Struct scratchstack_aspen::Policy
source · pub struct Policy { /* private fields */ }
Expand description
The top-level structure for holding an Aspen policy.
This does not directly derive Deserialize/Serialize to prevent serde from allowing this to be represented as an array.
Policy structures are immutable after creation.
Implementations§
source§impl Policy
impl Policy
sourcepub fn builder() -> PolicyBuilder
pub fn builder() -> PolicyBuilder
Returns a builder for a Policy.
sourcepub fn version(&self) -> PolicyVersion
pub fn version(&self) -> PolicyVersion
Returns the policy version.
sourcepub fn id(&self) -> Option<&str>
pub fn id(&self) -> Option<&str>
Returns the user-specified identifier for the policy, or None if no identifier was specified.
sourcepub fn statement(&self) -> &StatementList
pub fn statement(&self) -> &StatementList
Returns the policy statements associated with the policy.
sourcepub fn evaluate(&self, context: &Context) -> Result<Decision, AspenError>
pub fn evaluate(&self, context: &Context) -> Result<Decision, AspenError>
Evaluates the policy against the request Context.
Returns Decision::Deny if the policy denies the request, Decision::Allow if the policy allows the request, or Decision::DefaultDeny if the policy does not explicitly allow or deny the request.
Example
let action = Action::from_str("s3:ListBucket").unwrap();
let resource = Resource::from_str("arn:aws:s3:::examplebucket").unwrap();
let statement = Statement::builder().effect(Effect::Allow).action(action).resource(resource).build().unwrap();
let policy = Policy::builder().statement(statement).build().unwrap();
let actor = Principal::from(vec![User::from_str("arn:aws:iam::123456789012:user/exampleuser").unwrap().into()]);
let context = Context::builder().service("s3").api("ListBucket").actor(actor)
.session_data(SessionData::new()).build().unwrap();
policy.evaluate(&context);
Trait Implementations§
source§impl<'de> Deserialize<'de> for Policy
impl<'de> Deserialize<'de> for Policy
source§fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Policy, D::Error>
fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Policy, D::Error>
Deserialize this value from the given Serde deserializer. Read more