rolesanywhere

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 21 Imported by: 0

README

IAM Roles Anywhere

Parity grade: A · SDK aws-sdk-go-v2/service/rolesanywhere@v1.23.0 · last audited 2026-07-23 (aec3b6110)

Coverage

Metric Value
Operations audited 30 (28 ok, 2 partial)
Feature families 5 (5 ok)
Known gaps 4
Deferred items 0
Resource leaks clean
Known gaps
  • GetSubject/ListSubjects: subjects store is never populated -- there is no CreateSession endpoint in this service (AWS Roles Anywhere's session-vending API is a separate mTLS-authenticated data-plane API, not SigV4/control-plane, and remains out of scope). SubjectDetail's Credentials/InstanceProperties fields are also unmodeled. Would need its own audit pass if CreateSession is ever added to gopherstack.
  • No AccessDeniedException path anywhere in this service -- gopherstack has no IAM policy evaluation engine to source it from; this is a cross-cutting infra gap common to every gopherstack service, not specific to rolesanywhere.
  • CreateProfile/CreateTrustAnchor/ImportCrl don't validate their other 'required' members (e.g. CreateProfileInput.RoleArns, CreateTrustAnchorInput.Source is now checked but ImportCrlInput.CrlData/TrustAnchorArn were added this pass) as exhaustively as the real SDK's client-side validators -- e.g. RoleArns may still be an empty/nil list without a ValidationException, where real AWS's validateOpCreateProfileInput requires it non-nil. Low severity (permissive-accepts-more, not a wire-shape or invented-behavior bug); left unfixed this pass to control blast radius across the many existing tests that create profiles with nil roleArns for role-agnostic scenarios (attribute-mapping tests, isolation tests, etc.).
  • TrustAnchorDetail has no createdBy field in the real API (confirmed absent from types.TrustAnchorDetail) -- correctly NOT added to TrustAnchor's JSON output this pass (a prior gaps note incorrectly implied it should be); ProfileDetail DOES have createdBy and it is now implemented.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrTrustAnchorNotFound is returned when a trust anchor does not exist.
	ErrTrustAnchorNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrProfileNotFound is returned when a profile does not exist.
	ErrProfileNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrCrlNotFound is returned when a CRL does not exist.
	ErrCrlNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrSubjectNotFound is returned when a subject does not exist.
	ErrSubjectNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrResourceNotFound is returned when TagResource/ListTagsForResource is
	// given a resourceArn that does not match any trust anchor, profile, or
	// CRL. Unlike the resource-specific NotFound sentinels above, callers of
	// tag operations address resources purely by ARN, with no dedicated
	// per-family lookup path.
	ErrResourceNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrValidation is returned on invalid input.
	ErrValidation = awserr.New("ValidationException", awserr.ErrInvalidParameter)
	// ErrTooManyTags is returned when TagResource would push a resource's
	// total tag count past the service's 200-tag limit (the same limit the
	// real SDK's TagList shape enforces on any single tags list; see
	// aws-sdk-go-v2/service/rolesanywhere's service-2.json "TagList" shape,
	// max: 200).
	ErrTooManyTags = awserr.New("TooManyTagsException", awserr.ErrInvalidParameter)
)
View Source 
var ErrNilAppContext = errors.New("rolesanywhere: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type AttributeMapping 

type AttributeMapping struct {
	CertificateField string        `json:"certificateField"`
	MappingRules     []MappingRule `json:"mappingRules"`
}

AttributeMapping maps a certificate field to session attribute rules.

type Crl 

type Crl struct {
	CreatedAt      time.Time `json:"createdAt"`
	UpdatedAt      time.Time `json:"updatedAt"`
	CrlID          string    `json:"crlId"`
	CrlArn         string    `json:"crlArn"`
	Name           string    `json:"name"`
	TrustAnchorArn string    `json:"trustAnchorArn"`

	CrlData []byte `json:"crlData,omitempty"`
	Enabled bool   `json:"enabled"`
	// contains filtered or unexported fields
}

Crl represents an IAM Roles Anywhere Certificate Revocation List.

type Handler 

type Handler struct {
	Backend StorageBackend
}

Handler handles Roles Anywhere HTTP requests.

func NewHandler 

func NewHandler(b StorageBackend) *Handler

NewHandler constructs a new Handler.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset resets the backend.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Roles Anywhere requests by path.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend. Prior to Phase 3.3, Handler had no Snapshot/Restore of its own even though InMemoryBackend fully implemented them: the service registry's persistence setup (see setupPersistence in cli.go) only registers a service.Registerable that also satisfies an inline Snapshot/Restore interface, so RolesAnywhere state was silently never persisted. These two methods close that gap.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend implements StorageBackend using in-memory maps.

trustAnchors, profiles, crls, and subjects were previously map[region]map[id]*T; Phase 3.3 replaces each with a flat *store.Table keyed by the composite "region|id" string (see regionKey), with a companion *store.Index grouping entries by region -- see store_setup.go's registerAllTables doc for the full rationale and why all four are "dirty" (unregistered on registry) tables. tags, attributeMappings, and notificationSettings remain plain region-nested maps: each holds a slice value ([]TagEntry / []AttributeMapping / []NotificationSetting), not a *T, so there is nothing for store.Table to key on.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend constructs a new InMemoryBackend.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the backend's account ID.

func (*InMemoryBackend) CreateProfile 

func (b *InMemoryBackend) CreateProfile(
	ctx context.Context,
	name string,
	roleArns []string,
	tags []TagEntry,
	durationSeconds *int32,
	managedPolicyArns []string,
	sessionPolicy string,
	requireInstanceProperties bool,
	enabled *bool,
	acceptRoleSessionName *bool,
) (*Profile, error)

CreateProfile creates a new profile. enabled defaults to true when nil, matching the AWS CreateProfileRequest.enabled default (the same pattern CreateTrustAnchor and ImportCrl already use).

Real AWS Roles Anywhere has no uniqueness constraint on profile names (CreateProfile only models ValidationException/AccessDeniedException -- there is no ConflictException shape anywhere in the service), so duplicate names are accepted, matching the real API.

func (*InMemoryBackend) CreateTrustAnchor 

func (b *InMemoryBackend) CreateTrustAnchor(
	ctx context.Context,
	name string,
	source TrustAnchorSource,
	tags []TagEntry,
	enabled *bool,
	notificationSettings []NotificationSetting,
) (*TrustAnchor, error)

CreateTrustAnchor creates a new trust anchor. enabled defaults to true when nil, matching the AWS CreateTrustAnchorRequest.enabled default.

Real AWS Roles Anywhere has no uniqueness constraint on trust anchor names (only ResourceNotFoundException/ValidationException/AccessDeniedException are modeled for CreateTrustAnchor -- there is no ConflictException shape anywhere in the service at all), so duplicate names are accepted, matching the real API; the identifier of record is the generated ID/ARN.

func (*InMemoryBackend) DeleteAttributeMapping 

func (b *InMemoryBackend) DeleteAttributeMapping(
	ctx context.Context,
	profileID, certificateField string,
	specifiers []string,
) (*Profile, error)

DeleteAttributeMapping removes a certificate field mapping (and optional specifiers) from a profile.

func (*InMemoryBackend) DeleteCrl 

func (b *InMemoryBackend) DeleteCrl(ctx context.Context, id string) (*Crl, error)

DeleteCrl removes a CRL. Its tags (held in a separate ARN-keyed map, not on the Crl struct itself -- see store.go) are cascade-deleted so no ghost row survives the CRL it belonged to.

func (*InMemoryBackend) DeleteProfile 

func (b *InMemoryBackend) DeleteProfile(ctx context.Context, id string) (*Profile, error)

DeleteProfile removes a profile and returns its state immediately before deletion, matching AWS's DeleteProfileResponse.profile. Its attribute mappings and tags (both held in separate ID/ARN-keyed maps, not on the Profile struct itself -- see store.go) are cascade-deleted so no ghost rows survive the profile they belonged to.

func (*InMemoryBackend) DeleteTrustAnchor 

func (b *InMemoryBackend) DeleteTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)

DeleteTrustAnchor removes a trust anchor and returns its state immediately before deletion, matching AWS's DeleteTrustAnchorResponse.trustAnchor. Its notification settings and tags (both held in separate ARN/ID-keyed maps, not on the TrustAnchor struct itself -- see store.go) are cascade-deleted so no ghost rows survive the trust anchor they belonged to.

func (*InMemoryBackend) DisableCrl 

func (b *InMemoryBackend) DisableCrl(ctx context.Context, id string) (*Crl, error)

DisableCrl disables a CRL.

func (*InMemoryBackend) DisableProfile 

func (b *InMemoryBackend) DisableProfile(ctx context.Context, id string) (*Profile, error)

DisableProfile disables a profile.

func (*InMemoryBackend) DisableTrustAnchor 

func (b *InMemoryBackend) DisableTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)

DisableTrustAnchor disables a trust anchor.

func (*InMemoryBackend) EnableCrl 

func (b *InMemoryBackend) EnableCrl(ctx context.Context, id string) (*Crl, error)

EnableCrl enables a CRL.

func (*InMemoryBackend) EnableProfile 

func (b *InMemoryBackend) EnableProfile(ctx context.Context, id string) (*Profile, error)

EnableProfile enables a profile.

func (*InMemoryBackend) EnableTrustAnchor 

func (b *InMemoryBackend) EnableTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)

EnableTrustAnchor enables a trust anchor.

func (*InMemoryBackend) GetAttributeMappings 

func (b *InMemoryBackend) GetAttributeMappings(ctx context.Context, profileID string) []AttributeMapping

GetAttributeMappings returns the attribute mappings for a profile.

func (*InMemoryBackend) GetCrl 

func (b *InMemoryBackend) GetCrl(ctx context.Context, id string) (*Crl, error)

GetCrl returns a CRL by ID.

func (*InMemoryBackend) GetNotificationSettings 

func (b *InMemoryBackend) GetNotificationSettings(ctx context.Context, trustAnchorID string) []NotificationSetting

GetNotificationSettings returns notification settings for a trust anchor.

func (*InMemoryBackend) GetProfile 

func (b *InMemoryBackend) GetProfile(ctx context.Context, id string) (*Profile, error)

GetProfile returns the profile with the given ID.

func (*InMemoryBackend) GetSubject 

func (b *InMemoryBackend) GetSubject(ctx context.Context, id string) (*Subject, error)

GetSubject returns a subject by ID.

func (*InMemoryBackend) GetTrustAnchor 

func (b *InMemoryBackend) GetTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)

GetTrustAnchor returns the trust anchor with the given ID.

func (*InMemoryBackend) ImportCrl 

func (b *InMemoryBackend) ImportCrl(
	ctx context.Context,
	name string,
	crlData []byte,
	trustAnchorArn string,
	enabled bool,
	tags []TagEntry,
) (*Crl, error)

ImportCrl imports a new CRL.

Real AWS Roles Anywhere has no uniqueness constraint on CRL names (ImportCrl only models ValidationException/AccessDeniedException -- there is no ConflictException shape anywhere in the service), so duplicate names are accepted, matching the real API.

func (*InMemoryBackend) ListCrls 

func (b *InMemoryBackend) ListCrls(ctx context.Context, pageToken string, maxResults int) ([]*Crl, string, error)

ListCrls returns all CRLs with optional pagination.

func (*InMemoryBackend) ListProfiles 

func (b *InMemoryBackend) ListProfiles(
	ctx context.Context,
	pageToken string,
	maxResults int,
) ([]*Profile, string, error)

ListProfiles returns all profiles in the request region.

func (*InMemoryBackend) ListSubjects 

func (b *InMemoryBackend) ListSubjects(
	ctx context.Context,
	pageToken string,
	maxResults int,
) ([]*Subject, string, error)

ListSubjects returns all subjects with optional pagination.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(ctx context.Context, resourceARN string) ([]TagEntry, error)

ListTagsForResource returns tags for a resource. Region is resolved from the resource ARN. Real AWS's ListTagsForResource models ResourceNotFoundException, returned when resourceARN matches no trust anchor/profile/CRL (unlike UntagResource, which declares no such error and is left to silently no-op against an unknown ARN).

func (*InMemoryBackend) ListTrustAnchors 

func (b *InMemoryBackend) ListTrustAnchors(
	ctx context.Context,
	pageToken string,
	maxResults int,
) ([]*TrustAnchor, string, error)

ListTrustAnchors returns all trust anchors in the request region.

func (*InMemoryBackend) PutAttributeMapping 

func (b *InMemoryBackend) PutAttributeMapping(
	ctx context.Context,
	profileID, certificateField string,
	rules []MappingRule,
) (*Profile, error)

PutAttributeMapping adds or replaces a certificate field mapping on a profile.

func (*InMemoryBackend) PutNotificationSettings 

func (b *InMemoryBackend) PutNotificationSettings(
	ctx context.Context,
	trustAnchorID string,
	settings []NotificationSetting,
) (*TrustAnchor, error)

PutNotificationSettings sets notification settings on a trust anchor.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the backend's default region.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) ResetNotificationSettings 

func (b *InMemoryBackend) ResetNotificationSettings(
	ctx context.Context,
	trustAnchorID string,
	keys []NotificationSettingKey,
) (*TrustAnchor, error)

ResetNotificationSettings removes specified notification settings from a trust anchor.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore deserializes backend state from JSON. It implements persistence.Persistable.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serializes backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(ctx context.Context, resourceARN string, tags []TagEntry) error

TagResource adds tags to a resource. Region is resolved from the resource ARN. Real AWS's TagResource models ResourceNotFoundException (returned when resourceARN matches no trust anchor/profile/CRL) and TooManyTagsException (returned when the resulting tag count on the resource would exceed the service's per-resource limit).

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(ctx context.Context, resourceARN string, tagKeys []string) error

UntagResource removes tags from a resource. Region is resolved from the resource ARN.

func (*InMemoryBackend) UpdateCrl 

func (b *InMemoryBackend) UpdateCrl(ctx context.Context, id, name string, crlData []byte) (*Crl, error)

UpdateCrl updates a CRL's name and/or data.

func (*InMemoryBackend) UpdateProfile 

func (b *InMemoryBackend) UpdateProfile(
	ctx context.Context,
	id, name string,
	roleArns []string,
	durationSeconds *int32,
	managedPolicyArns []string,
	sessionPolicy string,
	requireInstanceProperties *bool,
	acceptRoleSessionName *bool,
) (*Profile, error)

UpdateProfile updates a profile's fields.

func (*InMemoryBackend) UpdateTrustAnchor 

func (b *InMemoryBackend) UpdateTrustAnchor(
	ctx context.Context,
	id, name string,
	source *TrustAnchorSource,
) (*TrustAnchor, error)

UpdateTrustAnchor updates name and/or source of a trust anchor.

type MappingRule 

type MappingRule struct {
	Specifier string `json:"specifier"`
}

MappingRule is a single rule mapping a certificate field specifier to a session attribute.

type NotificationSetting 

type NotificationSetting struct {
	Threshold    *int32 `json:"threshold,omitempty"`
	Event        string `json:"event"`
	Channel      string `json:"channel,omitempty"`
	ConfiguredBy string `json:"configuredBy,omitempty"`
	Enabled      bool   `json:"enabled"`
}

NotificationSetting holds a notification configuration for a trust anchor.

ConfiguredBy mirrors AWS's NotificationSettingDetail.configuredBy (the principal that configured the setting -- rolesanywhere.amazonaws.com for AWS-default settings, or the account ID for customer-configured ones). gopherstack never seeds default settings, so every setting present here was configured via PutNotificationSettings and ConfiguredBy is always the backend's account ID.

type NotificationSettingKey 

type NotificationSettingKey struct {
	Event   string `json:"event"`
	Channel string `json:"channel,omitempty"`
}

NotificationSettingKey identifies a notification setting to reset.

type Profile 

type Profile struct {
	CreatedAt       time.Time `json:"createdAt"`
	UpdatedAt       time.Time `json:"updatedAt"`
	DurationSeconds *int32    `json:"durationSeconds,omitempty"`
	ProfileID       string    `json:"profileId"`
	ProfileArn      string    `json:"profileArn"`
	Name            string    `json:"name"`
	SessionPolicy   string    `json:"sessionPolicy,omitempty"`
	// CreatedBy is the AWS account that created the profile
	// (ProfileDetail.createdBy); this is a single-account emulator, so it is
	// always the backend's own account ID.
	CreatedBy string `json:"createdBy,omitempty"`

	RoleArns                  []string `json:"roleArns"`
	ManagedPolicyArns         []string `json:"managedPolicyArns,omitempty"`
	RequireInstanceProperties bool     `json:"requireInstanceProperties,omitempty"`
	Enabled                   bool     `json:"enabled"`
	// AcceptRoleSessionName determines whether a custom role session name
	// will be accepted in a temporary credential request
	// (CreateProfileInput/UpdateProfileInput/ProfileDetail.
	// acceptRoleSessionName). Only meaningful to the separate CreateSession
	// data-plane API, which gopherstack does not implement, but the field
	// itself is stored/echoed for wire parity.
	AcceptRoleSessionName bool `json:"acceptRoleSessionName,omitempty"`
	// contains filtered or unexported fields
}

Profile represents an IAM Roles Anywhere profile.

Note: like TrustAnchor, this carries no Tags field -- real AWS ProfileDetail has none either; see TrustAnchor's doc comment.

type Provider 

type Provider struct{}

Provider implements service.Provider for IAM Roles Anywhere.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Roles Anywhere service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type StorageBackend 

type StorageBackend interface {
	// Trust anchor operations
	CreateTrustAnchor(
		ctx context.Context,
		name string,
		source TrustAnchorSource,
		tags []TagEntry,
		enabled *bool,
		notificationSettings []NotificationSetting,
	) (*TrustAnchor, error)
	GetTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)
	ListTrustAnchors(ctx context.Context, pageToken string, maxResults int) ([]*TrustAnchor, string, error)
	DeleteTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)
	UpdateTrustAnchor(ctx context.Context, id, name string, source *TrustAnchorSource) (*TrustAnchor, error)
	EnableTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)
	DisableTrustAnchor(ctx context.Context, id string) (*TrustAnchor, error)

	// Profile operations
	CreateProfile(
		ctx context.Context,
		name string,
		roleArns []string,
		tags []TagEntry,
		durationSeconds *int32,
		managedPolicyArns []string,
		sessionPolicy string,
		requireInstanceProperties bool,
		enabled *bool,
		acceptRoleSessionName *bool,
	) (*Profile, error)
	GetProfile(ctx context.Context, id string) (*Profile, error)
	ListProfiles(ctx context.Context, pageToken string, maxResults int) ([]*Profile, string, error)
	DeleteProfile(ctx context.Context, id string) (*Profile, error)
	UpdateProfile(
		ctx context.Context,
		id, name string,
		roleArns []string,
		durationSeconds *int32,
		managedPolicyArns []string,
		sessionPolicy string,
		requireInstanceProperties *bool,
		acceptRoleSessionName *bool,
	) (*Profile, error)
	EnableProfile(ctx context.Context, id string) (*Profile, error)
	DisableProfile(ctx context.Context, id string) (*Profile, error)

	// CRL operations
	ImportCrl(
		ctx context.Context,
		name string,
		crlData []byte,
		trustAnchorArn string,
		enabled bool,
		tags []TagEntry,
	) (*Crl, error)
	GetCrl(ctx context.Context, id string) (*Crl, error)
	ListCrls(ctx context.Context, pageToken string, maxResults int) ([]*Crl, string, error)
	UpdateCrl(ctx context.Context, id, name string, crlData []byte) (*Crl, error)
	DeleteCrl(ctx context.Context, id string) (*Crl, error)
	EnableCrl(ctx context.Context, id string) (*Crl, error)
	DisableCrl(ctx context.Context, id string) (*Crl, error)

	// Subject operations
	GetSubject(ctx context.Context, id string) (*Subject, error)
	ListSubjects(ctx context.Context, pageToken string, maxResults int) ([]*Subject, string, error)

	// Attribute mapping operations
	PutAttributeMapping(ctx context.Context, profileID, certificateField string, rules []MappingRule) (*Profile, error)
	DeleteAttributeMapping(
		ctx context.Context,
		profileID, certificateField string,
		specifiers []string,
	) (*Profile, error)
	GetAttributeMappings(ctx context.Context, profileID string) []AttributeMapping

	// Notification settings operations
	PutNotificationSettings(
		ctx context.Context,
		trustAnchorID string,
		settings []NotificationSetting,
	) (*TrustAnchor, error)
	ResetNotificationSettings(
		ctx context.Context,
		trustAnchorID string,
		keys []NotificationSettingKey,
	) (*TrustAnchor, error)
	GetNotificationSettings(ctx context.Context, trustAnchorID string) []NotificationSetting

	// Tag operations
	TagResource(ctx context.Context, resourceARN string, tags []TagEntry) error
	UntagResource(ctx context.Context, resourceARN string, tagKeys []string) error
	ListTagsForResource(ctx context.Context, resourceARN string) ([]TagEntry, error)

	// Lifecycle
	Reset()
	Region() string
	AccountID() string
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend defines the interface for Roles Anywhere backend implementations. All mutating methods must be safe for concurrent use.

type Subject 

type Subject struct {
	CreatedAt   time.Time `json:"createdAt"`
	UpdatedAt   time.Time `json:"updatedAt"`
	LastSeenAt  time.Time `json:"lastSeenAt"`
	SubjectID   string    `json:"subjectId"`
	SubjectArn  string    `json:"subjectArn"`
	X509Subject string    `json:"x509Subject"`

	Enabled bool `json:"enabled"`
	// contains filtered or unexported fields
}

Subject represents an IAM Roles Anywhere subject (authenticating certificate).

type TagEntry 

type TagEntry struct {
	Key   string `json:"key"`
	Value string `json:"value"`
}

TagEntry is a key-value tag pair (Roles Anywhere uses list-based tags).

type TrustAnchor 

type TrustAnchor struct {
	CreatedAt      time.Time         `json:"createdAt"`
	UpdatedAt      time.Time         `json:"updatedAt"`
	Source         TrustAnchorSource `json:"source"`
	TrustAnchorID  string            `json:"trustAnchorId"`
	TrustAnchorArn string            `json:"trustAnchorArn"`
	Name           string            `json:"name"`

	Enabled bool `json:"enabled"`
	// contains filtered or unexported fields
}

TrustAnchor represents an IAM Roles Anywhere trust anchor.

Note: real AWS TrustAnchorDetail carries no "tags" field at all -- tags are visible only via ListTagsForResource/TagResource/UntagResource, keyed by ARN in InMemoryBackend.tags (see store.go). This struct therefore has no Tags field of its own; a prior version did, which both invented a non-existent "tags" key on every Create/Get/List/Update/Enable/Disable/ Delete response AND caused the exposed value to permanently desync from TagResource/UntagResource (which write to the separate ARN-keyed map).

type TrustAnchorSource 

type TrustAnchorSource struct {
	// SourceData is a map of source-type-specific fields.
	SourceData map[string]string `json:"sourceData,omitempty"`
	SourceType string            `json:"sourceType"`
}

TrustAnchorSource defines the source of a trust anchor.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.