Struct ShieldService 

pub struct ShieldService { /* private fields */ }

Implementations

impl ShieldService

pub fn new(state: SharedShieldState) -> Self

pub fn with_snapshot_store(self, store: Arc<dyn SnapshotStore>) -> Self

pub fn snapshot_hook(&self) -> Option<SnapshotHook>

Persist hook for the CloudFormation provisioner; None in memory mode.

Trait Implementations

impl AwsService for ShieldService

fn service_name(&self) -> &str

The AWS service identifier (e.g., “sqs”, “sns”, “sts”, “events”, “ssm”).

fn handle<'life0, 'async_trait>( &'life0 self, req: AwsRequest, ) -> Pin<Box<dyn Future<Output = Result<AwsResponse, AwsServiceError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Handle an incoming request.

fn supported_actions(&self) -> &[&str]

List of actions this service supports (for introspection).

fn claim_unrouted_request( &self, _method: &Method, _raw_path: &str, _headers: &HeaderMap, _account_id: &str, ) -> Option<DataPlaneClaim>

Whether this service’s data plane owns a request that no protocol signal – target header, Action, signing scope or AWS endpoint host – routed, and on what grounds. raw_path is the undecoded wire path and account_id the account an anonymous request runs in.

fn iam_enforceable(&self) -> bool

Whether this service participates in opt-in IAM enforcement (FAKECLOUD_IAM=soft|strict).

fn iam_authorization_required(&self, _request: &AwsRequest) -> bool

Whether request needs authorization at all. A few requests need no permission and no policy can deny them; dispatch then evaluates no policy for the request. The service decides for every caller: sts:GetCallerIdentity needs none from a caller whose credentials resolved but still refuses an anonymous one (so it answers true for that), while an S3 CORS preflight is never authorized, whoever sends it. Defaults to true.

fn iam_action_for(&self, _request: &AwsRequest) -> Option<IamAction>

Derive the IAM action + resource ARN for an incoming request.

fn iam_actions_for(&self, request: &AwsRequest) -> Vec<IamAction>

Every IAM authorization an incoming request needs.

fn streams_request_body(&self, _head: &RequestHead<'_>) -> bool

Whether the handler reads this request’s body as a stream (AwsRequest::take_body_stream) instead of from a buffered AwsRequest::body. Dispatch asks only for a request its headers already route to this service, and buffers the body otherwise, so everything that runs before the handler (IAM enforcement reading the request’s tags, for one) sees it. The service decides by the same classification its handler routes on. Default false.

fn refuse_before_body( &self, _head: &RequestHead<'_>, ) -> Result<(), AwsServiceError>

Refuse a request from its head alone, before dispatch reads its body: what AwsService::validate_before_authorization refuses without needing the body (S3: conflicting resource-type parameters, a method a resource type does not take, a missing upload, a missing bucket for an anonymous caller), so a request refused for its URL is never buffered (up to the request-size cap) first. Dispatch calls it for a request its headers alone settle as this service’s (crate::protocol::headers_name_final_service), IAM enforcement on or off, and answers Err as the service’s error. The later validation must refuse the same requests the same way.

fn prepare_request( &self, _request: &mut AwsRequest, ) -> Result<(), AwsServiceError>

Put a buffered request into the form every later consumer reads – pre-authorization validation, IAM derivation and the handler alike – so none of them works on a different body than the others (S3 removes the aws-chunked framing of a small XML body here). Dispatch calls it first, IAM enforcement on or off, and answers Err as the service’s error. It must be idempotent: a handler called directly may run it again. Default: nothing to do.

fn validates_anonymous_before_authorization(&self) -> bool

Whether an anonymous (unsigned) request is validated (AwsService::validate_before_authorization) before it is authorized, rather than refused as anonymous first. Only a service that serves anonymous requests itself and judges them like any other opts in (S3: a missing bucket is NoSuchBucket, an unclassifiable request its 400, whoever asks). Every other service refuses an unsigned request before looking at it (recorded: an unsigned STS AssumeRoot with an invalid TaskPolicyArn is refused for its missing credentials, not validated). Default false.

fn is_control_plane_request(&self, _request: &AwsRequest) -> bool

Whether a REST request addressed to this service’s API host is one of its modeled control-plane operations, rather than a data-plane request the service also serves there (an API Gateway invocation). Only a control-plane request is refused for missing credentials (AwsService::anonymous_access). Defaults to true.

fn anonymous_access(&self, request: &AwsRequest) -> AnonymousAccess

What this service does with an unsigned request to the operation request names, under --iam soft|strict (with enforcement off every unsigned request is served). Dispatch asks for a request that carries no credential at all and names an API operation: an awsJson target, a Query Action, or a REST request addressed to this service’s API host. AnonymousAccess::Refused answers it with the service’s missing-credentials error before validation, authorization or the handler (strict; soft logs it); AnonymousAccess::Authorized authorizes the anonymous principal against the resource’s policy; AnonymousAccess::Unauthenticated serves it without authorization. Defaults to the Smithy model’s verdict (AnonymousAccess::for_operation): unauthenticated for an operation marked optionalAuth or auth: [], refused otherwise.

fn validate_before_authorization( &self, _request: &AwsRequest, ) -> Result<(), AwsServiceError>

Validation AWS performs before authorizing request: an error here is returned to the caller whatever its permissions, anonymous callers included where the service validates them first (AwsService::validates_anonymous_before_authorization) – a request the service cannot classify into an operation (S3 answers conflicting sub-resource parameters with 400 InvalidArgument whoever asks), or one carrying an invalid parameter AWS checks first (STS AssumeRoot’s TaskPolicyArn). Dispatch calls it for every request, once: after authentication (a key that resolves to no identity is refused before it) and before authorization under IAM enforcement, just before the handler otherwise. Err is answered as the service’s error, so such a request gets it rather than an AccessDenied and is never authorized as some other operation. Default: nothing to refuse.

fn iam_authorized_by_handler(&self, _request: &AwsRequest) -> bool

Whether the handler authorizes this request itself, item by item, through crate::auth::request_authorizer – an operation AWS authorizes per item and answers with per-item errors (S3 DeleteObjects reports a denied key as an AccessDenied entry of a 200 response). Dispatch then evaluates no action for the request (the caller’s credentials are still checked). Default false.

fn iam_resource_in_caller_account(&self, _request: &AwsRequest) -> bool

Whether the request creates its resource in the CALLER’s account, so that whatever currently holds the resource’s name elsewhere has no say in authorizing it. S3’s CreateBucket is the case: bucket names are global, and creating a name another account owns is authorized against the caller’s own policies (then answered BucketAlreadyExists), never against the other account’s bucket policy. Dispatch then evaluates the request as same-account with no resource policy. Default false.

fn iam_condition_keys_for( &self, _request: &AwsRequest, _action: &IamAction, ) -> BTreeMap<String, Vec<String>>

Derive service-specific IAM condition keys for an incoming request.

fn resource_tags_for( &self, _resource_arn: &str, ) -> Option<HashMap<String, String>>

Return the tags on the resource identified by resource_arn.

fn request_tags_from( &self, _request: &AwsRequest, _action: &str, ) -> Option<HashMap<String, String>>

Extract tags being sent in the request (e.g. on CreateQueue, PutObject with x-amz-tagging, TagResource).