Module cloud_provider 

The cloud-provider IP table and block selectors.

This is the Rust family’s port of the reference engine’s cloud-provider blocking data path (guard_core/handlers/cloud_handler.py plus the selector registry in guard_core/handlers/_cloud_provider_registry.py and the config validation in guard_core/models.py). It carries three pieces:

• parse_cloud_selectors: the block_cloud_providers syntax. A bare name ("GCP") blocks the whole provider; a ":!region" suffix ("GCP:!us-central1") blocks the provider except that region. An unrecognized provider name is a config error, exactly the reference _validate_block_cloud_providers_value ValueError.
• CloudIpTable: the provider ranges the block check consults. The reference keeps a module-singleton handler fed by background fetchers (with Redis caching and a refresh interval); those are I/O concerns this engine does not own, so the table is an in-memory store the adapter feeds (set_provider_ranges), shareable across clones.
• CloudIpTable::is_cloud_ip: the reference is_cloud_ip walk - for every selected provider that has ranges loaded, an address inside one of its networks is blocked unless the network’s region is carved out.

Details that mirror the reference exactly

• Region carve-outs only exempt networks whose region is known (the reference network_regions.get(str(network)) in allowed_regions): a provider that publishes no region data (Azure, DigitalOcean, Linode, Vultr) blocks its whole provider even under a carve-out.
• Providers with no ranges loaded are skipped, not blocked (the reference if provider not in self.ip_ranges: continue), and an empty range set for a loaded provider blocks nothing (the reference only logs a warning).
• Family-strict matching: an IPv4 network never contains an IPv6 address and vice versa, like ipaddress membership.

Example

use guard_core_engine::cloud_provider::{parse_cloud_selectors, CloudIpTable};
use std::net::IpAddr;
use std::str::FromStr;

// Block GCP except one region, and all of AWS.
let selectors = parse_cloud_selectors(["GCP:!us-central1", "AWS"]).expect("valid selectors");
let table = CloudIpTable::default();
table
    .set_provider_ranges(
        "AWS",
        vec![("203.0.113.0/24".to_owned(), None)],
    )
    .expect("valid ranges");
table
    .set_provider_ranges(
        "GCP",
        vec![
            ("198.51.100.0/24".to_owned(), Some("us-central1".to_owned())),
            ("198.51.101.0/24".to_owned(), Some("europe-west1".to_owned())),
        ],
    )
    .expect("valid ranges");

// An AWS address is blocked ...
assert!(table.is_cloud_ip(IpAddr::from_str("203.0.113.9").unwrap(), &selectors));
// ... a GCP address in the carved-out region is not ...
assert!(!table.is_cloud_ip(IpAddr::from_str("198.51.100.9").unwrap(), &selectors));
// ... a GCP address elsewhere is ...
assert!(table.is_cloud_ip(IpAddr::from_str("198.51.101.9").unwrap(), &selectors));
// ... and a datacenter address belonging to nobody passes.
assert!(!table.is_cloud_ip(IpAddr::from_str("192.0.2.1").unwrap(), &selectors));

Structs

CloudConfigError

An invalid block_cloud_providers entry: the config error parse_cloud_selectors fails closed with.

CloudIpTable

The provider ranges the block check consults.

CloudRangeError

An invalid range entry: the error CloudIpTable::set_provider_ranges fails with.

CloudSelectors

The parsed block_cloud_providers selectors: the blocked provider names in first-seen order, each optionally carrying carved-out regions.

ProviderStatus

One cloud provider’s row of the status payload (the reference cloud_handler.get_status shape).

Constants

CARVE_OUT_SEPARATOR

The selector separator carving a region exception out of a block (":!" in the reference _parse_cloud_selectors).

VALID_CLOUD_PROVIDERS

The providers the reference publishes range data for (VALID_CLOUD_PROVIDERS / _ALL_PROVIDERS).

Functions

parse_cloud_selectors

Parse the block_cloud_providers selectors, failing closed on an unknown provider name.