Enum InternalCaller 

pub enum InternalCaller {
    Service {
        service: String,
        source_arn: String,
        source_account: String,
    },
    ServiceOwned {
        arn: String,
        canonical_user_id: Option<String>,
        acting_account: String,
    },
}

The AWS-owned principal a request is made as when fakecloud itself issues it on a customer’s behalf through its own front door – CloudFront fetching from an S3 origin through an origin access control, for example.

It travels as an http::Request extension set by in-process code and is never parsed from the wire, so a client cannot claim it. Dispatch honors it only on a request that carries no credentials of its own, and authorizes it against the resource policy alone (see IamPolicyEvaluator::evaluate_resource_policy_only): neither kind of principal belongs to an account with identity policies.

Variants

Service

An AWS service principal (cloudfront.amazonaws.com) acting for one of its resources. source_arn / source_account are that resource and its owner – the aws:SourceArn / aws:SourceAccount values a confused-deputy condition compares against.

Fields

service: String

source_arn: String

source_account: String

ServiceOwned

An IAM identity an AWS service owns outside every customer account, such as a CloudFront origin access identity (arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity <id>). A resource policy names it by arn or, in S3, by its canonical_user_id. acting_account is the customer account whose resource made the request.

Fields

arn: String

canonical_user_id: Option<String>

acting_account: String

Implementations

impl InternalCaller

pub fn principal(&self) -> Principal

The principal the request is evaluated as. Neither kind carries an account id: a service principal belongs to no account and a service-owned identity to AWS’s, so an account-root grant (arn:aws:iam::<acct>:root) never matches either, as in AWS. A service-owned identity’s canonical user id is its user_id.

pub fn acting_account(&self) -> &str

The customer account the request is made for: the owner of the resource on whose behalf the service acts.

pub fn condition_keys(&self) -> BTreeMap<String, Vec<String>>

The request-context keys this caller contributes: for a service principal aws:SourceArn, aws:SourceAccount, aws:PrincipalServiceName and aws:PrincipalIsAWSService; for a service-owned identity nothing beyond its principal ARN (set on the typed context by dispatch).

Trait Implementations

impl Clone for InternalCaller

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for InternalCaller

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for InternalCaller

impl PartialEq for InternalCaller

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for InternalCaller