verifiedpermissions

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 25 Imported by: 0

README

Verified Permissions

Parity grade: A · SDK aws-sdk-go-v2/service/verifiedpermissions@v1.31.4 · last audited 2026-07-13 (b9f40060)

Coverage

Metric Value
Operations audited 30 (30 ok)
Known gaps 3
Deferred items 1
Resource leaks clean
Known gaps
  • GetPolicy/ListPolicies/BatchGetPolicy: STATIC policy views don't echo top-level principal/resource parsed from the Cedar statement's scope clause (AWS parses the actual permit/forbid scope; gopherstack only populates principal/resource for TEMPLATE_LINKED policies). Fixing this needs Cedar AST scope introspection via cedar-go, out of scope for this pass.
  • IsAuthorizedWithToken/BatchIsAuthorizedWithToken: principalFromToken always resolves the principal type from the FIRST identity source in the policy store and does not match the token's issuer/aud against a specific identity source, nor verify the JWT signature. Documented simplification of the identity-source-selection logic, not a wire-shape bug.
  • GetPolicyStore/ListPolicyStores: optional CedarVersion field (Cedar v4 FAQ) never populated -- SDK-optional field, no client breakage, low priority.
Deferred
  • CreatePolicyStore ClientToken idempotency semantics (real AWS treats a retried ClientToken with different params as ConflictException; gopherstack ignores ClientToken entirely)

More

Documentation

Index

Constants

View Source 
const (
	ValidationModeOff    = "OFF"
	ValidationModeStrict = "STRICT"
)

ValidationMode constants for policy store validation settings.

View Source 
const (
	DeletionProtectionEnabled  = "ENABLED"
	DeletionProtectionDisabled = "DISABLED"
)

DeletionProtection constants for policy store deletion protection.

Variables

View Source 
var (
	// ErrPolicyStoreNotFound is returned when a policy store is not found.
	ErrPolicyStoreNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrPolicyNotFound is returned when a policy is not found.
	ErrPolicyNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrPolicyTemplateNotFound is returned when a policy template is not found.
	ErrPolicyTemplateNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrIdentitySourceNotFound is returned when an identity source is not found.
	ErrIdentitySourceNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrSchemaNotFound is returned when no schema has been set for a policy store.
	ErrSchemaNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrValidation is returned when input fails validation.
	ErrValidation = awserr.New("ValidationException", awserr.ErrInvalidParameter)
	// ErrConflict is returned when a resource conflict prevents an operation.
	ErrConflict = awserr.New("ConflictException", awserr.ErrConflict)
	// ErrTooManyTags is returned when TagResource would push a resource's tag
	// count over the 50-tag limit. Real AWS only declares TooManyTagsException
	// for TagResource -- CreatePolicyStore's tag-count overflow stays a plain
	// ValidationException (ErrValidation), per the SDK's per-op error models.
	ErrTooManyTags = awserr.New("TooManyTagsException", awserr.ErrInvalidParameter)
)
View Source 
var ErrNilAppContext = errors.New("verifiedpermissions: nil AppContext")

ErrNilAppContext is returned when a nil AppContext is passed to Init.

Functions

This section is empty.

Types

type AuthDecision 

type AuthDecision struct {
	Request             AuthorizationRequest `json:"request"`
	Decision            string               `json:"decision"`
	DeterminingPolicies []string             `json:"determiningPolicies"`
	Errors              []string             `json:"errors"`
}

AuthDecision is the result of a single authorization evaluation.

type AuthorizationRequest 

type AuthorizationRequest struct {
	PrincipalEntityType string `json:"principalEntityType,omitempty"`
	PrincipalEntityID   string `json:"principalEntityId,omitempty"`
	ActionType          string `json:"actionType,omitempty"`
	ActionID            string `json:"actionId,omitempty"`
	ResourceEntityType  string `json:"resourceEntityType,omitempty"`
	ResourceEntityID    string `json:"resourceEntityId,omitempty"`
}

AuthorizationRequest represents a single authorization evaluation request.

type BatchGetPolicyItem 

type BatchGetPolicyItem struct {
	PolicyStoreID string `json:"policyStoreId"`
	PolicyID      string `json:"policyId"`
}

BatchGetPolicyItem identifies a policy to retrieve in a batch request.

type BatchGetPolicyResult 

type BatchGetPolicyResult struct {
	Results []Policy                  `json:"results"`
	Errors  []batchGetPolicyErrorItem `json:"errors"`
}

BatchGetPolicyResult holds the results of a BatchGetPolicy call.

type CognitoGroupConfig 

type CognitoGroupConfig struct {
	GroupEntityType string `json:"groupEntityType,omitempty"`
}

CognitoGroupConfig holds Cognito group-to-Cedar-entity mapping configuration.

type CreatePolicyParams 

type CreatePolicyParams struct {
	PolicyType          string // "STATIC" or "TEMPLATE_LINKED"
	Statement           string // STATIC only
	Description         string // STATIC only
	PolicyTemplateID    string // TEMPLATE_LINKED only
	PrincipalEntityType string // TEMPLATE_LINKED only
	PrincipalEntityID   string // TEMPLATE_LINKED only
	ResourceEntityType  string // TEMPLATE_LINKED only
	ResourceEntityID    string // TEMPLATE_LINKED only
}

CreatePolicyParams holds parameters for creating a policy.

type Handler 

type Handler struct {
	Backend StorageBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for Amazon Verified Permissions operations.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new Verified Permissions handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this handler handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the Verified Permissions action from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported Verified Permissions operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for Verified Permissions requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all Verified Permissions state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Verified Permissions API requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type IdentitySource 

type IdentitySource struct {
	CreatedDate         time.Time           `json:"createdDate"`
	LastUpdated         time.Time           `json:"lastUpdated"`
	CognitoGroupConfig  *CognitoGroupConfig `json:"cognitoGroupConfig,omitempty"`
	OIDCGroupConfig     *OIDCGroupConfig    `json:"oidcGroupConfig,omitempty"`
	OIDCTokenSelection  *OIDCTokenSelection `json:"oidcTokenSelection,omitempty"`
	IdentitySourceID    string              `json:"identitySourceId"`
	PolicyStoreID       string              `json:"policyStoreId"`
	PrincipalEntityType string              `json:"principalEntityType"`
	UserPoolArn         string              `json:"userPoolArn,omitempty"`
	OpenIDIssuer        string              `json:"openIdIssuer,omitempty"`
	EntityIDPrefix      string              `json:"entityIdPrefix,omitempty"`
	ClientIDs           []string            `json:"clientIds,omitempty"`
}

IdentitySource represents an Amazon Verified Permissions identity source.

type IdentitySourceConfig 

type IdentitySourceConfig struct {
	// Cognito
	UserPoolArn            string
	ClientIDs              []string
	CognitoGroupEntityType string
	// OIDC
	Issuer              string
	EntityIDPrefix      string
	OIDCGroupClaim      string
	OIDCGroupEntityType string
	// Token selection
	TokenType        string // "IDENTITY" or "ACCESS"
	PrincipalIDClaim string
	Audiences        []string
}

IdentitySourceConfig holds full identity source configuration for create/update.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for Verified Permissions resources.

policyStores registers directly on b.registry, keyed by its real PolicyStoreID field. policies, policyTemplates, and identitySources were previously nested by policy store (map[string]map[string]*T); each is now a flat *store.Table keyed by the composite "policyStoreID/id" string (see policyKey/policyTemplateKey/identitySourceKey), with a companion *store.Index grouping entries by policy store for the per-store scans the nested maps used to answer directly -- the same pattern services/codeartifact uses for its region-nested maps. All three carry real, wire-visible PolicyStoreID fields, so each is a "clean" table registered directly on b.registry, no DTO wrapper needed (see persistence.go).

schemas has no wire-visible identity field at all (one schema per policy store, keyed only by the outer map's policyStoreID), so it gained a hidden policyStoreID field purely for this key; it is a "dirty" table (store.New only, deliberately NOT store.Register-ed onto b.registry) round-tripped through a DTO wrapper in persistence.go.

arnIndex is a derived cache rebuilt from the tables above on Restore, so it is never itself persisted. resourceTags, policySetCache, and policySetDirty remain plain maps: resourceTags is a non-*T value map (map[string]string) still persisted directly; policySetCache/policySetDirty are ephemeral caches that are never persisted.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the AWS account ID configured for this backend.

func (*InMemoryBackend) AddIdentitySourceInternal 

func (b *InMemoryBackend) AddIdentitySourceInternal(is *IdentitySource)

AddIdentitySourceInternal inserts a pre-built IdentitySource directly into the backend (for test seeding).

func (*InMemoryBackend) AddPolicyInternal 

func (b *InMemoryBackend) AddPolicyInternal(p *Policy)

AddPolicyInternal inserts a pre-built Policy directly into the backend (for test seeding).

func (*InMemoryBackend) AddPolicyStoreInternal 

func (b *InMemoryBackend) AddPolicyStoreInternal(ps *PolicyStore)

AddPolicyStoreInternal inserts a pre-built PolicyStore directly into the backend (for test seeding).

func (*InMemoryBackend) AddPolicyTemplateInternal 

func (b *InMemoryBackend) AddPolicyTemplateInternal(pt *PolicyTemplate)

AddPolicyTemplateInternal inserts a pre-built PolicyTemplate directly into the backend (for test seeding).

func (*InMemoryBackend) BatchGetPolicy 

func (b *InMemoryBackend) BatchGetPolicy(items []BatchGetPolicyItem) BatchGetPolicyResult

BatchGetPolicy retrieves multiple policies in a single request.

func (*InMemoryBackend) BatchIsAuthorized 

func (b *InMemoryBackend) BatchIsAuthorized(
	policyStoreID string,
	requests []AuthorizationRequest,
) ([]AuthDecision, error)

BatchIsAuthorized evaluates a batch of authorization requests.

func (*InMemoryBackend) BatchIsAuthorizedWithToken 

func (b *InMemoryBackend) BatchIsAuthorizedWithToken(
	policyStoreID string,
	requests []AuthorizationRequest,
) ([]AuthDecision, error)

BatchIsAuthorizedWithToken evaluates a batch of authorization requests using a token.

func (*InMemoryBackend) CreateIdentitySource 

func (b *InMemoryBackend) CreateIdentitySource(
	policyStoreID, principalEntityType string,
	cfg IdentitySourceConfig,
) (*IdentitySource, error)

CreateIdentitySource creates a new identity source in the given policy store.

func (*InMemoryBackend) CreatePolicy 

func (b *InMemoryBackend) CreatePolicy(policyStoreID string, params CreatePolicyParams) (*Policy, error)

CreatePolicy creates a new policy in the given policy store.

func (*InMemoryBackend) CreatePolicyStore 

func (b *InMemoryBackend) CreatePolicyStore(
	description string,
	tags map[string]string,
	validationMode, deletionProtection string,
) (*PolicyStore, error)

CreatePolicyStore creates a new policy store.

func (*InMemoryBackend) CreatePolicyTemplate 

func (b *InMemoryBackend) CreatePolicyTemplate(policyStoreID, description, statement string) (*PolicyTemplate, error)

CreatePolicyTemplate creates a new policy template in the given policy store.

func (*InMemoryBackend) DeleteIdentitySource 

func (b *InMemoryBackend) DeleteIdentitySource(policyStoreID, identitySourceID string) error

DeleteIdentitySource removes an identity source from the given policy store.

func (*InMemoryBackend) DeletePolicy 

func (b *InMemoryBackend) DeletePolicy(policyStoreID, policyID string) error

DeletePolicy removes a policy from the given policy store.

func (*InMemoryBackend) DeletePolicyStore 

func (b *InMemoryBackend) DeletePolicyStore(policyStoreID string) error

DeletePolicyStore removes a policy store and all its policies and templates.

func (*InMemoryBackend) DeletePolicyTemplate 

func (b *InMemoryBackend) DeletePolicyTemplate(policyStoreID, policyTemplateID string) error

DeletePolicyTemplate removes a policy template from the given policy store.

func (*InMemoryBackend) GetIdentitySource 

func (b *InMemoryBackend) GetIdentitySource(policyStoreID, identitySourceID string) (*IdentitySource, error)

GetIdentitySource returns the identity source with the given ID.

func (*InMemoryBackend) GetPolicy 

func (b *InMemoryBackend) GetPolicy(policyStoreID, policyID string) (*Policy, error)

GetPolicy returns the policy with the given ID.

func (*InMemoryBackend) GetPolicyStore 

func (b *InMemoryBackend) GetPolicyStore(policyStoreID string) (*PolicyStore, error)

GetPolicyStore returns the policy store with the given ID.

func (*InMemoryBackend) GetPolicyTemplate 

func (b *InMemoryBackend) GetPolicyTemplate(policyStoreID, policyTemplateID string) (*PolicyTemplate, error)

GetPolicyTemplate returns the policy template with the given ID.

func (*InMemoryBackend) GetSchema 

func (b *InMemoryBackend) GetSchema(policyStoreID string) (*PolicyStoreSchema, error)

GetSchema returns the schema for a policy store.

func (*InMemoryBackend) IsAuthorized 

func (b *InMemoryBackend) IsAuthorized(policyStoreID string, req AuthorizationRequest) (*AuthDecision, error)

IsAuthorized evaluates a single authorization request against stored Cedar policies.

func (*InMemoryBackend) IsAuthorizedWithToken 

func (b *InMemoryBackend) IsAuthorizedWithToken(
	policyStoreID string,
	req AuthorizationRequest,
) (*AuthDecision, error)

IsAuthorizedWithToken evaluates a single authorization request using a token.

func (*InMemoryBackend) ListIdentitySources 

func (b *InMemoryBackend) ListIdentitySources(
	policyStoreID, nextToken string,
	maxResults int,
	principalEntityTypes []string,
) ([]IdentitySource, string, error)

ListIdentitySources returns all identity sources for a policy store sorted by creation date. principalEntityTypes mirrors the wire "filters" list (each element's principalEntityType); when non-empty, only identity sources whose PrincipalEntityType matches one of them are returned (an OR across filters, matching AWS's ListIdentitySourcesInput.Filters semantics).

func (*InMemoryBackend) ListPolicies 

func (b *InMemoryBackend) ListPolicies(
	policyStoreID string,
	filter ListPoliciesFilter,
	nextToken string,
	maxResults int,
) ([]Policy, string, error)

ListPolicies returns policies in a policy store, with optional filter and pagination.

func (*InMemoryBackend) ListPolicyStores 

func (b *InMemoryBackend) ListPolicyStores(nextToken string, maxResults int) ([]PolicyStore, string)

ListPolicyStores returns all policy stores sorted by creation date (newest first).

func (*InMemoryBackend) ListPolicyTemplates 

func (b *InMemoryBackend) ListPolicyTemplates(
	policyStoreID, nextToken string,
	maxResults int,
) ([]PolicyTemplate, string, error)

ListPolicyTemplates returns all policy templates in a policy store sorted by creation date.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(resourceARN string) (map[string]string, error)

ListTagsForResource returns the tags for a resource identified by its ARN. Supports policy stores, policies, policy templates, and identity sources.

func (*InMemoryBackend) PutSchema 

func (b *InMemoryBackend) PutSchema(policyStoreID, schema string) ([]string, error)

PutSchema creates or replaces the schema for a policy store, extracts namespaces, and returns them.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all policy store state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(resourceARN string, tags map[string]string) error

TagResource adds or updates tags on a resource identified by its ARN. Supports policy stores, policies, policy templates, and identity sources.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(resourceARN string, tagKeys []string) error

UntagResource removes tags from a resource identified by its ARN. Supports policy stores, policies, policy templates, and identity sources.

func (*InMemoryBackend) UpdateIdentitySource 

func (b *InMemoryBackend) UpdateIdentitySource(
	policyStoreID, identitySourceID, principalEntityType string,
	cfg IdentitySourceConfig,
) (*IdentitySource, error)

UpdateIdentitySource updates the configuration and principal entity type of an identity source.

func (*InMemoryBackend) UpdatePolicy 

func (b *InMemoryBackend) UpdatePolicy(policyStoreID, policyID string, params UpdatePolicyParams) (*Policy, error)

UpdatePolicy updates an existing policy.

func (*InMemoryBackend) UpdatePolicyStore 

func (b *InMemoryBackend) UpdatePolicyStore(
	policyStoreID, description, validationMode, deletionProtection string,
) (*PolicyStore, error)

UpdatePolicyStore updates a policy store.

func (*InMemoryBackend) UpdatePolicyTemplate 

func (b *InMemoryBackend) UpdatePolicyTemplate(
	policyStoreID, policyTemplateID, description, statement string,
) (*PolicyTemplate, error)

UpdatePolicyTemplate updates the description and statement of a policy template.

type ListPoliciesFilter 

type ListPoliciesFilter struct {
	PolicyType           string
	PolicyTemplateID     string
	PrincipalEntityType  string
	PrincipalEntityID    string
	ResourceEntityType   string
	ResourceEntityID     string
	PrincipalUnspecified bool
	ResourceUnspecified  bool
}

ListPoliciesFilter holds filter params for ListPolicies. PrincipalUnspecified / ResourceUnspecified mirror the wire filter's EntityReference "unspecified" variant: when set, only policies with no principal/resource scope match.

type OIDCGroupConfig 

type OIDCGroupConfig struct {
	GroupClaim      string `json:"groupClaim,omitempty"`
	GroupEntityType string `json:"groupEntityType,omitempty"`
}

OIDCGroupConfig holds OIDC group claim to Cedar entity mapping configuration.

type OIDCTokenSelection 

type OIDCTokenSelection struct {
	TokenType        string   `json:"tokenType,omitempty"` // IDENTITY | ACCESS
	PrincipalIDClaim string   `json:"principalIdClaim,omitempty"`
	Audiences        []string `json:"audiences,omitempty"`
}

OIDCTokenSelection holds configuration for which OIDC token to use for authorization.

type Policy 

type Policy struct {
	CreatedDate         time.Time `json:"createdDate"`
	LastUpdated         time.Time `json:"lastUpdated"`
	PolicyStoreID       string    `json:"policyStoreID"`
	PolicyID            string    `json:"policyID"`
	PolicyType          string    `json:"policyType"` // STATIC | TEMPLATE_LINKED
	Statement           string    `json:"statement"`
	Description         string    `json:"description,omitempty"`
	PolicyTemplateID    string    `json:"policyTemplateID,omitempty"`
	PrincipalEntityType string    `json:"principalEntityType,omitempty"`
	PrincipalEntityID   string    `json:"principalEntityID,omitempty"`
	ResourceEntityType  string    `json:"resourceEntityType,omitempty"`
	ResourceEntityID    string    `json:"resourceEntityID,omitempty"`
}

Policy represents a policy in a Verified Permissions policy store.

type PolicyStore 

type PolicyStore struct {
	CreatedDate        time.Time         `json:"createdDate"`
	LastUpdated        time.Time         `json:"lastUpdated"`
	Tags               map[string]string `json:"tags,omitempty"`
	PolicyStoreID      string            `json:"policyStoreID"`
	Arn                string            `json:"arn"`
	Description        string            `json:"description"`
	AccountID          string            `json:"accountID"`
	Region             string            `json:"region"`
	ValidationMode     string            `json:"validationMode"`
	DeletionProtection string            `json:"deletionProtection"`
}

PolicyStore represents an Amazon Verified Permissions policy store.

type PolicyStoreSchema 

type PolicyStoreSchema struct {
	CreatedDate time.Time `json:"createdDate"`
	LastUpdated time.Time `json:"lastUpdated"`
	Schema      string    `json:"schema"`

	Namespaces []string `json:"namespaces,omitempty"`
	// contains filtered or unexported fields
}

PolicyStoreSchema holds the Cedar schema for a policy store.

type PolicyTemplate 

type PolicyTemplate struct {
	CreatedDate      time.Time `json:"createdDate"`
	LastUpdated      time.Time `json:"lastUpdated"`
	PolicyStoreID    string    `json:"policyStoreID"`
	PolicyTemplateID string    `json:"policyTemplateID"`
	Description      string    `json:"description"`
	Statement        string    `json:"statement"`
}

PolicyTemplate represents a policy template in a Verified Permissions policy store.

type Provider 

type Provider struct{}

Provider implements service.Provider for Amazon Verified Permissions.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Verified Permissions service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type StorageBackend 

type StorageBackend interface {
	AccountID() string
	CreatePolicyStore(
		description string,
		tags map[string]string,
		validationMode, deletionProtection string,
	) (*PolicyStore, error)
	GetPolicyStore(policyStoreID string) (*PolicyStore, error)
	ListPolicyStores(nextToken string, maxResults int) ([]PolicyStore, string)
	UpdatePolicyStore(policyStoreID, description, validationMode, deletionProtection string) (*PolicyStore, error)
	DeletePolicyStore(policyStoreID string) error
	CreatePolicy(policyStoreID string, params CreatePolicyParams) (*Policy, error)
	GetPolicy(policyStoreID, policyID string) (*Policy, error)
	ListPolicies(
		policyStoreID string,
		filter ListPoliciesFilter,
		nextToken string,
		maxResults int,
	) ([]Policy, string, error)
	UpdatePolicy(policyStoreID, policyID string, params UpdatePolicyParams) (*Policy, error)
	DeletePolicy(policyStoreID, policyID string) error
	CreatePolicyTemplate(policyStoreID, description, statement string) (*PolicyTemplate, error)
	GetPolicyTemplate(policyStoreID, policyTemplateID string) (*PolicyTemplate, error)
	ListPolicyTemplates(policyStoreID, nextToken string, maxResults int) ([]PolicyTemplate, string, error)
	UpdatePolicyTemplate(policyStoreID, policyTemplateID, description, statement string) (*PolicyTemplate, error)
	DeletePolicyTemplate(policyStoreID, policyTemplateID string) error
	Reset()
	TagResource(resourceARN string, tags map[string]string) error
	UntagResource(resourceARN string, tagKeys []string) error
	ListTagsForResource(resourceARN string) (map[string]string, error)
	IsAuthorized(policyStoreID string, req AuthorizationRequest) (*AuthDecision, error)
	IsAuthorizedWithToken(policyStoreID string, req AuthorizationRequest) (*AuthDecision, error)
	BatchGetPolicy(items []BatchGetPolicyItem) BatchGetPolicyResult
	BatchIsAuthorized(policyStoreID string, requests []AuthorizationRequest) ([]AuthDecision, error)
	BatchIsAuthorizedWithToken(policyStoreID string, requests []AuthorizationRequest) ([]AuthDecision, error)
	CreateIdentitySource(policyStoreID, principalEntityType string, cfg IdentitySourceConfig) (*IdentitySource, error)
	GetIdentitySource(policyStoreID, identitySourceID string) (*IdentitySource, error)
	DeleteIdentitySource(policyStoreID, identitySourceID string) error
	ListIdentitySources(
		policyStoreID, nextToken string,
		maxResults int,
		principalEntityTypes []string,
	) ([]IdentitySource, string, error)
	UpdateIdentitySource(
		policyStoreID, identitySourceID, principalEntityType string,
		cfg IdentitySourceConfig,
	) (*IdentitySource, error)
	PutSchema(policyStoreID, schema string) ([]string, error)
	GetSchema(policyStoreID string) (*PolicyStoreSchema, error)
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend is the interface for Verified Permissions storage operations.

type UpdatePolicyParams 

type UpdatePolicyParams struct {
	// For STATIC updates:
	Statement   string
	Description string
	// For TEMPLATE_LINKED principal/resource updates (template id is immutable):
	PrincipalEntityType string
	PrincipalEntityID   string
	ResourceEntityType  string
	ResourceEntityID    string
}

UpdatePolicyParams holds parameters for updating a policy.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.