Module auth 

Authentication and authorization primitives shared across services.

This module defines the opt-in modes for SigV4 signature verification and IAM policy enforcement, plus the reserved “root bypass” identity that short-circuits both checks when enabled.

Neither feature is enforced at this layer — the types are plumbed through crate::dispatch::DispatchConfig and consulted later by dispatch and service handlers once the corresponding batches land. See /docs/reference/security (added in a later batch) for the user-facing contract.

Structs

IamAction

One IAM action that the dispatch layer should evaluate against the caller’s effective policy set.

ParseIamModeError

Parse error for IamMode from string.

Principal

Identity of the caller making a request, once its credentials have been resolved. Attached to crate::service::AwsRequest::principal so handlers can make identity-based decisions without re-parsing the Authorization header.

ResolvedCredential

Credentials resolved from an access key ID.

Enums

IamDecision

Result of evaluating a request against an identity’s effective policy set. Abstract over the concrete evaluator [Decision] in fakecloud-iam::evaluator so fakecloud-core can consume it without depending on fakecloud-iam.

IamMode

How IAM identity policies are evaluated for incoming requests.

PrincipalType

Kind of principal a set of credentials resolves to.

Traits

CredentialResolver

Abstraction over “given an access key ID, return the secret and resolved principal.” Implemented by the IAM crate against IamState; the core crate depends only on the trait so there’s no circular dependency.

IamPolicyEvaluator

Abstraction over “given a principal and an action, say Allow / Deny”. Implemented by fakecloud-iam against IamState + the Phase 1 evaluator. Dispatch calls this for every request when FAKECLOUD_IAM != off and the target service opts into enforcement.

Functions

is_root_bypass

Reserved root-identity convention.