Struct IAMPolicy

pub struct IAMPolicy {
    pub version: IAMVersion,
    pub id: Option<String>,
    pub statement: Vec<IAMStatement>,
}

JSON policy documents are made up of elements. The elements are listed here in the general order you use them in a policy. The order of the elements doesn’t matter—for example, the Resource element can come before the Action element. You’re not required to specify any Condition elements in the policy. To learn more about the general structure and purpose of a JSON policy document, see Overview of JSON policies.

Some JSON policy elements are mutually exclusive. This means that you cannot create a policy that uses both. For example, you cannot use both Action and NotAction in the same policy statement. Other pairs that are mutually exclusive include Principal/NotPrincipal and Resource/NotResource.

The details of what goes into a policy vary for each service, depending on what actions the service makes available, what types of resources it contains, and so on. When you’re writing policies for a specific service, it’s helpful to see examples of policies for that service.

When you create or edit a JSON policy, iam-rw can perform policy validation to help you create an effective policy.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html

Fields

version: IAMVersion

The Version policy element specifies the language syntax rules that are to be used to process a policy.

To use all of the available policy features, include the following Version element outside the Statement element in all policies. Version is a required element in all IAM policies and must always be set to at least 2012-10-17.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_version.html

id: Option<String>

The Id element specifies an optional identifier for the policy.

The ID is used differently in different services. ID is allowed in resource-based policies, but not in identity-based policies.

Recommendation is to use a UUID (GUID) for the value, or incorporate a UUID as part of the ID to ensure uniqueness.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_id.html

statement: Vec<IAMStatement>

The Statement element is the main element for a policy.

The Statement element can contain a single statement or an array of individual statements. Each individual statement block must be enclosed in curly braces { }. For multiple statements, the array must be enclosed in square brackets [ ].

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_statement.html

Implementations

impl IAMPolicy

pub fn new() -> Self

Creates a new IAM policy with the default version

Examples found in repository

examples/arn_demo.rs (line 81)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== IAM ARN Validator Demo ===\n");

    // Example 1: Parse and validate ARNs
    println!("1. Parsing and validating ARNs:");

    let valid_arns = vec![
        "arn:aws:s3:::my-bucket/folder/file.txt",
        "arn:aws:iam::123456789012:user/alice",
        "arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0",
        "arn:aws:lambda:us-east-1:123456789012:function:MyFunction",
        "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable",
        "arn:aws-eu-gov:dynamodb:us-east-1:123456789012:table/MyTable",
    ];

    for arn_str in &valid_arns {
        match Arn::parse(arn_str) {
            Ok(arn) => {
                println!("✓ Valid ARN: {}", arn);
                println!("  - Service: {}", arn.service);
                println!(
                    "  - Region: {}",
                    if arn.region.is_empty() {
                        "global"
                    } else {
                        &arn.region
                    }
                );
                println!(
                    "  - Account: {}",
                    if arn.account_id.is_empty() {
                        "none"
                    } else {
                        &arn.account_id
                    }
                );
                if let Some(resource_type) = arn.resource_type() {
                    println!("  - Resource Type: {}", resource_type);
                }
                if let Some(resource_id) = arn.resource_id() {
                    println!("  - Resource ID: {}", resource_id);
                }
                println!();
            }
            Err(e) => println!("✗ Invalid ARN {}: {}", arn_str, e),
        }
    }

    // Example 2: Wildcard matching
    println!("2. Wildcard pattern matching:");

    let resource_arn = Arn::parse("arn:aws:s3:::my-bucket/uploads/user123/document.pdf")?;
    println!("Resource ARN: {}", resource_arn);

    let patterns = vec![
        "arn:aws:s3:::my-bucket/*",
        "arn:aws:s3:::my-bucket/uploads/*",
        "arn:aws:s3:::my-bucket/uploads/user123/*",
        "arn:aws:s3:::*/uploads/user123/document.pdf",
        "arn:aws:s3:::my-bucket/uploads/*/document.pdf",
        "arn:aws:s3:::my-bucket/uploads/user???/document.pdf",
        "arn:aws:s3:::other-bucket/*",
        "arn:aws:ec2:*:*:instance/*",
    ];

    for pattern in &patterns {
        match resource_arn.matches(pattern) {
            Ok(matches) => {
                let status = if matches { "✓ MATCH" } else { "✗ NO MATCH" };
                println!("  {} Pattern: {}", status, pattern);
            }
            Err(e) => println!("  ✗ ERROR Pattern: {} ({})", pattern, e),
        }
    }

    // Example 3: Integration with IAM policies
    println!("\n3. Using ARNs in IAM policies:");

    let policy = IAMPolicy::new()
        .with_id("s3-access-policy")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Read")
                .with_action(Action::Multiple(vec![
                    "s3:GetObject".to_string(),
                    "s3:ListBucket".to_string(),
                ]))
                .with_resource(Resource::Multiple(vec![
                    "arn:aws:s3:::my-bucket".to_string(),
                    "arn:aws:s3:::my-bucket/*".to_string(),
                ])),
        )
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Write")
                .with_action(Action::Single("s3:PutObject".to_string()))
                .with_resource(Resource::Single(
                    "arn:aws:s3:::my-bucket/uploads/*".to_string(),
                )),
        );

    let policy_json = policy.to_json()?;
    println!("Generated IAM Policy:");
    println!("{}", policy_json);

    // Example 4: Validate all ARNs in the policy
    println!("\n4. Validating ARNs in policy:");

    for (i, statement) in policy.statement.iter().enumerate() {
        println!(
            "Statement {}: {}",
            i + 1,
            statement.sid.as_ref().unwrap_or(&"(no sid)".to_string())
        );

        let resources = match &statement.resource {
            Some(Resource::Single(arn)) => vec![arn.clone()],
            Some(Resource::Multiple(arns)) => arns.clone(),
            None => vec![],
        };

        for resource in resources {
            match Arn::parse(&resource) {
                Ok(arn) => {
                    let validity = if arn.is_valid() {
                        "✓ Valid"
                    } else {
                        "⚠ Invalid"
                    };
                    println!("  {} Resource: {}", validity, resource);
                }
                Err(e) => println!("  ✗ Parse Error: {} ({})", resource, e),
            }
        }
    }

    Ok(())
}

examples/validation_demo.rs (line 12)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== IAM Policy Validation Demo ===\n");

    // Example 1: Valid Policy
    println!("1. Valid Policy Validation:");
    let valid_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440000")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Read")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("arn:aws:s3:::my-bucket/*".to_string()))
                .with_condition(
                    Operator::StringEquals,
                    "aws:PrincipalTag/department".to_string(),
                    json!("engineering"),
                ),
        );

    if valid_policy.is_valid() {
        println!("✓ Policy is valid!");
    } else {
        println!("✗ Policy is invalid");
    }

    match valid_policy.validate_result() {
        Ok(()) => println!("✓ Policy passes validation"),
        Err(e) => println!("✗ Policy fails validation: {}", e),
    }

    println!();

    // Example 2: Invalid Policy - Missing Required Fields
    println!("2. Invalid Policy - Missing Required Fields:");
    let invalid_policy = IAMPolicy::new().add_statement(IAMStatement::new(Effect::Allow)); // Missing action and resource

    if !invalid_policy.is_valid() {
        println!("✗ Policy is invalid (as expected)");
        match invalid_policy.validate_result() {
            Err(e) => println!("   Validation errors: {}", e),
            Ok(()) => println!("   Unexpected: validation passed"),
        }
    }

    println!();

    // Example 3: Policy with Multiple Validation Errors
    println!("3. Policy with Multiple Validation Errors:");
    let multi_error_policy = IAMPolicy::new()
        .with_id("") // Empty ID
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_action(Action::Single("invalid-action".to_string())) // Invalid action format
                .with_resource(Resource::Single("invalid-resource".to_string())), // Invalid resource
        )
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("DuplicateId")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("*".to_string())),
        )
        .add_statement(
            IAMStatement::new(Effect::Deny)
                .with_sid("DuplicateId") // Duplicate SID
                .with_action(Action::Single("s3:DeleteObject".to_string()))
                .with_resource(Resource::Single("*".to_string())),
        );

    match multi_error_policy.validate_result() {
        Err(ValidationError::Multiple(errors)) => {
            println!("✗ Found {} validation errors:", errors.len());
            for (i, error) in errors.iter().enumerate() {
                println!("   {}. {}", i + 1, error);
            }
        }
        Err(e) => {
            println!("✗ Single validation error: {}", e);
        }
        Ok(()) => {
            println!("✓ Unexpected: validation passed");
        }
    }

    println!();

    // Example 4: Comprehensive Validation
    println!("4. Comprehensive Validation:");
    let comprehensive_policy = IAMPolicy::new()
        .with_id("short") // Short ID - will fail validation
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("*".to_string()))
                .with_condition(
                    Operator::NumericEquals,
                    "aws:RequestedRegion".to_string(),
                    json!("not-a-number"), // Numeric operator with string value - will fail
                ),
        );

    match comprehensive_policy.validate_result() {
        Ok(()) => println!("✓ Policy passes validation"),
        Err(e) => println!("✗ Policy fails validation: {}", e),
    }

    println!();

    // Example 5: Logical Policy Errors
    println!("5. Logical Policy Errors:");

    // NotPrincipal with Allow effect (invalid)
    let mut logical_error_policy = IAMStatement::new(Effect::Allow);
    logical_error_policy.action = Some(Action::Single("s3:GetObject".to_string()));
    logical_error_policy.resource = Some(Resource::Single("*".to_string()));
    let mut principal_map = std::collections::HashMap::new();
    principal_map.insert(
        PrincipalType::Aws,
        serde_json::json!("arn:aws:iam::123456789012:user/test"),
    );
    logical_error_policy.not_principal = Some(Principal::Mapped(principal_map));

    match logical_error_policy.validate_result() {
        Err(e) => println!("✗ Logical error detected: {}", e),
        Ok(()) => println!("✓ Unexpected: validation passed"),
    }

    // Both Action and NotAction (invalid)
    let mut conflicting_statement = IAMStatement::new(Effect::Allow);
    conflicting_statement.action = Some(Action::Single("s3:GetObject".to_string()));
    conflicting_statement.not_action = Some(Action::Single("s3:PutObject".to_string()));
    conflicting_statement.resource = Some(Resource::Single("*".to_string()));

    match conflicting_statement.validate_result() {
        Err(e) => println!("✗ Logical error detected: {}", e),
        Ok(()) => println!("✓ Unexpected: validation passed"),
    }

    println!();

    // Example 6: Component Validation
    println!("6. Individual Component Validation:");

    // Invalid action
    let invalid_action = Action::Single("invalid-action".to_string());
    match invalid_action.validate_result() {
        Err(e) => println!("✗ Invalid action: {}", e),
        Ok(()) => println!("✓ Action is valid"),
    }

    // Invalid principal
    let mut invalid_map = std::collections::HashMap::new();
    invalid_map.insert(PrincipalType::Aws, serde_json::json!("invalid-principal"));
    let invalid_principal = Principal::Mapped(invalid_map);
    match invalid_principal.validate_result() {
        Err(e) => println!("✗ Invalid principal: {}", e),
        Ok(()) => println!("✓ Principal is valid"),
    }

    // Valid service principal
    let service_principal = Principal::Mapped(
        [(PrincipalType::Service, json!("lambda.amazonaws.com"))]
            .iter()
            .cloned()
            .collect(),
    );
    if service_principal.is_valid() {
        println!("✓ Service principal is valid");
    } else {
        println!("✗ Service principal is invalid");
    }

    println!("\n=== Validation Demo Complete ===");

    Ok(())
}

examples/evaluation_demo.rs (line 12)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== IAM Policy Evaluation Engine Demo ===\n");

    // Example 1: Simple Allow Policy
    println!("1. Simple Allow Policy:");
    let allow_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440000")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Read")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("arn:aws:s3:::my-bucket/*".to_string())),
        );

    let request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::my-bucket/file.txt",
    );

    match evaluate_policy(&allow_policy, &request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy (implicit deny)"),
    }
    println!();

    // Example 2: Simple Deny Policy
    println!("2. Simple Deny Policy:");
    let deny_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440001")
        .add_statement(
            IAMStatement::new(Effect::Deny)
                .with_sid("DenyS3Delete")
                .with_action(Action::Single("s3:DeleteObject".to_string()))
                .with_resource(Resource::Single(
                    "arn:aws:s3:::protected-bucket/*".to_string(),
                )),
        );

    let delete_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:DeleteObject",
        "arn:aws:s3:::protected-bucket/important.txt",
    );

    match evaluate_policy(&deny_policy, &delete_request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy (implicit deny)"),
    }
    println!();

    // Example 3: Wildcard Action Matching
    println!("3. Wildcard Action Matching:");
    let wildcard_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440002")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowAllS3")
                .with_action(Action::Single("s3:*".to_string()))
                .with_resource(Resource::Single("arn:aws:s3:::my-bucket/*".to_string())),
        );

    let wildcard_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:PutObject",
        "arn:aws:s3:::my-bucket/new-file.txt",
    );

    match evaluate_policy(&wildcard_policy, &wildcard_request)? {
        Decision::Allow => println!("✓ Wildcard action matched - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy"),
    }
    println!();

    // Example 4: Condition-Based Policy
    println!("4. Condition-Based Policy:");
    let mut context = Context::new();
    context.insert(
        "aws:userid".to_string(),
        ContextValue::String("alice".to_string()),
    );
    context.insert(
        "aws:CurrentTime".to_string(),
        ContextValue::String("2024-01-15T10:00:00Z".to_string()),
    );

    let condition_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440003")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowWithCondition")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single(
                    "arn:aws:s3:::private-bucket/*".to_string(),
                ))
                .with_condition(
                    Operator::StringEquals,
                    "aws:userid".to_string(),
                    json!("alice"),
                ),
        );

    let condition_request = IAMRequest::new_with_context(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::private-bucket/personal.txt",
        context,
    );

    match evaluate_policy(&condition_policy, &condition_request)? {
        Decision::Allow => println!("✓ Condition satisfied - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Condition not satisfied"),
    }
    println!();

    // Example 5: Failed Condition
    println!("5. Failed Condition:");
    let mut wrong_context = Context::new();
    wrong_context.insert(
        "aws:userid".to_string(),
        ContextValue::String("bob".to_string()),
    );

    let failed_condition_request = IAMRequest::new_with_context(
        "arn:aws:iam::123456789012:user/bob",
        "s3:GetObject",
        "arn:aws:s3:::private-bucket/personal.txt",
        wrong_context,
    );

    match evaluate_policy(&condition_policy, &failed_condition_request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Condition failed - No applicable policy"),
    }
    println!();

    // Example 6: Explicit Deny Overrides Allow
    println!("6. Explicit Deny Overrides Allow:");
    let combined_policies = vec![
        IAMPolicy::new()
            .with_id("550e8400-e29b-41d4-a716-446655440004")
            .add_statement(
                IAMStatement::new(Effect::Allow)
                    .with_sid("AllowAll")
                    .with_action(Action::Single("s3:*".to_string()))
                    .with_resource(Resource::Single("*".to_string())),
            ),
        IAMPolicy::new()
            .with_id("550e8400-e29b-41d4-a716-446655440005")
            .add_statement(
                IAMStatement::new(Effect::Deny)
                    .with_sid("DenyProtected")
                    .with_action(Action::Single("s3:DeleteObject".to_string()))
                    .with_resource(Resource::Single(
                        "arn:aws:s3:::protected-bucket/*".to_string(),
                    )),
            ),
    ];

    let evaluator = PolicyEvaluator::with_policies(combined_policies);
    let protected_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:DeleteObject",
        "arn:aws:s3:::protected-bucket/critical.txt",
    );

    match evaluator.evaluate(&protected_request)?.decision {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Explicit DENY overrides Allow"),
        Decision::NotApplicable => println!("? No applicable policy"),
    }
    println!();

    // Example 7: Numeric Condition
    println!("7. Numeric Condition:");
    let mut numeric_context = Context::new();
    numeric_context.insert("aws:RequestCount".to_string(), ContextValue::Number(5.0));

    let numeric_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440006")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowLimitedRequests")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("*".to_string()))
                .with_condition(
                    Operator::NumericLessThan,
                    "aws:RequestCount".to_string(),
                    json!(10),
                ),
        );

    let numeric_request = IAMRequest::new_with_context(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::any-bucket/file.txt",
        numeric_context,
    );

    match evaluate_policy(&numeric_policy, &numeric_request)? {
        Decision::Allow => println!("✓ Numeric condition satisfied - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Numeric condition failed"),
    }
    println!();

    // Example 8: Detailed Evaluation with Options
    println!("8. Detailed Evaluation with Options:");
    let detailed_evaluator = PolicyEvaluator::with_policies(vec![allow_policy.clone()])
        .with_options(EvaluationOptions {
            collect_match_details: true,
            stop_on_explicit_deny: false,
            max_statements: 100,
        });

    let detailed_result = detailed_evaluator.evaluate(&request)?;
    println!("Decision: {:?}", detailed_result.decision);
    println!("Matched Statements:");
    for (i, statement_match) in detailed_result.matched_statements.iter().enumerate() {
        println!(
            "  {}. SID: {:?}, Effect: {:?}, Satisfied: {}, Reason: {}",
            i + 1,
            statement_match.sid,
            statement_match.effect,
            statement_match.conditions_satisfied,
            statement_match.reason
        );
    }
    println!();

    // Example 9: No Applicable Policy (Implicit Deny)
    println!("9. No Applicable Policy (Implicit Deny):");
    let unrelated_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "ec2:DescribeInstances",
        "arn:aws:ec2:us-east-1:123456789012:instance/*",
    );

    match evaluate_policy(&allow_policy, &unrelated_request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy - Implicit DENY"),
    }
    println!();

    // Example 10: Resource Pattern Matching
    println!("10. Resource Pattern Matching:");
    let pattern_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440007")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowBucketAccess")
                .with_action(Action::Multiple(vec![
                    "s3:GetObject".to_string(),
                    "s3:PutObject".to_string(),
                ]))
                .with_resource(Resource::Single("arn:aws:s3:::user-data-*/*".to_string())),
        );

    let pattern_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::user-data-alice/profile.json",
    );

    match evaluate_policy(&pattern_policy, &pattern_request)? {
        Decision::Allow => println!("✓ Resource pattern matched - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Resource pattern didn't match"),
    }

    println!("\n=== Policy Evaluation Demo Complete ===");
    println!("\nThe Policy Evaluation Engine successfully:");
    println!("• ✅ Evaluates Allow/Deny effects");
    println!("• ✅ Handles wildcard actions and resources");
    println!("• ✅ Processes condition blocks with various operators");
    println!("• ✅ Implements proper IAM logic (explicit deny overrides)");
    println!("• ✅ Supports detailed evaluation with match information");
    println!("• ✅ Handles multiple policies with complex interactions");
    println!("• ✅ Provides clear Allow/Deny/NotApplicable decisions");

    Ok(())
}

pub fn with_version(version: IAMVersion) -> Self

Creates a new IAM policy with a specific version

pub fn add_statement(self, statement: IAMStatement) -> Self

Adds a statement to the policy

Examples found in repository

examples/arn_demo.rs (lines 83-94)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== IAM ARN Validator Demo ===\n");

    // Example 1: Parse and validate ARNs
    println!("1. Parsing and validating ARNs:");

    let valid_arns = vec![
        "arn:aws:s3:::my-bucket/folder/file.txt",
        "arn:aws:iam::123456789012:user/alice",
        "arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0",
        "arn:aws:lambda:us-east-1:123456789012:function:MyFunction",
        "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable",
        "arn:aws-eu-gov:dynamodb:us-east-1:123456789012:table/MyTable",
    ];

    for arn_str in &valid_arns {
        match Arn::parse(arn_str) {
            Ok(arn) => {
                println!("✓ Valid ARN: {}", arn);
                println!("  - Service: {}", arn.service);
                println!(
                    "  - Region: {}",
                    if arn.region.is_empty() {
                        "global"
                    } else {
                        &arn.region
                    }
                );
                println!(
                    "  - Account: {}",
                    if arn.account_id.is_empty() {
                        "none"
                    } else {
                        &arn.account_id
                    }
                );
                if let Some(resource_type) = arn.resource_type() {
                    println!("  - Resource Type: {}", resource_type);
                }
                if let Some(resource_id) = arn.resource_id() {
                    println!("  - Resource ID: {}", resource_id);
                }
                println!();
            }
            Err(e) => println!("✗ Invalid ARN {}: {}", arn_str, e),
        }
    }

    // Example 2: Wildcard matching
    println!("2. Wildcard pattern matching:");

    let resource_arn = Arn::parse("arn:aws:s3:::my-bucket/uploads/user123/document.pdf")?;
    println!("Resource ARN: {}", resource_arn);

    let patterns = vec![
        "arn:aws:s3:::my-bucket/*",
        "arn:aws:s3:::my-bucket/uploads/*",
        "arn:aws:s3:::my-bucket/uploads/user123/*",
        "arn:aws:s3:::*/uploads/user123/document.pdf",
        "arn:aws:s3:::my-bucket/uploads/*/document.pdf",
        "arn:aws:s3:::my-bucket/uploads/user???/document.pdf",
        "arn:aws:s3:::other-bucket/*",
        "arn:aws:ec2:*:*:instance/*",
    ];

    for pattern in &patterns {
        match resource_arn.matches(pattern) {
            Ok(matches) => {
                let status = if matches { "✓ MATCH" } else { "✗ NO MATCH" };
                println!("  {} Pattern: {}", status, pattern);
            }
            Err(e) => println!("  ✗ ERROR Pattern: {} ({})", pattern, e),
        }
    }

    // Example 3: Integration with IAM policies
    println!("\n3. Using ARNs in IAM policies:");

    let policy = IAMPolicy::new()
        .with_id("s3-access-policy")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Read")
                .with_action(Action::Multiple(vec![
                    "s3:GetObject".to_string(),
                    "s3:ListBucket".to_string(),
                ]))
                .with_resource(Resource::Multiple(vec![
                    "arn:aws:s3:::my-bucket".to_string(),
                    "arn:aws:s3:::my-bucket/*".to_string(),
                ])),
        )
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Write")
                .with_action(Action::Single("s3:PutObject".to_string()))
                .with_resource(Resource::Single(
                    "arn:aws:s3:::my-bucket/uploads/*".to_string(),
                )),
        );

    let policy_json = policy.to_json()?;
    println!("Generated IAM Policy:");
    println!("{}", policy_json);

    // Example 4: Validate all ARNs in the policy
    println!("\n4. Validating ARNs in policy:");

    for (i, statement) in policy.statement.iter().enumerate() {
        println!(
            "Statement {}: {}",
            i + 1,
            statement.sid.as_ref().unwrap_or(&"(no sid)".to_string())
        );

        let resources = match &statement.resource {
            Some(Resource::Single(arn)) => vec![arn.clone()],
            Some(Resource::Multiple(arns)) => arns.clone(),
            None => vec![],
        };

        for resource in resources {
            match Arn::parse(&resource) {
                Ok(arn) => {
                    let validity = if arn.is_valid() {
                        "✓ Valid"
                    } else {
                        "⚠ Invalid"
                    };
                    println!("  {} Resource: {}", validity, resource);
                }
                Err(e) => println!("  ✗ Parse Error: {} ({})", resource, e),
            }
        }
    }

    Ok(())
}

examples/validation_demo.rs (lines 14-24)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== IAM Policy Validation Demo ===\n");

    // Example 1: Valid Policy
    println!("1. Valid Policy Validation:");
    let valid_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440000")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Read")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("arn:aws:s3:::my-bucket/*".to_string()))
                .with_condition(
                    Operator::StringEquals,
                    "aws:PrincipalTag/department".to_string(),
                    json!("engineering"),
                ),
        );

    if valid_policy.is_valid() {
        println!("✓ Policy is valid!");
    } else {
        println!("✗ Policy is invalid");
    }

    match valid_policy.validate_result() {
        Ok(()) => println!("✓ Policy passes validation"),
        Err(e) => println!("✗ Policy fails validation: {}", e),
    }

    println!();

    // Example 2: Invalid Policy - Missing Required Fields
    println!("2. Invalid Policy - Missing Required Fields:");
    let invalid_policy = IAMPolicy::new().add_statement(IAMStatement::new(Effect::Allow)); // Missing action and resource

    if !invalid_policy.is_valid() {
        println!("✗ Policy is invalid (as expected)");
        match invalid_policy.validate_result() {
            Err(e) => println!("   Validation errors: {}", e),
            Ok(()) => println!("   Unexpected: validation passed"),
        }
    }

    println!();

    // Example 3: Policy with Multiple Validation Errors
    println!("3. Policy with Multiple Validation Errors:");
    let multi_error_policy = IAMPolicy::new()
        .with_id("") // Empty ID
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_action(Action::Single("invalid-action".to_string())) // Invalid action format
                .with_resource(Resource::Single("invalid-resource".to_string())), // Invalid resource
        )
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("DuplicateId")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("*".to_string())),
        )
        .add_statement(
            IAMStatement::new(Effect::Deny)
                .with_sid("DuplicateId") // Duplicate SID
                .with_action(Action::Single("s3:DeleteObject".to_string()))
                .with_resource(Resource::Single("*".to_string())),
        );

    match multi_error_policy.validate_result() {
        Err(ValidationError::Multiple(errors)) => {
            println!("✗ Found {} validation errors:", errors.len());
            for (i, error) in errors.iter().enumerate() {
                println!("   {}. {}", i + 1, error);
            }
        }
        Err(e) => {
            println!("✗ Single validation error: {}", e);
        }
        Ok(()) => {
            println!("✓ Unexpected: validation passed");
        }
    }

    println!();

    // Example 4: Comprehensive Validation
    println!("4. Comprehensive Validation:");
    let comprehensive_policy = IAMPolicy::new()
        .with_id("short") // Short ID - will fail validation
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("*".to_string()))
                .with_condition(
                    Operator::NumericEquals,
                    "aws:RequestedRegion".to_string(),
                    json!("not-a-number"), // Numeric operator with string value - will fail
                ),
        );

    match comprehensive_policy.validate_result() {
        Ok(()) => println!("✓ Policy passes validation"),
        Err(e) => println!("✗ Policy fails validation: {}", e),
    }

    println!();

    // Example 5: Logical Policy Errors
    println!("5. Logical Policy Errors:");

    // NotPrincipal with Allow effect (invalid)
    let mut logical_error_policy = IAMStatement::new(Effect::Allow);
    logical_error_policy.action = Some(Action::Single("s3:GetObject".to_string()));
    logical_error_policy.resource = Some(Resource::Single("*".to_string()));
    let mut principal_map = std::collections::HashMap::new();
    principal_map.insert(
        PrincipalType::Aws,
        serde_json::json!("arn:aws:iam::123456789012:user/test"),
    );
    logical_error_policy.not_principal = Some(Principal::Mapped(principal_map));

    match logical_error_policy.validate_result() {
        Err(e) => println!("✗ Logical error detected: {}", e),
        Ok(()) => println!("✓ Unexpected: validation passed"),
    }

    // Both Action and NotAction (invalid)
    let mut conflicting_statement = IAMStatement::new(Effect::Allow);
    conflicting_statement.action = Some(Action::Single("s3:GetObject".to_string()));
    conflicting_statement.not_action = Some(Action::Single("s3:PutObject".to_string()));
    conflicting_statement.resource = Some(Resource::Single("*".to_string()));

    match conflicting_statement.validate_result() {
        Err(e) => println!("✗ Logical error detected: {}", e),
        Ok(()) => println!("✓ Unexpected: validation passed"),
    }

    println!();

    // Example 6: Component Validation
    println!("6. Individual Component Validation:");

    // Invalid action
    let invalid_action = Action::Single("invalid-action".to_string());
    match invalid_action.validate_result() {
        Err(e) => println!("✗ Invalid action: {}", e),
        Ok(()) => println!("✓ Action is valid"),
    }

    // Invalid principal
    let mut invalid_map = std::collections::HashMap::new();
    invalid_map.insert(PrincipalType::Aws, serde_json::json!("invalid-principal"));
    let invalid_principal = Principal::Mapped(invalid_map);
    match invalid_principal.validate_result() {
        Err(e) => println!("✗ Invalid principal: {}", e),
        Ok(()) => println!("✓ Principal is valid"),
    }

    // Valid service principal
    let service_principal = Principal::Mapped(
        [(PrincipalType::Service, json!("lambda.amazonaws.com"))]
            .iter()
            .cloned()
            .collect(),
    );
    if service_principal.is_valid() {
        println!("✓ Service principal is valid");
    } else {
        println!("✗ Service principal is invalid");
    }

    println!("\n=== Validation Demo Complete ===");

    Ok(())
}

examples/evaluation_demo.rs (lines 14-19)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== IAM Policy Evaluation Engine Demo ===\n");

    // Example 1: Simple Allow Policy
    println!("1. Simple Allow Policy:");
    let allow_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440000")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Read")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("arn:aws:s3:::my-bucket/*".to_string())),
        );

    let request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::my-bucket/file.txt",
    );

    match evaluate_policy(&allow_policy, &request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy (implicit deny)"),
    }
    println!();

    // Example 2: Simple Deny Policy
    println!("2. Simple Deny Policy:");
    let deny_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440001")
        .add_statement(
            IAMStatement::new(Effect::Deny)
                .with_sid("DenyS3Delete")
                .with_action(Action::Single("s3:DeleteObject".to_string()))
                .with_resource(Resource::Single(
                    "arn:aws:s3:::protected-bucket/*".to_string(),
                )),
        );

    let delete_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:DeleteObject",
        "arn:aws:s3:::protected-bucket/important.txt",
    );

    match evaluate_policy(&deny_policy, &delete_request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy (implicit deny)"),
    }
    println!();

    // Example 3: Wildcard Action Matching
    println!("3. Wildcard Action Matching:");
    let wildcard_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440002")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowAllS3")
                .with_action(Action::Single("s3:*".to_string()))
                .with_resource(Resource::Single("arn:aws:s3:::my-bucket/*".to_string())),
        );

    let wildcard_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:PutObject",
        "arn:aws:s3:::my-bucket/new-file.txt",
    );

    match evaluate_policy(&wildcard_policy, &wildcard_request)? {
        Decision::Allow => println!("✓ Wildcard action matched - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy"),
    }
    println!();

    // Example 4: Condition-Based Policy
    println!("4. Condition-Based Policy:");
    let mut context = Context::new();
    context.insert(
        "aws:userid".to_string(),
        ContextValue::String("alice".to_string()),
    );
    context.insert(
        "aws:CurrentTime".to_string(),
        ContextValue::String("2024-01-15T10:00:00Z".to_string()),
    );

    let condition_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440003")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowWithCondition")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single(
                    "arn:aws:s3:::private-bucket/*".to_string(),
                ))
                .with_condition(
                    Operator::StringEquals,
                    "aws:userid".to_string(),
                    json!("alice"),
                ),
        );

    let condition_request = IAMRequest::new_with_context(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::private-bucket/personal.txt",
        context,
    );

    match evaluate_policy(&condition_policy, &condition_request)? {
        Decision::Allow => println!("✓ Condition satisfied - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Condition not satisfied"),
    }
    println!();

    // Example 5: Failed Condition
    println!("5. Failed Condition:");
    let mut wrong_context = Context::new();
    wrong_context.insert(
        "aws:userid".to_string(),
        ContextValue::String("bob".to_string()),
    );

    let failed_condition_request = IAMRequest::new_with_context(
        "arn:aws:iam::123456789012:user/bob",
        "s3:GetObject",
        "arn:aws:s3:::private-bucket/personal.txt",
        wrong_context,
    );

    match evaluate_policy(&condition_policy, &failed_condition_request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Condition failed - No applicable policy"),
    }
    println!();

    // Example 6: Explicit Deny Overrides Allow
    println!("6. Explicit Deny Overrides Allow:");
    let combined_policies = vec![
        IAMPolicy::new()
            .with_id("550e8400-e29b-41d4-a716-446655440004")
            .add_statement(
                IAMStatement::new(Effect::Allow)
                    .with_sid("AllowAll")
                    .with_action(Action::Single("s3:*".to_string()))
                    .with_resource(Resource::Single("*".to_string())),
            ),
        IAMPolicy::new()
            .with_id("550e8400-e29b-41d4-a716-446655440005")
            .add_statement(
                IAMStatement::new(Effect::Deny)
                    .with_sid("DenyProtected")
                    .with_action(Action::Single("s3:DeleteObject".to_string()))
                    .with_resource(Resource::Single(
                        "arn:aws:s3:::protected-bucket/*".to_string(),
                    )),
            ),
    ];

    let evaluator = PolicyEvaluator::with_policies(combined_policies);
    let protected_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:DeleteObject",
        "arn:aws:s3:::protected-bucket/critical.txt",
    );

    match evaluator.evaluate(&protected_request)?.decision {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Explicit DENY overrides Allow"),
        Decision::NotApplicable => println!("? No applicable policy"),
    }
    println!();

    // Example 7: Numeric Condition
    println!("7. Numeric Condition:");
    let mut numeric_context = Context::new();
    numeric_context.insert("aws:RequestCount".to_string(), ContextValue::Number(5.0));

    let numeric_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440006")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowLimitedRequests")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("*".to_string()))
                .with_condition(
                    Operator::NumericLessThan,
                    "aws:RequestCount".to_string(),
                    json!(10),
                ),
        );

    let numeric_request = IAMRequest::new_with_context(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::any-bucket/file.txt",
        numeric_context,
    );

    match evaluate_policy(&numeric_policy, &numeric_request)? {
        Decision::Allow => println!("✓ Numeric condition satisfied - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Numeric condition failed"),
    }
    println!();

    // Example 8: Detailed Evaluation with Options
    println!("8. Detailed Evaluation with Options:");
    let detailed_evaluator = PolicyEvaluator::with_policies(vec![allow_policy.clone()])
        .with_options(EvaluationOptions {
            collect_match_details: true,
            stop_on_explicit_deny: false,
            max_statements: 100,
        });

    let detailed_result = detailed_evaluator.evaluate(&request)?;
    println!("Decision: {:?}", detailed_result.decision);
    println!("Matched Statements:");
    for (i, statement_match) in detailed_result.matched_statements.iter().enumerate() {
        println!(
            "  {}. SID: {:?}, Effect: {:?}, Satisfied: {}, Reason: {}",
            i + 1,
            statement_match.sid,
            statement_match.effect,
            statement_match.conditions_satisfied,
            statement_match.reason
        );
    }
    println!();

    // Example 9: No Applicable Policy (Implicit Deny)
    println!("9. No Applicable Policy (Implicit Deny):");
    let unrelated_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "ec2:DescribeInstances",
        "arn:aws:ec2:us-east-1:123456789012:instance/*",
    );

    match evaluate_policy(&allow_policy, &unrelated_request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy - Implicit DENY"),
    }
    println!();

    // Example 10: Resource Pattern Matching
    println!("10. Resource Pattern Matching:");
    let pattern_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440007")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowBucketAccess")
                .with_action(Action::Multiple(vec![
                    "s3:GetObject".to_string(),
                    "s3:PutObject".to_string(),
                ]))
                .with_resource(Resource::Single("arn:aws:s3:::user-data-*/*".to_string())),
        );

    let pattern_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::user-data-alice/profile.json",
    );

    match evaluate_policy(&pattern_policy, &pattern_request)? {
        Decision::Allow => println!("✓ Resource pattern matched - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Resource pattern didn't match"),
    }

    println!("\n=== Policy Evaluation Demo Complete ===");
    println!("\nThe Policy Evaluation Engine successfully:");
    println!("• ✅ Evaluates Allow/Deny effects");
    println!("• ✅ Handles wildcard actions and resources");
    println!("• ✅ Processes condition blocks with various operators");
    println!("• ✅ Implements proper IAM logic (explicit deny overrides)");
    println!("• ✅ Supports detailed evaluation with match information");
    println!("• ✅ Handles multiple policies with complex interactions");
    println!("• ✅ Provides clear Allow/Deny/NotApplicable decisions");

    Ok(())
}

pub fn with_id<S: Into<String>>(self, id: S) -> Self

Sets the policy ID

Examples found in repository

examples/arn_demo.rs (line 82)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== IAM ARN Validator Demo ===\n");

    // Example 1: Parse and validate ARNs
    println!("1. Parsing and validating ARNs:");

    let valid_arns = vec![
        "arn:aws:s3:::my-bucket/folder/file.txt",
        "arn:aws:iam::123456789012:user/alice",
        "arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0",
        "arn:aws:lambda:us-east-1:123456789012:function:MyFunction",
        "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable",
        "arn:aws-eu-gov:dynamodb:us-east-1:123456789012:table/MyTable",
    ];

    for arn_str in &valid_arns {
        match Arn::parse(arn_str) {
            Ok(arn) => {
                println!("✓ Valid ARN: {}", arn);
                println!("  - Service: {}", arn.service);
                println!(
                    "  - Region: {}",
                    if arn.region.is_empty() {
                        "global"
                    } else {
                        &arn.region
                    }
                );
                println!(
                    "  - Account: {}",
                    if arn.account_id.is_empty() {
                        "none"
                    } else {
                        &arn.account_id
                    }
                );
                if let Some(resource_type) = arn.resource_type() {
                    println!("  - Resource Type: {}", resource_type);
                }
                if let Some(resource_id) = arn.resource_id() {
                    println!("  - Resource ID: {}", resource_id);
                }
                println!();
            }
            Err(e) => println!("✗ Invalid ARN {}: {}", arn_str, e),
        }
    }

    // Example 2: Wildcard matching
    println!("2. Wildcard pattern matching:");

    let resource_arn = Arn::parse("arn:aws:s3:::my-bucket/uploads/user123/document.pdf")?;
    println!("Resource ARN: {}", resource_arn);

    let patterns = vec![
        "arn:aws:s3:::my-bucket/*",
        "arn:aws:s3:::my-bucket/uploads/*",
        "arn:aws:s3:::my-bucket/uploads/user123/*",
        "arn:aws:s3:::*/uploads/user123/document.pdf",
        "arn:aws:s3:::my-bucket/uploads/*/document.pdf",
        "arn:aws:s3:::my-bucket/uploads/user???/document.pdf",
        "arn:aws:s3:::other-bucket/*",
        "arn:aws:ec2:*:*:instance/*",
    ];

    for pattern in &patterns {
        match resource_arn.matches(pattern) {
            Ok(matches) => {
                let status = if matches { "✓ MATCH" } else { "✗ NO MATCH" };
                println!("  {} Pattern: {}", status, pattern);
            }
            Err(e) => println!("  ✗ ERROR Pattern: {} ({})", pattern, e),
        }
    }

    // Example 3: Integration with IAM policies
    println!("\n3. Using ARNs in IAM policies:");

    let policy = IAMPolicy::new()
        .with_id("s3-access-policy")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Read")
                .with_action(Action::Multiple(vec![
                    "s3:GetObject".to_string(),
                    "s3:ListBucket".to_string(),
                ]))
                .with_resource(Resource::Multiple(vec![
                    "arn:aws:s3:::my-bucket".to_string(),
                    "arn:aws:s3:::my-bucket/*".to_string(),
                ])),
        )
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Write")
                .with_action(Action::Single("s3:PutObject".to_string()))
                .with_resource(Resource::Single(
                    "arn:aws:s3:::my-bucket/uploads/*".to_string(),
                )),
        );

    let policy_json = policy.to_json()?;
    println!("Generated IAM Policy:");
    println!("{}", policy_json);

    // Example 4: Validate all ARNs in the policy
    println!("\n4. Validating ARNs in policy:");

    for (i, statement) in policy.statement.iter().enumerate() {
        println!(
            "Statement {}: {}",
            i + 1,
            statement.sid.as_ref().unwrap_or(&"(no sid)".to_string())
        );

        let resources = match &statement.resource {
            Some(Resource::Single(arn)) => vec![arn.clone()],
            Some(Resource::Multiple(arns)) => arns.clone(),
            None => vec![],
        };

        for resource in resources {
            match Arn::parse(&resource) {
                Ok(arn) => {
                    let validity = if arn.is_valid() {
                        "✓ Valid"
                    } else {
                        "⚠ Invalid"
                    };
                    println!("  {} Resource: {}", validity, resource);
                }
                Err(e) => println!("  ✗ Parse Error: {} ({})", resource, e),
            }
        }
    }

    Ok(())
}

examples/validation_demo.rs (line 13)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== IAM Policy Validation Demo ===\n");

    // Example 1: Valid Policy
    println!("1. Valid Policy Validation:");
    let valid_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440000")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Read")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("arn:aws:s3:::my-bucket/*".to_string()))
                .with_condition(
                    Operator::StringEquals,
                    "aws:PrincipalTag/department".to_string(),
                    json!("engineering"),
                ),
        );

    if valid_policy.is_valid() {
        println!("✓ Policy is valid!");
    } else {
        println!("✗ Policy is invalid");
    }

    match valid_policy.validate_result() {
        Ok(()) => println!("✓ Policy passes validation"),
        Err(e) => println!("✗ Policy fails validation: {}", e),
    }

    println!();

    // Example 2: Invalid Policy - Missing Required Fields
    println!("2. Invalid Policy - Missing Required Fields:");
    let invalid_policy = IAMPolicy::new().add_statement(IAMStatement::new(Effect::Allow)); // Missing action and resource

    if !invalid_policy.is_valid() {
        println!("✗ Policy is invalid (as expected)");
        match invalid_policy.validate_result() {
            Err(e) => println!("   Validation errors: {}", e),
            Ok(()) => println!("   Unexpected: validation passed"),
        }
    }

    println!();

    // Example 3: Policy with Multiple Validation Errors
    println!("3. Policy with Multiple Validation Errors:");
    let multi_error_policy = IAMPolicy::new()
        .with_id("") // Empty ID
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_action(Action::Single("invalid-action".to_string())) // Invalid action format
                .with_resource(Resource::Single("invalid-resource".to_string())), // Invalid resource
        )
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("DuplicateId")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("*".to_string())),
        )
        .add_statement(
            IAMStatement::new(Effect::Deny)
                .with_sid("DuplicateId") // Duplicate SID
                .with_action(Action::Single("s3:DeleteObject".to_string()))
                .with_resource(Resource::Single("*".to_string())),
        );

    match multi_error_policy.validate_result() {
        Err(ValidationError::Multiple(errors)) => {
            println!("✗ Found {} validation errors:", errors.len());
            for (i, error) in errors.iter().enumerate() {
                println!("   {}. {}", i + 1, error);
            }
        }
        Err(e) => {
            println!("✗ Single validation error: {}", e);
        }
        Ok(()) => {
            println!("✓ Unexpected: validation passed");
        }
    }

    println!();

    // Example 4: Comprehensive Validation
    println!("4. Comprehensive Validation:");
    let comprehensive_policy = IAMPolicy::new()
        .with_id("short") // Short ID - will fail validation
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("*".to_string()))
                .with_condition(
                    Operator::NumericEquals,
                    "aws:RequestedRegion".to_string(),
                    json!("not-a-number"), // Numeric operator with string value - will fail
                ),
        );

    match comprehensive_policy.validate_result() {
        Ok(()) => println!("✓ Policy passes validation"),
        Err(e) => println!("✗ Policy fails validation: {}", e),
    }

    println!();

    // Example 5: Logical Policy Errors
    println!("5. Logical Policy Errors:");

    // NotPrincipal with Allow effect (invalid)
    let mut logical_error_policy = IAMStatement::new(Effect::Allow);
    logical_error_policy.action = Some(Action::Single("s3:GetObject".to_string()));
    logical_error_policy.resource = Some(Resource::Single("*".to_string()));
    let mut principal_map = std::collections::HashMap::new();
    principal_map.insert(
        PrincipalType::Aws,
        serde_json::json!("arn:aws:iam::123456789012:user/test"),
    );
    logical_error_policy.not_principal = Some(Principal::Mapped(principal_map));

    match logical_error_policy.validate_result() {
        Err(e) => println!("✗ Logical error detected: {}", e),
        Ok(()) => println!("✓ Unexpected: validation passed"),
    }

    // Both Action and NotAction (invalid)
    let mut conflicting_statement = IAMStatement::new(Effect::Allow);
    conflicting_statement.action = Some(Action::Single("s3:GetObject".to_string()));
    conflicting_statement.not_action = Some(Action::Single("s3:PutObject".to_string()));
    conflicting_statement.resource = Some(Resource::Single("*".to_string()));

    match conflicting_statement.validate_result() {
        Err(e) => println!("✗ Logical error detected: {}", e),
        Ok(()) => println!("✓ Unexpected: validation passed"),
    }

    println!();

    // Example 6: Component Validation
    println!("6. Individual Component Validation:");

    // Invalid action
    let invalid_action = Action::Single("invalid-action".to_string());
    match invalid_action.validate_result() {
        Err(e) => println!("✗ Invalid action: {}", e),
        Ok(()) => println!("✓ Action is valid"),
    }

    // Invalid principal
    let mut invalid_map = std::collections::HashMap::new();
    invalid_map.insert(PrincipalType::Aws, serde_json::json!("invalid-principal"));
    let invalid_principal = Principal::Mapped(invalid_map);
    match invalid_principal.validate_result() {
        Err(e) => println!("✗ Invalid principal: {}", e),
        Ok(()) => println!("✓ Principal is valid"),
    }

    // Valid service principal
    let service_principal = Principal::Mapped(
        [(PrincipalType::Service, json!("lambda.amazonaws.com"))]
            .iter()
            .cloned()
            .collect(),
    );
    if service_principal.is_valid() {
        println!("✓ Service principal is valid");
    } else {
        println!("✗ Service principal is invalid");
    }

    println!("\n=== Validation Demo Complete ===");

    Ok(())
}

examples/evaluation_demo.rs (line 13)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== IAM Policy Evaluation Engine Demo ===\n");

    // Example 1: Simple Allow Policy
    println!("1. Simple Allow Policy:");
    let allow_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440000")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Read")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("arn:aws:s3:::my-bucket/*".to_string())),
        );

    let request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::my-bucket/file.txt",
    );

    match evaluate_policy(&allow_policy, &request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy (implicit deny)"),
    }
    println!();

    // Example 2: Simple Deny Policy
    println!("2. Simple Deny Policy:");
    let deny_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440001")
        .add_statement(
            IAMStatement::new(Effect::Deny)
                .with_sid("DenyS3Delete")
                .with_action(Action::Single("s3:DeleteObject".to_string()))
                .with_resource(Resource::Single(
                    "arn:aws:s3:::protected-bucket/*".to_string(),
                )),
        );

    let delete_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:DeleteObject",
        "arn:aws:s3:::protected-bucket/important.txt",
    );

    match evaluate_policy(&deny_policy, &delete_request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy (implicit deny)"),
    }
    println!();

    // Example 3: Wildcard Action Matching
    println!("3. Wildcard Action Matching:");
    let wildcard_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440002")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowAllS3")
                .with_action(Action::Single("s3:*".to_string()))
                .with_resource(Resource::Single("arn:aws:s3:::my-bucket/*".to_string())),
        );

    let wildcard_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:PutObject",
        "arn:aws:s3:::my-bucket/new-file.txt",
    );

    match evaluate_policy(&wildcard_policy, &wildcard_request)? {
        Decision::Allow => println!("✓ Wildcard action matched - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy"),
    }
    println!();

    // Example 4: Condition-Based Policy
    println!("4. Condition-Based Policy:");
    let mut context = Context::new();
    context.insert(
        "aws:userid".to_string(),
        ContextValue::String("alice".to_string()),
    );
    context.insert(
        "aws:CurrentTime".to_string(),
        ContextValue::String("2024-01-15T10:00:00Z".to_string()),
    );

    let condition_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440003")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowWithCondition")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single(
                    "arn:aws:s3:::private-bucket/*".to_string(),
                ))
                .with_condition(
                    Operator::StringEquals,
                    "aws:userid".to_string(),
                    json!("alice"),
                ),
        );

    let condition_request = IAMRequest::new_with_context(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::private-bucket/personal.txt",
        context,
    );

    match evaluate_policy(&condition_policy, &condition_request)? {
        Decision::Allow => println!("✓ Condition satisfied - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Condition not satisfied"),
    }
    println!();

    // Example 5: Failed Condition
    println!("5. Failed Condition:");
    let mut wrong_context = Context::new();
    wrong_context.insert(
        "aws:userid".to_string(),
        ContextValue::String("bob".to_string()),
    );

    let failed_condition_request = IAMRequest::new_with_context(
        "arn:aws:iam::123456789012:user/bob",
        "s3:GetObject",
        "arn:aws:s3:::private-bucket/personal.txt",
        wrong_context,
    );

    match evaluate_policy(&condition_policy, &failed_condition_request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Condition failed - No applicable policy"),
    }
    println!();

    // Example 6: Explicit Deny Overrides Allow
    println!("6. Explicit Deny Overrides Allow:");
    let combined_policies = vec![
        IAMPolicy::new()
            .with_id("550e8400-e29b-41d4-a716-446655440004")
            .add_statement(
                IAMStatement::new(Effect::Allow)
                    .with_sid("AllowAll")
                    .with_action(Action::Single("s3:*".to_string()))
                    .with_resource(Resource::Single("*".to_string())),
            ),
        IAMPolicy::new()
            .with_id("550e8400-e29b-41d4-a716-446655440005")
            .add_statement(
                IAMStatement::new(Effect::Deny)
                    .with_sid("DenyProtected")
                    .with_action(Action::Single("s3:DeleteObject".to_string()))
                    .with_resource(Resource::Single(
                        "arn:aws:s3:::protected-bucket/*".to_string(),
                    )),
            ),
    ];

    let evaluator = PolicyEvaluator::with_policies(combined_policies);
    let protected_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:DeleteObject",
        "arn:aws:s3:::protected-bucket/critical.txt",
    );

    match evaluator.evaluate(&protected_request)?.decision {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Explicit DENY overrides Allow"),
        Decision::NotApplicable => println!("? No applicable policy"),
    }
    println!();

    // Example 7: Numeric Condition
    println!("7. Numeric Condition:");
    let mut numeric_context = Context::new();
    numeric_context.insert("aws:RequestCount".to_string(), ContextValue::Number(5.0));

    let numeric_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440006")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowLimitedRequests")
                .with_action(Action::Single("s3:GetObject".to_string()))
                .with_resource(Resource::Single("*".to_string()))
                .with_condition(
                    Operator::NumericLessThan,
                    "aws:RequestCount".to_string(),
                    json!(10),
                ),
        );

    let numeric_request = IAMRequest::new_with_context(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::any-bucket/file.txt",
        numeric_context,
    );

    match evaluate_policy(&numeric_policy, &numeric_request)? {
        Decision::Allow => println!("✓ Numeric condition satisfied - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Numeric condition failed"),
    }
    println!();

    // Example 8: Detailed Evaluation with Options
    println!("8. Detailed Evaluation with Options:");
    let detailed_evaluator = PolicyEvaluator::with_policies(vec![allow_policy.clone()])
        .with_options(EvaluationOptions {
            collect_match_details: true,
            stop_on_explicit_deny: false,
            max_statements: 100,
        });

    let detailed_result = detailed_evaluator.evaluate(&request)?;
    println!("Decision: {:?}", detailed_result.decision);
    println!("Matched Statements:");
    for (i, statement_match) in detailed_result.matched_statements.iter().enumerate() {
        println!(
            "  {}. SID: {:?}, Effect: {:?}, Satisfied: {}, Reason: {}",
            i + 1,
            statement_match.sid,
            statement_match.effect,
            statement_match.conditions_satisfied,
            statement_match.reason
        );
    }
    println!();

    // Example 9: No Applicable Policy (Implicit Deny)
    println!("9. No Applicable Policy (Implicit Deny):");
    let unrelated_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "ec2:DescribeInstances",
        "arn:aws:ec2:us-east-1:123456789012:instance/*",
    );

    match evaluate_policy(&allow_policy, &unrelated_request)? {
        Decision::Allow => println!("✓ Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? No applicable policy - Implicit DENY"),
    }
    println!();

    // Example 10: Resource Pattern Matching
    println!("10. Resource Pattern Matching:");
    let pattern_policy = IAMPolicy::new()
        .with_id("550e8400-e29b-41d4-a716-446655440007")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowBucketAccess")
                .with_action(Action::Multiple(vec![
                    "s3:GetObject".to_string(),
                    "s3:PutObject".to_string(),
                ]))
                .with_resource(Resource::Single("arn:aws:s3:::user-data-*/*".to_string())),
        );

    let pattern_request = IAMRequest::new(
        "arn:aws:iam::123456789012:user/alice",
        "s3:GetObject",
        "arn:aws:s3:::user-data-alice/profile.json",
    );

    match evaluate_policy(&pattern_policy, &pattern_request)? {
        Decision::Allow => println!("✓ Resource pattern matched - Access ALLOWED"),
        Decision::Deny => println!("✗ Access DENIED"),
        Decision::NotApplicable => println!("? Resource pattern didn't match"),
    }

    println!("\n=== Policy Evaluation Demo Complete ===");
    println!("\nThe Policy Evaluation Engine successfully:");
    println!("• ✅ Evaluates Allow/Deny effects");
    println!("• ✅ Handles wildcard actions and resources");
    println!("• ✅ Processes condition blocks with various operators");
    println!("• ✅ Implements proper IAM logic (explicit deny overrides)");
    println!("• ✅ Supports detailed evaluation with match information");
    println!("• ✅ Handles multiple policies with complex interactions");
    println!("• ✅ Provides clear Allow/Deny/NotApplicable decisions");

    Ok(())
}

pub fn from_json(json: &str) -> Result<Self, Error>

Parses an IAM policy from a JSON string

pub fn to_json(&self) -> Result<String, Error>

Serializes the IAM policy to a JSON string

Examples found in repository

examples/arn_demo.rs (line 104)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== IAM ARN Validator Demo ===\n");

    // Example 1: Parse and validate ARNs
    println!("1. Parsing and validating ARNs:");

    let valid_arns = vec![
        "arn:aws:s3:::my-bucket/folder/file.txt",
        "arn:aws:iam::123456789012:user/alice",
        "arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0",
        "arn:aws:lambda:us-east-1:123456789012:function:MyFunction",
        "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable",
        "arn:aws-eu-gov:dynamodb:us-east-1:123456789012:table/MyTable",
    ];

    for arn_str in &valid_arns {
        match Arn::parse(arn_str) {
            Ok(arn) => {
                println!("✓ Valid ARN: {}", arn);
                println!("  - Service: {}", arn.service);
                println!(
                    "  - Region: {}",
                    if arn.region.is_empty() {
                        "global"
                    } else {
                        &arn.region
                    }
                );
                println!(
                    "  - Account: {}",
                    if arn.account_id.is_empty() {
                        "none"
                    } else {
                        &arn.account_id
                    }
                );
                if let Some(resource_type) = arn.resource_type() {
                    println!("  - Resource Type: {}", resource_type);
                }
                if let Some(resource_id) = arn.resource_id() {
                    println!("  - Resource ID: {}", resource_id);
                }
                println!();
            }
            Err(e) => println!("✗ Invalid ARN {}: {}", arn_str, e),
        }
    }

    // Example 2: Wildcard matching
    println!("2. Wildcard pattern matching:");

    let resource_arn = Arn::parse("arn:aws:s3:::my-bucket/uploads/user123/document.pdf")?;
    println!("Resource ARN: {}", resource_arn);

    let patterns = vec![
        "arn:aws:s3:::my-bucket/*",
        "arn:aws:s3:::my-bucket/uploads/*",
        "arn:aws:s3:::my-bucket/uploads/user123/*",
        "arn:aws:s3:::*/uploads/user123/document.pdf",
        "arn:aws:s3:::my-bucket/uploads/*/document.pdf",
        "arn:aws:s3:::my-bucket/uploads/user???/document.pdf",
        "arn:aws:s3:::other-bucket/*",
        "arn:aws:ec2:*:*:instance/*",
    ];

    for pattern in &patterns {
        match resource_arn.matches(pattern) {
            Ok(matches) => {
                let status = if matches { "✓ MATCH" } else { "✗ NO MATCH" };
                println!("  {} Pattern: {}", status, pattern);
            }
            Err(e) => println!("  ✗ ERROR Pattern: {} ({})", pattern, e),
        }
    }

    // Example 3: Integration with IAM policies
    println!("\n3. Using ARNs in IAM policies:");

    let policy = IAMPolicy::new()
        .with_id("s3-access-policy")
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Read")
                .with_action(Action::Multiple(vec![
                    "s3:GetObject".to_string(),
                    "s3:ListBucket".to_string(),
                ]))
                .with_resource(Resource::Multiple(vec![
                    "arn:aws:s3:::my-bucket".to_string(),
                    "arn:aws:s3:::my-bucket/*".to_string(),
                ])),
        )
        .add_statement(
            IAMStatement::new(Effect::Allow)
                .with_sid("AllowS3Write")
                .with_action(Action::Single("s3:PutObject".to_string()))
                .with_resource(Resource::Single(
                    "arn:aws:s3:::my-bucket/uploads/*".to_string(),
                )),
        );

    let policy_json = policy.to_json()?;
    println!("Generated IAM Policy:");
    println!("{}", policy_json);

    // Example 4: Validate all ARNs in the policy
    println!("\n4. Validating ARNs in policy:");

    for (i, statement) in policy.statement.iter().enumerate() {
        println!(
            "Statement {}: {}",
            i + 1,
            statement.sid.as_ref().unwrap_or(&"(no sid)".to_string())
        );

        let resources = match &statement.resource {
            Some(Resource::Single(arn)) => vec![arn.clone()],
            Some(Resource::Multiple(arns)) => arns.clone(),
            None => vec![],
        };

        for resource in resources {
            match Arn::parse(&resource) {
                Ok(arn) => {
                    let validity = if arn.is_valid() {
                        "✓ Valid"
                    } else {
                        "⚠ Invalid"
                    };
                    println!("  {} Resource: {}", validity, resource);
                }
                Err(e) => println!("  ✗ Parse Error: {} ({})", resource, e),
            }
        }
    }

    Ok(())
}

Trait Implementations

impl Clone for IAMPolicy

fn clone(&self) -> IAMPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IAMPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for IAMPolicy

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for IAMPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for IAMPolicy

fn eq(&self, other: &IAMPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for IAMPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Validate for IAMPolicy

fn validate(&self, context: &mut ValidationContext) -> ValidationResult

fn is_valid(&self) -> bool

Convenience method for basic validation

fn validate_result(&self) -> ValidationResult

Validate with detailed errors (same as regular validation)

impl Eq for IAMPolicy

impl StructuralPartialEq for IAMPolicy