteTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)

DeleteTrustAnchor removes a trust anchor and returns its state immediately before deletion, matching AWS's DeleteTrustAnchorResponse.trustAnchor.

func (*InMemoryBackend) DisableCrl 

func (b *InMemoryBackend) DisableCrl(ctx context.Context, id string) (*Crl, error)

DisableCrl disables a CRL.

func (*InMemoryBackend) DisableProfile 

func (b *InMemoryBackend) DisableProfile(ctx context.Context, id string) (*Profile, error)

DisableProfile disables a profile.

func (*InMemoryBackend) DisableTrustAnchor 

func (b *InMemoryBackend) DisableTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)

DisableTrustAnchor disables a trust anchor.

func (*InMemoryBackend) EnableCrl 

func (b *InMemoryBackend) EnableCrl(ctx context.Context, id string) (*Crl, error)

EnableCrl enables a CRL.

func (*InMemoryBackend) EnableProfile 

func (b *InMemoryBackend) EnableProfile(ctx context.Context, id string) (*Profile, error)

EnableProfile enables a profile.

func (*InMemoryBackend) EnableTrustAnchor 

func (b *InMemoryBackend) EnableTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)

EnableTrustAnchor enables a trust anchor.

func (*InMemoryBackend) GetAttributeMappings 

func (b *InMemoryBackend) GetAttributeMappings(ctx context.Context, profileID string) []AttributeMapping

GetAttributeMappings returns the attribute mappings for a profile.

func (*InMemoryBackend) GetCrl 

func (b *InMemoryBackend) GetCrl(ctx context.Context, id string) (*Crl, error)

GetCrl returns a CRL by ID.

func (*InMemoryBackend) GetNotificationSettings 

func (b *InMemoryBackend) GetNotificationSettings(ctx context.Context, trustAnchorID string) []NotificationSetting

GetNotificationSettings returns notification settings for a trust anchor.

func (*InMemoryBackend) GetProfile 

func (b *InMemoryBackend) GetProfile(ctx context.Context, id string) (*Profile, error)

GetProfile returns the profile with the given ID.

func (*InMemoryBackend) GetSubject 

func (b *InMemoryBackend) GetSubject(ctx context.Context, id string) (*Subject, error)

GetSubject returns a subject by ID.

func (*InMemoryBackend) GetTrustAnchor 

func (b *InMemoryBackend) GetTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)

GetTrustAnchor returns the trust anchor with the given ID.

func (*InMemoryBackend) ImportCrl 

func (b *InMemoryBackend) ImportCrl(
	ctx context.Context,
	name string,
	crlData []byte,
	trustAnchorArn string,
	enabled bool,
	tags []TagEntry,
) (*Crl, error)

ImportCrl imports a new CRL.

func (*InMemoryBackend) ListCrls 

func (b *InMemoryBackend) ListCrls(ctx context.Context, pageToken string, maxResults int) ([]*Crl, string, error)

ListCrls returns all CRLs with optional pagination.

func (*InMemoryBackend) ListProfiles 

func (b *InMemoryBackend) ListProfiles(
	ctx context.Context,
	pageToken string,
	maxResults int,
) ([]*Profile, string, error)

ListProfiles returns all profiles in the request region.

func (*InMemoryBackend) ListSubjects 

func (b *InMemoryBackend) ListSubjects(
	ctx context.Context,
	pageToken string,
	maxResults int,
) ([]*Subject, string, error)

ListSubjects returns all subjects with optional pagination.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(ctx context.Context, resourceARN string) ([]TagEntry, error)

ListTagsForResource returns tags for a resource. Region is resolved from the resource ARN.

func (*InMemoryBackend) ListTrustAnchors 

func (b *InMemoryBackend) ListTrustAnchors(
	ctx context.Context,
	pageToken string,
	maxResults int,
) ([]*TrustAnchor, string, error)

ListTrustAnchors returns all trust anchors in the request region.

func (*InMemoryBackend) PutAttributeMapping 

func (b *InMemoryBackend) PutAttributeMapping(
	ctx context.Context,
	profileID, certificateField string,
	rules []MappingRule,
) (*Profile, error)

PutAttributeMapping adds or replaces a certificate field mapping on a profile.

func (*InMemoryBackend) PutNotificationSettings 

func (b *InMemoryBackend) PutNotificationSettings(
	ctx context.Context,
	trustAnchorID string,
	settings []NotificationSetting,
) (*TrustAnchor, error)

PutNotificationSettings sets notification settings on a trust anchor.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the backend's default region.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) ResetNotificationSettings 

func (b *InMemoryBackend) ResetNotificationSettings(
	ctx context.Context,
	trustAnchorID string,
	keys []NotificationSettingKey,
) (*TrustAnchor, error)

ResetNotificationSettings removes specified notification settings from a trust anchor.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore deserializes backend state from JSON. It implements persistence.Persistable.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serializes backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(ctx context.Context, resourceARN string, tags []TagEntry) error

TagResource adds tags to a resource. Region is resolved from the resource ARN.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(ctx context.Context, resourceARN string, tagKeys []string) error

UntagResource removes tags from a resource. Region is resolved from the resource ARN.

func (*InMemoryBackend) UpdateCrl 

func (b *InMemoryBackend) UpdateCrl(ctx context.Context, id, name string, crlData []byte) (*Crl, error)

UpdateCrl updates a CRL's name and/or data.

func (*InMemoryBackend) UpdateProfile 

func (b *InMemoryBackend) UpdateProfile(
	ctx context.Context,
	id, name string,
	roleArns []string,
	durationSeconds *int32,
	managedPolicyArns []string,
	sessionPolicy string,
	requireInstanceProperties *bool,
) (*Profile, error)

UpdateProfile updates a profile's fields.

func (*InMemoryBackend) UpdateTrustAnchor 

func (b *InMemoryBackend) UpdateTrustAnchor(
	ctx context.Context,
	id, name string,
	source *TrustAnchorSource,
) (*TrustAnchor, error)

UpdateTrustAnchor updates name and/or source of a trust anchor.

type MappingRule 

type MappingRule struct {
	Specifier string `json:"specifier"`
}

MappingRule is a single rule mapping a certificate field specifier to a session attribute.

type NotificationSetting 

type NotificationSetting struct {
	Threshold *int32 `json:"threshold,omitempty"`
	Event     string `json:"event"`
	Channel   string `json:"channel,omitempty"`
	Enabled   bool   `json:"enabled"`
}

NotificationSetting holds a notification configuration for a trust anchor.

type NotificationSettingKey 

type NotificationSettingKey struct {
	Event   string `json:"event"`
	Channel string `json:"channel,omitempty"`
}

NotificationSettingKey identifies a notification setting to reset.

type Profile 

type Profile struct {
	CreatedAt       time.Time `json:"createdAt"`
	UpdatedAt       time.Time `json:"updatedAt"`
	DurationSeconds *int32    `json:"durationSeconds,omitempty"`
	ProfileID       string    `json:"profileId"`
	ProfileArn      string    `json:"profileArn"`
	Name            string    `json:"name"`
	SessionPolicy   string    `json:"sessionPolicy,omitempty"`

	Tags                      []TagEntry `json:"tags,omitempty"`
	RoleArns                  []string   `json:"roleArns"`
	ManagedPolicyArns         []string   `json:"managedPolicyArns,omitempty"`
	RequireInstanceProperties bool       `json:"requireInstanceProperties,omitempty"`
	Enabled                   bool       `json:"enabled"`
	// contains filtered or unexported fields
}

Profile represents an IAM Roles Anywhere profile.

type Provider 

type Provider struct{}

Provider implements service.Provider for IAM Roles Anywhere.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Roles Anywhere service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type StorageBackend 

type StorageBackend interface {
	// Trust anchor operations
	CreateTrustAnchor(
		ctx context.Context,
		name string,
		source TrustAnchorSource,
		tags []TagEntry,
		enabled *bool,
	) (*TrustAnchor, error)
	GetTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)
	ListTrustAnchors(ctx context.Context, pageToken string, maxResults int) ([]*TrustAnchor, string, error)
	DeleteTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)
	UpdateTrustAnchor(ctx context.Context, id, name string, source *TrustAnchorSource) (*TrustAnchor, error)
	EnableTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)
	DisableTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)

	// Profile operations
	CreateProfile(
		ctx context.Context,
		name string,
		roleArns []string,
		tags []TagEntry,
		durationSeconds *int32,
		managedPolicyArns []string,
		sessionPolicy string,
		requireInstanceProperties bool,
	) (*Profile, error)
	GetProfile(ctx context.Context, id string) (*Profile, error)
	ListProfiles(ctx context.Context, pageToken string, maxResults int) ([]*Profile, string, error)
	DeleteProfile(ctx context.Context, id string) (*Profile, error)
	UpdateProfile(
		ctx context.Context,
		id, name string,
		roleArns []string,
		durationSeconds *int32,
		managedPolicyArns []string,
		sessionPolicy string,
		requireInstanceProperties *bool,
	) (*Profile, error)
	EnableProfile(ctx context.Context, id string) (*Profile, error)
	DisableProfile(ctx context.Context, id string) (*Profile, error)

	// CRL operations
	ImportCrl(
		ctx context.Context,
		name string,
		crlData []byte,
		trustAnchorArn string,
		enabled bool,
		tags []TagEntry,
	) (*Crl, error)
	GetCrl(ctx context.Context, id string) (*Crl, error)
	ListCrls(ctx context.Context, pageToken string, maxResults int) ([]*Crl, string, error)
	UpdateCrl(ctx context.Context, id, name string, crlData []byte) (*Crl, error)
	DeleteCrl(ctx context.Context, id string) (*Crl, error)
	EnableCrl(ctx context.Context, id string) (*Crl, error)
	DisableCrl(ctx context.Context, id string) (*Crl, error)

	// Subject operations
	GetSubject(ctx context.Context, id string) (*Subject, error)
	ListSubjects(ctx context.Context, pageToken string, maxResults int) ([]*Subject, string, error)

	// Attribute mapping operations
	PutAttributeMapping(ctx context.Context, profileID, certificateField string, rules []MappingRule) (*Profile, error)
	DeleteAttributeMapping(
		ctx context.Context,
		profileID, certificateField string,
		specifiers []string,
	) (*Profile, error)
	GetAttributeMappings(ctx context.Context, profileID string) []AttributeMapping

	// Notification settings operations
	PutNotificationSettings(
		ctx context.Context,
		trustAnchorID string,
		settings []NotificationSetting,
	) (*TrustAnchor, error)
	ResetNotificationSettings(
		ctx context.Context,
		trustAnchorID string,
		keys []NotificationSettingKey,
	) (*TrustAnchor, error)
	GetNotificationSettings(ctx context.Context, trustAnchorID string) []NotificationSetting

	// Tag operations
	TagResource(ctx context.Context, resourceARN string, tags []TagEntry) error
	UntagResource(ctx context.Context, resourceARN string, tagKeys []string) error
	ListTagsForResource(ctx context.Context, resourceARN string) ([]TagEntry, error)

	// Lifecycle
	Reset()
	Region() string
	AccountID() string
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend defines the interface for Roles Anywhere backend implementations. All mutating methods must be safe for concurrent use.

type Subject 

type Subject struct {
	CreatedAt   time.Time `json:"createdAt"`
	UpdatedAt   time.Time `json:"updatedAt"`
	LastSeenAt  time.Time `json:"lastSeenAt"`
	SubjectID   string    `json:"subjectId"`
	SubjectArn  string    `json:"subjectArn"`
	X509Subject string    `json:"x509Subject"`

	Enabled bool `json:"enabled"`
	// contains filtered or unexported fields
}

Subject represents an IAM Roles Anywhere subject (authenticating certificate).

type TagEntry 

type TagEntry struct {
	Key   string `json:"key"`
	Value string `json:"value"`
}

TagEntry is a key-value tag pair (Roles Anywhere uses list-based tags).

type TrustAnchor 

type TrustAnchor struct {
	CreatedAt      time.Time         `json:"createdAt"`
	UpdatedAt      time.Time         `json:"updatedAt"`
	Source         TrustAnchorSource `json:"source"`
	TrustAnchorID  string            `json:"trustAnchorId"`
	TrustAnchorArn string            `json:"trustAnchorArn"`
	Name           string            `json:"name"`

	Tags    []TagEntry `json:"tags,omitempty"`
	Enabled bool       `json:"enabled"`
	// contains filtered or unexported fields
}

TrustAnchor represents an IAM Roles Anywhere trust anchor.

type TrustAnchorSource 

type TrustAnchorSource struct {
	// SourceData is a map of source-type-specific fields.
	SourceData map[string]string `json:"sourceData,omitempty"`
	SourceType string            `json:"sourceType"`
}

TrustAnchorSource defines the source of a trust anchor.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.