Enum KmsCaller 

pub enum KmsCaller<'a> {
    OnBehalfOf {
        service_principal: &'a str,
        caller_arn: Option<&'a str>,
    },
    Service {
        service_principal: &'a str,
        source_arn: &'a str,
        source_account: &'a str,
        via_service: Option<&'a str>,
    },
}

Who a cross-service KMS call is made as, which decides what the key policy sees.

AWS services use KMS in one of two ways, and key policies are written for each: most (S3 SSE-KMS, SQS, SNS, DynamoDB, Secrets Manager, SSM) call KMS on behalf of the caller of their own API, with the caller’s identity, and KMS adds kms:ViaService = <service>.<region>.amazonaws.com (the AWS-managed aws/<service> keys only allow that); a few (SES writing received mail to S3, Lambda for durable executions) call KMS as their service principal, which a key policy must name in a "Service" principal.

Variants

OnBehalfOf

The service identified by service_principal (s3.amazonaws.com) acting for a caller of its API in the request’s account.

Fields

service_principal: &'a str

caller_arn: Option<&'a str>

The ARN of the caller the service acts for (an IAM user or assumed role of the account), whom KMS names in a refusal. None when the service knows no identity (the account itself).

Service

The service principal itself (ses.us-east-1.amazonaws.com) acting for its resource source_arn owned by source_account (the aws:SourceArn / aws:SourceAccount of the request).

Fields

service_principal: &'a str

source_arn: &'a str

source_account: &'a str

via_service: Option<&'a str>

The service that makes the KMS call on the principal’s behalf, when it is not the principal’s own (SQS encrypting a message SNS delivers: sqs.amazonaws.com); it sets kms:ViaService.

Implementations

impl<'a> KmsCaller<'a>

pub fn via(service_principal: &'a str) -> Self

A service calling KMS on behalf of the account, with no known caller identity (see KmsCaller::OnBehalfOf).

pub fn via_for(service_principal: &'a str, caller_arn: Option<&'a str>) -> Self

A service calling KMS on behalf of the caller caller_arn of its API.

pub fn service_principal(&self) -> &'a str

The service principal the call is recorded under.

Trait Implementations

impl<'a> Clone for KmsCaller<'a>

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Copy for KmsCaller<'a>

impl<'a> Debug for KmsCaller<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> Eq for KmsCaller<'a>

impl<'a> PartialEq for KmsCaller<'a>

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl<'a> StructuralPartialEq for KmsCaller<'a>