iamapi

package
v1.10.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 22, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// HeaderAmznRequestID is the response header that carries the request ID.
	// Re-exported from iammiddleware so callers only need to import iamapi.
	HeaderAmznRequestID = iammiddleware.HeaderAmznRequestID
)

Variables

This section is empty.

Functions

func ProcessController 

func ProcessController(ctx fiber.Ctx, controller ActionHandler) error

func ProcessHandlers 

func ProcessHandlers(controller ActionHandler, handlers ...fiber.Handler) fiber.Handler

func SetResponseHeaders 

func SetResponseHeaders(ctx fiber.Ctx, headers map[string]*string)

Types

type ActionHandler 

type ActionHandler func(ctx fiber.Ctx) (*Response, error)

type CertStorage 

type CertStorage = netutil.CertStorage

func NewCertStorage 

func NewCertStorage() *CertStorage

type IAMApiController 

type IAMApiController struct {
	// contains filtered or unexported fields
}

func NewController 

func NewController(store storage.Storer, oidc OIDCConfig) IAMApiController

func (IAMApiController) AddClientIDToOpenIDConnectProvider 

func (c IAMApiController) AddClientIDToOpenIDConnectProvider(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) AssumeRoleWithWebIdentity 

func (c IAMApiController) AssumeRoleWithWebIdentity(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) CreateAccessKey 

func (c IAMApiController) CreateAccessKey(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) CreateOpenIDConnectProvider 

func (c IAMApiController) CreateOpenIDConnectProvider(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) CreateRole 

func (c IAMApiController) CreateRole(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) CreateUser 

func (c IAMApiController) CreateUser(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) DeleteAccessKey 

func (c IAMApiController) DeleteAccessKey(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) DeleteOpenIDConnectProvider 

func (c IAMApiController) DeleteOpenIDConnectProvider(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) DeleteRole 

func (c IAMApiController) DeleteRole(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) DeleteRolePolicy 

func (c IAMApiController) DeleteRolePolicy(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) DeleteUser 

func (c IAMApiController) DeleteUser(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) DeleteUserPolicy 

func (c IAMApiController) DeleteUserPolicy(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) GetAccessKeyLastUsed 

func (c IAMApiController) GetAccessKeyLastUsed(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) GetCallerIdentity 

func (c IAMApiController) GetCallerIdentity(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) GetOpenIDConnectProvider 

func (c IAMApiController) GetOpenIDConnectProvider(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) GetRole 

func (c IAMApiController) GetRole(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) GetRolePolicy 

func (c IAMApiController) GetRolePolicy(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) GetUser 

func (c IAMApiController) GetUser(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) GetUserPolicy 

func (c IAMApiController) GetUserPolicy(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) ListAccessKeys 

func (c IAMApiController) ListAccessKeys(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) ListOpenIDConnectProviderTags 

func (c IAMApiController) ListOpenIDConnectProviderTags(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) ListOpenIDConnectProviders 

func (c IAMApiController) ListOpenIDConnectProviders(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) ListRolePolicies 

func (c IAMApiController) ListRolePolicies(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) ListRoleTags 

func (c IAMApiController) ListRoleTags(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) ListRoles 

func (c IAMApiController) ListRoles(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) ListUserPolicies 

func (c IAMApiController) ListUserPolicies(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) ListUserTags 

func (c IAMApiController) ListUserTags(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) ListUsers 

func (c IAMApiController) ListUsers(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) PutRolePolicy 

func (c IAMApiController) PutRolePolicy(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) PutUserPolicy 

func (c IAMApiController) PutUserPolicy(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) RemoveClientIDFromOpenIDConnectProvider 

func (c IAMApiController) RemoveClientIDFromOpenIDConnectProvider(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) TagOpenIDConnectProvider 

func (c IAMApiController) TagOpenIDConnectProvider(ctx fiber.Ctx) (*Response, error)

TagOpenIDConnectProvider adds or replaces tags on an existing OIDC provider. Unlike the user and role tag actions, provider tag keys are compared exactly, so "env" and "ENV" are two distinct tags.

func (IAMApiController) TagRole 

func (c IAMApiController) TagRole(ctx fiber.Ctx) (*Response, error)

TagRole adds or replaces tags on an existing role.

func (IAMApiController) TagUser 

func (c IAMApiController) TagUser(ctx fiber.Ctx) (*Response, error)

TagUser adds or replaces tags on an existing user. AWS validates the request in full before it ever looks the user up, so a malformed tag on a non-existent user reports the tag error, not NoSuchEntity.

func (IAMApiController) UntagOpenIDConnectProvider 

func (c IAMApiController) UntagOpenIDConnectProvider(ctx fiber.Ctx) (*Response, error)

UntagOpenIDConnectProvider removes the named tags from an existing OIDC provider. Removal is idempotent: a key naming no current tag is not an error.

func (IAMApiController) UntagRole 

func (c IAMApiController) UntagRole(ctx fiber.Ctx) (*Response, error)

UntagRole removes the named tags from an existing role. Removal is idempotent: a key naming no current tag is not an error.

func (IAMApiController) UntagUser 

func (c IAMApiController) UntagUser(ctx fiber.Ctx) (*Response, error)

UntagUser removes the named tags from an existing user. Removal is idempotent: a key naming no current tag is not an error.

func (IAMApiController) UpdateAccessKey 

func (c IAMApiController) UpdateAccessKey(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) UpdateAssumeRolePolicy 

func (c IAMApiController) UpdateAssumeRolePolicy(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) UpdateOpenIDConnectProviderThumbprint 

func (c IAMApiController) UpdateOpenIDConnectProviderThumbprint(ctx fiber.Ctx) (*Response, error)

func (IAMApiController) UpdateUser 

func (c IAMApiController) UpdateUser(ctx fiber.Ctx) (*Response, error)

type IAMApiRouter 

type IAMApiRouter struct {
	Ctrl IAMApiController
	// contains filtered or unexported fields
}

func (*IAMApiRouter) Init 

func (r *IAMApiRouter) Init()

type IAMApiServer 

type IAMApiServer struct {
	Router *IAMApiRouter

	CertStorage *CertStorage
	// contains filtered or unexported fields
}

func New 

func New(store storage.Storer, root RootCredentials, opts ...Option) (*IAMApiServer, error)

func (*IAMApiServer) ServeMultiPort 

func (s *IAMApiServer) ServeMultiPort(ports []string) error

func (*IAMApiServer) Shutdown 

func (s *IAMApiServer) Shutdown() error

type OIDCConfig added in v1.9.0 

type OIDCConfig struct {
	// ThumbprintAutoFetchDisabled disables CreateOpenIDConnectProvider's
	// TLS auto-fetch fallback when ThumbprintList is omitted; see
	// WithOIDCThumbprintAutoFetchDisabled.
	ThumbprintAutoFetchDisabled bool
	// AllowPrivateEndpoints permits OIDC provider URLs that resolve to
	// loopback/private/link-local addresses, and that carry an explicit
	// port; see WithOIDCAllowPrivateEndpoints.
	AllowPrivateEndpoints bool
	// AllowInsecureTransport permits plaintext http OIDC provider URLs and
	// drops TLS verification for https ones; see
	// WithOIDCAllowInsecureTransport.
	AllowInsecureTransport bool
	// DiscoveryURLs holds "<provider url>=<discovery url>" pairs, each
	// redirecting one provider's discovery-document fetch; see
	// WithOIDCDiscoveryURLs.
	DiscoveryURLs []string
	// contains filtered or unexported fields
}

OIDCConfig groups the settings that govern how this API treats OIDC identity providers: whether CreateOpenIDConnectProvider may reach out for a thumbprint at all, and how strictly a provider's endpoint is validated and fetched from. The zero value is the default AWS-matching posture.

type Option 

type Option func(*IAMApiServer)

func WithCORSAllowOrigin 

func WithCORSAllowOrigin(origin string) Option

WithCORSAllowOrigin sets the Access-Control-Allow-Origin value returned to browsers, and enables preflight handling. Required for the WebUI, which never shares a port with the IAM API. Empty (the default) skips the CORS middleware, leaving the API usable by CLI and SDK clients only.

func WithClientIPHeader added in v1.10.0 

func WithClientIPHeader(header string) Option

WithClientIPHeader records the client address from the named proxy header in the request log. The accepted values are clientip.ClientIPHeaderForwardedFor and clientip.ClientIPHeaderRealIP; an empty value (the default) keeps the socket peer address. The header is only honoured from a peer listed in WithTrustedProxies. ctx.IP() is not changed, so SourceIP in policy evaluation keeps using the socket address.

func WithConcurrencyLimiter 

func WithConcurrencyLimiter(maxConnections, maxRequests int) Option

func WithHealth 

func WithHealth(health string) Option

func WithKeepAlive 

func WithKeepAlive() Option

func WithOIDCAllowInsecureTransport added in v1.9.0 

func WithOIDCAllowInsecureTransport() Option

WithOIDCAllowInsecureTransport permits plaintext http OIDC provider URLs and drops TLS certificate verification (ThumbprintList pinning included) for https ones, leaving the network path as the only thing authenticating the IdP. Intended for an IdP reachable only over a path that is itself trusted — a discovery provider bound to loopback as a sidecar in this process's own pod.

func WithOIDCAllowPrivateEndpoints added in v1.9.0 

func WithOIDCAllowPrivateEndpoints() Option

WithOIDCAllowPrivateEndpoints permits an OIDC provider Url that resolves to a loopback/private/link-local address, and one carrying an explicit port. Both are refused by default, which makes an IdP that only exists on an internal network — a SPIFFE/SPIRE OIDC discovery provider on a cluster Service, say — impossible to register or verify tokens against. Transport is unaffected: still https, still fully verified.

func WithOIDCDiscoveryURLs added in v1.9.0 

func WithOIDCDiscoveryURLs(pairs []string) Option

WithOIDCDiscoveryURLs redirects the discovery-document fetch of individual providers, taking "<provider url>=<discovery url>" pairs. The discovery URL is fetched exactly as given, so it must include the "/.well-known/openid-configuration" path when the IdP serves it there.

Only the fetch moves: the provider Url is still what a token's iss claim and the fetched document's own issuer field must match, and the JWKS is still fetched from the jwks_uri that document publishes. That is what lets an IdP hand out tokens naming a public issuer while this gateway reads its keys over a cluster-internal path — the endpoints being private is the point, so a configured discovery URL and the jwks_uri it publishes are exempt from the private-address check without WithOIDCAllowPrivateEndpoints.

func WithOIDCThumbprintAutoFetchDisabled 

func WithOIDCThumbprintAutoFetchDisabled() Option

WithOIDCThumbprintAutoFetchDisabled disables CreateOpenIDConnectProvider's TLS auto-fetch fallback for when ThumbprintList is omitted. When set, an omitted ThumbprintList is rejected with a MissingValue error instead of the gateway making an outbound TLS connection to the caller-supplied URL — an operational safety valve for restricted/air-gapped deployments.

func WithOnListen 

func WithOnListen(fn func()) Option

func WithQuiet 

func WithQuiet() Option

func WithSocketPerm 

func WithSocketPerm(perm os.FileMode) Option

func WithTLS 

func WithTLS(cs *CertStorage) Option

func WithTrustedProxies added in v1.10.0 

func WithTrustedProxies(trusted clientip.TrustedProxies) Option

WithTrustedProxies sets the peers whose client IP header is trusted, as parsed by clientip.ParseTrustedProxies. It only has an effect together with WithClientIPHeader.

type Response 

type Response struct {
	Data    types.ActionResponse
	Headers map[string]*string
	Status  int
}

type RootCredentials 

type RootCredentials = iammiddleware.RootCredentials

RootCredentials re-exports the type from iammiddleware so callers only need to import iamapi.

Source Files

View all Source files

Directories

Path Synopsis
internal
iammiddleware
iamutil
Package private implements the standalone IAM service's private endpoint set: derive a SigV4 signing key, evaluate IAM identity policies, and resolve an access key id to the principal that owns it.
 Package private implements the standalone IAM service's private endpoint set: derive a SigV4 signing key, evaluate IAM identity policies, and resolve an access key id to the principal that owns it.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.