Struct ScopedPolicy 

pub struct ScopedPolicy {
    pub actions: Vec<ActionPattern>,
    pub resources: Vec<String>,
}

A scoped IAM policy built from user-specified allowed actions.

Fields

actions: Vec<ActionPattern>

resources: Vec<String>

Implementations

impl ScopedPolicy

pub fn from_allow_str(allow: &str) -> Result<Self>

Parse a comma-separated allow string like “s3:GetObject,lambda:Update*”. Optionally accepts resource ARNs to restrict beyond just actions.

pub fn from_allow_str_with_resources( allow: &str, resources: Option<&str>, ) -> Result<Self>

Parse allow string with optional resource ARN restrictions.

pub fn from_gcp_allow_str(allow: &str) -> Result<Self>

Parse a comma-separated GCP permissions string like “storage.objects.get,compute.instances.list”.

pub fn from_azure_allow_str(allow: &str) -> Result<Self>

Parse a comma-separated Azure permissions string like “Microsoft.Storage/storageAccounts/read”.

pub fn to_iam_policy_json(&self) -> Result<String>

Generate the AWS IAM policy JSON document for STS inline policy.

pub fn to_iam_policy_json_with_tag_lock(&self, tag_key: &str) -> Result<String>

Generate the AWS IAM policy JSON with a Deny statement that blocks the caller from removing or overwriting the given tag key. Used by --tag-session to keep agents from stripping the tryaudex-session marker mid-session and escaping cleanup.

pub fn to_iam_policy_json_with_network_and_tag_lock( &self, network: Option<&NetworkPolicy>, tag_lock_key: Option<&str>, ) -> Result<String>

Full policy JSON with both network conditions and tag-lock deny.

pub fn to_iam_policy_json_with_network( &self, network: Option<&NetworkPolicy>, ) -> Result<String>

Generate the AWS IAM policy JSON with optional network conditions.

pub fn enforce_deny_list(&self, deny: &[String]) -> Result<()>

Check all actions against a deny list. Returns error if any action is denied.

pub fn services(&self) -> Vec<String>

List the services involved in this policy.

Trait Implementations

impl Clone for ScopedPolicy

fn clone(&self) -> ScopedPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ScopedPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ScopedPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ScopedPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.