Struct ActionPattern 

pub struct ActionPattern {
    pub service: String,
    pub action: String,
}

A parsed IAM action pattern like “s3:GetObject” or “lambda:Update*”.

Fields

service: String

action: String

Implementations

impl ActionPattern

pub fn parse(s: &str) -> Result<Self>

Parse a string like “s3:GetObject” into an ActionPattern.

Both the service and action components must match [a-zA-Z0-9*?-]+ to prevent opaque STS errors from malformed policy documents.

pub fn to_iam_action(&self) -> String

Convert to IAM action string (AWS format: service:Action).

pub fn parse_gcp(s: &str) -> Result<Self>

Parse a GCP permission like “storage.objects.get” or “compute.instances.list”.

Components are validated to contain only [a-zA-Z0-9.*?-]+ to prevent null bytes or special characters from corrupting deny-list matching.

pub fn to_gcp_permission(&self) -> String

Convert to GCP permission string (service.resource.verb).

pub fn parse_azure(s: &str) -> Result<Self>

Parse an Azure permission like “Microsoft.Storage/storageAccounts/read”.

Components are validated to contain only [a-zA-Z0-9./*?-]+ to prevent null bytes or special characters from corrupting deny-list matching.

pub fn to_azure_permission(&self) -> String

Convert to Azure permission string (Microsoft.Service/resource/action).

pub fn matches(&self, other: &ActionPattern) -> bool

Check if this pattern matches another action (for deny list checking). Supports wildcards: “iam:” matches “iam:CreateRole”, “:*” matches everything, “s3:*Object” matches “s3:GetObject” and “s3:PutObject”.

AWS IAM and GCP actions are case-insensitive, so comparison is normalised to lowercase. R6-M26: Azure permissions preserve casing in role definitions and resource providers; blanket lowercasing could cause spurious deny-list matches against differently-cased operator tokens (e.g. a deny rule on Microsoft.Storage/storageAccounts/write comparing against a user-supplied Microsoft.storage/storageaccounts/WRITE). When either side looks like an Azure provider (service starts with Microsoft.), compare with case preserved on both sides so the match semantics mirror Azure’s own service-provider identifiers.

Trait Implementations

impl Clone for ActionPattern

fn clone(&self) -> ActionPattern

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ActionPattern

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ActionPattern

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ActionPattern

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.