Struct ServiceAccount 

pub struct ServiceAccount {
    pub id: String,
    pub stack_permission_sets: Vec<PermissionSet>,
    pub resource_permission_sets: IndexMap<String, Vec<PermissionSet>>,
}

Represents a non-human identity that can be assumed by compute services such as Lambda, Cloud Run, ECS, Container Apps, etc.

Maps to:

• AWS: IAM Role
• GCP: Service Account
• Azure: User-assigned Managed Identity

The ServiceAccount is automatically created from permission profiles in the stack and contains the resolved permission sets for both stack-level and resource-scoped access.

Fields

id: String

Identifier for the service account. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.

stack_permission_sets: Vec<PermissionSet>

Stack-level permission sets that apply to all resources in the stack. These are derived from the “*” scope in the permission profile. Resource-scoped permissions are handled by individual resource controllers.

resource_permission_sets: IndexMap<String, Vec<PermissionSet>>

Resolved grants for concrete resource IDs, captured for setup comparison.

Implementations

impl ServiceAccount

pub fn new(id: String) -> ServiceAccountBuilder

Create an instance of ServiceAccount using the builder syntax

impl ServiceAccount

pub const RESOURCE_TYPE: ResourceType

The resource type identifier for ServiceAccount

pub fn id(&self) -> &str

Returns the service account’s unique identifier.

pub fn from_permission_profile( id: String, profile: &PermissionProfile, permission_set_resolver: impl Fn(&str) -> Option<PermissionSet>, ) -> Result<Self>

Creates a ServiceAccount from a permission profile by resolving permission set references. This is used by the stack processor to convert profiles into concrete ServiceAccount resources.

pub fn concrete_permission_sets( &self, legacy_profile: Option<&PermissionProfile>, resolver: impl Fn(&str) -> Option<PermissionSet>, ) -> Result<Cow<'_, IndexMap<String, Vec<PermissionSet>>>>

Uses captured grants; legacy templates may supply their existing explicit profile. This compatibility path does not create a profile or add default grants.

impl ServiceAccount

pub fn impersonation_target(stack: &Stack, scope: &str) -> Option<String>

The service account a resource-scoped impersonation grant targets. A grant names either the account itself or the profile it was created from ({profile} → {profile}-sa).

pub fn impersonators(&self, stack: &Stack) -> BTreeSet<String>

Ids of the other service accounts in stack that may impersonate this one.

Reads the permission profiles and each account’s captured grants: a frozen account keeps its grants after the profile that produced them is gone, and the caller policy is written from those grants, so its trust has to be too.

Trait Implementations

impl Clone for ServiceAccount

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServiceAccount

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ServiceAccount

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ServiceAccount

impl PartialEq for ServiceAccount

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl ResourceDefinition for ServiceAccount

fn get_resource_type(&self) -> ResourceType

Returns the resource type for this instance

fn id(&self) -> &str

Returns the unique identifier for this specific resource instance

fn get_dependencies(&self) -> Vec<ResourceRef>

Returns the list of other resources this resource depends on

fn validate_update(&self, new_config: &dyn ResourceDefinition) -> Result<()>

Validates if an update from the current configuration to a new configuration is allowed

fn as_any(&self) -> &dyn Any

Provides access to the underlying concrete type for downcasting

fn as_any_mut(&mut self) -> &mut dyn Any

Provides mutable access to the underlying concrete type for downcasting

fn box_clone(&self) -> Box<dyn ResourceDefinition>

Creates a boxed clone of this resource definition

fn resource_eq(&self, other: &dyn ResourceDefinition) -> bool

For equality comparison between resource definitions

fn to_json_value(&self) -> Result<Value>

Serialize this resource to a JSON value (without the “type” tag - that’s added by Resource)

fn get_permissions(&self) -> Option<&str>

Returns the permission profile name for this resource, if it has one.

fn replace_after_failed_create_is_safe(&self) -> bool

Whether the executor may delete this resource and create it again when its create failed and its config changed since.

impl Serialize for ServiceAccount

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ServiceAccount