Struct ConditionContext 

pub struct ConditionContext {

    pub aws_username: Option<String>,
    pub aws_userid: Option<String>,
    pub aws_principal_arn: Option<String>,
    pub aws_principal_account: Option<String>,
    pub aws_principal_type: Option<String>,
    pub aws_source_ip: Option<IpAddr>,
    pub aws_current_time: Option<DateTime<Utc>>,
    pub aws_epoch_time: Option<i64>,
    pub aws_secure_transport: Option<bool>,
    pub aws_requested_region: Option<String>,
    pub service_keys: BTreeMap<String, Vec<String>>,
    pub resource_tags: Option<HashMap<String, String>>,
    pub request_tags: Option<HashMap<String, String>>,
    pub principal_tags: Option<HashMap<String, String>>,
}

Request-time values consulted when a policy statement carries a Condition block. Populated at dispatch time from the resolved Principal and the incoming HTTP request, then handed to IamPolicyEvaluator::evaluate.

Lives in fakecloud-core (not fakecloud-iam) so the trait can reference it without creating a circular crate dependency. All fields are optional — a missing field means the key wasn’t knowable at dispatch time, and any operator that references it safe-fails to false (unless the operator carries the IfExists suffix, in which case it evaluates to true, matching AWS).

The service_keys map is reserved for service-specific condition keys (s3:prefix, sqs:MessageAttribute, …) which Phase 2 ships empty; service-specific support lands in a follow-up batch without a signature change.

Fields

aws_username: Option<String>

aws:username — username segment of an IAM user ARN, or None for assumed roles / federated users where AWS does not set the key.

aws_userid: Option<String>

aws:userid — the unique AIDA.../AROA... identifier.

aws_principal_arn: Option<String>

aws:PrincipalArn — full principal ARN.

aws_principal_account: Option<String>

aws:PrincipalAccount — 12-digit account ID sourced from the credential, not global config (#381 multi-account alignment).

aws_principal_type: Option<String>

aws:PrincipalType — "User", "AssumedRole", etc.

aws_source_ip: Option<IpAddr>

aws:SourceIp — remote address of the HTTP connection.

aws_current_time: Option<DateTime<Utc>>

aws:CurrentTime — evaluation timestamp (UTC).

aws_epoch_time: Option<i64>

aws:EpochTime — same moment as aws_current_time in seconds since the Unix epoch.

aws_secure_transport: Option<bool>

aws:SecureTransport — true iff the request came in over TLS.

aws_requested_region: Option<String>

aws:RequestedRegion — region extracted from SigV4 / config.

service_keys: BTreeMap<String, Vec<String>>

Service-specific keys (s3:prefix, sqs:MessageAttribute, …).

resource_tags: Option<HashMap<String, String>>

aws:ResourceTag/<key> — tags on the target resource. Populated by crate::service::AwsService::resource_tags_for. None means the service doesn’t expose resource tags for ABAC.

request_tags: Option<HashMap<String, String>>

aws:RequestTag/<key> — tags sent in the request body/headers. Populated by crate::service::AwsService::request_tags_from. Also drives aws:TagKeys (the list of request tag keys).

principal_tags: Option<HashMap<String, String>>

aws:PrincipalTag/<key> — tags on the calling IAM user or role. Populated from Principal::tags at dispatch time.

Implementations

impl ConditionContext

pub fn lookup(&self, key: &str) -> Option<Vec<String>>

Resolve a condition key (e.g. "aws:username") to the list of context values. Returns None if the key is not populated. Key names are matched case-insensitively — AWS treats aws:username and AWS:UserName as the same key.

Trait Implementations

impl Clone for ConditionContext

fn clone(&self) -> ConditionContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ConditionContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ConditionContext

fn default() -> ConditionContext

Returns the “default value” for a type.