ssoadmin

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 24 Imported by: 0

README

IAM Identity Center (SSO)

Parity grade: A · SDK aws-sdk-go-v2/service/ssoadmin@v1.38.0 · last audited 2026-07-12 (ecdacf06)

Coverage

Metric Value
Operations audited 20 (20 ok)
Feature families 6 (6 ok)
Known gaps 1
Deferred items 0
Resource leaks clean
Known gaps
  • RegionMetadata.IsPrimaryRegion is always false -- this backend has no concept of an instance's 'home' region distinct from AddRegion-added regions, so DescribeRegion/ListRegions never report a primary region. Real AWS sets it for the region where the instance was originally enabled. Low-value to model fully (most callers key off RegionName+Status); left as a known simplification rather than a partial/incorrect implementation. (bd: none filed -- flagging for triage)

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrValidation is returned when input validation fails.
	ErrValidation = awserr.New("ValidationException", awserr.ErrInvalidParameter)

	ErrInstanceNotFound                = errors.New("ResourceNotFoundException")
	ErrPermissionSetNotFound           = errors.New("ResourceNotFoundException")
	ErrPermissionSetAlreadyExists      = errors.New("ConflictException")
	ErrPermissionSetHasAssignments     = errors.New("ConflictException")
	ErrAssignmentNotFound              = errors.New("ResourceNotFoundException")
	ErrRequestNotFound                 = errors.New("ResourceNotFoundException")
	ErrApplicationNotFound             = errors.New("ResourceNotFoundException")
	ErrApplicationAlreadyExists        = errors.New("ConflictException")
	ErrTrustedTokenIssuerNotFound      = errors.New("ResourceNotFoundException")
	ErrTrustedTokenIssuerAlreadyExists = errors.New("ConflictException")
	ErrAccessScopeNotFound             = errors.New("ResourceNotFoundException")
	ErrAuthMethodNotFound              = errors.New("ResourceNotFoundException")
	ErrGrantNotFound                   = errors.New("ResourceNotFoundException")
	ErrACAAlreadyExists                = errors.New("ConflictException")
	ErrPermissionsBoundaryNotFound     = errors.New("ResourceNotFoundException")
	// ErrServiceQuotaExceeded is returned when a resource would exceed the
	// 50-tags-per-resource limit. Real ssoadmin has no TooManyTagsException in
	// its error model (see types/errors.go) -- quota overruns map to
	// ServiceQuotaExceededException like every other ssoadmin limit.
	ErrServiceQuotaExceeded = errors.New("ServiceQuotaExceededException")
)
View Source 
var ErrNilAppContext = errors.New("nil AppContext passed to SsoAdmin Provider.Init")

ErrNilAppContext is returned by Init when a nil AppContext is passed.

Functions

This section is empty.

Types

type ABACConfig 

type ABACConfig struct {
	// InstanceArn is the instance this configuration is keyed by in the
	// instanceACAs Table (see store_setup.go). Tagged json:"-" for the same
	// reason as PermissionsBoundary.PermissionSetArn -- see its doc comment.
	InstanceArn             string                   `json:"-"`
	StatusReason            string                   `json:"StatusReason"`
	Status                  string                   `json:"Status"`
	AccessControlAttributes []AccessControlAttribute `json:"AccessControlAttributes"`
}

ABACConfig holds ABAC configuration for an SSO instance with lifecycle status.

type AccessControlAttribute 

type AccessControlAttribute struct {
	Key   string                      `json:"Key"`
	Value AccessControlAttributeValue `json:"Value"`
}

AccessControlAttribute represents a single ABAC attribute.

type AccessControlAttributeValue 

type AccessControlAttributeValue struct {
	Source []string `json:"Source"`
}

AccessControlAttributeValue holds the source list for an attribute.

type AccountAssignment 

type AccountAssignment struct {
	AccountID        string `json:"AccountId"`
	PermissionSetArn string `json:"PermissionSetArn"`
	PrincipalID      string `json:"PrincipalId"`
	PrincipalType    string `json:"PrincipalType"`
}

AccountAssignment represents an assignment of a permission set to a principal in an account.

type Application 

type Application struct {
	CreatedDate            time.Time         `json:"CreatedDate"`
	Tags                   map[string]string `json:"Tags"`
	PortalOptions          *PortalOptions    `json:"PortalOptions,omitempty"`
	ApplicationArn         string            `json:"ApplicationArn"`
	ApplicationProviderArn string            `json:"ApplicationProviderArn"`
	Description            string            `json:"Description"`
	InstanceArn            string            `json:"InstanceArn"`
	Name                   string            `json:"Name"`
	Status                 string            `json:"Status"`
}

Application represents an AWS SSO application.

type ApplicationAssignment 

type ApplicationAssignment struct {
	ApplicationArn string `json:"ApplicationArn"`
	PrincipalID    string `json:"PrincipalId"`
	PrincipalType  string `json:"PrincipalType"`
}

ApplicationAssignment represents a principal assigned to an application.

type ApplicationGrant 

type ApplicationGrant struct {
	GrantType string          `json:"GrantType"`
	Grant     json.RawMessage `json:"Grant"`
}

ApplicationGrant holds a typed grant with its structured body.

type ApplicationProvider 

type ApplicationProvider struct {
	ApplicationProviderArn string                         `json:"ApplicationProviderArn"`
	DisplayData            ApplicationProviderDisplayData `json:"DisplayData"`
	FederationProtocol     string                         `json:"FederationProtocol,omitempty"`
}

ApplicationProvider represents an SSO application provider.

type ApplicationProviderDisplayData 

type ApplicationProviderDisplayData struct {
	Description string `json:"Description,omitempty"`
	DisplayName string `json:"DisplayName,omitempty"`
	IconURL     string `json:"IconUrl,omitempty"`
}

ApplicationProviderDisplayData contains display metadata for an application provider.

type AuthMethod 

type AuthMethod struct {
	AuthMethodType string          `json:"AuthenticationMethodType"`
	Body           json.RawMessage `json:"AuthenticationMethod"`
}

AuthMethod holds a typed authentication method with its full structured body.

type CustomerManagedPolicyReference 

type CustomerManagedPolicyReference struct {
	Name string `json:"Name"`
	Path string `json:"Path"`
}

CustomerManagedPolicyReference references a customer-managed policy.

type Handler 

type Handler struct {
	Backend StorageBackend
}

Handler is the Echo HTTP handler for the SSO Admin service.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new SSO Admin handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns the operations subject to chaos injection.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns the regions for chaos injection.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the service name for chaos injection.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation returns the operation name from the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the instance ARN from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns all supported SSO Admin operations (sorted). When adding a new operation, register it in this slice AND in the dispatch function below.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the matching priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the handler name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all backend state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a matcher that identifies SSO Admin requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory backend for the SSO Admin service.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new in-memory SSO Admin backend with a default instance.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the backend account ID.

func (*InMemoryBackend) AddApplicationInternal 

func (b *InMemoryBackend) AddApplicationInternal(instanceArn, name string) *Application

AddApplicationInternal adds a pre-built Application directly to the backend for test seeding.

func (*InMemoryBackend) AddInstanceInternal 

func (b *InMemoryBackend) AddInstanceInternal(name string) *Instance

AddInstanceInternal adds a pre-built Instance directly to the backend for test seeding. Must NOT be called concurrently with other backend methods.

func (*InMemoryBackend) AddPermissionSetInternal 

func (b *InMemoryBackend) AddPermissionSetInternal(instanceArn, name string) *PermissionSet

AddPermissionSetInternal adds a pre-built PermissionSet directly to the backend for test seeding.

func (*InMemoryBackend) AddRegion 

func (b *InMemoryBackend) AddRegion(instanceArn, regionName string) (string, error)

AddRegion adds a region to an SSO instance, simulating the asynchronous replication workflow AWS documents (status starts ADDING, transitions to ACTIVE once observed via ListRegions/DescribeRegion). Returns the region's current status, matching AddRegionOutput.Status.

func (*InMemoryBackend) AttachCustomerManagedPolicyReferenceToPermissionSet 

func (b *InMemoryBackend) AttachCustomerManagedPolicyReferenceToPermissionSet(
	instanceArn, permissionSetArn, name, path string,
) error

AttachCustomerManagedPolicyReferenceToPermissionSet attaches a customer-managed policy reference to a permission set.

func (*InMemoryBackend) AttachManagedPolicyToPermissionSet 

func (b *InMemoryBackend) AttachManagedPolicyToPermissionSet(
	instanceArn, permissionSetArn, managedPolicyArn, name string,
) error

AttachManagedPolicyToPermissionSet attaches a managed policy to a permission set.

func (*InMemoryBackend) CreateAccountAssignment 

func (b *InMemoryBackend) CreateAccountAssignment(
	instanceArn, permissionSetArn, accountID, principalID, principalType string,
) (string, error)

CreateAccountAssignment assigns a permission set to a principal in an account.

func (*InMemoryBackend) CreateApplication 

func (b *InMemoryBackend) CreateApplication(
	instanceArn, applicationProviderArn, name, description string,
	tags map[string]string,
	portalOptions *PortalOptions,
) (*Application, error)

CreateApplication creates a new application within an SSO instance.

func (*InMemoryBackend) CreateApplicationAssignment 

func (b *InMemoryBackend) CreateApplicationAssignment(applicationArn, principalID, principalType string) error

CreateApplicationAssignment assigns a principal to an application.

func (*InMemoryBackend) CreateInstance 

func (b *InMemoryBackend) CreateInstance(name, ownerAccountID, identityStoreID string) (*Instance, error)

CreateInstance creates a new SSO instance.

func (*InMemoryBackend) CreateInstanceAccessControlAttributeConfiguration 

func (b *InMemoryBackend) CreateInstanceAccessControlAttributeConfiguration(
	instanceArn string,
	attributes []AccessControlAttribute,
) error

CreateInstanceAccessControlAttributeConfiguration creates ABAC configuration for an SSO instance. Returns ConflictException if a configuration already exists (use Update to modify).

func (*InMemoryBackend) CreatePermissionSet 

func (b *InMemoryBackend) CreatePermissionSet(
	instanceArn, name, description, sessionDuration, relayState string,
	tags map[string]string,
) (*PermissionSet, error)

CreatePermissionSet creates a new permission set within an SSO instance.

func (*InMemoryBackend) CreateTrustedTokenIssuer 

func (b *InMemoryBackend) CreateTrustedTokenIssuer(
	instanceArn, name, issuerType string,
	tags map[string]string,
	cfg *TrustedTokenIssuerConfiguration,
) (*TrustedTokenIssuer, error)

CreateTrustedTokenIssuer creates a trusted token issuer within an SSO instance.

func (*InMemoryBackend) DeleteAccountAssignment 

func (b *InMemoryBackend) DeleteAccountAssignment(
	instanceArn, permissionSetArn, accountID, principalID, principalType string,
) (string, error)

DeleteAccountAssignment removes an account assignment.

func (*InMemoryBackend) DeleteApplication 

func (b *InMemoryBackend) DeleteApplication(applicationArn string) error

DeleteApplication deletes an application.

func (*InMemoryBackend) DeleteApplicationAccessScope 

func (b *InMemoryBackend) DeleteApplicationAccessScope(applicationArn, scope string) error

DeleteApplicationAccessScope removes an access scope from an application.

func (*InMemoryBackend) DeleteApplicationAssignment 

func (b *InMemoryBackend) DeleteApplicationAssignment(applicationArn, principalID, principalType string) error

DeleteApplicationAssignment removes a principal assignment from an application.

func (*InMemoryBackend) DeleteApplicationAuthenticationMethod 

func (b *InMemoryBackend) DeleteApplicationAuthenticationMethod(applicationArn, authMethodType string) error

DeleteApplicationAuthenticationMethod removes an authentication method from an application.

func (*InMemoryBackend) DeleteApplicationGrant 

func (b *InMemoryBackend) DeleteApplicationGrant(applicationArn, grantType string) error

DeleteApplicationGrant removes a grant from an application.

func (*InMemoryBackend) DeleteInlinePolicyFromPermissionSet 

func (b *InMemoryBackend) DeleteInlinePolicyFromPermissionSet(instanceArn, permissionSetArn string) error

DeleteInlinePolicyFromPermissionSet removes the inline policy from a permission set.

func (*InMemoryBackend) DeleteInstance 

func (b *InMemoryBackend) DeleteInstance(instanceArn string) error

DeleteInstance transitions an instance to DELETE_IN_PROGRESS and cascades deletion of dependent resources. The instance entry is retained briefly with DELETE_IN_PROGRESS status and pruned on next ListInstances.

func (*InMemoryBackend) DeleteInstanceAccessControlAttributeConfiguration 

func (b *InMemoryBackend) DeleteInstanceAccessControlAttributeConfiguration(instanceArn string) error

DeleteInstanceAccessControlAttributeConfiguration deletes ABAC configuration for an instance.

func (*InMemoryBackend) DeletePermissionSet 

func (b *InMemoryBackend) DeletePermissionSet(instanceArn, permissionSetArn string) error

DeletePermissionSet removes a permission set and cascades to its assignments. Returns ConflictException if the permission set is still assigned to any accounts.

func (*InMemoryBackend) DeletePermissionsBoundaryFromPermissionSet 

func (b *InMemoryBackend) DeletePermissionsBoundaryFromPermissionSet(instanceArn, permissionSetArn string) error

DeletePermissionsBoundaryFromPermissionSet removes the permissions boundary from a permission set.

func (*InMemoryBackend) DeleteTrustedTokenIssuer 

func (b *InMemoryBackend) DeleteTrustedTokenIssuer(trustedTokenIssuerArn string) error

DeleteTrustedTokenIssuer deletes a trusted token issuer.

func (*InMemoryBackend) DescribeAccountAssignmentCreationStatus 

func (b *InMemoryBackend) DescribeAccountAssignmentCreationStatus(
	_ string,
	requestID string,
) (*ProvisioningStatus, error)

DescribeAccountAssignmentCreationStatus returns the status of a creation request. Lazily transitions IN_PROGRESS → SUCCEEDED on first poll.

func (*InMemoryBackend) DescribeAccountAssignmentDeletionStatus 

func (b *InMemoryBackend) DescribeAccountAssignmentDeletionStatus(
	_ string,
	requestID string,
) (*ProvisioningStatus, error)

DescribeAccountAssignmentDeletionStatus returns the status of a deletion request. Lazily transitions IN_PROGRESS → SUCCEEDED on first poll.

func (*InMemoryBackend) DescribeApplication 

func (b *InMemoryBackend) DescribeApplication(applicationArn string) (*Application, error)

DescribeApplication returns an application by ARN.

func (*InMemoryBackend) DescribeApplicationAssignment 

func (b *InMemoryBackend) DescribeApplicationAssignment(
	applicationArn,
	principalID,
	principalType string,
) (*ApplicationAssignment, error)

DescribeApplicationAssignment returns a specific application assignment.

func (*InMemoryBackend) DescribeApplicationProvider 

func (b *InMemoryBackend) DescribeApplicationProvider(
	applicationProviderArn string,
) (*ApplicationProvider, error)

DescribeApplicationProvider returns details for an application provider. Account-scoped custom provider ARNs (arn:aws:sso::<accountId>:applicationProvider/custom) are resolved to the AWS-managed custom provider entry.

func (*InMemoryBackend) DescribeInstance 

func (b *InMemoryBackend) DescribeInstance(instanceArn string) (*Instance, error)

DescribeInstance returns a specific SSO instance. Lazily transitions CREATE_IN_PROGRESS → ACTIVE on first read.

func (*InMemoryBackend) DescribeInstanceAccessControlAttributeConfiguration 

func (b *InMemoryBackend) DescribeInstanceAccessControlAttributeConfiguration(
	instanceArn string,
) (*ABACConfig, error)

DescribeInstanceAccessControlAttributeConfiguration returns ABAC configuration for an instance.

func (*InMemoryBackend) DescribePermissionSet 

func (b *InMemoryBackend) DescribePermissionSet(instanceArn, permissionSetArn string) (*PermissionSet, error)

DescribePermissionSet returns a specific permission set.

func (*InMemoryBackend) DescribePermissionSetProvisioningStatus 

func (b *InMemoryBackend) DescribePermissionSetProvisioningStatus(
	_ string,
	provisioningRequestID string,
) (*ProvisioningStatus, error)

DescribePermissionSetProvisioningStatus returns the status of a provisioning request. Lazily transitions IN_PROGRESS → SUCCEEDED on first poll.

func (*InMemoryBackend) DescribeRegion 

func (b *InMemoryBackend) DescribeRegion(instanceArn, regionName string) (*RegionMetadata, error)

DescribeRegion returns metadata for a specific region associated with an SSO instance, lazily transitioning ADDING → ACTIVE on first describe (see ListRegions doc comment). Returns ResourceNotFoundException if the region was never added, or has finished being removed, on this instance.

func (*InMemoryBackend) DescribeTrustedTokenIssuer 

func (b *InMemoryBackend) DescribeTrustedTokenIssuer(
	trustedTokenIssuerArn string,
) (*TrustedTokenIssuer, error)

DescribeTrustedTokenIssuer returns a trusted token issuer.

func (*InMemoryBackend) DetachCustomerManagedPolicyReferenceFromPermissionSet 

func (b *InMemoryBackend) DetachCustomerManagedPolicyReferenceFromPermissionSet(
	instanceArn, permissionSetArn, name, path string,
) error

DetachCustomerManagedPolicyReferenceFromPermissionSet detaches a customer-managed policy reference.

func (*InMemoryBackend) DetachManagedPolicyFromPermissionSet 

func (b *InMemoryBackend) DetachManagedPolicyFromPermissionSet(
	instanceArn, permissionSetArn, managedPolicyArn string,
) error

DetachManagedPolicyFromPermissionSet detaches a managed policy from a permission set. Returns ResourceNotFoundException if the policy is not attached.

func (*InMemoryBackend) GetApplicationAccessScope 

func (b *InMemoryBackend) GetApplicationAccessScope(applicationArn, scope string) ([]string, error)

GetApplicationAccessScope returns whether a specific access scope exists for an application.

func (*InMemoryBackend) GetApplicationAssignmentConfiguration 

func (b *InMemoryBackend) GetApplicationAssignmentConfiguration(applicationArn string) (bool, error)

GetApplicationAssignmentConfiguration returns the assignment configuration for an application.

func (*InMemoryBackend) GetApplicationAuthenticationMethod 

func (b *InMemoryBackend) GetApplicationAuthenticationMethod(
	applicationArn, authMethodType string,
) (json.RawMessage, error)

GetApplicationAuthenticationMethod returns a specific auth method body.

func (*InMemoryBackend) GetApplicationGrant 

func (b *InMemoryBackend) GetApplicationGrant(applicationArn, grantType string) (json.RawMessage, error)

GetApplicationGrant returns a specific grant body.

func (*InMemoryBackend) GetApplicationSessionConfiguration 

func (b *InMemoryBackend) GetApplicationSessionConfiguration(applicationArn string) (string, error)

GetApplicationSessionConfiguration returns the session configuration for an application.

func (*InMemoryBackend) GetInlinePolicyForPermissionSet 

func (b *InMemoryBackend) GetInlinePolicyForPermissionSet(instanceArn, permissionSetArn string) (string, error)

GetInlinePolicyForPermissionSet returns the inline policy for a permission set.

func (*InMemoryBackend) GetPermissionsBoundaryForPermissionSet 

func (b *InMemoryBackend) GetPermissionsBoundaryForPermissionSet(
	instanceArn,
	permissionSetArn string,
) (*PermissionsBoundary, error)

GetPermissionsBoundaryForPermissionSet returns the permissions boundary for a permission set.

func (*InMemoryBackend) ListAccountAssignmentCreationStatus 

func (b *InMemoryBackend) ListAccountAssignmentCreationStatus(_, filterStatus string) []*ProvisioningStatus

ListAccountAssignmentCreationStatus returns creation statuses sorted by creation date descending. filterStatus filters by status when non-empty.

func (*InMemoryBackend) ListAccountAssignmentDeletionStatus 

func (b *InMemoryBackend) ListAccountAssignmentDeletionStatus(_, filterStatus string) []*ProvisioningStatus

ListAccountAssignmentDeletionStatus returns deletion statuses sorted by creation date descending. filterStatus filters by status when non-empty.

func (*InMemoryBackend) ListAccountAssignments 

func (b *InMemoryBackend) ListAccountAssignments(instanceArn, permissionSetArn, accountID string) []*AccountAssignment

ListAccountAssignments returns assignments for a permission set in an instance, optionally filtered by account.

func (*InMemoryBackend) ListAccountAssignmentsForPrincipal 

func (b *InMemoryBackend) ListAccountAssignmentsForPrincipal(
	instanceArn, principalID, principalType string,
) []*AccountAssignment

ListAccountAssignmentsForPrincipal returns account assignments for a specific principal.

func (*InMemoryBackend) ListAccountsForProvisionedPermissionSet 

func (b *InMemoryBackend) ListAccountsForProvisionedPermissionSet(
	instanceArn, permissionSetArn string,
) ([]string, error)

ListAccountsForProvisionedPermissionSet returns account IDs where a permission set has assignments.

func (*InMemoryBackend) ListApplicationAccessScopes 

func (b *InMemoryBackend) ListApplicationAccessScopes(applicationArn string) ([]ScopeDetails, error)

ListApplicationAccessScopes lists access scopes and their authorized targets on an application, sorted by scope name for deterministic output.

func (*InMemoryBackend) ListApplicationAssignments 

func (b *InMemoryBackend) ListApplicationAssignments(applicationArn string) ([]*ApplicationAssignment, error)

ListApplicationAssignments returns assignments for an application.

func (*InMemoryBackend) ListApplicationAssignmentsForPrincipal 

func (b *InMemoryBackend) ListApplicationAssignmentsForPrincipal(
	instanceArn, principalID, principalType string,
) []*ApplicationAssignment

ListApplicationAssignmentsForPrincipal returns all application assignments for a specific principal.

func (*InMemoryBackend) ListApplicationAuthenticationMethods 

func (b *InMemoryBackend) ListApplicationAuthenticationMethods(applicationArn string) ([]AuthMethod, error)

ListApplicationAuthenticationMethods lists authentication methods with their bodies.

func (*InMemoryBackend) ListApplicationGrants 

func (b *InMemoryBackend) ListApplicationGrants(applicationArn string) ([]ApplicationGrant, error)

ListApplicationGrants lists grants on an application with their bodies.

func (*InMemoryBackend) ListApplicationProviders 

func (b *InMemoryBackend) ListApplicationProviders() []*ApplicationProvider

ListApplicationProviders returns the static AWS-managed provider catalog.

func (*InMemoryBackend) ListApplications 

func (b *InMemoryBackend) ListApplications(instanceArn string) []*Application

ListApplications returns applications for an instance.

func (*InMemoryBackend) ListCustomerManagedPolicyReferencesInPermissionSet 

func (b *InMemoryBackend) ListCustomerManagedPolicyReferencesInPermissionSet(
	instanceArn,
	permissionSetArn string,
) ([]CustomerManagedPolicyReference, error)

ListCustomerManagedPolicyReferencesInPermissionSet lists customer-managed policy references in a permission set.

func (*InMemoryBackend) ListInstances 

func (b *InMemoryBackend) ListInstances() []*Instance

ListInstances returns all SSO instances, pruning DELETE_IN_PROGRESS entries.

func (*InMemoryBackend) ListManagedPoliciesInPermissionSet 

func (b *InMemoryBackend) ListManagedPoliciesInPermissionSet(
	instanceArn, permissionSetArn string,
) ([]ManagedPolicy, error)

ListManagedPoliciesInPermissionSet lists managed policies attached to a permission set.

func (*InMemoryBackend) ListPermissionSetProvisioningStatus 

func (b *InMemoryBackend) ListPermissionSetProvisioningStatus(_, filterStatus string) []*ProvisioningStatus

ListPermissionSetProvisioningStatus returns permission-set provisioning statuses sorted by date descending. filterStatus filters by status when non-empty.

func (*InMemoryBackend) ListPermissionSets 

func (b *InMemoryBackend) ListPermissionSets(instanceArn string) []*PermissionSet

ListPermissionSets returns all permission sets for an SSO instance.

func (*InMemoryBackend) ListPermissionSetsProvisionedToAccount 

func (b *InMemoryBackend) ListPermissionSetsProvisionedToAccount(instanceArn, accountID string) []string

ListPermissionSetsProvisionedToAccount returns the permission set ARNs provisioned to a specific account.

func (*InMemoryBackend) ListRegions 

func (b *InMemoryBackend) ListRegions(instanceArn string) ([]RegionMetadata, error)

ListRegions returns the regions associated with an SSO instance. Entries in ADDING status lazily transition to ACTIVE and entries in REMOVING status are pruned, matching the lazy-transition pattern used elsewhere in this backend (e.g. ListInstances, DescribeAccountAssignmentCreationStatus).

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(instanceArn, resourceArn string) (map[string]string, error)

ListTagsForResource returns the tags on a resource (permission set, instance, or application).

func (*InMemoryBackend) ListTrustedTokenIssuers 

func (b *InMemoryBackend) ListTrustedTokenIssuers(instanceArn string) []*TrustedTokenIssuer

ListTrustedTokenIssuers lists trusted token issuers for an instance.

func (*InMemoryBackend) ProvisionPermissionSet 

func (b *InMemoryBackend) ProvisionPermissionSet(
	instanceArn, permissionSetArn, targetType, targetID string,
) (string, error)

ProvisionPermissionSet initiates provisioning of a permission set. targetType is AWS_ACCOUNT or ALL_PROVISIONED_ACCOUNTS; targetID is required for AWS_ACCOUNT.

func (*InMemoryBackend) PutApplicationAccessScope 

func (b *InMemoryBackend) PutApplicationAccessScope(applicationArn, scope string, authorizedTargets []string) error

PutApplicationAccessScope adds or updates an access scope and its authorized target ARNs on an application. Real AWS "Put" semantics replace the full authorizedTargets list on each call rather than merging.

func (*InMemoryBackend) PutApplicationAssignmentConfiguration 

func (b *InMemoryBackend) PutApplicationAssignmentConfiguration(applicationArn string, assignmentRequired bool) error

PutApplicationAssignmentConfiguration sets assignment configuration on an application.

func (*InMemoryBackend) PutApplicationAuthenticationMethod 

func (b *InMemoryBackend) PutApplicationAuthenticationMethod(
	applicationArn, authMethodType string,
	body json.RawMessage,
) error

PutApplicationAuthenticationMethod stores a typed authentication method with its body. authMethodType must be IAM; body is the full AuthenticationMethod JSON object.

func (*InMemoryBackend) PutApplicationGrant 

func (b *InMemoryBackend) PutApplicationGrant(applicationArn, grantType string, body json.RawMessage) error

PutApplicationGrant stores a typed grant with its full body.

func (*InMemoryBackend) PutApplicationSessionConfiguration 

func (b *InMemoryBackend) PutApplicationSessionConfiguration(applicationArn, sessionDuration string) error

PutApplicationSessionConfiguration sets session configuration on an application.

func (*InMemoryBackend) PutInlinePolicyToPermissionSet 

func (b *InMemoryBackend) PutInlinePolicyToPermissionSet(instanceArn, permissionSetArn, inlinePolicy string) error

PutInlinePolicyToPermissionSet sets the inline policy on a permission set.

func (*InMemoryBackend) PutPermissionsBoundaryToPermissionSet 

func (b *InMemoryBackend) PutPermissionsBoundaryToPermissionSet(
	instanceArn, permissionSetArn string, boundary *PermissionsBoundary,
) error

PutPermissionsBoundaryToPermissionSet sets the permissions boundary on a permission set. boundary must have exactly one of ManagedPolicyArn or CustomerManagedPolicyReference set.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the backend region.

func (*InMemoryBackend) RemoveRegion 

func (b *InMemoryBackend) RemoveRegion(instanceArn, regionName string) (string, error)

RemoveRegion initiates removal of a region from an SSO instance. The entry is retained with REMOVING status and pruned on the next ListRegions or DescribeRegion call, mirroring the DeleteInstance/cascadeDeleteInstance lazy-prune pattern. Returns the region's status (REMOVING), matching RemoveRegionOutput.Status.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all backend state and re-seeds the default instance.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(instanceArn, resourceArn string, tags map[string]string) error

TagResource adds tags to a resource (permission set, instance, application, or trusted token issuer).

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(instanceArn, resourceArn string, tagKeys []string) error

UntagResource removes tags from a resource (permission set, instance, or application).

func (*InMemoryBackend) UpdateApplication 

func (b *InMemoryBackend) UpdateApplication(
	applicationArn, name, description, status string,
	portalOptions *PortalOptions,
) (*Application, error)

UpdateApplication updates mutable fields on an application.

func (*InMemoryBackend) UpdateInstance 

func (b *InMemoryBackend) UpdateInstance(instanceArn, name string) error

UpdateInstance updates the name of an SSO instance.

func (*InMemoryBackend) UpdateInstanceAccessControlAttributeConfiguration 

func (b *InMemoryBackend) UpdateInstanceAccessControlAttributeConfiguration(
	instanceArn string,
	attributes []AccessControlAttribute,
) error

UpdateInstanceAccessControlAttributeConfiguration updates the ABAC config for an instance.

func (*InMemoryBackend) UpdatePermissionSet 

func (b *InMemoryBackend) UpdatePermissionSet(
	instanceArn, permissionSetArn, description, sessionDuration, relayState string,
) error

UpdatePermissionSet updates a permission set's mutable fields.

func (*InMemoryBackend) UpdateTrustedTokenIssuer 

func (b *InMemoryBackend) UpdateTrustedTokenIssuer(
	trustedTokenIssuerArn,
	name,
	issuerType string,
	cfg *TrustedTokenIssuerConfiguration,
) (*TrustedTokenIssuer, error)

UpdateTrustedTokenIssuer updates mutable trusted token issuer fields.

type Instance 

type Instance struct {
	CreatedDate     time.Time         `json:"CreatedDate"`
	Tags            map[string]string `json:"Tags"`
	IdentityStoreID string            `json:"IdentityStoreId"`
	InstanceArn     string            `json:"InstanceArn"`
	Name            string            `json:"Name"`
	OwnerAccountID  string            `json:"OwnerAccountId"`
	Status          string            `json:"Status"`
}

Instance represents an AWS SSO instance.

type InstanceAccessControlAttributeConfiguration 

type InstanceAccessControlAttributeConfiguration struct {
	AccessControlAttributes []AccessControlAttribute `json:"AccessControlAttributes"`
}

InstanceAccessControlAttributeConfiguration holds ABAC configuration for an instance.

type ManagedPolicy 

type ManagedPolicy struct {
	Arn  string `json:"Arn"`
	Name string `json:"Name"`
}

ManagedPolicy represents an IAM managed policy attached to a permission set.

type OidcJwtConfiguration 

type OidcJwtConfiguration struct {
	IssuerURL                  string `json:"IssuerUrl"`
	ClaimAttributePath         string `json:"ClaimAttributePath"`
	IdentityStoreAttributePath string `json:"IdentityStoreAttributePath"`
	JwksRetrievalOption        string `json:"JwksRetrievalOption"`
}

OidcJwtConfiguration holds OIDC JWT trusted token issuer configuration.

type PermissionSet 

type PermissionSet struct {
	CreatedDate      time.Time         `json:"CreatedDate"`
	Tags             map[string]string `json:"Tags"`
	PermissionSetArn string            `json:"PermissionSetArn"`
	InstanceArn      string            `json:"InstanceArn"`
	Name             string            `json:"Name"`
	Description      string            `json:"Description"`
	SessionDuration  string            `json:"SessionDuration"`
	RelayState       string            `json:"RelayState"`
	InlinePolicy     string            `json:"InlinePolicy"`
	ManagedPolicies  []ManagedPolicy   `json:"ManagedPolicies"`
}

PermissionSet represents an AWS SSO permission set.

type PermissionsBoundary 

type PermissionsBoundary struct {
	// PermissionSetArn is the permission set this boundary is keyed by in the
	// permissionBoundaries Table (see store_setup.go). It is tagged json:"-"
	// because permissionBoundaries is a "dirty" table -- persistence.go
	// instead round-trips it through a dedicated permissionsBoundarySnapshot
	// DTO that carries the identity as a real JSON field, so it survives the
	// round trip despite being excluded here. It must never change after the
	// value is stored (store.Table's keyFn purity requirement).
	PermissionSetArn               string                          `json:"-"`
	CustomerManagedPolicyReference *CustomerManagedPolicyReference `json:"CustomerManagedPolicyReference,omitempty"`
	ManagedPolicyArn               string                          `json:"ManagedPolicyArn,omitempty"`
}

PermissionsBoundary is a union: either ManagedPolicyArn or CustomerManagedPolicyReference.

type PortalOptions 

type PortalOptions struct {
	Visibility    string        `json:"Visibility"`
	SignInOptions SignInOptions `json:"SignInOptions"`
}

PortalOptions holds portal configuration for an application.

type Provider 

type Provider struct{}

Provider implements service.Provider for the SSO Admin service.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the SSO Admin service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type ProvisioningStatus 

type ProvisioningStatus struct {
	CreatedDate      time.Time `json:"CreatedDate"`
	RequestID        string    `json:"RequestId"`
	Status           string    `json:"Status"`
	FailureReason    string    `json:"FailureReason"`
	AccountID        string    `json:"AccountId,omitempty"`
	PermissionSetArn string    `json:"PermissionSetArn,omitempty"`
	TargetType       string    `json:"TargetType,omitempty"`
	PrincipalID      string    `json:"PrincipalId,omitempty"`
	PrincipalType    string    `json:"PrincipalType,omitempty"`
}

ProvisioningStatus represents the status of an async provisioning/assignment request.

type RegionMetadata 

type RegionMetadata struct {
	AddedDate       time.Time `json:"AddedDate"`
	RegionName      string    `json:"RegionName"`
	Status          string    `json:"Status"`
	IsPrimaryRegion bool      `json:"IsPrimaryRegion"`
}

RegionMetadata represents a region associated with an SSO instance. Field names and JSON tags mirror the real ssoadmin.RegionMetadata wire shape (AddedDate, IsPrimaryRegion, RegionName, Status) -- see aws-sdk-go-v2/service/ssoadmin/types.RegionMetadata.

type ScopeDetails 

type ScopeDetails struct {
	Scope             string   `json:"Scope"`
	AuthorizedTargets []string `json:"AuthorizedTargets"`
}

ScopeDetails describes an access scope and the ARNs it authorizes, matching the real ssoadmin.types.ScopeDetails wire shape returned by ListApplicationAccessScopes.

type SignInOptions 

type SignInOptions struct {
	Origin         string `json:"Origin"`
	ApplicationURL string `json:"ApplicationUrl"`
}

SignInOptions holds sign-in configuration for an application's portal.

type StorageBackend 

type StorageBackend interface {
	AccountID() string
	Region() string
	Reset()
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
	CreateInstance(name, ownerAccountID, identityStoreID string) (*Instance, error)
	ListInstances() []*Instance
	DescribeInstance(instanceArn string) (*Instance, error)
	DeleteInstance(instanceArn string) error
	CreatePermissionSet(
		instanceArn, name, description, sessionDuration, relayState string,
		tags map[string]string,
	) (*PermissionSet, error)
	DescribePermissionSet(instanceArn, permissionSetArn string) (*PermissionSet, error)
	ListPermissionSets(instanceArn string) []*PermissionSet
	ListPermissionSetsProvisionedToAccount(instanceArn, accountID string) []string
	DeletePermissionSet(instanceArn, permissionSetArn string) error
	UpdatePermissionSet(instanceArn, permissionSetArn, description, sessionDuration, relayState string) error
	CreateAccountAssignment(instanceArn, permissionSetArn, accountID, principalID, principalType string) (string, error)
	DescribeAccountAssignmentCreationStatus(instanceArn, requestID string) (*ProvisioningStatus, error)
	ListAccountAssignments(instanceArn, permissionSetArn, accountID string) []*AccountAssignment
	ListAccountAssignmentsForPrincipal(instanceArn, principalID, principalType string) []*AccountAssignment
	DeleteAccountAssignment(instanceArn, permissionSetArn, accountID, principalID, principalType string) (string, error)
	DescribeAccountAssignmentDeletionStatus(instanceArn, requestID string) (*ProvisioningStatus, error)
	AttachManagedPolicyToPermissionSet(instanceArn, permissionSetArn, managedPolicyARN, name string) error
	DetachManagedPolicyFromPermissionSet(instanceArn, permissionSetArn, managedPolicyARN string) error
	ListManagedPoliciesInPermissionSet(instanceArn, permissionSetArn string) ([]ManagedPolicy, error)
	PutInlinePolicyToPermissionSet(instanceArn, permissionSetArn, inlinePolicy string) error
	GetInlinePolicyForPermissionSet(instanceArn, permissionSetArn string) (string, error)
	DeleteInlinePolicyFromPermissionSet(instanceArn, permissionSetArn string) error
	// ProvisionPermissionSet provisions a permission set; targetType is AWS_ACCOUNT or ALL_PROVISIONED_ACCOUNTS.
	ProvisionPermissionSet(instanceArn, permissionSetArn, targetType, targetID string) (string, error)
	DescribePermissionSetProvisioningStatus(instanceArn, provisioningRequestID string) (*ProvisioningStatus, error)
	TagResource(instanceArn, resourceARN string, tags map[string]string) error
	UntagResource(instanceArn, resourceARN string, tagKeys []string) error
	ListTagsForResource(instanceArn, resourceARN string) (map[string]string, error)
	// AddRegion returns the region's status (ADDING, or the existing status if
	// already present), matching AddRegionOutput.Status.
	AddRegion(instanceArn, regionName string) (string, error)
	AttachCustomerManagedPolicyReferenceToPermissionSet(instanceArn, permissionSetArn, name, path string) error
	DeleteApplicationGrant(applicationArn, grantType string) error
	DeleteInstanceAccessControlAttributeConfiguration(instanceArn string) error
	DeleteTrustedTokenIssuer(trustedTokenIssuerArn string) error
	DescribeApplication(applicationArn string) (*Application, error)
	DescribeApplicationAssignment(applicationArn, principalID, principalType string) (*ApplicationAssignment, error)
	DescribeApplicationProvider(applicationProviderArn string) (*ApplicationProvider, error)
	DescribeInstanceAccessControlAttributeConfiguration(instanceArn string) (*ABACConfig, error)
	DescribeTrustedTokenIssuer(trustedTokenIssuerArn string) (*TrustedTokenIssuer, error)
	// GetPermissionsBoundaryForPermissionSet returns the full union-type boundary.
	GetPermissionsBoundaryForPermissionSet(instanceArn, permissionSetArn string) (*PermissionsBoundary, error)
	// ListAccountAssignmentCreationStatus accepts an optional filterStatus ("IN_PROGRESS", "SUCCEEDED", "FAILED", "").
	ListAccountAssignmentCreationStatus(instanceArn, filterStatus string) []*ProvisioningStatus
	// ListAccountAssignmentDeletionStatus accepts an optional filterStatus.
	ListAccountAssignmentDeletionStatus(instanceArn, filterStatus string) []*ProvisioningStatus
	ListApplicationAccessScopes(applicationArn string) ([]ScopeDetails, error)
	ListApplicationAssignments(applicationArn string) ([]*ApplicationAssignment, error)
	ListApplicationAuthenticationMethods(applicationArn string) ([]AuthMethod, error)
	ListApplicationGrants(applicationArn string) ([]ApplicationGrant, error)
	ListApplicationProviders() []*ApplicationProvider
	ListApplications(instanceArn string) []*Application
	// ListPermissionSetProvisioningStatus accepts an optional filterStatus.
	ListPermissionSetProvisioningStatus(instanceArn, filterStatus string) []*ProvisioningStatus
	ListRegions(instanceArn string) ([]RegionMetadata, error)
	ListTrustedTokenIssuers(instanceArn string) []*TrustedTokenIssuer
	PutApplicationAccessScope(applicationArn, scope string, authorizedTargets []string) error
	PutApplicationAssignmentConfiguration(applicationArn string, assignmentRequired bool) error
	// PutApplicationAuthenticationMethod stores a structured auth method body; authMethodType must be IAM.
	PutApplicationAuthenticationMethod(applicationArn, authMethodType string, body json.RawMessage) error
	// PutApplicationGrant stores a structured grant body; grantType must be a valid AWS grant type enum value.
	PutApplicationGrant(applicationArn, grantType string, body json.RawMessage) error
	PutApplicationSessionConfiguration(applicationArn, sessionDuration string) error
	// PutPermissionsBoundaryToPermissionSet accepts a union boundary
	// (ManagedPolicyArn xor CustomerManagedPolicyReference).
	PutPermissionsBoundaryToPermissionSet(
		instanceArn, permissionSetArn string, boundary *PermissionsBoundary,
	) error
	UpdateApplication(
		applicationArn, name, description, status string,
		portalOptions *PortalOptions,
	) (*Application, error)
	UpdateTrustedTokenIssuer(
		trustedTokenIssuerArn, name, issuerType string,
		cfg *TrustedTokenIssuerConfiguration,
	) (*TrustedTokenIssuer, error)
	CreateApplication(
		instanceArn, applicationProviderArn, name, description string,
		tags map[string]string,
		portalOptions *PortalOptions,
	) (*Application, error)
	CreateApplicationAssignment(applicationArn, principalID, principalType string) error
	CreateInstanceAccessControlAttributeConfiguration(instanceArn string, attributes []AccessControlAttribute) error
	CreateTrustedTokenIssuer(
		instanceArn, name, issuerType string,
		tags map[string]string,
		cfg *TrustedTokenIssuerConfiguration,
	) (*TrustedTokenIssuer, error)
	DeleteApplication(applicationArn string) error
	DeleteApplicationAccessScope(applicationArn, scope string) error
	DeleteApplicationAssignment(applicationArn, principalID, principalType string) error
	DeleteApplicationAuthenticationMethod(applicationArn, authMethodType string) error
	DeletePermissionsBoundaryFromPermissionSet(instanceArn, permissionSetArn string) error
	DetachCustomerManagedPolicyReferenceFromPermissionSet(instanceArn, permissionSetArn, name, path string) error
	GetApplicationAssignmentConfiguration(applicationArn string) (bool, error)
	GetApplicationSessionConfiguration(applicationArn string) (string, error)
	GetApplicationAccessScope(applicationArn, scope string) ([]string, error)
	GetApplicationAuthenticationMethod(applicationArn, authMethodType string) (json.RawMessage, error)
	GetApplicationGrant(applicationArn, grantType string) (json.RawMessage, error)
	ListCustomerManagedPolicyReferencesInPermissionSet(
		instanceArn, permissionSetArn string,
	) ([]CustomerManagedPolicyReference, error)
	// RemoveRegion returns the region's status (REMOVING), matching
	// RemoveRegionOutput.Status.
	RemoveRegion(instanceArn, regionName string) (string, error)
	// DescribeRegion returns metadata for a region previously added via AddRegion.
	DescribeRegion(instanceArn, regionName string) (*RegionMetadata, error)
	UpdateInstance(instanceArn, name string) error
	UpdateInstanceAccessControlAttributeConfiguration(instanceArn string, attributes []AccessControlAttribute) error
	ListAccountsForProvisionedPermissionSet(instanceArn, permissionSetArn string) ([]string, error)
	ListApplicationAssignmentsForPrincipal(instanceArn, principalID, principalType string) []*ApplicationAssignment
}

StorageBackend is the interface for SSO Admin storage operations.

type TrustedTokenIssuer 

type TrustedTokenIssuer struct {
	Tags                            map[string]string                `json:"Tags"`
	TrustedTokenIssuerConfiguration *TrustedTokenIssuerConfiguration `json:"TrustedTokenIssuerConfiguration,omitempty"`
	TrustedTokenIssuerArn           string                           `json:"TrustedTokenIssuerArn"`
	InstanceArn                     string                           `json:"InstanceArn"`
	Name                            string                           `json:"Name"`
	TrustedTokenIssuerType          string                           `json:"TrustedTokenIssuerType"`
}

TrustedTokenIssuer represents a trusted token issuer.

type TrustedTokenIssuerConfiguration 

type TrustedTokenIssuerConfiguration struct {
	OidcJwtConfiguration *OidcJwtConfiguration `json:"OidcJwtConfiguration,omitempty"`
}

TrustedTokenIssuerConfiguration holds the issuer-type-specific configuration.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.