Enum GrantAuthorization 

pub enum GrantAuthorization {
    Grantee,
    GranteeRole,
    Account,
}

How a grant matched the caller (see ResourcePolicyProvider::grant_authorization).

Variants

Grantee

The grant names the calling identity itself (its user or session ARN): it authorizes the request without an IAM policy, in the key’s account or another, within the caller’s SCP ceiling.

GranteeRole

The grant names the role an assumed-role session assumed. As for Self::Grantee, but the session’s session policies also cap it: they limit what is granted to the role.

Account

The grant names the caller’s account (its root). Like a key policy statement naming an account, that only lets the account delegate: the caller’s own IAM policies must also allow the action.

Implementations

impl GrantAuthorization

pub fn strongest(a: Option<Self>, b: Option<Self>) -> Option<Self>

The stronger of two matches.

Trait Implementations

impl Clone for GrantAuthorization

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for GrantAuthorization

impl Debug for GrantAuthorization

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for GrantAuthorization

impl PartialEq for GrantAuthorization

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for GrantAuthorization