19_role_assumption_workflow/
19_role_assumption_workflow.rs

1//! Role Assumption Workflow
2//!
3//! This example demonstrates:
4//! - AssumeRole pattern for elevated permissions
5//! - Temporary credentials with role permissions
6//! - Session-based access
7//!
8//! Scenario: User assuming a role for elevated access.
9//!
10//! Run with: `cargo run --example 19_role_assumption_workflow`
11
12use std::sync::Arc;
13use tokio::sync::RwLock;
14use wami::arn::{TenantPath, WamiArn};
15use wami::context::WamiContext;
16use wami::service::{AssumeRoleService, RoleService, UserService};
17use wami::store::memory::InMemoryWamiStore;
18use wami::wami::identity::role::requests::CreateRoleRequest;
19use wami::wami::identity::user::requests::CreateUserRequest;
20use wami::wami::sts::assume_role::requests::AssumeRoleRequest;
21
22#[tokio::main]
23async fn main() -> Result<(), Box<dyn std::error::Error>> {
24    println!("=== Role Assumption Workflow ===\n");
25
26    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
27
28    // Create context
29    let context = WamiContext::builder()
30        .instance_id("123456789012")
31        .tenant_path(TenantPath::single(0))
32        .caller_arn(
33            WamiArn::builder()
34                .service(wami::arn::Service::Iam)
35                .tenant_path(TenantPath::single(0))
36                .wami_instance("123456789012")
37                .resource("user", "admin")
38                .build()?,
39        )
40        .is_root(false)
41        .build()?;
42
43    let user_service = UserService::new(store.clone());
44    let role_service = RoleService::new(store.clone());
45    let sts_service = AssumeRoleService::new(store.clone());
46
47    // Create user
48    println!("Step 1: Creating user...\n");
49    let alice = user_service
50        .create_user(
51            &context,
52            CreateUserRequest {
53                user_name: "alice".to_string(),
54                path: Some("/".to_string()),
55                permissions_boundary: None,
56                tags: None,
57            },
58        )
59        .await?;
60    println!("✓ Created alice: {}", alice.arn);
61
62    // Create elevated role
63    println!("\nStep 2: Creating admin role...\n");
64    let trust_policy = r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"sts:AssumeRole"}]}"#;
65    let role = role_service
66        .create_role(
67            &context,
68            CreateRoleRequest {
69                role_name: "AdminRole".to_string(),
70                path: Some("/".to_string()),
71                assume_role_policy_document: trust_policy.to_string(),
72                description: Some("Admin role for elevated access".to_string()),
73                max_session_duration: Some(3600),
74                permissions_boundary: None,
75                tags: None,
76            },
77        )
78        .await?;
79    println!("✓ Created AdminRole: {}", role.arn);
80
81    // Assume role
82    println!("\nStep 3: Alice assuming AdminRole...\n");
83    let assume_req = AssumeRoleRequest {
84        role_arn: role.arn.clone(),
85        role_session_name: "alice-admin-session".to_string(),
86        duration_seconds: Some(3600),
87        external_id: None,
88        policy: None,
89    };
90
91    let response = sts_service
92        .assume_role(&context, assume_req, &alice.arn)
93        .await?;
94    println!("✓ Successfully assumed role!");
95    println!("  Assumed Role ARN: {}", response.assumed_role_user.arn);
96    println!("  Access Key: {}", response.credentials.access_key_id);
97    println!("  Expiration: {}", response.credentials.expiration);
98
99    println!("\n✅ Example completed successfully!");
100    println!("Key takeaways:");
101    println!("- AssumeRole provides temporary elevated permissions");
102    println!("- Trust policies control who can assume roles");
103    println!("- Session credentials expire automatically");
104
105    Ok(())
106}
19_role_assumption_workflow/19_role_assumption_workflow.rs

19_role_assumption_workflow/
19_role_assumption_workflow.rs
