aws

Documentation

Overview

Package aws implements the read-only AWS cloud posture connector.

Index

• func LeastPrivilegeActions() []string
• type Connector
  • func New(vault ports.CredentialVault, opts Options) (*Connector, error)
  • func (c *Connector) Enumerate(ctx context.Context, scope ports.CloudScope) (cloudposture.Inventory, []cloudposture.CoverageIssue, error)
  • func (c *Connector) Evaluate(_ context.Context, inventory cloudposture.Inventory) ([]cloudposture.PostureFinding, error)
• type Options

Functions

func LeastPrivilegeActions

func LeastPrivilegeActions() []string

LeastPrivilegeActions returns a copy of the read-only AWS permission manifest.

Types

type Connector

type Connector struct {
	// contains filtered or unexported fields
}

Connector obtains credential material only from the credential vault.

func New

func New(vault ports.CredentialVault, opts Options) (*Connector, error)

New creates a read-only AWS connector. Credentials are resolved when a scope runs.

func (*Connector) Enumerate

func (c *Connector) Enumerate(ctx context.Context, scope ports.CloudScope) (cloudposture.Inventory, []cloudposture.CoverageIssue, error)

Enumerate records every observed resource and never treats incomplete account coverage as clean.

func (*Connector) Evaluate

func (c *Connector) Evaluate(_ context.Context, inventory cloudposture.Inventory) ([]cloudposture.PostureFinding, error)

Evaluate delegates all SDK-neutral posture evaluation to the domain.

type Options

type Options struct {
	Region                  string
	Endpoint                string
	HTTPClient              *http.Client
	MaxAccounts             int
	MaxResourcesPerCategory int
	RequestsPerSecond       int
}

Options bounds provider calls and permits an emulator endpoint in tests.