Struct Config 

pub struct Config {

    pub provider: Option<String>,
    pub role_arn: Option<String>,
    pub ttl: Option<String>,
    pub budget: Option<f64>,
    pub region: Option<String>,
    pub deny: Option<Vec<String>>,
    pub permissions_boundary: Option<String>,
    pub network: Option<NetworkPolicy>,
    pub profiles: HashMap<String, Profile>,
    pub gcp_service_account: Option<String>,
    pub gcp_project: Option<String>,
    pub gcp_extended_lifetime: bool,
    pub azure_subscription: Option<String>,
    pub azure_tenant: Option<String>,
    pub team: Option<TeamConfig>,
    pub approval: Option<ApprovalConfig>,
    pub audit: Option<ForwardConfig>,
    pub roles: Option<RoleMappingConfig>,
    pub ratelimit: Option<RateLimitConfig>,
    pub sso: Option<SsoConfig>,
    pub vault: Option<VaultConfig>,
    pub account: Option<AccountConfig>,
    pub broker: Option<BrokerConfig>,
    pub mcp_allowed_commands: Option<Vec<String>>,
    pub dbaudit: Option<DbAuditConfig>,
    pub ha: Option<HaConfig>,
}

Fields

provider: Option<String>

Default cloud provider (“aws”, “gcp”, or “azure”)

role_arn: Option<String>

Default IAM role ARN to assume (AWS)

ttl: Option<String>

Default TTL for sessions (e.g. “15m”)

budget: Option<f64>

Default budget limit in USD

region: Option<String>

Default AWS region

deny: Option<Vec<String>>

Actions that are always denied regardless of –allow

permissions_boundary: Option<String>

AWS permissions boundary policy ARN — applied to every AssumeRole call as an additional ceiling beyond the inline session policy.

network: Option<NetworkPolicy>

Network policy: restrict credentials to specific source IPs or VPCs.

profiles: HashMap<String, Profile>

Named policy profiles

gcp_service_account: Option<String>

GCP service account email for impersonation

gcp_project: Option<String>

GCP project ID

gcp_extended_lifetime: bool

Allow GCP access token TTLs beyond the default 1h (up to 12h).

Requires the org policy constraints/iam.allowServiceAccountCredentialLifetimeExtension to be enabled for the target project. If that policy is not set, the IAM generateAccessToken API will reject requests for tokens with a lifetime exceeding 3600s with a PERMISSION_DENIED error. Verify the org policy is in place before enabling this flag — there is no pre-flight API check available for org policy constraints.

To inspect the policy:

gcloud org-policies describe \
  constraints/iam.allowServiceAccountCredentialLifetimeExtension \
  --project=<PROJECT_ID>

azure_subscription: Option<String>

Azure subscription ID

azure_tenant: Option<String>

Azure tenant ID

team: Option<TeamConfig>

Team policy configuration

approval: Option<ApprovalConfig>

Approval workflow configuration

audit: Option<ForwardConfig>

Audit forwarding configuration

roles: Option<RoleMappingConfig>

Role mapping configuration

ratelimit: Option<RateLimitConfig>

Rate limiting configuration

sso: Option<SsoConfig>

SSO configuration

vault: Option<VaultConfig>

Vault credential backend configuration

account: Option<AccountConfig>

Multi-account configuration

broker: Option<BrokerConfig>

Credential broker configuration

mcp_allowed_commands: Option<Vec<String>>

MCP command allowlist — when set, only commands whose basename matches an entry in this list can be executed via the MCP audex_run tool. Example: mcp_allowed_commands = ["aws", "terraform", "gcloud", "az"]

dbaudit: Option<DbAuditConfig>

Database audit backend configuration (planned — parsed but not yet wired to a DB driver)

ha: Option<HaConfig>

High availability configuration (planned — parsed but not yet wired to Redis/etcd)

Implementations

impl Config

pub fn load() -> Result<Self>

Load config from ~/.config/audex/config.toml. Returns default if file doesn’t exist.

pub fn resolve_profile(&self, name: &str) -> Result<Profile>

Get a profile by name. Checks community:// prefix, then user config, then built-in profiles.

pub fn all_profiles(&self) -> Vec<(String, Profile)>

List all available profiles (user + built-in).

pub fn path() -> PathBuf

Config file path: ~/.config/audex/config.toml

Trait Implementations

impl Clone for Config

fn clone(&self) -> Config

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Config

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Config

fn default() -> Config

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Config

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Config

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.