awsspec

Documentation

Index

• type ConditionOperator
• type ConditionType
• type ConditionVariable
• type IAMSpec
  • func New(s *session.Session) IAMSpec
  • func (i IAMSpec) PolicyAllows(arn string, actions, resources []string) (res bool, err error)
  • func (i IAMSpec) RoleHasPolicy(role, policyARN string) (res bool, err error)
  • func (i IAMSpec) UserHasPolicy(user, policyARN string) (res bool, err error)
• type OptSlice
  • func (o OptSlice) Contains(items []string) (res bool)
  • func (o *OptSlice) MarshalJSON() ([]byte, error)
  • func (o *OptSlice) UnmarshalJSON(data []byte) error
• type PolicyDocument
• type Statement

Types

type ConditionOperator

type ConditionOperator interface {
	GetOperator() string
	GetVariable() string
	GetValue() interface{}
}

type ConditionType

type ConditionType string

ConditionType represents all the possible comparison types for the Condition of a Policy Statement Inspired by github.com/gwkunze/goiam/policy

const (
	ConditionStringEquals              ConditionType = "StringEquals"
	ConditionStringNotEquals           ConditionType = "StringNotEquals"
	ConditionStringEqualsIgnoreCase    ConditionType = "StringEqualsIgnoreCase"
	ConditionStringNotEqualsIgnoreCase ConditionType = "StringNotEqualsIgnoreCase"
	ConditionStringLike                ConditionType = "StringLike"
	ConditionStringNotLike             ConditionType = "StringNotLike"
	ConditionNumericEquals             ConditionType = "NumericEquals"
	ConditionNumericNotEquals          ConditionType = "NumericNotEquals"
	ConditionNumericLessThan           ConditionType = "NumericLessThan"
	ConditionNumericLessThanEquals     ConditionType = "NumericLessThanEquals"
	ConditionNumericGreaterThan        ConditionType = "NumericGreaterThan"
	ConditionNumericGreaterThanEquals  ConditionType = "NumericGreaterThanEquals"
	ConditionDateEquals                ConditionType = "DateEquals"
	ConditionDateNotEquals             ConditionType = "DateNotEquals"
	ConditionDateLessThan              ConditionType = "DateLessThan"
	ConditionDateLessThanEquals        ConditionType = "DateLessThanEquals"
	ConditionDateGreaterThan           ConditionType = "DateGreaterThan"
	ConditionDateGreaterThanEquals     ConditionType = "DateGreaterThanEquals"
	ConditionBool                      ConditionType = "Bool"
	ConditionIpAddress                 ConditionType = "IpAddress"
	ConditionNotIpAddress              ConditionType = "NotIpAddress"
	ConditionArnEquals                 ConditionType = "ArnEquals"
	ConditionArnNotEquals              ConditionType = "ArnNotEquals"
	ConditionArnLike                   ConditionType = "ArnLike"
	ConditionArnNotLike                ConditionType = "ArnNotLike"
	ConditionNull                      ConditionType = "Null"
)

type ConditionVariable

type ConditionVariable string

ConditionVariable represent the available variables used in Conditions Inspired by github.com/gwkunze/goiam/policy

const (
	VarCurrentTime        ConditionVariable = "AWS:CurrentTime"
	VarEpochTime          ConditionVariable = "AWS:EpochTime"
	VarMultiFactorAuthAge ConditionVariable = "AWS:MultiFactorAuthAge"
	VarPrincipalType      ConditionVariable = "AWS:principaltype"
	VarSecureTransport    ConditionVariable = "AWS:SecureTransport"
	VarSourceArn          ConditionVariable = "AWS:SourceArn"
	VarSourceIp           ConditionVariable = "AWS:SourceIp"
	VarUserAgent          ConditionVariable = "AWS:UserAgent"
	VarUsedId             ConditionVariable = "AWS:userid"
	VarUsername           ConditionVariable = "AWS:username"
)

type IAMSpec

type IAMSpec struct {
	Session *session.Session
}

IAMSpec contains the AWS session

func New

func New(s *session.Session) IAMSpec

New returns a new IAMSpec

func (IAMSpec) PolicyAllows

func (i IAMSpec) PolicyAllows(arn string, actions, resources []string) (res bool, err error)

PolicyAllows returns true if the defined actions are allowed on the provided resources. Please note that the check will be performed on the default policy version.

func (IAMSpec) RoleHasPolicy

func (i IAMSpec) RoleHasPolicy(role, policyARN string) (res bool, err error)

RoleHasPolicy checks that the provided policy ARN is attached to the specified IAM role

func (IAMSpec) UserHasPolicy

func (i IAMSpec) UserHasPolicy(user, policyARN string) (res bool, err error)

UserHasPolicy checks that the provided policy ARN is attached to the specified IAM user

type OptSlice

type OptSlice []string

OptSlice is an entity that could be either a JSON string or a slice As per https://stackoverflow.com/a/38757780/543423

func (OptSlice) Contains

func (o OptSlice) Contains(items []string) (res bool)

Contains checks whether OptSlice contains the provided items slice

func (*OptSlice) MarshalJSON

func (o *OptSlice) MarshalJSON() ([]byte, error)

MarshalJSON returns o as the JSON encoding of o

func (*OptSlice) UnmarshalJSON

func (o *OptSlice) UnmarshalJSON(data []byte) error

UnmarshalJSON sets *o to a copy of data

type PolicyDocument

type PolicyDocument struct {
	Version   string
	ID        string
	Statement []Statement
}

PolicyDocument represents an IAM policy document

type Statement

type Statement struct {
	// TODO:
	// - Handle Principal, NotPrincipal, and Condition
	SID          string
	Principal    interface{}
	NotPrincipal interface{}
	Effect       string
	Action       *OptSlice
	NotAction    *OptSlice
	Resource     *OptSlice
	NotResource  *OptSlice
	Condition    map[ConditionType]map[ConditionVariable]OptSlice `json:",omitempty"`
}

Statement represents an IAM statement