aws_iam/
lib.rs

1/*!
2This crate provides a Rust typed model for creating and reading AWS IAM Policy documents.
3Whreever possible this crate uses documentation directly from the AWS IAM User Guide.
4
5From [AWS Identity and Access Management Documentation](https://docs.aws.amazon.com/iam/index.html):
6
7> The access management portion of AWS Identity and Access Management (IAM) helps you define
8> what a principal entity is allowed to do in an account. A principal entity is a person or
9> application that is authenticated using an IAM entity (user or role). Access management is often
10> referred to as authorization. You manage access in AWS by creating policies and attaching them
11> to IAM identities (users, groups of users, or roles) or AWS resources. A policy is an object in
12> AWS that, when associated with an identity or resource, defines their permissions. AWS evaluates
13> these policies when a principal uses an IAM entity (user or role) to make a request. Permissions
14> in the policies determine whether the request is allowed or denied. Most policies are stored in
15> AWS as JSON documents.
16
17# Overview
18
19This crate provides a set of types that can be used to serialize and deserialize IAM Policy
20documents. For a simpler experience creating documents a [`builder`](model/builder/index.html)
21module provides a more _fluent_ method for construction. The [`io`](io/index.html) module
22provides basic support for reading and writing JSON files.
23
24# Usage
25
26The example JSON below is taken from [Overview of JSON
27Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json).
28
29```json
30{
31  "Version": "2012-10-17",
32  "Statement": [
33    ...
34    {
35      "Sid": "ThirdStatement",
36      "Effect": "Allow",
37      "Action": [
38        "s3:List*",
39        "s3:Get*"
40      ],
41      "Resource": [
42        "arn:aws:s3:::confidential-data",
43        "arn:aws:s3:::confidential-data/ *"
44      ],
45      "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}
46    }
47  ]
48}
49```
50
51This can be constructed with the following code.
52
53```rust
54use std::collections::HashMap;
55use aws_iam::model::*;
56use aws_iam::model::builder::*;
57use std::str::FromStr;
58
59let condition = ConditionBuilder::new(GlobalConditionOperator::Bool)
60    .right_hand_str("aws:MultiFactorAuthPresent", "true")
61    .build_as_condition();
62let policy = Policy {
63    version: Some(Version::V2012),
64    id: Some("test_access_policy_with_condition".to_string()),
65    statement: OneOrAll::All(vec![Statement {
66        sid: Some("ThirdStatement".to_string()),
67        principal: None,
68        effect: Effect::Allow,
69        action: Action::these(&mut vec![
70            "s3:List*".parse().unwrap(),
71            "s3:Get*".parse().unwrap(),
72        ]),
73        resource: Resource::these(&mut vec![
74            "arn:aws:s3:::confidential-data".to_string(),
75            "arn:aws:s3:::confidential-data/-*".to_string(),
76        ]),
77        condition: Some(condition),
78    }]),
79};
80println!("{}", policy.to_string());
81```
82
83# Features
84
85The following features are supported by this crate and can be included as needed. By default the
86crate only provides an in-memory data model with Serde support for reading and writing to the
87standard JSON representation.
88
89* `command_line` - provides a command line tool, `policy` that can verify and evaluate existing
90  policy documents and create new ones from a set of templates.
91* `document` - produces formatted documentation for a policy. This can be in the form of Markdown
92  or LaTeX and would usually be used to document a policy template for others to follow.
93* `offline_eval` - provides a simple, by which we mean incomplete, evaluation of a policy  using
94  a request object to match. This is useful but not sufficient for testing policies.
95* `service_config` - adds to the verification of policies by storing service-specific configuration
96  on actions, resource formats, and condition keys.
97
98The `default` feature includes none of the above. This documentation was built with the following
99features enabled.
100
101*/
102#![cfg_attr(feature = "default", doc = "* default")]
103#![cfg_attr(feature = "command_line", doc = "* command line tool")]
104#![cfg_attr(feature = "document", doc = "* documentation formatters")]
105#![cfg_attr(feature = "offline_eval", doc = "* offline evaluation")]
106#![cfg_attr(feature = "service_config", doc = "* service-specific configuration")]
107// ------------------------------------------------------------------------------------------------
108// Preamble
109// ------------------------------------------------------------------------------------------------
110#![warn(
111    missing_debug_implementations,
112    missing_docs,
113    unused_extern_crates,
114    rust_2018_idioms
115)]
116
117#[macro_use]
118extern crate lazy_static;
119
120// ------------------------------------------------------------------------------------------------
121// Modules
122// ------------------------------------------------------------------------------------------------
123
124pub mod constants;
125
126pub mod io;
127
128pub mod model;
129
130#[cfg(feature = "document")]
131pub mod document;
132
133#[cfg(feature = "offline_eval")]
134pub mod offline;
135
136#[cfg(feature = "service_config")]
137pub mod service;
aws_iam/lib.rs

aws_iam/
lib.rs
