ram

package
v1.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 6, 2026 License: MIT Imports: 31 Imported by: 0

README

Resource Access Manager

Parity grade: A · SDK aws-sdk-go-v2/service/ram@v1.39.4 · last audited 2026-09-24 (f78c3b7c7)

Coverage

Metric Value
PARITY entries audited 36 (35 ok, 1 partial)
Feature families 3 (3 ok)
Known gaps 3
Deferred items 2
Resource leaks clean
Known gaps
  • gopherstack-kvyy (2026-09-11): Glue's PutResourcePolicy(EnableHybrid=TRUE) with any cross-account Principal.AWS grant is treated as the trigger for creating a RAM CREATED_FROM_POLICY resource share. Real AWS documents CREATED_FROM_POLICY generically as 'when you attach a resource-based policy to a resource', and the Glue/Lake-Formation-specific path is actually mediated by Lake Formation's own cross-account grant flow, not a literal 'any cross-account Glue policy triggers a RAM share' rule -- disclosed as broader than real Lake-Formation-mediated Glue sharing since Glue has no other concrete, emulatable wire path to the general mechanism. Revisit if a narrower, Lake-Formation-grant-shaped trigger becomes emulatable.
  • ClientToken replays CreateResourceShare, CreatePermission and CreatePermissionVersion (pkgs/idempotency, IdempotentParameterMismatchException on changed parameters). The other ClientToken ops are accepted but not replayed: their natural idempotency covers a retry, yet a retried Delete/Disassociate returns the current state's error, not the original result. Sources and ResourceShareConfiguration are stored and echoed, not enforced; ListSourceAssociations has no sourceType.
  • gopherstack-kvyy (2026-09-11): PromoteResourceShareCreatedFromPolicy's UnmatchedPolicyPermissionException is not modeled -- it requires simulating 'no existing customer-managed permission exactly matches' the derived policy-based permission, out of scope for this pass.
Deferred
  • DISCLOSED not fixed (2026-08-19 sweep, out of scope per sweep charter -- Layer 3 never-emitted members are only fixed if incidental): Resource never emits resourceGroupArn (deserializers.go's awsRestjson1_deserializeDocumentResource); ResourceShareInvitation never emits receiverArn or resourceShareAssociations (deserializers.go's awsRestjson1_deserializeDocumentResourceShareInvitation). None of these surfaced incidentally while fixing the 3 genuine bugs this session, so left alone per the sweep's Layer-3-out-of-scope rule.
  • ResourceShareStatus never reaches PENDING/FAILED/DELETING and ResourceShareAssociationStatus never reaches ASSOCIATING/FAILED/DISASSOCIATING/SUSPENDED/SUSPENDING/RESTORING: each needs async backend processing or Organizations SCP state this backend cannot represent, and invalid ARNs surface synchronously as MalformedArnException.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrValidation is returned when a request contains an invalid or missing parameter.
	// CreateResourceShare, AssociateResourceShare and DeletePermissionVersion --
	// the three ops that raise this -- all model InvalidParameterException for it
	// (ram@v1.39.4 deserializers.go, each op's own deserializeOpError switch).
	ErrValidation = awserr.New("invalid or missing parameter", awserr.ErrInvalidParameter)
	// ErrNotFound is returned when a resource share does not exist.
	ErrNotFound = awserr.New("UnknownResourceException", awserr.ErrNotFound)
	// ErrPermissionAlreadyExists is returned when a customer-managed
	// permission with the same name already exists. CreatePermission's own
	// error model defines PermissionAlreadyExistsException for this.
	ErrPermissionAlreadyExists = awserr.New("permission already exists", awserr.ErrConflict)
	// ErrPermissionNotFound is returned when a permission does not exist.
	ErrPermissionNotFound = awserr.New("InvalidParameterException", awserr.ErrNotFound)
	// ErrInvitationNotFound is returned when an invitation does not exist.
	ErrInvitationNotFound = awserr.New(
		"ResourceShareInvitationArnNotFoundException",
		awserr.ErrNotFound,
	)
	// ErrInvitationAlreadyAccepted is returned when accepting an already-accepted invitation.
	ErrInvitationAlreadyAccepted = awserr.New(
		"ResourceShareInvitationAlreadyAcceptedException",
		awserr.ErrConflict,
	)
	// ErrInvitationAlreadyRejected is returned when accepting or rejecting an already-rejected invitation.
	ErrInvitationAlreadyRejected = awserr.New(
		"ResourceShareInvitationAlreadyRejectedException",
		awserr.ErrConflict,
	)
	// ErrInvitationExpired is returned when acting on an expired invitation.
	ErrInvitationExpired = awserr.New(
		"ResourceShareInvitationExpiredException",
		awserr.ErrConflict,
	)
	// ErrPermissionVersionNotFound is returned when a permission version does not exist.
	ErrPermissionVersionNotFound = awserr.New("InvalidParameterException", awserr.ErrNotFound)
	// ErrOperationNotPermitted is returned when an operation is not permitted on an AWS-managed resource.
	ErrOperationNotPermitted = awserr.New("OperationNotPermittedException", awserr.ErrConflict)
	// ErrPermissionInUse is returned when deleting a permission that is
	// associated with active shares. DeletePermission's own error model has
	// no PermissionInUseException -- it defines no InUse-shaped exception at
	// all -- but does define OperationNotPermittedException, matching both
	// its own doc comment and DeletePermission's ("only if it isn't attached
	// to any resource share").
	ErrPermissionInUse = awserr.New("permission is associated with one or more resource shares", awserr.ErrConflict)
	// ErrInvalidParameter is returned when a parameter value is out of the allowed range.
	ErrInvalidParameter = awserr.New("InvalidParameterException", awserr.ErrInvalidParameter)
	// ErrInvalidStateTransition is returned when an operation is requested against a
	// resource share in a state that doesn't permit it -- e.g. Associate/Disassociate
	// ResourceShare or DisassociateResourceSharePermission against a CREATED_FROM_POLICY
	// share, or PromoteResourceShareCreatedFromPolicy against a share that isn't one.
	// Each of those ops' own error model (ram@v1.39.4 deserializers.go) declares
	// InvalidStateTransitionException.
	ErrInvalidStateTransition = awserr.New(
		"InvalidStateTransitionException",
		awserr.ErrConflict,
	)
	// ErrMalformedArn is returned when a resourceArns entry isn't ARN-shaped.
	// CreateResourceShare and AssociateResourceShare both model
	// MalformedArnException for this (ram@v1.39.4 deserializers.go,
	// awsRestjson1_deserializeOpErrorCreateResourceShare and
	// awsRestjson1_deserializeOpErrorAssociateResourceShare).
	ErrMalformedArn = awserr.New("MalformedArnException", awserr.ErrInvalidParameter)
)
View Source 
var ErrNilAppContext = errors.New("ram: nil AppContext")

ErrNilAppContext is returned when the AppContext passed to Init is nil.

Functions

This section is empty.

Types

type Handler 

type Handler struct {
	Backend   StorageBackend
	AccountID string
	Region    string
	// contains filtered or unexported fields
}

Handler is the HTTP handler for the AWS RAM REST API.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new RAM handler.

func (*Handler) BackendFor 

func (h *Handler) BackendFor(region string) StorageBackend

BackendFor returns the backend serving region: the home backend, or the sibling built on first use.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this handler handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) EnableRegions 

func (h *Handler) EnableRegions()

EnableRegions makes h serve every other region through lazily built per-region siblings.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the request path.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource share ARN from the request body or query.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported RAM operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler serves each request from the handler of its region.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) RegionBackends 

func (h *Handler) RegionBackends() []StorageBackend

RegionBackends returns the home backend followed by every sibling built so far.

func (*Handler) RegionHandler 

func (h *Handler) RegionHandler(region string) *Handler

RegionHandler returns the handler serving region: h itself for the home region, else its sibling.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears every region.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches RAM API requests. All path-based matches are gated on the SigV4 service name to prevent routing conflicts with other services that share similar REST paths.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable; other regions ride in an additive "regions" key.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is an in-memory store for AWS RAM resources.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new in-memory RAM backend seeded with AWS-managed permissions.

func (*InMemoryBackend) AcceptResourceShareInvitation 

func (b *InMemoryBackend) AcceptResourceShareInvitation(
	invitationARN string,
) (*ResourceShareInvitation, error)

AcceptResourceShareInvitation accepts a pending resource share invitation.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

func (*InMemoryBackend) AddInvitationInternal 

func (b *InMemoryBackend) AddInvitationInternal(inv *ResourceShareInvitation)

AddInvitationInternal adds a pre-built invitation for testing or seeding.

func (*InMemoryBackend) AddPermissionInternal 

func (b *InMemoryBackend) AddPermissionInternal(p *Permission)

AddPermissionInternal inserts a permission directly, bypassing validation. Useful for seeding test state.

func (*InMemoryBackend) AddResourceShareInternal 

func (b *InMemoryBackend) AddResourceShareInternal(rs *ResourceShare)

AddResourceShareInternal inserts a resource share directly, bypassing validation. Useful for seeding test state.

func (*InMemoryBackend) AssociateResourceShare 

func (b *InMemoryBackend) AssociateResourceShare(
	shareARN string,
	principals, resourceARNs []string,
) ([]*ResourceShareAssociation, error)

AssociateResourceShare associates principals or resource ARNs with a resource share. Entities already ASSOCIATED are silently skipped (idempotent), matching AWS behavior. An entity with an existing DISASSOCIATED row (produced by a prior DisassociateResourceShare) is reactivated in place -- a real re-association, since AWS keeps a single row per (share, entity) pair and transitions its status rather than accumulating duplicates. Returns deep copies of the associations that changed state so callers cannot mutate backend state.

func (*InMemoryBackend) AssociateResourceSharePermission 

func (b *InMemoryBackend) AssociateResourceSharePermission(
	shareARN, permissionARN string,
	replace bool,
	permissionVersion *int32,
) error

AssociateResourceSharePermission associates a managed permission with a resource share.

func (*InMemoryBackend) AssociateResourceShareSources 

func (b *InMemoryBackend) AssociateResourceShareSources(shareARN string, sources []string) error

AssociateResourceShareSources adds source constraints to a share, reactivating disassociated ones.

func (*InMemoryBackend) AutoAssociateDefaultPermissions added in v1.2.0 

func (b *InMemoryBackend) AutoAssociateDefaultPermissions(shareARN string) error

AutoAssociateDefaultPermissions attaches the AWS-managed default permission for every resource type present in the share's active resource associations that does not already have an associated permission. Mirrors real AWS: CreateResourceShare and AssociateResourceShare automatically associate the default managed permission for each resource type included in the share when no explicit permission covers that type yet (CreateResourceShare's caller-supplied permissionArns skip this; the handler only calls this when none were supplied. AssociateResourceShare never accepts permissionArns at all, so real AWS always runs this step for it). Idempotent: calling it again after nothing changed is a no-op.

func (*InMemoryBackend) ConfigureResourceShare 

func (b *InMemoryBackend) ConfigureResourceShare(shareARN string, retain *bool, sources []string) error

ConfigureResourceShare stores the CreateResourceShare-only members: the retain flag and source constraints.

func (*InMemoryBackend) CreateInvitation 

func (b *InMemoryBackend) CreateInvitation(
	shareARN, shareNm, senderAcctID, receiverAcctID string,
) *ResourceShareInvitation

CreateInvitation creates a pending invitation for a resource share. This is a helper for the mock that mirrors what AWS does when AssociateResourceShare is called with principals.

func (*InMemoryBackend) CreatePermission 

func (b *InMemoryBackend) CreatePermission(
	name, resourceType, policyTemplate string,
	tags map[string]string,
) (*Permission, error)

CreatePermission creates a new customer-managed RAM permission.

func (*InMemoryBackend) CreatePermissionVersion 

func (b *InMemoryBackend) CreatePermissionVersion(
	permissionARN, policyTemplate string,
) (*Permission, error)

CreatePermissionVersion creates a new version of an existing customer-managed RAM permission.

func (*InMemoryBackend) CreateResourceShare 

func (b *InMemoryBackend) CreateResourceShare(
	name string,
	allowExternalPrincipals bool,
	tags map[string]string,
	principals, resourceARNs []string,
) (*ResourceShare, error)

CreateResourceShare creates a new resource share.

func (*InMemoryBackend) DeletePermission 

func (b *InMemoryBackend) DeletePermission(permissionARN string) error

DeletePermission soft-deletes a customer-managed RAM permission and removes it from all shares. AWS-managed permissions cannot be deleted.

func (*InMemoryBackend) DeletePermissionVersion 

func (b *InMemoryBackend) DeletePermissionVersion(
	permissionARN string,
	permissionVersion int32,
) error

DeletePermissionVersion deletes a specific version of a customer-managed RAM permission. The default version cannot be deleted. If the latest version is deleted, LatestVersion is updated to the next-highest remaining version.

func (*InMemoryBackend) DeletePolicyBasedShare 

func (b *InMemoryBackend) DeletePolicyBasedShare(resourceARN string) error

DeletePolicyBasedShare removes the CREATED_FROM_POLICY resource share tracking resourceARN, if one exists. Called by glue's DeleteResourcePolicy, or by PutResourcePolicy when an updated policy no longer grants any cross-account principal. No-op (not an error) when no such share exists, mirroring DisassociateResourceSharePermission's "nothing to do" precedent for an unassociated entity -- a caller resyncing state on every policy write shouldn't have to track whether a share was ever created.

func (*InMemoryBackend) DeleteResourceShare 

func (b *InMemoryBackend) DeleteResourceShare(shareARN string) error

DeleteResourceShare deletes a resource share and removes it from the store. Associations for the share are disassociated before the share is removed so that ListResources / ListPrincipals no longer return them.

func (*InMemoryBackend) DisassociateResourceShare 

func (b *InMemoryBackend) DisassociateResourceShare(
	shareARN string,
	principals, resourceARNs []string,
) ([]*ResourceShareAssociation, error)

DisassociateResourceShare marks principals or resource ARNs on a resource share as DISASSOCIATED. Rows are kept in place (soft-deleted), matching the same pattern DeleteResourceShare uses for every association on a deleted share -- this lets GetResourceShareAssociations(associationStatus=DISASSOCIATED) see the history, and lets a later AssociateResourceShare reactivate the row instead of accumulating duplicates (see reactivateOrCreateLocked). Only currently-ASSOCIATED rows are affected; disassociating an entity that is not currently associated is a no-op for that entity.

func (*InMemoryBackend) DisassociateResourceSharePermission 

func (b *InMemoryBackend) DisassociateResourceSharePermission(
	shareARN, permissionARN string,
) error

DisassociateResourceSharePermission removes a managed permission from a resource share. Real AWS refuses the request while any resource of the permission's resource type is still actively attached to the share, per the documented rule: you can remove a managed permission from a resource share only if there are currently no resources of the relevant resource type currently attached to the resource share.

func (*InMemoryBackend) DisassociateResourceShareSources 

func (b *InMemoryBackend) DisassociateResourceShareSources(shareARN string, sources []string) error

DisassociateResourceShareSources marks the named source constraints DISASSOCIATED.

func (*InMemoryBackend) EnableSharingWithAwsOrganization 

func (b *InMemoryBackend) EnableSharingWithAwsOrganization() error

EnableSharingWithAwsOrganization creates the RAM service-linked role in the IAM backend, matching real AWS: enabling org sharing creates AWSServiceRoleForResourceAccessManager as a side effect (this is what terraform-provider-aws's aws_ram_sharing_with_organization Read looks up via iam:GetRole). Idempotent: a role that already exists (e.g. a second EnableSharingWithAwsOrganization call) is left untouched, not an error.

It also enables "ram.amazonaws.com" as a trusted service principal in the Organizations backend -- real AWS's EnableSharingWithAwsOrganization does this as a second side effect, which is what organizations:ListAWSServiceAccessForOrganization then lists and what terraform-provider-aws's aws_ram_sharing_with_organization Read also checks. When no organization exists, Organizations' EnableAWSServiceAccess returns ErrOrgNotFound (AWSOrganizationsNotInUseException) -- but that exception isn't declared on RAM's own EnableSharingWithAwsOrganization (ram@v1.39.4 deserializers.go's awsRestjson1_deserializeOpErrorEnableSharingWithAwsOrganization declares only OperationNotPermittedException, ServerInternalException and ServiceUnavailableException), so this maps it to OperationNotPermittedException -- the modeled fit, matching the real requirement that the operation "must [be] call[ed] ... from ... the organization's management account" (EnableSharingWithAwsOrganizationInput doc comment), which cannot hold when there is no organization.

func (*InMemoryBackend) GetPermission 

func (b *InMemoryBackend) GetPermission(
	permissionARN string,
	permissionVersion *int32,
) (*Permission, *PermissionVersion, error)

GetPermission returns the details of a RAM permission, optionally at a specific version.

func (*InMemoryBackend) GetResourcePolicies 

func (b *InMemoryBackend) GetResourcePolicies(resourceARNs []string) []string

GetResourcePolicies returns resource-based policy documents for shared resources. Only ARNs that are actively associated with a resource share receive a policy entry; ARNs not in any share are omitted, matching real AWS behaviour.

func (*InMemoryBackend) GetResourceShare 

func (b *InMemoryBackend) GetResourceShare(shareARN string) (*ResourceShare, error)

GetResourceShare returns a resource share by ARN.

func (*InMemoryBackend) GetResourceShareAssociations 

func (b *InMemoryBackend) GetResourceShareAssociations(
	associationType string,
	shareARNs []string,
) []*ResourceShareAssociation

GetResourceShareAssociations returns associations for the given resource share ARNs and type.

func (*InMemoryBackend) GetResourceShareInvitations 

func (b *InMemoryBackend) GetResourceShareInvitations(
	invitationARNs, shareARNs []string,
) []*ResourceShareInvitation

GetResourceShareInvitations returns invitations filtered by ARN or resource share ARN, sorted by creation time (oldest first) for deterministic output. Lazily expires any still-PENDING invitation past invitationExpiryWindow before reading.

func (*InMemoryBackend) ListPendingInvitationResources 

func (b *InMemoryBackend) ListPendingInvitationResources(
	invitationARN string,
) ([]*ResourceShareAssociation, error)

ListPendingInvitationResources returns the resource associations for the resource share associated with the given invitation, filtered to resources that are in an active state.

func (*InMemoryBackend) ListPermissionAssociations 

func (b *InMemoryBackend) ListPermissionAssociations(
	permissionARN string, permissionVersion *int32, defaultVersion *bool,
) []SharePermissionAssociation

ListPermissionAssociations returns all share-permission associations filtered optionally by permissionARN, permissionVersion, and defaultVersion (true restricts to associations pinned to their permission's current default version -- ram@v1.39.4 api_op_ListPermissionAssociations.go:38-48), sorted by share ARN + permission ARN.

func (*InMemoryBackend) ListPermissionVersions 

func (b *InMemoryBackend) ListPermissionVersions(
	permissionARN string,
) ([]*PermissionVersion, error)

ListPermissionVersions returns all versions of a permission, sorted ascending by version number.

func (*InMemoryBackend) ListPermissions 

func (b *InMemoryBackend) ListPermissions(resourceType string) []*Permission

ListPermissions returns all non-deleted customer-managed permissions, optionally filtered by resource type, sorted by ARN.

func (*InMemoryBackend) ListPrincipals 

func (b *InMemoryBackend) ListPrincipals(
	resourceOwner string, shareARNs []string,
) []*ResourceShareAssociation

ListPrincipals returns principal associations for shares, filtered by resourceOwner ("SELF" or "OTHER-ACCOUNTS") and share ARNs (any-of; empty means no filter). Sorted by associated entity.

func (*InMemoryBackend) ListReplacePermissionAssociationsWork added in v1.2.0 

func (b *InMemoryBackend) ListReplacePermissionAssociationsWork(
	workIDs []string, status string,
) []*ReplacePermissionAssociationsWork

ListReplacePermissionAssociationsWork returns recorded ReplacePermissionAssociations background work items, optionally filtered by work ID and/or status, sorted newest-first.

func (*InMemoryBackend) ListResourceSharePermissions 

func (b *InMemoryBackend) ListResourceSharePermissions(shareARN string) []*ResourceSharePermissionDetail

ListResourceSharePermissions returns the permissions associated with a resource share, each paired with the version actually associated with that share (which may differ from the permission's current default version), sorted by ARN for deterministic output.

func (*InMemoryBackend) ListResourceShares 

func (b *InMemoryBackend) ListResourceShares(resourceOwner, status string) []*ResourceShare

ListResourceShares returns resource shares matching the given owner and optional status filter. resourceOwner must be "SELF" or "OTHER-ACCOUNTS".

  • "SELF": shares owned by this account (not deleted, optionally filtered by status).
  • "OTHER-ACCOUNTS": shares owned by another account where this account is a PRINCIPAL.

Pass status="" to return all matching shares, or e.g. "ACTIVE" to filter by status.

func (*InMemoryBackend) ListResources 

func (b *InMemoryBackend) ListResources(
	resourceOwner string, shareARNs []string, resourceType string,
) []*ResourceShareAssociation

ListResources returns resources (resource-type associations) for shares, filtered by resourceOwner ("SELF" or "OTHER-ACCOUNTS"), share ARNs (any-of; empty means no filter), and resource type.

func (*InMemoryBackend) ListSourceAssociations 

func (b *InMemoryBackend) ListSourceAssociations(shareARNs []string, sourceID, status string) []SourceAssociation

ListSourceAssociations returns source constraints, hiding DISASSOCIATED ones unless status asks for them.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(shareARN string) (map[string]string, error)

ListTagsForResource returns tags for a resource share identified by ARN.

func (*InMemoryBackend) PromotePermissionCreatedFromPolicy 

func (b *InMemoryBackend) PromotePermissionCreatedFromPolicy(
	permissionARN string, name string,
) (*Permission, error)

PromotePermissionCreatedFromPolicy promotes a CREATED_FROM_POLICY permission to a CUSTOMER_MANAGED permission with the given name.

func (*InMemoryBackend) PromoteResourceShareCreatedFromPolicy 

func (b *InMemoryBackend) PromoteResourceShareCreatedFromPolicy(
	shareARN string,
) (*ResourceShare, error)

PromoteResourceShareCreatedFromPolicy promotes a CREATED_FROM_POLICY resource share to STANDARD, making it fully manageable in RAM (api_op_PromoteResourceShareCreatedFromPolicy.go doc). Real AWS transitions CREATED_FROM_POLICY -> PROMOTING_TO_STANDARD -> STANDARD asynchronously; this backend applies the transition synchronously and never persists the intermediate state, matching this repo's existing PromotePermissionCreatedFromPolicy convention (permissions.go) of skipping straight to the terminal state.

func (*InMemoryBackend) PutPolicyBasedShare 

func (b *InMemoryBackend) PutPolicyBasedShare(resourceARN string, principals, actions []string) error

PutPolicyBasedShare creates or updates the CREATED_FROM_POLICY resource share that represents resourceARN's cross-account resource-based-policy grant. This is glue's ResourceShareCreator seam target (services/glue/interfaces.go): glue's PutResourcePolicy calls it, outside its own lock, whenever a hybrid resource policy's Principal grants access to another account (services/lambda/lifecycle.go's capture/release/call/re-lock pattern -- ram's lock must never nest inside glue's). Idempotent: a share already tracking resourceARN has its principal associations and derived permission re-synced from the given values instead of duplicating state.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) RejectResourceShareInvitation 

func (b *InMemoryBackend) RejectResourceShareInvitation(
	invitationARN string,
) (*ResourceShareInvitation, error)

RejectResourceShareInvitation rejects a pending resource share invitation.

func (*InMemoryBackend) ReplacePermissionAssociations 

func (b *InMemoryBackend) ReplacePermissionAssociations(
	fromPermissionARN, toPermissionARN string,
	fromPermissionVersion *int32,
) (*ReplacePermissionAssociationsWork, error)

ReplacePermissionAssociations replaces all associations using fromPermissionARN with toPermissionARN across all resource shares. If fromPermissionVersion is non-nil, only shares currently pinned to that specific version are replaced (matching AWS's documented per-version filtering); otherwise every share using fromPermissionARN at any version is replaced. The replacement always associates toPermissionARN's current default version, matching real AWS.

This mock performs the swap synchronously, so the returned work item's Status is always the terminal COMPLETED state -- there is no separate async completion step to model. Returns the work item for ListReplacePermissionAssociationsWork lookups.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all in-memory state from the backend and re-seeds built-in permissions. It is used by the POST /_gopherstack/reset endpoint for CI pipelines and rapid local development.

func (*InMemoryBackend) ResourceShareARNsFor 

func (b *InMemoryBackend) ResourceShareARNsFor(f ShareFilter) map[string]struct{}

ResourceShareARNsFor returns the active shares that satisfy every set field of f, or nil for an empty filter.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) SetAppConfig 

func (b *InMemoryBackend) SetAppConfig(cfg any)

SetAppConfig records the service.AppContext.Config value Provider.Init received, so this backend can resolve the IAM backend on demand. See services/grafana/cross_service.go's SetAppConfig for why this must be resolved lazily rather than at construction time.

func (*InMemoryBackend) SetDefaultPermissionVersion 

func (b *InMemoryBackend) SetDefaultPermissionVersion(
	permissionARN string,
	version int32,
) (*Permission, error)

SetDefaultPermissionVersion updates the default version of a customer-managed permission.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(shareARN string, kv map[string]string) error

TagResource adds or updates tags on a resource share identified by ARN.

func (*InMemoryBackend) TaggedResources added in v1.3.1 

func (b *InMemoryBackend) TaggedResources() []TaggedEntry

TaggedResources returns every resource share ARN that currently has at least one tag. Real RAM's TagResource only tags resource shares (not permissions or invitations), matching this backend's TagResource gate.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(shareARN string, keys []string) error

UntagResource removes specified tag keys from a resource share.

func (*InMemoryBackend) UpdateResourceShare 

func (b *InMemoryBackend) UpdateResourceShare(
	shareARN, name string,
	allowExternalPrincipals *bool,
) (*ResourceShare, error)

UpdateResourceShare updates an existing resource share. If name is changed, all matching associations are updated to reflect the new name.

type Permission 

type Permission struct {
	CreationTime          time.Time                    `json:"creationTime"`
	LastUpdatedTime       time.Time                    `json:"lastUpdatedTime"`
	Tags                  map[string]string            `json:"tags,omitempty"`
	Versions              map[int32]*PermissionVersion `json:"versions"`
	ARN                   string                       `json:"arn"`
	Name                  string                       `json:"name"`
	ResourceType          string                       `json:"resourceType"`
	PermissionType        string                       `json:"permissionType"`
	ResourceRegionScope   string                       `json:"resourceRegionScope"`
	LatestVersion         int32                        `json:"latestVersion"`
	DefaultVersion        int32                        `json:"defaultVersion"`
	IsResourceTypeDefault bool                         `json:"isResourceTypeDefault"`
	Deleted               bool                         `json:"deleted"`
}

Permission represents a managed RAM permission (AWS-managed or customer-managed).

type PermissionVersion 

type PermissionVersion struct {
	CreationTime    time.Time `json:"creationTime"`
	LastUpdatedTime time.Time `json:"lastUpdatedTime"`
	PolicyTemplate  string    `json:"policyTemplate"`
	Version         int32     `json:"version"`
}

PermissionVersion holds a single versioned policy document for a managed permission.

type Provider 

type Provider struct{}

Provider implements service.Provider for AWS RAM.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the RAM service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type ReplacePermissionAssociationsWork added in v1.2.0 

type ReplacePermissionAssociationsWork struct {
	CreationTime          time.Time
	LastUpdatedTime       time.Time
	ID                    string
	FromPermissionARN     string
	ToPermissionARN       string
	Status                string
	StatusMessage         string
	FromPermissionVersion int32
	ToPermissionVersion   int32
}

ReplacePermissionAssociationsWork tracks the background task created by a ReplacePermissionAssociations call, retrievable via ListReplacePermissionAssociationsWork. This mock performs the underlying association swap synchronously, so a work item's Status is always terminal (COMPLETED) by the time it is stored -- there is no separate async completion step to model.

type ResourceShare 

type ResourceShare struct {
	LastUpdatedTime time.Time         `json:"lastUpdatedTime"`
	CreationTime    time.Time         `json:"creationTime"`
	Tags            map[string]string `json:"tags,omitempty"`
	// RetainSharingOnAccountLeaveOrganization is CreateResourceShare's ResourceShareConfiguration member.
	RetainSharingOnAccountLeaveOrganization *bool  `json:"retainSharingOnAccountLeaveOrganization,omitempty"`
	Name                                    string `json:"name"`
	ARN                                     string `json:"arn"`
	OwningAccountID                         string `json:"owningAccountId"`
	Status                                  string `json:"status"`
	StatusMessage                           string `json:"statusMessage,omitempty"`
	// FeatureSet is one of STANDARD/CREATED_FROM_POLICY/PROMOTING_TO_STANDARD
	// (ram@v1.39.4 types/enums.go ResourceShareFeatureSet). Empty decodes as
	// STANDARD (see featureSetOf) so pre-existing snapshots stay valid without a
	// version bump.
	FeatureSet string `json:"featureSet,omitempty"`
	// PolicyResourceARN is set only for a CREATED_FROM_POLICY share: the ARN of
	// the resource whose resource-based policy this share represents (see
	// PutPolicyBasedShare). Empty for every ordinary STANDARD share. Not part of
	// the AWS wire shape -- internal bookkeeping only, never read by
	// toResourceShareObject.
	PolicyResourceARN string `json:"policyResourceArn,omitempty"`
	// Sources are the service-principal source constraints (CreateResourceShare/AssociateResourceShare Sources).
	Sources                 []ShareSource `json:"sources,omitempty"`
	AllowExternalPrincipals bool          `json:"allowExternalPrincipals"`
}

ResourceShare represents an AWS RAM resource share.

type ResourceShareAssociation 

type ResourceShareAssociation struct {
	LastUpdatedTime   time.Time `json:"lastUpdatedTime"`
	CreationTime      time.Time `json:"creationTime"`
	ResourceShareARN  string    `json:"resourceShareArn"`
	ResourceShareName string    `json:"resourceShareName"`
	AssociatedEntity  string    `json:"associatedEntity"`
	AssociationType   string    `json:"associationType"`
	Status            string    `json:"status"`
	StatusMessage     string    `json:"statusMessage,omitempty"`
	External          bool      `json:"external"`
}

ResourceShareAssociation represents a principal or resource associated with a resource share.

type ResourceShareInvitation 

type ResourceShareInvitation struct {
	CreationTime      time.Time `json:"creationTime"`
	LastUpdatedTime   time.Time `json:"lastUpdatedTime"`
	InvitationARN     string    `json:"invitationArn"`
	ResourceShareARN  string    `json:"resourceShareArn"`
	ResourceShareName string    `json:"resourceShareName"`
	SenderAccountID   string    `json:"senderAccountId"`
	ReceiverAccountID string    `json:"receiverAccountId"`
	Status            string    `json:"status"`
}

ResourceShareInvitation represents an invitation to access a resource share.

type ResourceSharePermissionDetail 

type ResourceSharePermissionDetail struct {
	Permission *Permission
	Version    int32
}

ResourceSharePermissionDetail pairs a managed permission with the specific version that is associated with a particular resource share. AWS tracks the associated version per (share, permission) pair -- AssociateResourceSharePermission can pin a non-default version -- so this must be reported per share rather than assumed to be the permission's current default version.

type ShareFilter 

type ShareFilter struct {
	Principal    string
	ResourceType string
	ResourceARNs []string
}

ShareFilter narrows the resource shares a list op considers; a zero field imposes no constraint.

type SharePermissionAssociation 

type SharePermissionAssociation struct {
	ShareARN      string
	PermissionARN string
	Version       int32
}

SharePermissionAssociation represents a share-permission link for ListPermissionAssociations.

type ShareSource 

type ShareSource struct {
	CreationTime    time.Time `json:"creationTime"`
	LastUpdatedTime time.Time `json:"lastUpdatedTime"`
	ID              string    `json:"id"`
	Status          string    `json:"status"`
}

ShareSource is one source constraint on a resource share.

type SourceAssociation 

type SourceAssociation struct {
	CreationTime     time.Time
	LastUpdatedTime  time.Time
	ResourceShareARN string
	SourceID         string
	Status           string
}

SourceAssociation is one source constraint on a resource share.

type StorageBackend 

type StorageBackend interface {
	// Resource share operations
	CreateResourceShare(
		name string,
		allowExternalPrincipals bool,
		tags map[string]string,
		principals, resourceARNs []string,
	) (*ResourceShare, error)
	GetResourceShare(shareARN string) (*ResourceShare, error)
	ConfigureResourceShare(shareARN string, retain *bool, sources []string) error
	AssociateResourceShareSources(shareARN string, sources []string) error
	DisassociateResourceShareSources(shareARN string, sources []string) error
	ListSourceAssociations(shareARNs []string, sourceID, status string) []SourceAssociation
	ResourceShareARNsFor(f ShareFilter) map[string]struct{}
	ListResourceShares(resourceOwner, status string) []*ResourceShare
	UpdateResourceShare(shareARN, name string, allowExternalPrincipals *bool) (*ResourceShare, error)
	DeleteResourceShare(shareARN string) error
	AssociateResourceShare(shareARN string, principals, resourceARNs []string) ([]*ResourceShareAssociation, error)
	DisassociateResourceShare(shareARN string, principals, resourceARNs []string) ([]*ResourceShareAssociation, error)
	GetResourceShareAssociations(assocType string, shareARNs []string) []*ResourceShareAssociation
	// AutoAssociateDefaultPermissions attaches the AWS-managed default permission for
	// every resource type present in the share's active resource associations that
	// does not already have an associated permission. Idempotent; safe to call after
	// any resource association even when nothing needs attaching.
	AutoAssociateDefaultPermissions(shareARN string) error

	// Tag operations
	TagResource(shareARN string, tags map[string]string) error
	UntagResource(shareARN string, tagKeys []string) error
	ListTagsForResource(shareARN string) (map[string]string, error)

	// Permission operations
	CreatePermission(name, resourceType, policyTemplate string, tags map[string]string) (*Permission, error)
	CreatePermissionVersion(permissionARN, policyTemplate string) (*Permission, error)
	DeletePermission(permissionARN string) error
	DeletePermissionVersion(permissionARN string, permissionVersion int32) error
	GetPermission(permissionARN string, permissionVersion *int32) (*Permission, *PermissionVersion, error)
	AssociateResourceSharePermission(shareARN, permissionARN string, replace bool, permissionVersion *int32) error
	DisassociateResourceSharePermission(shareARN, permissionARN string) error
	ListResourceSharePermissions(shareARN string) []*ResourceSharePermissionDetail

	// Invitation operations
	AcceptResourceShareInvitation(invitationARN string) (*ResourceShareInvitation, error)
	RejectResourceShareInvitation(invitationARN string) (*ResourceShareInvitation, error)
	GetResourceShareInvitations(invitationARNs, shareARNs []string) []*ResourceShareInvitation
	ListPendingInvitationResources(invitationARN string) ([]*ResourceShareAssociation, error)

	// Permission list/version/promotion operations
	ListPermissions(resourceType string) []*Permission
	ListPermissionVersions(permissionARN string) ([]*PermissionVersion, error)
	ListPermissionAssociations(
		permissionARN string, permissionVersion *int32, defaultVersion *bool,
	) []SharePermissionAssociation
	SetDefaultPermissionVersion(permissionARN string, version int32) (*Permission, error)
	PromotePermissionCreatedFromPolicy(permissionARN, name string) (*Permission, error)
	PromoteResourceShareCreatedFromPolicy(shareARN string) (*ResourceShare, error)
	ReplacePermissionAssociations(
		fromPermissionARN, toPermissionARN string,
		fromPermissionVersion *int32,
	) (*ReplacePermissionAssociationsWork, error)
	ListReplacePermissionAssociationsWork(workIDs []string, status string) []*ReplacePermissionAssociationsWork

	// Resource and principal list operations
	ListResources(resourceOwner string, shareARNs []string, resourceType string) []*ResourceShareAssociation
	ListPrincipals(resourceOwner string, shareARNs []string) []*ResourceShareAssociation

	// Resource policy operations
	GetResourcePolicies(resourceARNs []string) []string

	// EnableSharingWithAwsOrganization creates the RAM service-linked role
	// (AWSServiceRoleForResourceAccessManager) in the IAM backend, mirroring
	// real AWS's side effect of the call. A no-op (not an error) when the
	// IAM backend isn't wired -- e.g. unit tests that construct
	// InMemoryBackend directly, with no sibling registry.
	EnableSharingWithAwsOrganization() error

	// Persistence
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error

	// Lifecycle
	Reset()
	AccountID() string
	Region() string
}

StorageBackend defines the interface for the AWS RAM in-memory backend. All mutating methods must be safe for concurrent use.

type TaggedEntry added in v1.3.1 

type TaggedEntry struct {
	Tags map[string]string
	ARN  string
}

TaggedEntry pairs a resource ARN with its tags.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.