Help us shape the future of Go! Take the 2026 Go Developer Survey

verifiedpermissions

package
v1.8.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: MIT Imports: 29 Imported by: 0

README

Verified Permissions

Parity grade: A · SDK aws-sdk-go-v2/service/verifiedpermissions@v1.36.4 · last audited 2026-10-10 (24813b443)

Coverage

Metric Value
PARITY entries audited 34 (33 ok, 1 partial)
Known gaps 2
Structural gaps (can't be emulated) 1
Deferred items 0
Resource leaks clean
Known gaps
  • DeletePolicyStoreAlias never returns InvalidStateException: the SDK lists it for the op but the only documented trigger (InvalidStateException type doc) is DeletePolicyStore's deletion protection.
  • CreatePolicyStoreAlias never returns ServiceQuotaExceededException: AWS documents no numeric alias quota.
Structural gaps

These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.

  • IsAuthorizedWithToken/BatchIsAuthorizedWithToken do not verify JWT signatures or expiry: that needs the issuer's real signing keys; aud/client_id matching is implemented.

More

Documentation

Index

Constants

View Source 
const (
	ValidationModeOff    = "OFF"
	ValidationModeStrict = "STRICT"
)

ValidationMode constants for policy store validation settings.

View Source 
const (
	DeletionProtectionEnabled  = "ENABLED"
	DeletionProtectionDisabled = "DISABLED"
)

DeletionProtection constants for policy store deletion protection.

View Source 
const (
	AliasStateActive          = "Active"
	AliasStatePendingDeletion = "PendingDeletion"
)

AliasState constants for policy store alias state (real SDK: types.AliasState).

View Source 
const (
	DeletionModeSoftDelete = "SoftDelete"
	DeletionModeHardDelete = "HardDelete"
)

DeletionMode constants for DeletePolicyStoreAlias (real SDK: types.DeletionMode).

Variables

View Source 
var (
	// ErrPolicyStoreNotFound is returned when a policy store is not found.
	ErrPolicyStoreNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrPolicyNotFound is returned when a policy is not found.
	ErrPolicyNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrPolicyTemplateNotFound is returned when a policy template is not found.
	ErrPolicyTemplateNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrIdentitySourceNotFound is returned when an identity source is not found.
	ErrIdentitySourceNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrSchemaNotFound is returned when no schema has been set for a policy store.
	ErrSchemaNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrValidation is returned when input fails validation.
	ErrValidation = awserr.New("ValidationException", awserr.ErrInvalidParameter)
	// ErrConflict is returned when a resource conflict prevents an operation.
	ErrConflict = awserr.New("ConflictException", awserr.ErrConflict)
	// ErrPolicyStoreDeletionProtected is returned when DeletePolicyStore is
	// called on a store with deletion protection enabled. Real AWS models
	// this as InvalidStateException, not ConflictException (SDK
	// types/errors.go doc comment on InvalidStateException: "The policy
	// store can't be deleted because deletion protection is enabled.").
	ErrPolicyStoreDeletionProtected = awserr.New("InvalidStateException", awserr.ErrConflict)
	// ErrTooManyTags is returned when TagResource would push a resource's tag
	// count over the 50-tag limit. Real AWS only declares TooManyTagsException
	// for TagResource -- CreatePolicyStore's tag-count overflow stays a plain
	// ValidationException (ErrValidation), per the SDK's per-op error models.
	ErrTooManyTags = awserr.New("TooManyTagsException", awserr.ErrInvalidParameter)
)
View Source 
var ErrNilAppContext = errors.New("verifiedpermissions: nil AppContext")

ErrNilAppContext is returned when a nil AppContext is passed to Init.

Functions

This section is empty.

Types

type AuthDecision 

type AuthDecision struct {
	Request             AuthorizationRequest `json:"request"`
	Decision            string               `json:"decision"`
	DeterminingPolicies []string             `json:"determiningPolicies"`
	Errors              []string             `json:"errors"`
}

AuthDecision is the result of a single authorization evaluation.

type AuthorizationRequest 

type AuthorizationRequest struct {
	PrincipalEntityType string       `json:"principalEntityType,omitempty"`
	PrincipalEntityID   string       `json:"principalEntityId,omitempty"`
	ActionType          string       `json:"actionType,omitempty"`
	ActionID            string       `json:"actionId,omitempty"`
	ResourceEntityType  string       `json:"resourceEntityType,omitempty"`
	ResourceEntityID    string       `json:"resourceEntityId,omitempty"`
	Context             cedar.Record `json:"-"`
}

AuthorizationRequest represents a single authorization evaluation request. Context is internal-only (never wire-marshaled directly -- the JSON echo in AuthDecision.Request is built field-by-field by the handler layer, see toBatchRequestEcho), so it carries no json tag.

type BatchGetPolicyItem 

type BatchGetPolicyItem struct {
	PolicyStoreID string `json:"policyStoreId"`
	PolicyID      string `json:"policyId"`
}

BatchGetPolicyItem identifies a policy to retrieve in a batch request.

type BatchGetPolicyResult 

type BatchGetPolicyResult struct {
	Results []Policy                  `json:"results"`
	Errors  []batchGetPolicyErrorItem `json:"errors"`
}

BatchGetPolicyResult holds the results of a BatchGetPolicy call.

type CognitoGroupConfig 

type CognitoGroupConfig struct {
	GroupEntityType string `json:"groupEntityType,omitempty"`
}

CognitoGroupConfig holds Cognito group-to-Cedar-entity mapping configuration.

type CreatePolicyParams 

type CreatePolicyParams struct {
	PolicyType          string // "STATIC" or "TEMPLATE_LINKED"
	Statement           string // STATIC only
	Description         string // STATIC only
	PolicyTemplateID    string // TEMPLATE_LINKED only
	PrincipalEntityType string // TEMPLATE_LINKED only
	PrincipalEntityID   string // TEMPLATE_LINKED only
	ResourceEntityType  string // TEMPLATE_LINKED only
	ResourceEntityID    string // TEMPLATE_LINKED only
	Name                string // optional, unique within the policy store
	ClientToken         string // idempotency token, see InMemoryBackend.checkClientToken
}

CreatePolicyParams holds parameters for creating a policy.

type Handler 

type Handler struct {
	Backend StorageBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for Amazon Verified Permissions operations.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new Verified Permissions handler.

func (*Handler) BackendFor 

func (h *Handler) BackendFor(region string) StorageBackend

BackendFor returns the backend serving region: the home backend, or the sibling built on first use.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this handler handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) EnableRegions 

func (h *Handler) EnableRegions()

EnableRegions makes h serve every other region through lazily built per-region siblings.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the Verified Permissions action from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported Verified Permissions operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler serves each request from the handler of its region.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) RegionBackends 

func (h *Handler) RegionBackends() []StorageBackend

RegionBackends returns the home backend followed by every sibling built so far.

func (*Handler) RegionHandler 

func (h *Handler) RegionHandler(region string) *Handler

RegionHandler returns the handler serving region: h itself for the home region, else its sibling.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears every region.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Verified Permissions API requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable; other regions ride in an additive "regions" key.

type IdentitySource 

type IdentitySource struct {
	CreatedDate         time.Time           `json:"createdDate"`
	LastUpdated         time.Time           `json:"lastUpdated"`
	CognitoGroupConfig  *CognitoGroupConfig `json:"cognitoGroupConfig,omitempty"`
	OIDCGroupConfig     *OIDCGroupConfig    `json:"oidcGroupConfig,omitempty"`
	OIDCTokenSelection  *OIDCTokenSelection `json:"oidcTokenSelection,omitempty"`
	IdentitySourceID    string              `json:"identitySourceId"`
	PolicyStoreID       string              `json:"policyStoreId"`
	PrincipalEntityType string              `json:"principalEntityType"`
	UserPoolArn         string              `json:"userPoolArn,omitempty"`
	OpenIDIssuer        string              `json:"openIdIssuer,omitempty"`
	EntityIDPrefix      string              `json:"entityIdPrefix,omitempty"`
	ClientIDs           []string            `json:"clientIds,omitempty"`
}

IdentitySource represents an Amazon Verified Permissions identity source.

type IdentitySourceConfig 

type IdentitySourceConfig struct {
	// Cognito
	UserPoolArn            string
	ClientIDs              []string
	CognitoGroupEntityType string
	// OIDC
	Issuer              string
	EntityIDPrefix      string
	OIDCGroupClaim      string
	OIDCGroupEntityType string
	// Token selection
	TokenType        string // "IDENTITY" or "ACCESS"
	PrincipalIDClaim string
	Audiences        []string
}

IdentitySourceConfig holds full identity source configuration for create/update.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for Verified Permissions resources.

policyStores registers directly on b.registry, keyed by its real PolicyStoreID field. policies, policyTemplates, and identitySources were previously nested by policy store (map[string]map[string]*T); each is now a flat *store.Table keyed by the composite "policyStoreID/id" string (see policyKey/policyTemplateKey/identitySourceKey), with a companion *store.Index grouping entries by policy store for the per-store scans the nested maps used to answer directly -- the same pattern services/codeartifact uses for its region-nested maps. All three carry real, wire-visible PolicyStoreID fields, so each is a "clean" table registered directly on b.registry, no DTO wrapper needed (see persistence.go).

schemas has no wire-visible identity field at all (one schema per policy store, keyed only by the outer map's policyStoreID), so it gained a hidden policyStoreID field purely for this key; it is a "dirty" table (store.New only, deliberately NOT store.Register-ed onto b.registry) round-tripped through a DTO wrapper in persistence.go.

policyStoreAliases registers directly on b.registry too, keyed by its own (wire-visible, account/region-unique) AliasName field -- a "clean" table like policyStores, needing no DTO wrapper. policyStoreAliasesByStore groups aliases by the policy store they point at, for ListPolicyStoreAliases' filter and for DeletePolicyStore's cascade (see DeletePolicyStore).

arnIndex is a derived cache rebuilt from the tables above on Restore, so it is never itself persisted. resourceTags, policySetCache, and policySetDirty remain plain maps: resourceTags is a non-*T value map (map[string]string) still persisted directly; policySetCache/policySetDirty are ephemeral caches that are never persisted.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the AWS account ID configured for this backend.

func (*InMemoryBackend) AddIdentitySourceInternal 

func (b *InMemoryBackend) AddIdentitySourceInternal(is *IdentitySource)

AddIdentitySourceInternal inserts a pre-built IdentitySource directly into the backend (for test seeding).

func (*InMemoryBackend) AddPolicyInternal 

func (b *InMemoryBackend) AddPolicyInternal(p *Policy)

AddPolicyInternal inserts a pre-built Policy directly into the backend (for test seeding).

func (*InMemoryBackend) AddPolicyStoreInternal 

func (b *InMemoryBackend) AddPolicyStoreInternal(ps *PolicyStore)

AddPolicyStoreInternal inserts a pre-built PolicyStore directly into the backend (for test seeding).

func (*InMemoryBackend) AddPolicyTemplateInternal 

func (b *InMemoryBackend) AddPolicyTemplateInternal(pt *PolicyTemplate)

AddPolicyTemplateInternal inserts a pre-built PolicyTemplate directly into the backend (for test seeding).

func (*InMemoryBackend) BatchGetPolicy 

func (b *InMemoryBackend) BatchGetPolicy(items []BatchGetPolicyItem) BatchGetPolicyResult

BatchGetPolicy retrieves multiple policies in a single request.

func (*InMemoryBackend) BatchIsAuthorized 

func (b *InMemoryBackend) BatchIsAuthorized(
	policyStoreID string,
	requests []AuthorizationRequest,
	entities cedar.EntityMap,
) ([]AuthDecision, error)

BatchIsAuthorized evaluates a batch of authorization requests.

func (*InMemoryBackend) BatchIsAuthorizedWithToken 

func (b *InMemoryBackend) BatchIsAuthorizedWithToken(
	policyStoreID string,
	requests []AuthorizationRequest,
	entities cedar.EntityMap,
) ([]AuthDecision, error)

BatchIsAuthorizedWithToken evaluates a batch of authorization requests using a token.

func (*InMemoryBackend) CreateIdentitySource 

func (b *InMemoryBackend) CreateIdentitySource(
	policyStoreID, principalEntityType string,
	cfg IdentitySourceConfig,
	clientToken string,
) (*IdentitySource, error)

CreateIdentitySource creates a new identity source in the given policy store. A non-empty clientToken makes the call idempotent for eight hours, same semantics as CreatePolicyStore's ClientToken.

func (*InMemoryBackend) CreatePolicy 

func (b *InMemoryBackend) CreatePolicy(policyStoreID string, params CreatePolicyParams) (*Policy, error)

CreatePolicy creates a new policy in the given policy store.

func (*InMemoryBackend) CreatePolicyStore 

func (b *InMemoryBackend) CreatePolicyStore(
	description string,
	tags map[string]string,
	validationMode, deletionProtection, clientToken string,
) (*PolicyStore, error)

CreatePolicyStore creates a new policy store. A non-empty clientToken makes the call idempotent for eight hours: a retry with the same token and the same parameters replays the original policy store instead of creating a duplicate, and a retry with the same token but different parameters fails with ErrConflict, matching real AWS's documented ClientToken semantics.

func (*InMemoryBackend) CreatePolicyStoreAlias added in v1.2.0 

func (b *InMemoryBackend) CreatePolicyStoreAlias(aliasName, policyStoreID string) (*PolicyStoreAlias, error)

CreatePolicyStoreAlias creates an alias pointing at policyStoreID.

Real AWS semantics (this op is new to the SDK; verified against the API reference since no prior gopherstack pass audited it):

  • aliasName must be prefixed "policy-store-alias/" (ValidationException).
  • policyStoreID must reference an existing policy store, identified by ID only -- unlike almost every other policyStoreId parameter in this API (see Handler.resolvePolicyStoreID), alias resolution does NOT apply here: "The associated policy store must be specified using its ID. The alias name cannot be used." A nonexistent target is ResourceNotFoundException.
  • Idempotent on an exact (aliasName, policyStoreId) repeat against an Active alias: replays the existing alias instead of erroring ("For each duplicate CreatePolicyStoreAlias request, a Success response will be returned and a new policy store alias will not be created").
  • An aliasName already in use for a DIFFERENT policyStoreId, or currently in the PendingDeletion state (real SDK's GetPolicyStoreAlias doc: "creating a policy store alias with the same alias name will fail" while PendingDeletion -- no exception carved out for the same-target-store case), is a ConflictException.

func (*InMemoryBackend) CreatePolicyStoreEncrypted 

func (b *InMemoryBackend) CreatePolicyStoreEncrypted(
	description string,
	tags map[string]string,
	validationMode, deletionProtection, clientToken string,
	enc *PolicyStoreEncryption,
) (*PolicyStore, error)

CreatePolicyStoreEncrypted is CreatePolicyStore with an optional customer-managed KMS configuration.

func (*InMemoryBackend) CreatePolicyTemplate 

func (b *InMemoryBackend) CreatePolicyTemplate(
	policyStoreID, description, statement, name, clientToken string,
) (*PolicyTemplate, error)

CreatePolicyTemplate creates a new policy template in the given policy store. A non-empty clientToken makes the call idempotent for eight hours, same semantics as CreatePolicyStore's ClientToken.

func (*InMemoryBackend) DeleteIdentitySource 

func (b *InMemoryBackend) DeleteIdentitySource(policyStoreID, identitySourceID string) error

DeleteIdentitySource removes an identity source from the given policy store.

func (*InMemoryBackend) DeletePolicy 

func (b *InMemoryBackend) DeletePolicy(policyStoreID, policyID string) error

DeletePolicy removes a policy from the given policy store. Idempotent for a nonexistent policyID, matching the real SDK's documented idempotency ("This operation is idempotent; if you specify a policy that doesn't exist, the request response returns a successful HTTP 200 status code"). A nonexistent policyStoreID still errors: ResourceNotFoundException remains in DeletePolicy's modelled error set (unlike DeletePolicyStore's), so the idempotency only covers the policy, not its store.

func (*InMemoryBackend) DeletePolicyStore 

func (b *InMemoryBackend) DeletePolicyStore(policyStoreID string) error

DeletePolicyStore removes a policy store and all its policies and templates. Idempotent: a nonexistent policyStoreID is a no-op success, matching the real SDK's documented idempotency ("This operation is idempotent. If you specify a policy store that does not exist, the request response will still return a successful HTTP 200 status code") -- ResourceNotFoundException isn't even in DeletePolicyStore's modelled error set.

func (*InMemoryBackend) DeletePolicyStoreAlias added in v1.2.0 

func (b *InMemoryBackend) DeletePolicyStoreAlias(aliasName string, hardDelete bool) error

DeletePolicyStoreAlias deletes the named alias. Idempotent: a nonexistent aliasName is a no-op success, matching the real SDK's documented idempotency ("If you specify a policy store alias that does not exist, the request response will still return a successful HTTP 200 status code"). hardDelete selects DeletionMode=HardDelete (immediate removal, bypassing PendingDeletion); the default (false, SoftDelete) instead transitions the alias to PendingDeletion -- it remains visible via GetPolicyStoreAlias/ListPolicyStoreAliases but is ineligible for a new CreatePolicyStoreAlias with the same name and for policyStoreId-alias resolution elsewhere (see ResolvePolicyStoreAlias).

func (*InMemoryBackend) DeletePolicyTemplate 

func (b *InMemoryBackend) DeletePolicyTemplate(policyStoreID, policyTemplateID string) error

DeletePolicyTemplate removes a policy template from the given policy store. Per the real SDK's documented behavior ("This operation also deletes any policies that were created from the specified policy template"), it also cascade-deletes every TEMPLATE_LINKED policy that references this template -- otherwise those policies would be left pointing at a nonexistent template (a dangling reference visible to GetPolicy/ListPolicies/BatchGetPolicy, and silently dropped from Cedar evaluation, since resolveStatementLocked treats a missing template as an empty statement).

func (*InMemoryBackend) GetIdentitySource 

func (b *InMemoryBackend) GetIdentitySource(policyStoreID, identitySourceID string) (*IdentitySource, error)

GetIdentitySource returns the identity source with the given ID.

func (*InMemoryBackend) GetPolicy 

func (b *InMemoryBackend) GetPolicy(policyStoreID, policyID string) (*Policy, error)

GetPolicy returns the policy with the given ID.

func (*InMemoryBackend) GetPolicyStore 

func (b *InMemoryBackend) GetPolicyStore(policyStoreID string) (*PolicyStore, error)

GetPolicyStore returns the policy store with the given ID.

func (*InMemoryBackend) GetPolicyStoreAlias added in v1.2.0 

func (b *InMemoryBackend) GetPolicyStoreAlias(aliasName string) (*PolicyStoreAlias, error)

GetPolicyStoreAlias returns the alias with the given name, regardless of its state -- reporting Active vs PendingDeletion is exactly this op's job.

func (*InMemoryBackend) GetPolicyTemplate 

func (b *InMemoryBackend) GetPolicyTemplate(policyStoreID, policyTemplateID string) (*PolicyTemplate, error)

GetPolicyTemplate returns the policy template with the given ID.

func (*InMemoryBackend) GetSchema 

func (b *InMemoryBackend) GetSchema(policyStoreID string) (*PolicyStoreSchema, error)

GetSchema returns the schema for a policy store.

func (*InMemoryBackend) IsAuthorized 

func (b *InMemoryBackend) IsAuthorized(
	policyStoreID string,
	req AuthorizationRequest,
	entities cedar.EntityMap,
) (*AuthDecision, error)

IsAuthorized evaluates a single authorization request against stored Cedar policies.

func (*InMemoryBackend) IsAuthorizedWithToken 

func (b *InMemoryBackend) IsAuthorizedWithToken(
	policyStoreID string,
	req AuthorizationRequest,
	entities cedar.EntityMap,
) (*AuthDecision, error)

IsAuthorizedWithToken evaluates a single authorization request using a token.

func (*InMemoryBackend) ListIdentitySources 

func (b *InMemoryBackend) ListIdentitySources(
	policyStoreID, nextToken string,
	maxResults int,
	principalEntityTypes []string,
) ([]IdentitySource, string, error)

ListIdentitySources returns all identity sources for a policy store sorted by creation date. principalEntityTypes mirrors the wire "filters" list (each element's principalEntityType); when non-empty, only identity sources whose PrincipalEntityType matches one of them are returned (an OR across filters, matching AWS's ListIdentitySourcesInput.Filters semantics).

func (*InMemoryBackend) ListPolicies 

func (b *InMemoryBackend) ListPolicies(
	policyStoreID string,
	filter ListPoliciesFilter,
	nextToken string,
	maxResults int,
) ([]Policy, string, error)

ListPolicies returns policies in a policy store, with optional filter and pagination.

func (*InMemoryBackend) ListPolicyStoreAliases added in v1.2.0 

func (b *InMemoryBackend) ListPolicyStoreAliases(
	policyStoreID, nextToken string, maxResults int,
) ([]PolicyStoreAlias, string)

ListPolicyStoreAliases returns all policy store aliases in the account, optionally narrowed to one policy store, sorted by creation date ascending and paginated -- the same shape/pagination convention ListPolicyTemplates/ListIdentitySources use (see listByPolicyStore).

func (*InMemoryBackend) ListPolicyStores 

func (b *InMemoryBackend) ListPolicyStores(nextToken string, maxResults int) ([]PolicyStore, string)

ListPolicyStores returns all policy stores sorted by creation date (newest first).

func (*InMemoryBackend) ListPolicyTemplates 

func (b *InMemoryBackend) ListPolicyTemplates(
	policyStoreID, nextToken string,
	maxResults int,
) ([]PolicyTemplate, string, error)

ListPolicyTemplates returns all policy templates in a policy store sorted by creation date.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(resourceARN string) (map[string]string, error)

ListTagsForResource returns the tags for a resource identified by its ARN. Supports policy stores, policies, policy templates, and identity sources.

func (*InMemoryBackend) PolicyScope added in v1.2.0 

func (b *InMemoryBackend) PolicyScope(p *Policy) *PolicyScopeResult

PolicyScope returns the effect/actions/principal/resource derived from p's effective Cedar statement: p's own statement for STATIC policies, or the referenced policy template's statement (with ?principal/?resource substituted) for TEMPLATE_LINKED policies. Returns nil if the statement can't be resolved (e.g. a dangling template reference) or parsed.

func (*InMemoryBackend) PutSchema 

func (b *InMemoryBackend) PutSchema(policyStoreID, schema string) ([]string, error)

PutSchema creates or replaces the schema for a policy store, extracts namespaces, and returns them.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all policy store state.

func (*InMemoryBackend) ResolvePolicyStoreAlias added in v1.2.0 

func (b *InMemoryBackend) ResolvePolicyStoreAlias(aliasName string) (string, error)

ResolvePolicyStoreAlias resolves an alias name (prefixed "policy-store-alias/") to its underlying policy store ID, for operations that accept either a policy store ID or an alias name in their policyStoreId field (see Handler.resolvePolicyStoreID). Only an Active alias resolves; a nonexistent or PendingDeletion alias is ResourceNotFoundException -- matching the real SDK's documented behavior: "If the policy store alias is used in an API that has a policyStoreId field, the operation will fail with a ResourceNotFound exception" once the alias enters PendingDeletion.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(resourceARN string, tags map[string]string) error

TagResource adds or updates tags on a resource identified by its ARN. Supports policy stores, policies, policy templates, and identity sources.

func (*InMemoryBackend) TaggedResources added in v1.3.1 

func (b *InMemoryBackend) TaggedResources() []TaggedEntry

TaggedResources returns every Verified Permissions resource ARN that currently has at least one tag applied via TagResource.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(resourceARN string, tagKeys []string) error

UntagResource removes tags from a resource identified by its ARN. Supports policy stores, policies, policy templates, and identity sources.

func (*InMemoryBackend) UpdateIdentitySource 

func (b *InMemoryBackend) UpdateIdentitySource(
	policyStoreID, identitySourceID, principalEntityType string,
	cfg IdentitySourceConfig,
) (*IdentitySource, error)

UpdateIdentitySource updates the configuration and principal entity type of an identity source.

func (*InMemoryBackend) UpdatePolicy 

func (b *InMemoryBackend) UpdatePolicy(policyStoreID, policyID string, params UpdatePolicyParams) (*Policy, error)

UpdatePolicy updates an existing static policy. Real AWS's UpdatePolicyDefinition union has only a "static" member -- there is no templateLinked variant -- and the operation doc is explicit: "You can directly update only static policies. To change a template-linked policy, you must update the template instead, using UpdatePolicyTemplate." A template-linked target is therefore always rejected here.

func (*InMemoryBackend) UpdatePolicyStore 

func (b *InMemoryBackend) UpdatePolicyStore(
	policyStoreID, description, validationMode, deletionProtection string,
) (*PolicyStore, error)

UpdatePolicyStore updates a policy store.

func (*InMemoryBackend) UpdatePolicyTemplate 

func (b *InMemoryBackend) UpdatePolicyTemplate(
	policyStoreID, policyTemplateID, description, statement, name string,
) (*PolicyTemplate, error)

UpdatePolicyTemplate updates the description, statement, and name of a policy template.

type ListPoliciesFilter 

type ListPoliciesFilter struct {
	PolicyType           string
	PolicyTemplateID     string
	PrincipalEntityType  string
	PrincipalEntityID    string
	ResourceEntityType   string
	ResourceEntityID     string
	PrincipalUnspecified bool
	ResourceUnspecified  bool
}

ListPoliciesFilter holds filter params for ListPolicies. PrincipalUnspecified / ResourceUnspecified mirror the wire filter's EntityReference "unspecified" variant: when set, only policies with no principal/resource scope match.

type OIDCGroupConfig 

type OIDCGroupConfig struct {
	GroupClaim      string `json:"groupClaim,omitempty"`
	GroupEntityType string `json:"groupEntityType,omitempty"`
}

OIDCGroupConfig holds OIDC group claim to Cedar entity mapping configuration.

type OIDCTokenSelection 

type OIDCTokenSelection struct {
	TokenType        string   `json:"tokenType,omitempty"` // IDENTITY | ACCESS
	PrincipalIDClaim string   `json:"principalIdClaim,omitempty"`
	Audiences        []string `json:"audiences,omitempty"`
}

OIDCTokenSelection holds configuration for which OIDC token to use for authorization.

type Policy 

type Policy struct {
	CreatedDate         time.Time `json:"createdDate"`
	LastUpdated         time.Time `json:"lastUpdated"`
	PolicyStoreID       string    `json:"policyStoreID"`
	PolicyID            string    `json:"policyID"`
	PolicyType          string    `json:"policyType"` // STATIC | TEMPLATE_LINKED
	Statement           string    `json:"statement"`
	Description         string    `json:"description,omitempty"`
	Name                string    `json:"name,omitempty"`
	PolicyTemplateID    string    `json:"policyTemplateID,omitempty"`
	PrincipalEntityType string    `json:"principalEntityType,omitempty"`
	PrincipalEntityID   string    `json:"principalEntityID,omitempty"`
	ResourceEntityType  string    `json:"resourceEntityType,omitempty"`
	ResourceEntityID    string    `json:"resourceEntityID,omitempty"`
}

Policy represents a policy in a Verified Permissions policy store.

type PolicyScopeResult added in v1.2.0 

type PolicyScopeResult struct {
	Principal *entityIdentifier
	Resource  *entityIdentifier
	Effect    string
	Actions   []actionIdentifierJSON
}

PolicyScopeResult holds the scope-derived fields the real SDK echoes at the top level of policy responses: effect, actions, principal, resource. A nil *PolicyScopeResult means the statement could not be resolved or parsed (e.g. a dangling template reference); callers should omit these fields, same as AWS omits them "when [the value] isn't present in the policy content".

type PolicyStore 

type PolicyStore struct {
	CreatedDate        time.Time         `json:"createdDate"`
	LastUpdated        time.Time         `json:"lastUpdated"`
	Tags               map[string]string `json:"tags,omitempty"`
	KMSEncryptionCtx   map[string]string `json:"kmsEncryptionCtx,omitempty"`
	PolicyStoreID      string            `json:"policyStoreID"`
	Arn                string            `json:"arn"`
	Description        string            `json:"description"`
	AccountID          string            `json:"accountID"`
	Region             string            `json:"region"`
	ValidationMode     string            `json:"validationMode"`
	DeletionProtection string            `json:"deletionProtection"`
	KMSKeyArn          string            `json:"kmsKeyArn,omitempty"`
}

PolicyStore represents an Amazon Verified Permissions policy store.

type PolicyStoreAlias added in v1.2.0 

type PolicyStoreAlias struct {
	CreatedAt     time.Time `json:"createdAt"`
	AliasName     string    `json:"aliasName"`
	Arn           string    `json:"arn"`
	PolicyStoreID string    `json:"policyStoreID"`
	State         string    `json:"state"`
}

PolicyStoreAlias represents a Verified Permissions policy store alias -- a human-readable, account/region-unique name that (once Active) resolves to a policy store ID and can be used in place of that ID in the policyStoreId field of nearly every other operation (see Handler.resolvePolicyStoreID). Not itself taggable: the real SDK's TagResource doc says "In Verified Permissions, policy stores can be tagged" and there is no alias ResourceType, so -- unlike PolicyStore/Policy/PolicyTemplate/ IdentitySource -- aliases are never registered in InMemoryBackend's arnIndex/resourceTags.

type PolicyStoreEncryption 

type PolicyStoreEncryption struct {
	Context map[string]string
	Key     string
}

PolicyStoreEncryption is the customer-managed KMS configuration from CreatePolicyStore.

type PolicyStoreSchema 

type PolicyStoreSchema struct {
	CreatedDate time.Time `json:"createdDate"`
	LastUpdated time.Time `json:"lastUpdated"`
	Schema      string    `json:"schema"`

	Namespaces []string `json:"namespaces,omitempty"`
	// contains filtered or unexported fields
}

PolicyStoreSchema holds the Cedar schema for a policy store.

type PolicyTemplate 

type PolicyTemplate struct {
	CreatedDate      time.Time `json:"createdDate"`
	LastUpdated      time.Time `json:"lastUpdated"`
	PolicyStoreID    string    `json:"policyStoreID"`
	PolicyTemplateID string    `json:"policyTemplateID"`
	Description      string    `json:"description"`
	Statement        string    `json:"statement"`
	Name             string    `json:"name,omitempty"`
}

PolicyTemplate represents a policy template in a Verified Permissions policy store.

type Provider 

type Provider struct{}

Provider implements service.Provider for Amazon Verified Permissions.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Verified Permissions service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type StorageBackend 

type StorageBackend interface {
	AccountID() string
	CreatePolicyStore(
		description string,
		tags map[string]string,
		validationMode, deletionProtection, clientToken string,
	) (*PolicyStore, error)
	CreatePolicyStoreEncrypted(
		description string,
		tags map[string]string,
		validationMode, deletionProtection, clientToken string,
		enc *PolicyStoreEncryption,
	) (*PolicyStore, error)
	GetPolicyStore(policyStoreID string) (*PolicyStore, error)
	ListPolicyStores(nextToken string, maxResults int) ([]PolicyStore, string)
	UpdatePolicyStore(policyStoreID, description, validationMode, deletionProtection string) (*PolicyStore, error)
	DeletePolicyStore(policyStoreID string) error
	CreatePolicy(policyStoreID string, params CreatePolicyParams) (*Policy, error)
	GetPolicy(policyStoreID, policyID string) (*Policy, error)
	ListPolicies(
		policyStoreID string,
		filter ListPoliciesFilter,
		nextToken string,
		maxResults int,
	) ([]Policy, string, error)
	UpdatePolicy(policyStoreID, policyID string, params UpdatePolicyParams) (*Policy, error)
	DeletePolicy(policyStoreID, policyID string) error
	PolicyScope(p *Policy) *PolicyScopeResult
	CreatePolicyTemplate(policyStoreID, description, statement, name, clientToken string) (*PolicyTemplate, error)
	GetPolicyTemplate(policyStoreID, policyTemplateID string) (*PolicyTemplate, error)
	ListPolicyTemplates(policyStoreID, nextToken string, maxResults int) ([]PolicyTemplate, string, error)
	UpdatePolicyTemplate(policyStoreID, policyTemplateID, description, statement, name string) (*PolicyTemplate, error)
	DeletePolicyTemplate(policyStoreID, policyTemplateID string) error
	Reset()
	TagResource(resourceARN string, tags map[string]string) error
	UntagResource(resourceARN string, tagKeys []string) error
	ListTagsForResource(resourceARN string) (map[string]string, error)
	IsAuthorized(policyStoreID string, req AuthorizationRequest, entities cedar.EntityMap) (*AuthDecision, error)
	IsAuthorizedWithToken(
		policyStoreID string,
		req AuthorizationRequest,
		entities cedar.EntityMap,
	) (*AuthDecision, error)
	BatchGetPolicy(items []BatchGetPolicyItem) BatchGetPolicyResult
	BatchIsAuthorized(
		policyStoreID string,
		requests []AuthorizationRequest,
		entities cedar.EntityMap,
	) ([]AuthDecision, error)
	BatchIsAuthorizedWithToken(
		policyStoreID string,
		requests []AuthorizationRequest,
		entities cedar.EntityMap,
	) ([]AuthDecision, error)
	CreateIdentitySource(
		policyStoreID, principalEntityType string,
		cfg IdentitySourceConfig,
		clientToken string,
	) (*IdentitySource, error)
	GetIdentitySource(policyStoreID, identitySourceID string) (*IdentitySource, error)
	DeleteIdentitySource(policyStoreID, identitySourceID string) error
	ListIdentitySources(
		policyStoreID, nextToken string,
		maxResults int,
		principalEntityTypes []string,
	) ([]IdentitySource, string, error)
	UpdateIdentitySource(
		policyStoreID, identitySourceID, principalEntityType string,
		cfg IdentitySourceConfig,
	) (*IdentitySource, error)
	PutSchema(policyStoreID, schema string) ([]string, error)
	GetSchema(policyStoreID string) (*PolicyStoreSchema, error)
	CreatePolicyStoreAlias(aliasName, policyStoreID string) (*PolicyStoreAlias, error)
	GetPolicyStoreAlias(aliasName string) (*PolicyStoreAlias, error)
	ListPolicyStoreAliases(policyStoreID, nextToken string, maxResults int) ([]PolicyStoreAlias, string)
	DeletePolicyStoreAlias(aliasName string, hardDelete bool) error
	ResolvePolicyStoreAlias(aliasName string) (string, error)
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend is the interface for Verified Permissions storage operations.

type TaggedEntry added in v1.3.1 

type TaggedEntry struct {
	Tags map[string]string
	ARN  string
}

TaggedEntry pairs a resource ARN with its tags.

type UpdatePolicyParams 

type UpdatePolicyParams struct {
	Name        *string // nil keeps the existing name, "" removes it
	Statement   string
	Description string
}

UpdatePolicyParams holds parameters for updating a static policy. Real AWS's UpdatePolicy can only update static policies; there is no TEMPLATE_LINKED variant.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.