Documentation
¶
Overview ¶
Package roleauth authorizes AWS-service-initiated calls against the customer role the service acts as.
Index ¶
- Constants
- Variables
- func Authorize(a Authorizer, servicePrincipal, roleArn, action, resource string) error
- func AuthorizeResource(a Authorizer, servicePrincipal, action, resource, sourceARN string) error
- func ResourcePolicyAction(arn string) (string, bool)
- func TargetAction(targetARN string) (string, bool)
- type Authorizer
- type ResourceAuthorizer
Constants ¶
const ( PrincipalStates = "states.amazonaws.com" PrincipalEvents = "events.amazonaws.com" PrincipalScheduler = "scheduler.amazonaws.com" PrincipalPipes = "pipes.amazonaws.com" PrincipalFirehose = "firehose.amazonaws.com" PrincipalLogs = "logs.amazonaws.com" PrincipalIoT = "iot.amazonaws.com" PrincipalSNS = "sns.amazonaws.com" PrincipalS3 = "s3.amazonaws.com" )
Service principals documented as the trusted principal of each service's execution role.
Variables ¶
var ( // ErrNotAssumable means the service principal may not assume the role. ErrNotAssumable = errors.New("role cannot be assumed by the service") // ErrAccessDenied means the role's policies do not allow the action. ErrAccessDenied = errors.New("AccessDeniedException") )
Functions ¶
func Authorize ¶
func Authorize(a Authorizer, servicePrincipal, roleArn, action, resource string) error
Authorize is a nil-safe call: a nil Authorizer allows everything (enforcement off).
func AuthorizeResource ¶
func AuthorizeResource(a Authorizer, servicePrincipal, action, resource, sourceARN string) error
AuthorizeResource is nil-safe; an Authorizer without resource-policy support allows everything.
func ResourcePolicyAction ¶
ResourcePolicyAction maps a destination ARN to the action a service principal needs on it.
func TargetAction ¶
TargetAction maps a rule/schedule/pipe target ARN to the IAM action its execution role needs.
Types ¶
type Authorizer ¶
type Authorizer interface {
AuthorizeRole(servicePrincipal, roleArn, action, resource string) error
}
Authorizer answers whether servicePrincipal, acting as roleArn, may perform action on resource.
type ResourceAuthorizer ¶
type ResourceAuthorizer interface {
AuthorizeServiceResource(servicePrincipal, action, resource, sourceARN string) error
}
ResourceAuthorizer answers whether a service principal may act on a resource under that resource's own policy (Lambda, SQS, SNS, S3), given the source ARN and account conditions.
Source Files