aws_iam/model/
mod.rs

1/*!
2Provides a Serde-enabled model for AWS Identity and Access Management (IAM) policies.
3
4This implementation only provides a convenient API to construct and consume IAM
5policy resources using [Serde](https://serde.rs/) to serialize and deserialize into
6the AWS-defined JSON representation.
7
8# Policy Grammar
9
10The following is taken from the latest AWS [IAM User
11Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_grammar.html).
12Note that this is a logical grammar, the serialization in JSON has some specifics
13documented in the notes below.
14
15```plain,ignore
16policy  = {
17     <version_block?>
18     <id_block?>
19     <statement_block>
20}
21
22<version_block> = "Version" : ("2008-10-17" | "2012-10-17")
23
24<id_block> = "Id" : <policy_id_string>
25
26<statement_block> = "Statement" : [ <statement>, <statement>, ... ]
27
28<statement> = {
29    <sid_block?>,
30    <principal_block?>,
31    <effect_block>,
32    <action_block>,
33    <resource_block>,
34    <condition_block?>
35}
36
37<sid_block> = "Sid" : <sid_string>
38
39<effect_block> = "Effect" : ("Allow" | "Deny")
40
41<principal_block> = ("Principal" | "NotPrincipal") : ("*" | <principal_map>)
42
43<principal_map> = { <principal_map_entry>, <principal_map_entry>, ... }
44
45<principal_map_entry> = ("AWS" | "Federated" | "Service" | "CanonicalUser") :
46    [<principal_id_string>, <principal_id_string>, ...]
47
48<action_block> = ("Action" | "NotAction") :
49    ("*" | [<action_string>, <action_string>, ...])
50
51<resource_block> = ("Resource" | "NotResource") :
52    ("*" | [<resource_string>, <resource_string>, ...])
53
54<condition_block> = "Condition" : { <condition_map> }
55<condition_map> = {
56  <condition_type_string> : { <condition_key_string> : <condition_value_list> },
57  <condition_type_string> : { <condition_key_string> : <condition_value_list> }, ...
58}
59<condition_value_list> = [<condition_value>, <condition_value>, ...]
60<condition_value> = ("string" | "number" | "Boolean")
61```
62
63## Grammar Notes
64
651. For those blocks that appear to take a list of strings, i.e. `principal_map_entry`
66   contains a list of `principal_id_string`, `action_block`, `resource_block`, and
67   `condition_value_list` these may be serialized as a JSON array of values, or as simply
68   a single string if there is only one value. This is implemented by using enums
69   that construct a `One` variant or `All`/`AnyOf` variant.
701. For thse blocks which accept a wild card, `principal_block`, `action_block`, and
71   `resource_block` the `Qualified` enum has an `Any` variant.
721. The grammar for `condition_map` appears to suggest that there is only one value
73   for `condition_key_string`, this is not the case, the right-hand side of the
74   `condition_map` is itself a map.
751. The constraint that _The `id_block` is allowed in resource-based policies, but
76   not in identity-based policies.` is ignored in this implementation.
771. The constraint that _For IAM policies, basic alphanumeric characters (A-Z,a-z,0-9)
78   are the only allowed characters in the `Sid` value. Other AWS services that support
79   resource policies may have other requirements for the `Sid` value._ is ignored in
80   this implementation.
811. The value of `principal_id_string` **must** be an [Amazon Resource
82   Name (ARN)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns),
83   and the value of `resource_string` is **most likely** an ARN. This is not validated
84   in this implementation.
851. While most values for `condition_type_string` defined in [IAM JSON Policy Elements:
86   Condition Operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html)
87   are provided, the prefixes `ForAllValues` and `ForAnyValue` are not supported.
881. The value of `condition_key_string` is in effect an open-set enumeration, and
89   while some values are described within [AWS Global Condition Context
90   Keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html)
91   these are not validated in this implementation.
92
93# Example
94
95The example below implements a simple policy described in the IAM User Guide
96[Access Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json)
97section.
98
99```
100use aws_iam::model::*;
101
102let policy = Policy {
103    version: Some(Version::V2012),
104    id: Some("test_simple_access_policy".to_string()),
105    statement: OneOrAll::One(Statement {
106        sid: None,
107        principal: None,
108        effect: Effect::Allow,
109        action: Action::Action(OneOrAny::One("s3:ListBucket".parse().unwrap())),
110        resource: Resource::this("arn:aws:s3:::example_bucket".to_string()),
111        condition: None,
112    }),
113};
114let json = serde_json::to_string(&policy);
115assert!(json.is_ok());
116println!("JSON: {:#?}", json);
117```
118
119Alternatively using the `builder` module we can accomplish the same result with the following.
120
121```
122use aws_iam::model::*;
123use aws_iam::model::builder::*;
124
125let policy: Policy = PolicyBuilder::new()
126    .named("test_simple_access_policy")
127    .evaluate_statement(
128        StatementBuilder::new()
129            .allows()
130            .may_perform_action("s3:ListBucket")
131            .on_resource("arn:aws:s3:::example_bucket")
132    )
133    .into();
134let json = serde_json::to_string(&policy);
135assert!(json.is_ok());
136println!("JSON: {:#?}", json);
137```
138
139*/
140
141// ------------------------------------------------------------------------------------------------
142// Modules
143// ------------------------------------------------------------------------------------------------
144
145pub mod builder;
146
147pub mod containers;
148pub use containers::{OneOrAll, OneOrAny};
149
150pub mod impls;
151pub use impls::*;
152
153pub mod qstring;
154pub use qstring::QString;
155
156pub mod types;
157pub use types::*;
aws_iam/model/mod.rs

aws_iam/model/
mod.rs
