tryaudex-core

Core library for Audex — scoped, short-lived cloud credentials for AI coding agents.

What it provides

• Policy engine — Parse IAM actions (s3:GetObject,lambda:Update*) into inline session policies with deny list enforcement and wildcard matching
• Credential issuance — AWS STS AssumeRole, GCP service account impersonation, Azure CLI credentials, and HashiCorp Vault backend
• Session management — Create, persist, list, and kill credential sessions with full lifecycle tracking
• Audit logging — Append-only JSONL audit trail with HMAC chain integrity verification and secrets redaction
• Multi-cloud support — Unified policy syntax (storage:read) that maps to provider-specific actions across AWS, GCP, and Azure
• Smart features — TTL estimation from commands, credential caching, auto-suggest on AccessDenied, policy learning from CloudTrail

Usage

use tryaudex_core::policy::Policy;
use tryaudex_core::session::SessionStore;
use tryaudex_core::credentials::CredentialIssuer;

// Parse a policy
let policy = Policy::from_allow_str("s3:GetObject,s3:ListBucket")?;

// Issue scoped credentials
let issuer = CredentialIssuer::new(role_arn);
let creds = issuer.issue(&policy, ttl).await?;

// Manage sessions
let store = SessionStore::new()?;
let sessions = store.list()?;

Feature overview

License

MIT — see LICENSE