storage

package
v1.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 13, 2026 License: Apache-2.0 Imports: 18 Imported by: 0

Documentation

Index

Constants

View Source 
const MaxAccessKeysPerUser = 2

MaxAccessKeysPerUser is the maximum number of access keys a single IAM user may hold at once, matching the AWS IAM quota.

View Source 
const MaxClientIDsPerOIDCProvider = 100

MaxClientIDsPerOIDCProvider is the maximum number of client IDs a single OIDC provider may hold at once

View Source 
const MaxInlinePolicyBytesPerRole = 10240

MaxInlinePolicyBytesPerRole is the maximum aggregate size, in bytes, of all of a single IAM role's inline policy documents combined

View Source 
const MaxInlinePolicyBytesPerUser = 2048

MaxInlinePolicyBytesPerUser is the maximum aggregate size, in bytes, of all of a single IAM user's inline policy documents combined

View Source 
const MaxOIDCProvidersPerAccount = 100

MaxOIDCProvidersPerAccount is the maximum number of OIDC providers a single account may hold

View Source 
const MaxTagsPerResource = 50

MaxTagsPerResource is the maximum number of tags a single IAM user, role or OIDC provider may carry at once, matching the AWS IAM quota.

View Source 
const UsageRecordCoalesceWindow = time.Minute

UsageRecordCoalesceWindow is how long a last-used record is left alone after a write that already reported the same service and region. Every authenticated S3 data-plane request records a use, so without this the internal storer would rewrite the whole IAM file (twice — it keeps a backup) on every GET, and the Vault storer would issue a read-modify-write per request. Real IAM's own last-used data is coarse for the same reason, so nothing observable is lost.

A change of service or region is never coalesced: that is the part of the record an operator reads to answer "what is this credential being used for", and it must be able to change the moment the answer does.

Variables

View Source 
var (
	ErrUserIDAlreadyExists      = errors.New("iamapi: user id already exists")
	ErrAccessKeyIDAlreadyExists = errors.New("iamapi: access key id already exists")
	ErrRoleIDAlreadyExists      = errors.New("iamapi: role id already exists")
	// ErrSessionNotFound is returned by GetSession when accessKeyID names no
	// session, or names one whose Expiration has already passed.
	ErrSessionNotFound = errors.New("iamapi: session not found")
)
View Source 
var MaxActiveSessionsPerRole = 1000

MaxActiveSessionsPerRole bounds how many currently-unexpired AssumeRoleWithWebIdentity sessions a single role may have at once. AWS manages and rate-limits STS as a hosted service with no customer-visible equivalent quota to match for fidelity; this exists purely as local resource protection, since without it a single valid federated token can be replayed indefinitely to grow the session store — every InternalStore rewrite, or Vault KV path/metadata entry — without bound. Chosen generously enough to not constrain any legitimate workload's concurrent session count.

A var, not a const, so tests can temporarily lower it rather than paying the cost of actually creating 1000 sessions to exercise the cap.

Functions

This section is empty.

Types

type Config 

type Config struct {
	Dir   string
	Vault VaultConfig
}

type CreateAccessKeyInput 

type CreateAccessKeyInput struct {
	UserName        string
	AccessKeyID     string
	SecretAccessKey string
	Status          string
	CreateDate      time.Time
}

type GetAccessKeyLastUsedOutput 

type GetAccessKeyLastUsedOutput struct {
	UserName     string
	LastUsedDate time.Time
	ServiceName  string
	Region       string
}

type InternalStore 

type InternalStore struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

func (*InternalStore) AddClientIDToOIDCProvider 

func (s *InternalStore) AddClientIDToOIDCProvider(_ context.Context, arn, clientID string) error

func (*InternalStore) CreateAccessKey 

func (s *InternalStore) CreateAccessKey(_ context.Context, input CreateAccessKeyInput) (*types.AccessKey, error)

func (*InternalStore) CreateOIDCProvider 

func (s *InternalStore) CreateOIDCProvider(_ context.Context, provider types.OIDCProvider) (*types.OIDCProvider, error)

func (*InternalStore) CreateRole 

func (s *InternalStore) CreateRole(_ context.Context, role types.Role) (*types.Role, error)

func (*InternalStore) CreateSession 

func (s *InternalStore) CreateSession(_ context.Context, session types.Session) (*types.Session, error)

func (*InternalStore) CreateUser 

func (s *InternalStore) CreateUser(_ context.Context, user types.User) (*types.User, error)

func (*InternalStore) DeleteAccessKey 

func (s *InternalStore) DeleteAccessKey(_ context.Context, username, accessKeyID string) error

func (*InternalStore) DeleteOIDCProvider 

func (s *InternalStore) DeleteOIDCProvider(_ context.Context, arn string) error

func (*InternalStore) DeleteRole 

func (s *InternalStore) DeleteRole(_ context.Context, roleName string) error

func (*InternalStore) DeleteRolePolicy 

func (s *InternalStore) DeleteRolePolicy(_ context.Context, roleName, policyName string) error

func (*InternalStore) DeleteUser 

func (s *InternalStore) DeleteUser(_ context.Context, username string) error

func (*InternalStore) DeleteUserPolicy 

func (s *InternalStore) DeleteUserPolicy(_ context.Context, userName, policyName string) error

func (*InternalStore) GetAccessKeyLastUsed 

func (s *InternalStore) GetAccessKeyLastUsed(_ context.Context, accessKeyID string) (*GetAccessKeyLastUsedOutput, error)

func (*InternalStore) GetOIDCProvider 

func (s *InternalStore) GetOIDCProvider(_ context.Context, arn string) (*types.OIDCProvider, error)

func (*InternalStore) GetRole 

func (s *InternalStore) GetRole(_ context.Context, roleName string) (*types.Role, error)

func (*InternalStore) GetRolePolicy 

func (s *InternalStore) GetRolePolicy(_ context.Context, roleName, policyName string) (*types.PolicyEntry, error)

func (*InternalStore) GetSession 

func (s *InternalStore) GetSession(_ context.Context, accessKeyID string) (*types.Session, error)

func (*InternalStore) GetUser 

func (s *InternalStore) GetUser(_ context.Context, username string) (*types.User, error)

func (*InternalStore) GetUserByAccessKeyID 

func (s *InternalStore) GetUserByAccessKeyID(ctx context.Context, accessKeyID string) (*types.User, error)

func (*InternalStore) GetUserPolicy 

func (s *InternalStore) GetUserPolicy(_ context.Context, userName, policyName string) (*types.PolicyEntry, error)

func (*InternalStore) ListAccessKeys 

func (s *InternalStore) ListAccessKeys(_ context.Context, input ListAccessKeysInput) (*ListAccessKeysOutput, error)

func (*InternalStore) ListOIDCProviderTags 

func (s *InternalStore) ListOIDCProviderTags(_ context.Context, input ListOIDCProviderTagsInput) (*ListTagsOutput, error)

func (*InternalStore) ListOIDCProviders 

func (s *InternalStore) ListOIDCProviders(_ context.Context) (*ListOIDCProvidersOutput, error)

func (*InternalStore) ListRolePolicies 

func (s *InternalStore) ListRolePolicies(_ context.Context, input ListRolePoliciesInput) (*ListRolePoliciesOutput, error)

func (*InternalStore) ListRoleTags 

func (s *InternalStore) ListRoleTags(_ context.Context, input ListRoleTagsInput) (*ListTagsOutput, error)

func (*InternalStore) ListRoles 

func (s *InternalStore) ListRoles(_ context.Context, input ListRolesInput) (*ListRolesOutput, error)

func (*InternalStore) ListUserPolicies 

func (s *InternalStore) ListUserPolicies(_ context.Context, input ListUserPoliciesInput) (*ListUserPoliciesOutput, error)

func (*InternalStore) ListUserTags 

func (s *InternalStore) ListUserTags(_ context.Context, input ListUserTagsInput) (*ListTagsOutput, error)

func (*InternalStore) ListUsers 

func (s *InternalStore) ListUsers(_ context.Context, input ListUsersInput) (*ListUsersOutput, error)

func (*InternalStore) PutRolePolicy 

func (s *InternalStore) PutRolePolicy(_ context.Context, input PutRolePolicyInput) error

func (*InternalStore) PutUserPolicy 

func (s *InternalStore) PutUserPolicy(_ context.Context, input PutUserPolicyInput) error

func (*InternalStore) RecordAccessKeyUsage 

func (s *InternalStore) RecordAccessKeyUsage(_ context.Context, accessKeyID, service, region string, when time.Time) error

RecordAccessKeyUsage rewrites the whole IAM file, so it first reads the stored record and returns without writing anything when the update would be redundant — a read per request instead of a file rewrite per request, which is what makes recording every S3 data-plane request affordable here.

func (*InternalStore) RecordRoleUsage 

func (s *InternalStore) RecordRoleUsage(_ context.Context, roleName, region string, when time.Time) error

RecordRoleUsage is RecordAccessKeyUsage's role counterpart, including its read-first check: a redundant update writes nothing at all, and an update worth keeping rewrites the whole IAM file.

func (*InternalStore) RemoveClientIDFromOIDCProvider 

func (s *InternalStore) RemoveClientIDFromOIDCProvider(_ context.Context, arn, clientID string) error

func (*InternalStore) TagOIDCProvider 

func (s *InternalStore) TagOIDCProvider(_ context.Context, arn string, tags []types.Tag) error

func (*InternalStore) TagRole 

func (s *InternalStore) TagRole(_ context.Context, roleName string, tags []types.Tag) error

func (*InternalStore) TagUser 

func (s *InternalStore) TagUser(_ context.Context, userName string, tags []types.Tag) error

func (*InternalStore) UntagOIDCProvider 

func (s *InternalStore) UntagOIDCProvider(_ context.Context, arn string, tagKeys []string) error

func (*InternalStore) UntagRole 

func (s *InternalStore) UntagRole(_ context.Context, roleName string, tagKeys []string) error

func (*InternalStore) UntagUser 

func (s *InternalStore) UntagUser(_ context.Context, userName string, tagKeys []string) error

func (*InternalStore) UpdateAccessKey 

func (s *InternalStore) UpdateAccessKey(_ context.Context, input UpdateAccessKeyInput) error

func (*InternalStore) UpdateAssumeRolePolicy 

func (s *InternalStore) UpdateAssumeRolePolicy(_ context.Context, input UpdateAssumeRolePolicyInput) (*types.Role, error)

func (*InternalStore) UpdateOIDCProviderThumbprint 

func (s *InternalStore) UpdateOIDCProviderThumbprint(_ context.Context, arn string, thumbprints []string) error

func (*InternalStore) UpdateUser 

func (s *InternalStore) UpdateUser(_ context.Context, input UpdateUserInput) (*types.User, error)

type ListAccessKeysInput 

type ListAccessKeysInput struct {
	UserName string
	Marker   string
	MaxItems int32
}

type ListAccessKeysOutput 

type ListAccessKeysOutput struct {
	AccessKeys  []types.AccessKeyMetadata
	IsTruncated bool
	Marker      string
}

type ListOIDCProviderTagsInput 

type ListOIDCProviderTagsInput struct {
	Arn      string
	Marker   string
	MaxItems int32
}

type ListOIDCProvidersOutput 

type ListOIDCProvidersOutput struct {
	Providers []types.OpenIDConnectProviderListEntry
}

type ListRolePoliciesInput 

type ListRolePoliciesInput struct {
	RoleName string
	Marker   string
	MaxItems int32
}

type ListRolePoliciesOutput 

type ListRolePoliciesOutput struct {
	PolicyNames []string
	IsTruncated bool
	Marker      string
}

type ListRoleTagsInput 

type ListRoleTagsInput struct {
	RoleName string
	Marker   string
	MaxItems int32
}

type ListRolesInput 

type ListRolesInput struct {
	PathPrefix string
	Marker     string
	MaxItems   int32
}

type ListRolesOutput 

type ListRolesOutput struct {
	Roles       []types.Role
	IsTruncated bool
	Marker      string
}

type ListTagsOutput 

type ListTagsOutput struct {
	Tags        []types.Tag
	IsTruncated bool
	Marker      string
}

ListTagsOutput is the paginated tag window ListUserTags and ListRoleTags both return.

type ListUserPoliciesInput 

type ListUserPoliciesInput struct {
	UserName string
	Marker   string
	MaxItems int32
}

type ListUserPoliciesOutput 

type ListUserPoliciesOutput struct {
	PolicyNames []string
	IsTruncated bool
	Marker      string
}

type ListUserTagsInput 

type ListUserTagsInput struct {
	UserName string
	Marker   string
	MaxItems int32
}

type ListUsersInput 

type ListUsersInput struct {
	PathPrefix string
	Marker     string
	MaxItems   int32
}

type ListUsersOutput 

type ListUsersOutput struct {
	Users       []types.User
	IsTruncated bool
	Marker      string
}

type PutRolePolicyInput 

type PutRolePolicyInput struct {
	RoleName       string
	PolicyName     string
	PolicyDocument string
}

type PutUserPolicyInput 

type PutUserPolicyInput struct {
	UserName       string
	PolicyName     string
	PolicyDocument string
}

type Storer 

type Storer interface {
	CreateUser(ctx context.Context, user types.User) (*types.User, error)
	DeleteUser(ctx context.Context, username string) error
	GetUser(ctx context.Context, username string) (*types.User, error)
	GetUserByAccessKeyID(ctx context.Context, accessKeyID string) (*types.User, error)
	ListUsers(ctx context.Context, input ListUsersInput) (*ListUsersOutput, error)
	UpdateUser(ctx context.Context, input UpdateUserInput) (*types.User, error)

	TagUser(ctx context.Context, userName string, tags []types.Tag) error
	UntagUser(ctx context.Context, userName string, tagKeys []string) error
	ListUserTags(ctx context.Context, input ListUserTagsInput) (*ListTagsOutput, error)

	CreateAccessKey(ctx context.Context, input CreateAccessKeyInput) (*types.AccessKey, error)
	UpdateAccessKey(ctx context.Context, input UpdateAccessKeyInput) error
	DeleteAccessKey(ctx context.Context, username, accessKeyID string) error
	GetAccessKeyLastUsed(ctx context.Context, accessKeyID string) (*GetAccessKeyLastUsedOutput, error)
	ListAccessKeys(ctx context.Context, input ListAccessKeysInput) (*ListAccessKeysOutput, error)
	// RecordAccessKeyUsage updates accessKeyID's GetAccessKeyLastUsed
	// metadata (service, region, and timestamp) to reflect a successful
	// authentication at when. Called best-effort/asynchronously by the auth
	// middleware, so implementations should treat a lost update under
	// concurrent use as acceptable rather than something worth retrying hard.
	RecordAccessKeyUsage(ctx context.Context, accessKeyID, service, region string, when time.Time) error

	PutUserPolicy(ctx context.Context, input PutUserPolicyInput) error
	GetUserPolicy(ctx context.Context, userName, policyName string) (*types.PolicyEntry, error)
	DeleteUserPolicy(ctx context.Context, userName, policyName string) error
	ListUserPolicies(ctx context.Context, input ListUserPoliciesInput) (*ListUserPoliciesOutput, error)

	CreateRole(ctx context.Context, role types.Role) (*types.Role, error)
	GetRole(ctx context.Context, roleName string) (*types.Role, error)
	ListRoles(ctx context.Context, input ListRolesInput) (*ListRolesOutput, error)
	DeleteRole(ctx context.Context, roleName string) error
	UpdateAssumeRolePolicy(ctx context.Context, input UpdateAssumeRolePolicyInput) (*types.Role, error)
	// RecordRoleUsage updates roleName's RoleLastUsed metadata (region and
	// timestamp) to reflect a use of the role at when — GetRole's
	// counterpart to RecordAccessKeyUsage, and best-effort in exactly the
	// same way.
	RecordRoleUsage(ctx context.Context, roleName, region string, when time.Time) error

	TagRole(ctx context.Context, roleName string, tags []types.Tag) error
	UntagRole(ctx context.Context, roleName string, tagKeys []string) error
	ListRoleTags(ctx context.Context, input ListRoleTagsInput) (*ListTagsOutput, error)

	PutRolePolicy(ctx context.Context, input PutRolePolicyInput) error
	GetRolePolicy(ctx context.Context, roleName, policyName string) (*types.PolicyEntry, error)
	DeleteRolePolicy(ctx context.Context, roleName, policyName string) error
	ListRolePolicies(ctx context.Context, input ListRolePoliciesInput) (*ListRolePoliciesOutput, error)

	// OIDC Provider CRUD
	CreateOIDCProvider(ctx context.Context, provider types.OIDCProvider) (*types.OIDCProvider, error)
	GetOIDCProvider(ctx context.Context, arn string) (*types.OIDCProvider, error)
	ListOIDCProviders(ctx context.Context) (*ListOIDCProvidersOutput, error)
	DeleteOIDCProvider(ctx context.Context, arn string) error
	AddClientIDToOIDCProvider(ctx context.Context, arn, clientID string) error
	RemoveClientIDFromOIDCProvider(ctx context.Context, arn, clientID string) error
	UpdateOIDCProviderThumbprint(ctx context.Context, arn string, thumbprints []string) error

	TagOIDCProvider(ctx context.Context, arn string, tags []types.Tag) error
	UntagOIDCProvider(ctx context.Context, arn string, tagKeys []string) error
	ListOIDCProviderTags(ctx context.Context, input ListOIDCProviderTagsInput) (*ListTagsOutput, error)

	CreateSession(ctx context.Context, session types.Session) (*types.Session, error)
	GetSession(ctx context.Context, accessKeyID string) (*types.Session, error)
}

Storer is the IAM API storage backend contract.

func New 

func New(cfg Config) (Storer, error)

func NewInternal 

func NewInternal(dir string) (Storer, error)

func NewVault 

func NewVault(cfg VaultConfig) (Storer, error)

type UpdateAccessKeyInput 

type UpdateAccessKeyInput struct {
	UserName    string
	AccessKeyID string
	Status      string
}

type UpdateAssumeRolePolicyInput 

type UpdateAssumeRolePolicyInput struct {
	RoleName       string
	PolicyDocument string
}

type UpdateUserInput 

type UpdateUserInput struct {
	UserName    string
	NewPath     string
	NewUserName string
	NewArn      string
}

type VaultConfig 

type VaultConfig struct {
	EndpointURL            string
	Namespace              string
	SecretStoragePath      string
	SecretStorageNamespace string
	AuthMethod             string
	AuthNamespace          string
	MountPath              string
	RootToken              string
	RoleID                 string
	RoleSecret             string
	ServerCert             string
	ClientCert             string
	ClientCertKey          string
}

VaultConfig holds all configuration options for the Vault-backed IAM storer.

type VaultStore 

type VaultStore struct {
	// contains filtered or unexported fields
}

VaultStore is a Vault KV v2-backed implementation of Storer.

func (*VaultStore) AddClientIDToOIDCProvider 

func (s *VaultStore) AddClientIDToOIDCProvider(ctx context.Context, arn, clientID string) error

func (*VaultStore) CreateAccessKey 

func (s *VaultStore) CreateAccessKey(ctx context.Context, input CreateAccessKeyInput) (*types.AccessKey, error)

func (*VaultStore) CreateOIDCProvider 

func (s *VaultStore) CreateOIDCProvider(_ context.Context, provider types.OIDCProvider) (*types.OIDCProvider, error)

func (*VaultStore) CreateRole 

func (s *VaultStore) CreateRole(_ context.Context, role types.Role) (*types.Role, error)

func (*VaultStore) CreateSession 

func (s *VaultStore) CreateSession(ctx context.Context, session types.Session) (*types.Session, error)

func (*VaultStore) CreateUser 

func (s *VaultStore) CreateUser(_ context.Context, user types.User) (*types.User, error)

func (*VaultStore) DeleteAccessKey 

func (s *VaultStore) DeleteAccessKey(ctx context.Context, username, accessKeyID string) error

func (*VaultStore) DeleteOIDCProvider 

func (s *VaultStore) DeleteOIDCProvider(_ context.Context, arn string) error

func (*VaultStore) DeleteRole 

func (s *VaultStore) DeleteRole(ctx context.Context, roleName string) error

DeleteRole is DeleteUser's counterpart for roles - see its doc comment for why the dependency check (no inline policies) is confirmed via a same-data CAS write (replaceRole) immediately before the actual delete, instead of an unconditional delete straight after the check.

func (*VaultStore) DeleteRolePolicy 

func (s *VaultStore) DeleteRolePolicy(ctx context.Context, roleName, policyName string) error

func (*VaultStore) DeleteUser 

func (s *VaultStore) DeleteUser(ctx context.Context, username string) error

DeleteUser checks user against its dependency preconditions (no inline policies, no access keys) and then deletes it. The metadata-delete call Vault exposes has no CAS parameter of its own (unlike a KV write), so a plain read-check-then-delete would leave a window where a concurrent CreateAccessKey or PutUserPolicy lands between the check and the delete, and the delete proceeds anyway, orphaning the new key/policy against a user that no longer exists. Closing that window: after the dependency check, replaceUser writes the same (unchanged) record back with a CAS matching the version just read — succeeding only if nothing else has modified the record since — immediately before the actual delete, shrinking the race to the gap between two back-to-back Vault calls instead of the whole request lifecycle. A CAS conflict there means something changed after the check, so the whole check is retried (bounded by maxCASRetries) rather than deleting against stale information.

func (*VaultStore) DeleteUserPolicy 

func (s *VaultStore) DeleteUserPolicy(ctx context.Context, userName, policyName string) error

func (*VaultStore) GetAccessKeyLastUsed 

func (s *VaultStore) GetAccessKeyLastUsed(ctx context.Context, accessKeyID string) (*GetAccessKeyLastUsedOutput, error)

func (*VaultStore) GetOIDCProvider 

func (s *VaultStore) GetOIDCProvider(_ context.Context, arn string) (*types.OIDCProvider, error)

func (*VaultStore) GetRole 

func (s *VaultStore) GetRole(_ context.Context, roleName string) (*types.Role, error)

func (*VaultStore) GetRolePolicy 

func (s *VaultStore) GetRolePolicy(ctx context.Context, roleName, policyName string) (*types.PolicyEntry, error)

func (*VaultStore) GetSession 

func (s *VaultStore) GetSession(_ context.Context, accessKeyID string) (*types.Session, error)

func (*VaultStore) GetUser 

func (s *VaultStore) GetUser(_ context.Context, username string) (*types.User, error)

func (*VaultStore) GetUserByAccessKeyID 

func (s *VaultStore) GetUserByAccessKeyID(ctx context.Context, accessKeyID string) (*types.User, error)

GetUserByAccessKeyID has no index to consult (unlike InternalStore's AccessKeyIndex) so it scans every user's access keys, mirroring GetAccessKeyLastUsed's existing linear scan.

func (*VaultStore) GetUserPolicy 

func (s *VaultStore) GetUserPolicy(ctx context.Context, userName, policyName string) (*types.PolicyEntry, error)

func (*VaultStore) ListAccessKeys 

func (s *VaultStore) ListAccessKeys(ctx context.Context, input ListAccessKeysInput) (*ListAccessKeysOutput, error)

func (*VaultStore) ListOIDCProviderTags 

func (s *VaultStore) ListOIDCProviderTags(_ context.Context, input ListOIDCProviderTagsInput) (*ListTagsOutput, error)

func (*VaultStore) ListOIDCProviders 

func (s *VaultStore) ListOIDCProviders(_ context.Context) (*ListOIDCProvidersOutput, error)

func (*VaultStore) ListRolePolicies 

func (s *VaultStore) ListRolePolicies(ctx context.Context, input ListRolePoliciesInput) (*ListRolePoliciesOutput, error)

func (*VaultStore) ListRoleTags 

func (s *VaultStore) ListRoleTags(ctx context.Context, input ListRoleTagsInput) (*ListTagsOutput, error)

func (*VaultStore) ListRoles 

func (s *VaultStore) ListRoles(ctx context.Context, input ListRolesInput) (*ListRolesOutput, error)

func (*VaultStore) ListUserPolicies 

func (s *VaultStore) ListUserPolicies(ctx context.Context, input ListUserPoliciesInput) (*ListUserPoliciesOutput, error)

func (*VaultStore) ListUserTags 

func (s *VaultStore) ListUserTags(ctx context.Context, input ListUserTagsInput) (*ListTagsOutput, error)

func (*VaultStore) ListUsers 

func (s *VaultStore) ListUsers(ctx context.Context, input ListUsersInput) (*ListUsersOutput, error)

func (*VaultStore) PutRolePolicy 

func (s *VaultStore) PutRolePolicy(ctx context.Context, input PutRolePolicyInput) error

func (*VaultStore) PutUserPolicy 

func (s *VaultStore) PutUserPolicy(ctx context.Context, input PutUserPolicyInput) error

func (*VaultStore) RecordAccessKeyUsage 

func (s *VaultStore) RecordAccessKeyUsage(_ context.Context, accessKeyID, service, region string, when time.Time) error

RecordAccessKeyUsage updates accessKeyID's GetAccessKeyLastUsed metadata in its own background goroutine, detached from ctx, and always returns nil immediately: this runs on the hot path of every authenticated request, and a Vault round trip — plus, on a CAS conflict, withUserCAS's retry loop — is too expensive to add synchronously to every one of them. A failure (including one that exhausts those retries) is only logged, never surfaced: this is purely informational metadata, and a lost update under concurrent use is immaterial.

func (*VaultStore) RecordRoleUsage 

func (s *VaultStore) RecordRoleUsage(_ context.Context, roleName, region string, when time.Time) error

RecordRoleUsage updates roleName's RoleLastUsed metadata in its own background goroutine, detached from ctx, and always returns nil immediately — for the same reasons RecordAccessKeyUsage does: it runs on the hot path of every request authenticated with a session credential, and the metadata is purely informational, so a Vault round trip (plus a CAS retry loop) must not be charged to the request, and a lost or failed update is only logged.

func (*VaultStore) RemoveClientIDFromOIDCProvider 

func (s *VaultStore) RemoveClientIDFromOIDCProvider(ctx context.Context, arn, clientID string) error

func (*VaultStore) TagOIDCProvider 

func (s *VaultStore) TagOIDCProvider(ctx context.Context, arn string, tags []types.Tag) error

func (*VaultStore) TagRole 

func (s *VaultStore) TagRole(ctx context.Context, roleName string, tags []types.Tag) error

func (*VaultStore) TagUser 

func (s *VaultStore) TagUser(ctx context.Context, userName string, tags []types.Tag) error

func (*VaultStore) UntagOIDCProvider 

func (s *VaultStore) UntagOIDCProvider(ctx context.Context, arn string, tagKeys []string) error

func (*VaultStore) UntagRole 

func (s *VaultStore) UntagRole(ctx context.Context, roleName string, tagKeys []string) error

func (*VaultStore) UntagUser 

func (s *VaultStore) UntagUser(ctx context.Context, userName string, tagKeys []string) error

func (*VaultStore) UpdateAccessKey 

func (s *VaultStore) UpdateAccessKey(ctx context.Context, input UpdateAccessKeyInput) error

func (*VaultStore) UpdateAssumeRolePolicy 

func (s *VaultStore) UpdateAssumeRolePolicy(ctx context.Context, input UpdateAssumeRolePolicyInput) (*types.Role, error)

func (*VaultStore) UpdateOIDCProviderThumbprint 

func (s *VaultStore) UpdateOIDCProviderThumbprint(ctx context.Context, arn string, thumbprints []string) error

func (*VaultStore) UpdateUser 

func (s *VaultStore) UpdateUser(ctx context.Context, input UpdateUserInput) (*types.User, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.