Struct RoleService 

pub struct RoleService<S> { /* private fields */ }

Service for managing IAM roles

Provides high-level operations for role management.

Implementations

impl<S: RoleStore> RoleService<S>

pub fn new(store: Arc<RwLock<S>>, account_id: String) -> Self

Create a new RoleService with default AWS provider

Examples found in repository

examples/19_role_assumption_workflow.rs (line 29)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Role Assumption Workflow ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
    let _provider = Arc::new(AwsProvider::new());
    let account_id = "123456789012";

    let user_service = UserService::new(store.clone(), account_id.to_string());
    let role_service = RoleService::new(store.clone(), account_id.to_string());
    let sts_service = AssumeRoleService::new(store.clone(), account_id.to_string());

    // Create user
    println!("Step 1: Creating user...\n");
    let alice = user_service
        .create_user(CreateUserRequest {
            user_name: "alice".to_string(),
            path: Some("/".to_string()),
            permissions_boundary: None,
            tags: None,
        })
        .await?;
    println!("✓ Created alice: {}", alice.arn);

    // Create elevated role
    println!("\nStep 2: Creating admin role...\n");
    let trust_policy = r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"sts:AssumeRole"}]}"#;
    let role = role_service
        .create_role(CreateRoleRequest {
            role_name: "AdminRole".to_string(),
            path: Some("/".to_string()),
            assume_role_policy_document: trust_policy.to_string(),
            description: Some("Admin role for elevated access".to_string()),
            max_session_duration: Some(3600),
            permissions_boundary: None,
            tags: None,
        })
        .await?;
    println!("✓ Created AdminRole: {}", role.arn);

    // Assume role
    println!("\nStep 3: Alice assuming AdminRole...\n");
    let assume_req = AssumeRoleRequest {
        role_arn: role.arn.clone(),
        role_session_name: "alice-admin-session".to_string(),
        duration_seconds: Some(3600),
        external_id: None,
        policy: None,
    };

    let response = sts_service.assume_role(assume_req, &alice.arn).await?;
    println!("✓ Successfully assumed role!");
    println!("  Assumed Role ARN: {}", response.assumed_role_user.arn);
    println!("  Access Key: {}", response.credentials.access_key_id);
    println!("  Expiration: {}", response.credentials.expiration);

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- AssumeRole provides temporary elevated permissions");
    println!("- Trust policies control who can assume roles");
    println!("- Session credentials expire automatically");

    Ok(())
}

examples/03_service_layer_intro.rs (line 33)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Service Layer Introduction ===\n");

    // Step 1: Initialize store with Arc<RwLock> for thread-safe access
    println!("Step 1: Initializing services...\n");
    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
    let _provider = Arc::new(AwsProvider::new());
    let account_id = "123456789012";

    // Create services
    let user_service = UserService::new(store.clone(), account_id.to_string());
    let group_service = GroupService::new(store.clone(), account_id.to_string());
    let role_service = RoleService::new(store.clone(), account_id.to_string());

    println!("✓ Services initialized");

    // === CREATE Operations via Services ===
    println!("\nStep 2: Creating resources via services...\n");

    // Create users
    println!("Creating users...");
    let alice_req = CreateUserRequest {
        user_name: "alice".to_string(),
        path: Some("/users/".to_string()),
        permissions_boundary: None,
        tags: None,
    };
    let alice = user_service.create_user(alice_req).await?;
    println!("✓ Created user: {}", alice.user_name);

    let bob_req = CreateUserRequest {
        user_name: "bob".to_string(),
        path: Some("/users/".to_string()),
        permissions_boundary: None,
        tags: None,
    };
    user_service.create_user(bob_req).await?;
    println!("✓ Created user: bob");

    // Create groups
    println!("\nCreating groups...");
    let dev_group_req = CreateGroupRequest {
        group_name: "developers".to_string(),
        path: Some("/groups/".to_string()),
        tags: None,
    };
    let dev_group = group_service.create_group(dev_group_req).await?;
    println!("✓ Created group: {}", dev_group.group_name);

    // Create role
    println!("\nCreating role...");
    let role_req = CreateRoleRequest {
        role_name: "deploy-role".to_string(),
        path: Some("/roles/".to_string()),
        assume_role_policy_document: r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"sts:AssumeRole"}]}"#.to_string(),
        description: Some("Role for deployment".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };
    let role = role_service.create_role(role_req).await?;
    println!("✓ Created role: {}", role.role_name);

    // === READ Operations via Services ===
    println!("\n\nStep 3: Reading resources via services...\n");

    // Get specific user
    let alice_retrieved = user_service.get_user("alice").await?;
    if let Some(user) = alice_retrieved {
        println!("✓ Retrieved user 'alice':");
        println!("  - User ID: {}", user.user_id);
        println!("  - ARN: {}", user.arn);
    }

    // List users
    let users = user_service
        .list_users(ListUsersRequest {
            path_prefix: None,
            pagination: None,
        })
        .await?;
    println!("\n✓ Found {} users via service:", users.0.len());
    for user in &users.0 {
        println!("  - {}", user.user_name);
    }

    // === UPDATE Operations via Services ===
    println!("\n\nStep 4: Updating resources via services...\n");

    use wami::wami::identity::user::requests::UpdateUserRequest;
    let update_req = UpdateUserRequest {
        user_name: "alice".to_string(),
        new_user_name: None,
        new_path: Some("/admin-users/".to_string()),
    };
    user_service.update_user(update_req).await?;
    println!("✓ Updated alice's path to '/admin-users/'");

    // === DELETE Operations via Services ===
    println!("\n\nStep 5: Deleting resources via services...\n");

    user_service.delete_user("bob").await?;
    println!("✓ Deleted user 'bob'");

    // Verify deletion
    let bob_check = user_service.get_user("bob").await?;
    if bob_check.is_none() {
        println!("  Verified: bob no longer exists");
    }

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- Services provide a higher-level API than raw store access");
    println!("- Arc<RwLock<Store>> enables thread-safe concurrent operations");
    println!("- Services use request/response DTOs for clean API contracts");
    println!("- Services encapsulate business logic and validation");

    Ok(())
}

examples/07_cross_tenant_role_assumption.rs (line 65)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Cross-Tenant Role Assumption ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
    let _provider = Arc::new(AwsProvider::new());

    // === SETUP TENANTS ===
    println!("Step 1: Creating two tenants...\n");

    let tenant_service = TenantService::new(store.clone(), "root".to_string());

    // Tenant A (source)
    let _tenant_a_id = TenantId::new("company-a");
    tenant_service
        .create_tenant("company-a".to_string(), Some("Company A".to_string()), None)
        .await?;
    println!("✓ Created tenant: company-a");

    // Tenant B (target)
    let _tenant_b_id = TenantId::new("company-b");
    tenant_service
        .create_tenant("company-b".to_string(), Some("Company B".to_string()), None)
        .await?;
    println!("✓ Created tenant: company-b");

    // === CREATE USER IN TENANT A ===
    println!("\nStep 2: Creating user in tenant A...\n");

    let user_service_a = UserService::new(store.clone(), "company-a".to_string());

    let alice_req = CreateUserRequest {
        user_name: "alice".to_string(),
        path: Some("/".to_string()),
        permissions_boundary: None,
        tags: None,
    };
    let alice = user_service_a.create_user(alice_req).await?;
    println!("✓ Created alice in company-a");
    println!("  ARN: {}", alice.arn);

    // === CREATE ROLE IN TENANT B WITH TRUST POLICY ===
    println!("\nStep 3: Creating cross-tenant role in tenant B...\n");

    let role_service_b = RoleService::new(store.clone(), "company-b".to_string());

    // Trust policy allowing Company A users to assume this role
    let trust_policy = r#"{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam::company-a:root"},
    "Action": "sts:AssumeRole"
  }]
}"#
    .to_string();

    let role_req = CreateRoleRequest {
        role_name: "cross-tenant-reader".to_string(),
        path: Some("/".to_string()),
        assume_role_policy_document: trust_policy,
        description: Some("Role for cross-tenant read access".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };

    let role = role_service_b.create_role(role_req).await?;
    println!("✓ Created cross-tenant-reader role in company-b");
    println!("  Role ARN: {}", role.arn);

    // === ASSUME ROLE ACROSS TENANTS ===
    println!("\nStep 4: Alice assuming role in company-b...\n");

    let sts_service = AssumeRoleService::new(
        store.clone(),
        "company-a".to_string(), // Operating from tenant A
    );

    let assume_req = AssumeRoleRequest {
        role_arn: role.arn.clone(),
        role_session_name: "alice-cross-tenant-session".to_string(),
        duration_seconds: Some(3600),
        external_id: None,
        policy: None,
    };

    let assume_response = sts_service.assume_role(assume_req, &alice.arn).await?;
    println!("✓ Alice successfully assumed cross-tenant role!");
    println!("  Credentials:");
    println!(
        "    - Access Key: {}",
        assume_response.credentials.access_key_id
    );
    println!(
        "    - Session Token: {}...",
        &assume_response.credentials.session_token[..20]
    );
    println!(
        "    - Expiration: {}",
        assume_response.credentials.expiration
    );
    println!("\n  Assumed Role:");
    println!("    - ARN: {}", assume_response.assumed_role_user.arn);
    println!(
        "    - User ID: {}",
        assume_response.assumed_role_user.assumed_role_id
    );

    // === DEMONSTRATE USE CASE ===
    println!("\n\nStep 5: Understanding cross-tenant scenarios...\n");

    println!("Cross-tenant role assumption enables:");
    println!("- Partner company collaboration");
    println!("- Outsourced operations (DevOps team accessing client resources)");
    println!("- Centralized security auditing across organizations");
    println!("- Merger & acquisition transitional access");
    println!("\nSecurity considerations:");
    println!("- Trust policies must explicitly allow cross-tenant access");
    println!("- Use external_id for additional security");
    println!("- Limit session duration to minimum required");
    println!("- Attach restrictive permission policies to the role");

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- Cross-tenant access requires explicit trust policies");
    println!("- STS provides temporary, limited-privilege credentials");
    println!("- AssumeRole creates a session with the target role's permissions");
    println!("- Credentials are time-limited and automatically expire");

    Ok(())
}

examples/12_provider_specific_features.rs (line 29)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Provider-Specific Features ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));

    // === AWS: IAM ROLES WITH TRUST POLICIES ===
    println!("Step 1: AWS IAM Role with Trust Policy...\n");

    let _aws_provider = Arc::new(AwsProvider::new());
    let aws_service = RoleService::new(store.clone(), "123456789012".to_string());

    let aws_trust_policy = r#"{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "lambda.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}"#;

    let aws_role_req = CreateRoleRequest {
        role_name: "lambda-execution-role".to_string(),
        path: Some("/service-roles/".to_string()),
        assume_role_policy_document: aws_trust_policy.to_string(),
        description: Some("Role for Lambda function execution".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };

    let aws_role = aws_service.create_role(aws_role_req).await?;
    println!("✓ Created AWS Lambda execution role:");
    println!("  - ARN: {}", aws_role.arn);
    println!("  - Trust Policy: Allows lambda.amazonaws.com to assume");
    println!("  - Use case: Serverless function execution");

    // === GCP: SERVICE ACCOUNT PATTERN ===
    println!("\n\nStep 2: GCP Service Account Pattern...\n");

    let _gcp_provider = Arc::new(GcpProvider::new("my-gcp-project".to_string()));
    let gcp_service = RoleService::new(store.clone(), "my-gcp-project".to_string());

    let gcp_trust_policy = r#"{
  "bindings": [{
    "role": "roles/iam.serviceAccountUser",
    "members": ["serviceAccount:compute@my-gcp-project.iam.gserviceaccount.com"]
  }]
}"#;

    let gcp_role_req = CreateRoleRequest {
        role_name: "compute-service-account".to_string(),
        path: Some("/service-accounts/".to_string()),
        assume_role_policy_document: gcp_trust_policy.to_string(),
        description: Some("Service account for Compute Engine".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };

    let gcp_role = gcp_service.create_role(gcp_role_req).await?;
    println!("✓ Created GCP service account:");
    println!("  - ARN: {}", gcp_role.arn);
    println!("  - Bindings: Compute Engine service usage");
    println!("  - Use case: VM instance identity");

    // === AZURE: MANAGED IDENTITY PATTERN ===
    println!("\n\nStep 3: Azure Managed Identity Pattern...\n");

    let _azure_provider = Arc::new(AzureProvider::new(
        "my-subscription".to_string(),
        "default-rg".to_string(),
    ));
    let azure_service = RoleService::new(store.clone(), "my-subscription".to_string());

    let azure_trust_policy = r#"{
  "properties": {
    "principalType": "ServicePrincipal",
    "tenantId": "tenant-id",
    "type": "SystemAssigned"
  }
}"#;

    let azure_role_req = CreateRoleRequest {
        role_name: "app-managed-identity".to_string(),
        path: Some("/managed-identities/".to_string()),
        assume_role_policy_document: azure_trust_policy.to_string(),
        description: Some("Managed identity for App Service".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };

    let azure_role = azure_service.create_role(azure_role_req).await?;
    println!("✓ Created Azure managed identity:");
    println!("  - ARN: {}", azure_role.arn);
    println!("  - Type: System-assigned managed identity");
    println!("  - Use case: App Service authentication");

    // === COMPARE PATTERNS ===
    println!("\n\nStep 4: Comparing provider identity patterns...\n");

    println!("AWS IAM Roles:");
    println!("- Trust policies define who can assume the role");
    println!("- Used for cross-account and service-to-service access");
    println!("- Temporary credentials via STS");
    println!();
    println!("GCP Service Accounts:");
    println!("- Special type of account for applications");
    println!("- IAM bindings control permissions");
    println!("- Can be impersonated by other principals");
    println!();
    println!("Azure Managed Identities:");
    println!("- Automatically managed by Azure");
    println!("- System-assigned (bound to resource) or User-assigned");
    println!("- No credential management required");

    // === DEMONSTRATE UNIFIED VIEW ===
    println!("\n\nStep 5: Unified view across providers...\n");

    let (all_roles, _, _) = aws_service
        .list_roles(ListRolesRequest {
            path_prefix: None,
            pagination: None,
        })
        .await?;
    println!(
        "✓ Total roles/identities across all providers: {}",
        all_roles.len()
    );
    for role in &all_roles {
        let provider = if role.arn.contains("aws") {
            "AWS"
        } else if role.arn.contains("gcp") {
            "GCP"
        } else {
            "Azure"
        };
        println!("  - {} ({}) → {}", role.role_name, provider, role.arn);
    }

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- Each provider has unique identity patterns");
    println!("- WAMI abstracts differences while preserving provider semantics");
    println!("- Trust policies define security boundaries");
    println!("- Choose patterns based on provider strengths");

    Ok(())
}

examples/16_role_based_access_control.rs (line 29)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Role-Based Access Control (RBAC) ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
    let _provider = Arc::new(AwsProvider::new());
    let account_id = "123456789012";

    let user_service = UserService::new(store.clone(), account_id.to_string());
    let role_service = RoleService::new(store.clone(), account_id.to_string());
    let policy_service = PolicyService::new(store.clone(), account_id.to_string());

    // === CREATE POLICIES ===
    println!("Step 1: Creating role policies...\n");

    let _admin_policy = policy_service.create_policy(CreatePolicyRequest {
        policy_name: "AdminPolicy".to_string(),
        path: Some("/rbac/".to_string()),
        policy_document: r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}"#.to_string(),
        description: Some("Full admin access".to_string()),
        tags: None,
    }).await?;
    println!("✓ Created AdminPolicy");

    let _dev_policy = policy_service.create_policy(CreatePolicyRequest {
        policy_name: "DeveloperPolicy".to_string(),
        path: Some("/rbac/".to_string()),
        policy_document: r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:*","lambda:*"],"Resource":"*"}]}"#.to_string(),
        description: Some("Developer access to S3 and Lambda".to_string()),
        tags: None,
    }).await?;
    println!("✓ Created DeveloperPolicy");

    let _viewer_policy = policy_service.create_policy(CreatePolicyRequest {
        policy_name: "ViewerPolicy".to_string(),
        path: Some("/rbac/".to_string()),
        policy_document: r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:Get*","s3:List*"],"Resource":"*"}]}"#.to_string(),
        description: Some("Read-only access".to_string()),
        tags: None,
    }).await?;
    println!("✓ Created ViewerPolicy");

    // === CREATE ROLES ===
    println!("\n\nStep 2: Creating roles...\n");

    let trust_policy = r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"sts:AssumeRole"}]}"#;

    let admin_role = role_service
        .create_role(CreateRoleRequest {
            role_name: "Admin".to_string(),
            path: Some("/rbac/".to_string()),
            assume_role_policy_document: trust_policy.to_string(),
            description: Some("Administrator role".to_string()),
            max_session_duration: Some(3600),
            permissions_boundary: None,
            tags: None,
        })
        .await?;
    println!("✓ Created Admin role: {}", admin_role.arn);

    let dev_role = role_service
        .create_role(CreateRoleRequest {
            role_name: "Developer".to_string(),
            path: Some("/rbac/".to_string()),
            assume_role_policy_document: trust_policy.to_string(),
            description: Some("Developer role".to_string()),
            max_session_duration: Some(7200),
            permissions_boundary: None,
            tags: None,
        })
        .await?;
    println!("✓ Created Developer role: {}", dev_role.arn);

    let viewer_role = role_service
        .create_role(CreateRoleRequest {
            role_name: "Viewer".to_string(),
            path: Some("/rbac/".to_string()),
            assume_role_policy_document: trust_policy.to_string(),
            description: Some("Viewer role".to_string()),
            max_session_duration: Some(3600),
            permissions_boundary: None,
            tags: None,
        })
        .await?;
    println!("✓ Created Viewer role: {}", viewer_role.arn);

    // === CREATE USERS ===
    println!("\n\nStep 3: Creating users...\n");

    user_service
        .create_user(CreateUserRequest {
            user_name: "alice".to_string(),
            path: Some("/team/".to_string()),
            permissions_boundary: None,
            tags: Some(vec![wami::types::Tag {
                key: "Role".to_string(),
                value: "Admin".to_string(),
            }]),
        })
        .await?;
    println!("✓ Created alice (will be assigned Admin role)");

    user_service
        .create_user(CreateUserRequest {
            user_name: "bob".to_string(),
            path: Some("/team/".to_string()),
            permissions_boundary: None,
            tags: Some(vec![wami::types::Tag {
                key: "Role".to_string(),
                value: "Developer".to_string(),
            }]),
        })
        .await?;
    println!("✓ Created bob (will be assigned Developer role)");

    user_service
        .create_user(CreateUserRequest {
            user_name: "charlie".to_string(),
            path: Some("/team/".to_string()),
            permissions_boundary: None,
            tags: Some(vec![wami::types::Tag {
                key: "Role".to_string(),
                value: "Viewer".to_string(),
            }]),
        })
        .await?;
    println!("✓ Created charlie (will be assigned Viewer role)");

    // === DEMONSTRATE RBAC ===
    println!("\n\nStep 4: Understanding RBAC pattern...\n");

    println!("RBAC structure created:");
    println!();
    println!("Roles → Policies:");
    println!("  Admin → AdminPolicy (full access)");
    println!("  Developer → DeveloperPolicy (S3 + Lambda)");
    println!("  Viewer → ViewerPolicy (read-only)");
    println!();
    println!("Users → Roles (via AssumeRole):");
    println!("  alice → Admin");
    println!("  bob → Developer");
    println!("  charlie → Viewer");
    println!();
    println!("Benefits of RBAC:");
    println!("- Centralized permission management");
    println!("- Easy to add/remove users from roles");
    println!("- Consistent permissions across teams");
    println!("- Simplified auditing");

    println!("\n✅ Example completed successfully!");

    Ok(())
}

examples/23_permissions_boundaries.rs (line 39)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== WAMI Example 23: Permissions Boundaries ===\n");

    // Initialize store and services
    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
    let account_id = "123456789012";
    let _provider = Arc::new(AwsProvider::new());

    let user_service = UserService::new(store.clone(), account_id.to_string());
    let role_service = RoleService::new(store.clone(), account_id.to_string());
    let policy_service = PolicyService::new(store.clone(), account_id.to_string());
    let boundary_service = PermissionsBoundaryService::new(store.clone(), account_id.to_string());
    let evaluation_service = EvaluationService::new(store.clone(), account_id.to_string());

    // ==========================================
    // Part 1: Create User with Admin Policy
    // ==========================================
    println!("📋 Part 1: Creating User with Admin Policy\n");

    // Create a user
    let alice_req = CreateUserRequest {
        user_name: "alice".to_string(),
        path: Some("/developers/".to_string()),
        permissions_boundary: None,
        tags: None,
    };
    let alice = user_service.create_user(alice_req).await?;
    println!("✅ Created user: {}", alice.user_name);
    println!("   ARN: {}\n", alice.arn);

    // Create an admin policy (allows all actions)
    let admin_policy_doc = r#"{
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }]
    }"#;
    let admin_policy = policy_service
        .create_policy(CreatePolicyRequest {
            policy_name: "AdminPolicy".to_string(),
            policy_document: admin_policy_doc.to_string(),
            path: Some("/".to_string()),
            description: Some("Full admin access".to_string()),
            tags: None,
        })
        .await?;
    println!("✅ Created admin policy: {}", admin_policy.policy_name);
    println!("   ARN: {}", admin_policy.arn);
    println!("   Allows: All actions on all resources\n");

    // ==========================================
    // Part 2: Create S3-Only Boundary Policy
    // ==========================================
    println!("📋 Part 2: Creating S3-Only Boundary Policy\n");

    let s3_boundary_doc = r#"{
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
        }]
    }"#;
    let s3_boundary = policy_service
        .create_policy(CreatePolicyRequest {
            policy_name: "S3OnlyBoundary".to_string(),
            policy_document: s3_boundary_doc.to_string(),
            path: Some("/boundaries/".to_string()),
            description: Some("Limits permissions to S3 only".to_string()),
            tags: None,
        })
        .await?;
    println!("✅ Created boundary policy: {}", s3_boundary.policy_name);
    println!("   ARN: {}", s3_boundary.arn);
    println!("   Allows: Only S3 actions\n");

    // ==========================================
    // Part 3: Test Without Boundary
    // ==========================================
    println!("📋 Part 3: Testing Permissions WITHOUT Boundary\n");

    // Simulate alice's permissions (admin policy allows everything)
    let sim_req = SimulatePrincipalPolicyRequest {
        policy_source_arn: alice.arn.clone(),
        action_names: vec![
            "s3:GetObject".to_string(),
            "ec2:RunInstances".to_string(),
            "iam:CreateUser".to_string(),
        ],
        resource_arns: Some(vec!["*".to_string()]),
        policy_input_list: Some(vec![admin_policy_doc.to_string()]),
        context_entries: None,
    };

    let results = evaluation_service
        .simulate_principal_policy(sim_req)
        .await?;

    println!("Action Evaluation Results:");
    for result in &results.evaluation_results {
        println!(
            "  • {} on {} → {}",
            result.eval_action_name, result.eval_resource_name, result.eval_decision
        );
    }
    println!();

    // ==========================================
    // Part 4: Attach Boundary to User
    // ==========================================
    println!("📋 Part 4: Attaching S3-Only Boundary to User\n");

    let put_boundary_req = PutPermissionsBoundaryRequest {
        principal_type: PrincipalType::User,
        principal_name: "alice".to_string(),
        permissions_boundary: s3_boundary.arn.clone(),
    };
    boundary_service
        .put_permissions_boundary(put_boundary_req)
        .await?;
    println!("✅ Attached permissions boundary to alice");
    println!("   Boundary: {}", s3_boundary.arn);
    println!("   Effect: Alice's permissions are now limited to S3 actions only\n");

    // ==========================================
    // Part 5: Test WITH Boundary
    // ==========================================
    println!("📋 Part 5: Testing Permissions WITH Boundary\n");

    let sim_req_with_boundary = SimulatePrincipalPolicyRequest {
        policy_source_arn: alice.arn.clone(),
        action_names: vec![
            "s3:GetObject".to_string(),
            "s3:PutObject".to_string(),
            "ec2:RunInstances".to_string(),
            "iam:CreateUser".to_string(),
        ],
        resource_arns: Some(vec!["*".to_string()]),
        policy_input_list: Some(vec![admin_policy_doc.to_string()]),
        context_entries: None,
    };

    let results_with_boundary = evaluation_service
        .simulate_principal_policy(sim_req_with_boundary)
        .await?;

    println!("Action Evaluation Results (with boundary):");
    for result in &results_with_boundary.evaluation_results {
        let status = match result.eval_decision.as_str() {
            "allowed" => "✅ ALLOWED",
            "denied" => "❌ DENIED",
            _ => "⚠️  IMPLICIT DENY",
        };
        println!(
            "  {} → {} ({})",
            result.eval_action_name, status, result.eval_decision
        );
    }
    println!("\n📝 Notice:");
    println!("   • S3 actions are ALLOWED (both policy and boundary allow)");
    println!("   • EC2 and IAM actions are DENIED (boundary restricts them)\n");

    // ==========================================
    // Part 6: Boundary with Roles
    // ==========================================
    println!("📋 Part 6: Using Boundaries with Roles\n");

    // Create a role with assume policy
    let assume_policy_doc = r#"{
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Principal": {"Service": "ec2.amazonaws.com"},
            "Action": "sts:AssumeRole"
        }]
    }"#;

    let dev_role_req = CreateRoleRequest {
        role_name: "DeveloperRole".to_string(),
        assume_role_policy_document: assume_policy_doc.to_string(),
        path: Some("/roles/".to_string()),
        description: Some("Role for developers".to_string()),
        max_session_duration: None,
        permissions_boundary: None,
        tags: None,
    };
    let dev_role = role_service.create_role(dev_role_req).await?;
    println!("✅ Created role: {}", dev_role.role_name);
    println!("   ARN: {}\n", dev_role.arn);

    // Create a read-only boundary
    let read_only_boundary_doc = r#"{
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": [
                "s3:Get*",
                "s3:List*",
                "ec2:Describe*"
            ],
            "Resource": "*"
        }]
    }"#;
    let read_only_boundary = policy_service
        .create_policy(CreatePolicyRequest {
            policy_name: "ReadOnlyBoundary".to_string(),
            policy_document: read_only_boundary_doc.to_string(),
            path: Some("/boundaries/".to_string()),
            description: Some("Limits to read-only operations".to_string()),
            tags: None,
        })
        .await?;
    println!(
        "✅ Created read-only boundary: {}",
        read_only_boundary.policy_name
    );

    // Attach boundary to role
    let put_role_boundary = PutPermissionsBoundaryRequest {
        principal_type: PrincipalType::Role,
        principal_name: "DeveloperRole".to_string(),
        permissions_boundary: read_only_boundary.arn.clone(),
    };
    boundary_service
        .put_permissions_boundary(put_role_boundary)
        .await?;
    println!("✅ Attached read-only boundary to DeveloperRole\n");

    // Test role with boundary
    let role_sim_req = SimulatePrincipalPolicyRequest {
        policy_source_arn: dev_role.arn.clone(),
        action_names: vec![
            "s3:GetObject".to_string(),
            "s3:PutObject".to_string(),
            "ec2:DescribeInstances".to_string(),
            "ec2:RunInstances".to_string(),
        ],
        resource_arns: Some(vec!["*".to_string()]),
        policy_input_list: Some(vec![admin_policy_doc.to_string()]),
        context_entries: None,
    };

    let role_results = evaluation_service
        .simulate_principal_policy(role_sim_req)
        .await?;

    println!("Role Action Evaluation (with read-only boundary):");
    for result in &role_results.evaluation_results {
        let status = match result.eval_decision.as_str() {
            "allowed" => "✅ ALLOWED",
            "denied" => "❌ DENIED",
            _ => "⚠️  IMPLICIT DENY",
        };
        println!("  {} → {} ", result.eval_action_name, status);
    }
    println!("\n📝 Notice:");
    println!("   • Read operations (Get*, Describe*) are ALLOWED");
    println!("   • Write operations (Put*, Run*) are DENIED by boundary\n");

    // ==========================================
    // Part 7: Removing Boundaries
    // ==========================================
    println!("📋 Part 7: Removing Permissions Boundaries\n");

    let delete_user_boundary = DeletePermissionsBoundaryRequest {
        principal_type: PrincipalType::User,
        principal_name: "alice".to_string(),
    };
    boundary_service
        .delete_permissions_boundary(delete_user_boundary)
        .await?;
    println!("✅ Removed boundary from alice");
    println!("   Effect: Alice now has full admin permissions again\n");

    let delete_role_boundary = DeletePermissionsBoundaryRequest {
        principal_type: PrincipalType::Role,
        principal_name: "DeveloperRole".to_string(),
    };
    boundary_service
        .delete_permissions_boundary(delete_role_boundary)
        .await?;
    println!("✅ Removed boundary from DeveloperRole\n");

    // ==========================================
    // Part 8: Real-World Use Cases
    // ==========================================
    println!("📋 Part 8: Real-World Use Cases\n");
    println!("Use Case 1: Sandbox Environments");
    println!("  - Attach boundaries to prevent developers from:");
    println!("    • Creating IAM users/roles");
    println!("    • Modifying billing/account settings");
    println!("    • Accessing production resources\n");

    println!("Use Case 2: Contractor Access");
    println!("  - Limit contractors to specific services:");
    println!("    • Allow S3 and Lambda only");
    println!("    • Prevent infrastructure changes");
    println!("    • Ensure audit trail compliance\n");

    println!("Use Case 3: Delegated Administration");
    println!("  - Allow team leads to create users but:");
    println!("    • Boundary prevents privilege escalation");
    println!("    • New users inherit safe permission limits");
    println!("    • Central security team controls boundaries\n");

    println!("Use Case 4: Multi-Tenant SaaS");
    println!("  - Each tenant gets a boundary policy:");
    println!("    • Restricts access to tenant-specific resources");
    println!("    • Prevents cross-tenant data access");
    println!("    • Simplifies per-tenant permission management\n");

    println!("=== Example 23 Complete ===");
    println!("\n🎓 Key Takeaways:");
    println!("  1. Boundaries set maximum permissions (ceiling)");
    println!("  2. Effective permissions = identity policies ∩ boundary");
    println!("  3. Both identity policy AND boundary must allow an action");
    println!("  4. Boundaries prevent privilege escalation");
    println!("  5. Use for security controls, sandboxes, and delegation");

    Ok(())
}

pub fn with_provider(&self, provider: Arc<dyn CloudProvider>) -> Self

Returns a new service instance with different provider

pub async fn create_role(&self, request: CreateRoleRequest) -> Result<Role>

Create a new role

Examples found in repository

examples/19_role_assumption_workflow.rs (lines 48-56)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Role Assumption Workflow ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
    let _provider = Arc::new(AwsProvider::new());
    let account_id = "123456789012";

    let user_service = UserService::new(store.clone(), account_id.to_string());
    let role_service = RoleService::new(store.clone(), account_id.to_string());
    let sts_service = AssumeRoleService::new(store.clone(), account_id.to_string());

    // Create user
    println!("Step 1: Creating user...\n");
    let alice = user_service
        .create_user(CreateUserRequest {
            user_name: "alice".to_string(),
            path: Some("/".to_string()),
            permissions_boundary: None,
            tags: None,
        })
        .await?;
    println!("✓ Created alice: {}", alice.arn);

    // Create elevated role
    println!("\nStep 2: Creating admin role...\n");
    let trust_policy = r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"sts:AssumeRole"}]}"#;
    let role = role_service
        .create_role(CreateRoleRequest {
            role_name: "AdminRole".to_string(),
            path: Some("/".to_string()),
            assume_role_policy_document: trust_policy.to_string(),
            description: Some("Admin role for elevated access".to_string()),
            max_session_duration: Some(3600),
            permissions_boundary: None,
            tags: None,
        })
        .await?;
    println!("✓ Created AdminRole: {}", role.arn);

    // Assume role
    println!("\nStep 3: Alice assuming AdminRole...\n");
    let assume_req = AssumeRoleRequest {
        role_arn: role.arn.clone(),
        role_session_name: "alice-admin-session".to_string(),
        duration_seconds: Some(3600),
        external_id: None,
        policy: None,
    };

    let response = sts_service.assume_role(assume_req, &alice.arn).await?;
    println!("✓ Successfully assumed role!");
    println!("  Assumed Role ARN: {}", response.assumed_role_user.arn);
    println!("  Access Key: {}", response.credentials.access_key_id);
    println!("  Expiration: {}", response.credentials.expiration);

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- AssumeRole provides temporary elevated permissions");
    println!("- Trust policies control who can assume roles");
    println!("- Session credentials expire automatically");

    Ok(())
}

examples/03_service_layer_intro.rs (line 81)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Service Layer Introduction ===\n");

    // Step 1: Initialize store with Arc<RwLock> for thread-safe access
    println!("Step 1: Initializing services...\n");
    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
    let _provider = Arc::new(AwsProvider::new());
    let account_id = "123456789012";

    // Create services
    let user_service = UserService::new(store.clone(), account_id.to_string());
    let group_service = GroupService::new(store.clone(), account_id.to_string());
    let role_service = RoleService::new(store.clone(), account_id.to_string());

    println!("✓ Services initialized");

    // === CREATE Operations via Services ===
    println!("\nStep 2: Creating resources via services...\n");

    // Create users
    println!("Creating users...");
    let alice_req = CreateUserRequest {
        user_name: "alice".to_string(),
        path: Some("/users/".to_string()),
        permissions_boundary: None,
        tags: None,
    };
    let alice = user_service.create_user(alice_req).await?;
    println!("✓ Created user: {}", alice.user_name);

    let bob_req = CreateUserRequest {
        user_name: "bob".to_string(),
        path: Some("/users/".to_string()),
        permissions_boundary: None,
        tags: None,
    };
    user_service.create_user(bob_req).await?;
    println!("✓ Created user: bob");

    // Create groups
    println!("\nCreating groups...");
    let dev_group_req = CreateGroupRequest {
        group_name: "developers".to_string(),
        path: Some("/groups/".to_string()),
        tags: None,
    };
    let dev_group = group_service.create_group(dev_group_req).await?;
    println!("✓ Created group: {}", dev_group.group_name);

    // Create role
    println!("\nCreating role...");
    let role_req = CreateRoleRequest {
        role_name: "deploy-role".to_string(),
        path: Some("/roles/".to_string()),
        assume_role_policy_document: r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"sts:AssumeRole"}]}"#.to_string(),
        description: Some("Role for deployment".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };
    let role = role_service.create_role(role_req).await?;
    println!("✓ Created role: {}", role.role_name);

    // === READ Operations via Services ===
    println!("\n\nStep 3: Reading resources via services...\n");

    // Get specific user
    let alice_retrieved = user_service.get_user("alice").await?;
    if let Some(user) = alice_retrieved {
        println!("✓ Retrieved user 'alice':");
        println!("  - User ID: {}", user.user_id);
        println!("  - ARN: {}", user.arn);
    }

    // List users
    let users = user_service
        .list_users(ListUsersRequest {
            path_prefix: None,
            pagination: None,
        })
        .await?;
    println!("\n✓ Found {} users via service:", users.0.len());
    for user in &users.0 {
        println!("  - {}", user.user_name);
    }

    // === UPDATE Operations via Services ===
    println!("\n\nStep 4: Updating resources via services...\n");

    use wami::wami::identity::user::requests::UpdateUserRequest;
    let update_req = UpdateUserRequest {
        user_name: "alice".to_string(),
        new_user_name: None,
        new_path: Some("/admin-users/".to_string()),
    };
    user_service.update_user(update_req).await?;
    println!("✓ Updated alice's path to '/admin-users/'");

    // === DELETE Operations via Services ===
    println!("\n\nStep 5: Deleting resources via services...\n");

    user_service.delete_user("bob").await?;
    println!("✓ Deleted user 'bob'");

    // Verify deletion
    let bob_check = user_service.get_user("bob").await?;
    if bob_check.is_none() {
        println!("  Verified: bob no longer exists");
    }

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- Services provide a higher-level API than raw store access");
    println!("- Arc<RwLock<Store>> enables thread-safe concurrent operations");
    println!("- Services use request/response DTOs for clean API contracts");
    println!("- Services encapsulate business logic and validation");

    Ok(())
}

examples/07_cross_tenant_role_assumption.rs (line 88)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Cross-Tenant Role Assumption ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
    let _provider = Arc::new(AwsProvider::new());

    // === SETUP TENANTS ===
    println!("Step 1: Creating two tenants...\n");

    let tenant_service = TenantService::new(store.clone(), "root".to_string());

    // Tenant A (source)
    let _tenant_a_id = TenantId::new("company-a");
    tenant_service
        .create_tenant("company-a".to_string(), Some("Company A".to_string()), None)
        .await?;
    println!("✓ Created tenant: company-a");

    // Tenant B (target)
    let _tenant_b_id = TenantId::new("company-b");
    tenant_service
        .create_tenant("company-b".to_string(), Some("Company B".to_string()), None)
        .await?;
    println!("✓ Created tenant: company-b");

    // === CREATE USER IN TENANT A ===
    println!("\nStep 2: Creating user in tenant A...\n");

    let user_service_a = UserService::new(store.clone(), "company-a".to_string());

    let alice_req = CreateUserRequest {
        user_name: "alice".to_string(),
        path: Some("/".to_string()),
        permissions_boundary: None,
        tags: None,
    };
    let alice = user_service_a.create_user(alice_req).await?;
    println!("✓ Created alice in company-a");
    println!("  ARN: {}", alice.arn);

    // === CREATE ROLE IN TENANT B WITH TRUST POLICY ===
    println!("\nStep 3: Creating cross-tenant role in tenant B...\n");

    let role_service_b = RoleService::new(store.clone(), "company-b".to_string());

    // Trust policy allowing Company A users to assume this role
    let trust_policy = r#"{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam::company-a:root"},
    "Action": "sts:AssumeRole"
  }]
}"#
    .to_string();

    let role_req = CreateRoleRequest {
        role_name: "cross-tenant-reader".to_string(),
        path: Some("/".to_string()),
        assume_role_policy_document: trust_policy,
        description: Some("Role for cross-tenant read access".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };

    let role = role_service_b.create_role(role_req).await?;
    println!("✓ Created cross-tenant-reader role in company-b");
    println!("  Role ARN: {}", role.arn);

    // === ASSUME ROLE ACROSS TENANTS ===
    println!("\nStep 4: Alice assuming role in company-b...\n");

    let sts_service = AssumeRoleService::new(
        store.clone(),
        "company-a".to_string(), // Operating from tenant A
    );

    let assume_req = AssumeRoleRequest {
        role_arn: role.arn.clone(),
        role_session_name: "alice-cross-tenant-session".to_string(),
        duration_seconds: Some(3600),
        external_id: None,
        policy: None,
    };

    let assume_response = sts_service.assume_role(assume_req, &alice.arn).await?;
    println!("✓ Alice successfully assumed cross-tenant role!");
    println!("  Credentials:");
    println!(
        "    - Access Key: {}",
        assume_response.credentials.access_key_id
    );
    println!(
        "    - Session Token: {}...",
        &assume_response.credentials.session_token[..20]
    );
    println!(
        "    - Expiration: {}",
        assume_response.credentials.expiration
    );
    println!("\n  Assumed Role:");
    println!("    - ARN: {}", assume_response.assumed_role_user.arn);
    println!(
        "    - User ID: {}",
        assume_response.assumed_role_user.assumed_role_id
    );

    // === DEMONSTRATE USE CASE ===
    println!("\n\nStep 5: Understanding cross-tenant scenarios...\n");

    println!("Cross-tenant role assumption enables:");
    println!("- Partner company collaboration");
    println!("- Outsourced operations (DevOps team accessing client resources)");
    println!("- Centralized security auditing across organizations");
    println!("- Merger & acquisition transitional access");
    println!("\nSecurity considerations:");
    println!("- Trust policies must explicitly allow cross-tenant access");
    println!("- Use external_id for additional security");
    println!("- Limit session duration to minimum required");
    println!("- Attach restrictive permission policies to the role");

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- Cross-tenant access requires explicit trust policies");
    println!("- STS provides temporary, limited-privilege credentials");
    println!("- AssumeRole creates a session with the target role's permissions");
    println!("- Credentials are time-limited and automatically expire");

    Ok(())
}

examples/12_provider_specific_features.rs (line 50)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Provider-Specific Features ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));

    // === AWS: IAM ROLES WITH TRUST POLICIES ===
    println!("Step 1: AWS IAM Role with Trust Policy...\n");

    let _aws_provider = Arc::new(AwsProvider::new());
    let aws_service = RoleService::new(store.clone(), "123456789012".to_string());

    let aws_trust_policy = r#"{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "lambda.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}"#;

    let aws_role_req = CreateRoleRequest {
        role_name: "lambda-execution-role".to_string(),
        path: Some("/service-roles/".to_string()),
        assume_role_policy_document: aws_trust_policy.to_string(),
        description: Some("Role for Lambda function execution".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };

    let aws_role = aws_service.create_role(aws_role_req).await?;
    println!("✓ Created AWS Lambda execution role:");
    println!("  - ARN: {}", aws_role.arn);
    println!("  - Trust Policy: Allows lambda.amazonaws.com to assume");
    println!("  - Use case: Serverless function execution");

    // === GCP: SERVICE ACCOUNT PATTERN ===
    println!("\n\nStep 2: GCP Service Account Pattern...\n");

    let _gcp_provider = Arc::new(GcpProvider::new("my-gcp-project".to_string()));
    let gcp_service = RoleService::new(store.clone(), "my-gcp-project".to_string());

    let gcp_trust_policy = r#"{
  "bindings": [{
    "role": "roles/iam.serviceAccountUser",
    "members": ["serviceAccount:compute@my-gcp-project.iam.gserviceaccount.com"]
  }]
}"#;

    let gcp_role_req = CreateRoleRequest {
        role_name: "compute-service-account".to_string(),
        path: Some("/service-accounts/".to_string()),
        assume_role_policy_document: gcp_trust_policy.to_string(),
        description: Some("Service account for Compute Engine".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };

    let gcp_role = gcp_service.create_role(gcp_role_req).await?;
    println!("✓ Created GCP service account:");
    println!("  - ARN: {}", gcp_role.arn);
    println!("  - Bindings: Compute Engine service usage");
    println!("  - Use case: VM instance identity");

    // === AZURE: MANAGED IDENTITY PATTERN ===
    println!("\n\nStep 3: Azure Managed Identity Pattern...\n");

    let _azure_provider = Arc::new(AzureProvider::new(
        "my-subscription".to_string(),
        "default-rg".to_string(),
    ));
    let azure_service = RoleService::new(store.clone(), "my-subscription".to_string());

    let azure_trust_policy = r#"{
  "properties": {
    "principalType": "ServicePrincipal",
    "tenantId": "tenant-id",
    "type": "SystemAssigned"
  }
}"#;

    let azure_role_req = CreateRoleRequest {
        role_name: "app-managed-identity".to_string(),
        path: Some("/managed-identities/".to_string()),
        assume_role_policy_document: azure_trust_policy.to_string(),
        description: Some("Managed identity for App Service".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };

    let azure_role = azure_service.create_role(azure_role_req).await?;
    println!("✓ Created Azure managed identity:");
    println!("  - ARN: {}", azure_role.arn);
    println!("  - Type: System-assigned managed identity");
    println!("  - Use case: App Service authentication");

    // === COMPARE PATTERNS ===
    println!("\n\nStep 4: Comparing provider identity patterns...\n");

    println!("AWS IAM Roles:");
    println!("- Trust policies define who can assume the role");
    println!("- Used for cross-account and service-to-service access");
    println!("- Temporary credentials via STS");
    println!();
    println!("GCP Service Accounts:");
    println!("- Special type of account for applications");
    println!("- IAM bindings control permissions");
    println!("- Can be impersonated by other principals");
    println!();
    println!("Azure Managed Identities:");
    println!("- Automatically managed by Azure");
    println!("- System-assigned (bound to resource) or User-assigned");
    println!("- No credential management required");

    // === DEMONSTRATE UNIFIED VIEW ===
    println!("\n\nStep 5: Unified view across providers...\n");

    let (all_roles, _, _) = aws_service
        .list_roles(ListRolesRequest {
            path_prefix: None,
            pagination: None,
        })
        .await?;
    println!(
        "✓ Total roles/identities across all providers: {}",
        all_roles.len()
    );
    for role in &all_roles {
        let provider = if role.arn.contains("aws") {
            "AWS"
        } else if role.arn.contains("gcp") {
            "GCP"
        } else {
            "Azure"
        };
        println!("  - {} ({}) → {}", role.role_name, provider, role.arn);
    }

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- Each provider has unique identity patterns");
    println!("- WAMI abstracts differences while preserving provider semantics");
    println!("- Trust policies define security boundaries");
    println!("- Choose patterns based on provider strengths");

    Ok(())
}

examples/16_role_based_access_control.rs (lines 68-76)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Role-Based Access Control (RBAC) ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
    let _provider = Arc::new(AwsProvider::new());
    let account_id = "123456789012";

    let user_service = UserService::new(store.clone(), account_id.to_string());
    let role_service = RoleService::new(store.clone(), account_id.to_string());
    let policy_service = PolicyService::new(store.clone(), account_id.to_string());

    // === CREATE POLICIES ===
    println!("Step 1: Creating role policies...\n");

    let _admin_policy = policy_service.create_policy(CreatePolicyRequest {
        policy_name: "AdminPolicy".to_string(),
        path: Some("/rbac/".to_string()),
        policy_document: r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}"#.to_string(),
        description: Some("Full admin access".to_string()),
        tags: None,
    }).await?;
    println!("✓ Created AdminPolicy");

    let _dev_policy = policy_service.create_policy(CreatePolicyRequest {
        policy_name: "DeveloperPolicy".to_string(),
        path: Some("/rbac/".to_string()),
        policy_document: r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:*","lambda:*"],"Resource":"*"}]}"#.to_string(),
        description: Some("Developer access to S3 and Lambda".to_string()),
        tags: None,
    }).await?;
    println!("✓ Created DeveloperPolicy");

    let _viewer_policy = policy_service.create_policy(CreatePolicyRequest {
        policy_name: "ViewerPolicy".to_string(),
        path: Some("/rbac/".to_string()),
        policy_document: r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:Get*","s3:List*"],"Resource":"*"}]}"#.to_string(),
        description: Some("Read-only access".to_string()),
        tags: None,
    }).await?;
    println!("✓ Created ViewerPolicy");

    // === CREATE ROLES ===
    println!("\n\nStep 2: Creating roles...\n");

    let trust_policy = r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"sts:AssumeRole"}]}"#;

    let admin_role = role_service
        .create_role(CreateRoleRequest {
            role_name: "Admin".to_string(),
            path: Some("/rbac/".to_string()),
            assume_role_policy_document: trust_policy.to_string(),
            description: Some("Administrator role".to_string()),
            max_session_duration: Some(3600),
            permissions_boundary: None,
            tags: None,
        })
        .await?;
    println!("✓ Created Admin role: {}", admin_role.arn);

    let dev_role = role_service
        .create_role(CreateRoleRequest {
            role_name: "Developer".to_string(),
            path: Some("/rbac/".to_string()),
            assume_role_policy_document: trust_policy.to_string(),
            description: Some("Developer role".to_string()),
            max_session_duration: Some(7200),
            permissions_boundary: None,
            tags: None,
        })
        .await?;
    println!("✓ Created Developer role: {}", dev_role.arn);

    let viewer_role = role_service
        .create_role(CreateRoleRequest {
            role_name: "Viewer".to_string(),
            path: Some("/rbac/".to_string()),
            assume_role_policy_document: trust_policy.to_string(),
            description: Some("Viewer role".to_string()),
            max_session_duration: Some(3600),
            permissions_boundary: None,
            tags: None,
        })
        .await?;
    println!("✓ Created Viewer role: {}", viewer_role.arn);

    // === CREATE USERS ===
    println!("\n\nStep 3: Creating users...\n");

    user_service
        .create_user(CreateUserRequest {
            user_name: "alice".to_string(),
            path: Some("/team/".to_string()),
            permissions_boundary: None,
            tags: Some(vec![wami::types::Tag {
                key: "Role".to_string(),
                value: "Admin".to_string(),
            }]),
        })
        .await?;
    println!("✓ Created alice (will be assigned Admin role)");

    user_service
        .create_user(CreateUserRequest {
            user_name: "bob".to_string(),
            path: Some("/team/".to_string()),
            permissions_boundary: None,
            tags: Some(vec![wami::types::Tag {
                key: "Role".to_string(),
                value: "Developer".to_string(),
            }]),
        })
        .await?;
    println!("✓ Created bob (will be assigned Developer role)");

    user_service
        .create_user(CreateUserRequest {
            user_name: "charlie".to_string(),
            path: Some("/team/".to_string()),
            permissions_boundary: None,
            tags: Some(vec![wami::types::Tag {
                key: "Role".to_string(),
                value: "Viewer".to_string(),
            }]),
        })
        .await?;
    println!("✓ Created charlie (will be assigned Viewer role)");

    // === DEMONSTRATE RBAC ===
    println!("\n\nStep 4: Understanding RBAC pattern...\n");

    println!("RBAC structure created:");
    println!();
    println!("Roles → Policies:");
    println!("  Admin → AdminPolicy (full access)");
    println!("  Developer → DeveloperPolicy (S3 + Lambda)");
    println!("  Viewer → ViewerPolicy (read-only)");
    println!();
    println!("Users → Roles (via AssumeRole):");
    println!("  alice → Admin");
    println!("  bob → Developer");
    println!("  charlie → Viewer");
    println!();
    println!("Benefits of RBAC:");
    println!("- Centralized permission management");
    println!("- Easy to add/remove users from roles");
    println!("- Consistent permissions across teams");
    println!("- Simplified auditing");

    println!("\n✅ Example completed successfully!");

    Ok(())
}

examples/23_permissions_boundaries.rs (line 218)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== WAMI Example 23: Permissions Boundaries ===\n");

    // Initialize store and services
    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
    let account_id = "123456789012";
    let _provider = Arc::new(AwsProvider::new());

    let user_service = UserService::new(store.clone(), account_id.to_string());
    let role_service = RoleService::new(store.clone(), account_id.to_string());
    let policy_service = PolicyService::new(store.clone(), account_id.to_string());
    let boundary_service = PermissionsBoundaryService::new(store.clone(), account_id.to_string());
    let evaluation_service = EvaluationService::new(store.clone(), account_id.to_string());

    // ==========================================
    // Part 1: Create User with Admin Policy
    // ==========================================
    println!("📋 Part 1: Creating User with Admin Policy\n");

    // Create a user
    let alice_req = CreateUserRequest {
        user_name: "alice".to_string(),
        path: Some("/developers/".to_string()),
        permissions_boundary: None,
        tags: None,
    };
    let alice = user_service.create_user(alice_req).await?;
    println!("✅ Created user: {}", alice.user_name);
    println!("   ARN: {}\n", alice.arn);

    // Create an admin policy (allows all actions)
    let admin_policy_doc = r#"{
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }]
    }"#;
    let admin_policy = policy_service
        .create_policy(CreatePolicyRequest {
            policy_name: "AdminPolicy".to_string(),
            policy_document: admin_policy_doc.to_string(),
            path: Some("/".to_string()),
            description: Some("Full admin access".to_string()),
            tags: None,
        })
        .await?;
    println!("✅ Created admin policy: {}", admin_policy.policy_name);
    println!("   ARN: {}", admin_policy.arn);
    println!("   Allows: All actions on all resources\n");

    // ==========================================
    // Part 2: Create S3-Only Boundary Policy
    // ==========================================
    println!("📋 Part 2: Creating S3-Only Boundary Policy\n");

    let s3_boundary_doc = r#"{
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
        }]
    }"#;
    let s3_boundary = policy_service
        .create_policy(CreatePolicyRequest {
            policy_name: "S3OnlyBoundary".to_string(),
            policy_document: s3_boundary_doc.to_string(),
            path: Some("/boundaries/".to_string()),
            description: Some("Limits permissions to S3 only".to_string()),
            tags: None,
        })
        .await?;
    println!("✅ Created boundary policy: {}", s3_boundary.policy_name);
    println!("   ARN: {}", s3_boundary.arn);
    println!("   Allows: Only S3 actions\n");

    // ==========================================
    // Part 3: Test Without Boundary
    // ==========================================
    println!("📋 Part 3: Testing Permissions WITHOUT Boundary\n");

    // Simulate alice's permissions (admin policy allows everything)
    let sim_req = SimulatePrincipalPolicyRequest {
        policy_source_arn: alice.arn.clone(),
        action_names: vec![
            "s3:GetObject".to_string(),
            "ec2:RunInstances".to_string(),
            "iam:CreateUser".to_string(),
        ],
        resource_arns: Some(vec!["*".to_string()]),
        policy_input_list: Some(vec![admin_policy_doc.to_string()]),
        context_entries: None,
    };

    let results = evaluation_service
        .simulate_principal_policy(sim_req)
        .await?;

    println!("Action Evaluation Results:");
    for result in &results.evaluation_results {
        println!(
            "  • {} on {} → {}",
            result.eval_action_name, result.eval_resource_name, result.eval_decision
        );
    }
    println!();

    // ==========================================
    // Part 4: Attach Boundary to User
    // ==========================================
    println!("📋 Part 4: Attaching S3-Only Boundary to User\n");

    let put_boundary_req = PutPermissionsBoundaryRequest {
        principal_type: PrincipalType::User,
        principal_name: "alice".to_string(),
        permissions_boundary: s3_boundary.arn.clone(),
    };
    boundary_service
        .put_permissions_boundary(put_boundary_req)
        .await?;
    println!("✅ Attached permissions boundary to alice");
    println!("   Boundary: {}", s3_boundary.arn);
    println!("   Effect: Alice's permissions are now limited to S3 actions only\n");

    // ==========================================
    // Part 5: Test WITH Boundary
    // ==========================================
    println!("📋 Part 5: Testing Permissions WITH Boundary\n");

    let sim_req_with_boundary = SimulatePrincipalPolicyRequest {
        policy_source_arn: alice.arn.clone(),
        action_names: vec![
            "s3:GetObject".to_string(),
            "s3:PutObject".to_string(),
            "ec2:RunInstances".to_string(),
            "iam:CreateUser".to_string(),
        ],
        resource_arns: Some(vec!["*".to_string()]),
        policy_input_list: Some(vec![admin_policy_doc.to_string()]),
        context_entries: None,
    };

    let results_with_boundary = evaluation_service
        .simulate_principal_policy(sim_req_with_boundary)
        .await?;

    println!("Action Evaluation Results (with boundary):");
    for result in &results_with_boundary.evaluation_results {
        let status = match result.eval_decision.as_str() {
            "allowed" => "✅ ALLOWED",
            "denied" => "❌ DENIED",
            _ => "⚠️  IMPLICIT DENY",
        };
        println!(
            "  {} → {} ({})",
            result.eval_action_name, status, result.eval_decision
        );
    }
    println!("\n📝 Notice:");
    println!("   • S3 actions are ALLOWED (both policy and boundary allow)");
    println!("   • EC2 and IAM actions are DENIED (boundary restricts them)\n");

    // ==========================================
    // Part 6: Boundary with Roles
    // ==========================================
    println!("📋 Part 6: Using Boundaries with Roles\n");

    // Create a role with assume policy
    let assume_policy_doc = r#"{
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Principal": {"Service": "ec2.amazonaws.com"},
            "Action": "sts:AssumeRole"
        }]
    }"#;

    let dev_role_req = CreateRoleRequest {
        role_name: "DeveloperRole".to_string(),
        assume_role_policy_document: assume_policy_doc.to_string(),
        path: Some("/roles/".to_string()),
        description: Some("Role for developers".to_string()),
        max_session_duration: None,
        permissions_boundary: None,
        tags: None,
    };
    let dev_role = role_service.create_role(dev_role_req).await?;
    println!("✅ Created role: {}", dev_role.role_name);
    println!("   ARN: {}\n", dev_role.arn);

    // Create a read-only boundary
    let read_only_boundary_doc = r#"{
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": [
                "s3:Get*",
                "s3:List*",
                "ec2:Describe*"
            ],
            "Resource": "*"
        }]
    }"#;
    let read_only_boundary = policy_service
        .create_policy(CreatePolicyRequest {
            policy_name: "ReadOnlyBoundary".to_string(),
            policy_document: read_only_boundary_doc.to_string(),
            path: Some("/boundaries/".to_string()),
            description: Some("Limits to read-only operations".to_string()),
            tags: None,
        })
        .await?;
    println!(
        "✅ Created read-only boundary: {}",
        read_only_boundary.policy_name
    );

    // Attach boundary to role
    let put_role_boundary = PutPermissionsBoundaryRequest {
        principal_type: PrincipalType::Role,
        principal_name: "DeveloperRole".to_string(),
        permissions_boundary: read_only_boundary.arn.clone(),
    };
    boundary_service
        .put_permissions_boundary(put_role_boundary)
        .await?;
    println!("✅ Attached read-only boundary to DeveloperRole\n");

    // Test role with boundary
    let role_sim_req = SimulatePrincipalPolicyRequest {
        policy_source_arn: dev_role.arn.clone(),
        action_names: vec![
            "s3:GetObject".to_string(),
            "s3:PutObject".to_string(),
            "ec2:DescribeInstances".to_string(),
            "ec2:RunInstances".to_string(),
        ],
        resource_arns: Some(vec!["*".to_string()]),
        policy_input_list: Some(vec![admin_policy_doc.to_string()]),
        context_entries: None,
    };

    let role_results = evaluation_service
        .simulate_principal_policy(role_sim_req)
        .await?;

    println!("Role Action Evaluation (with read-only boundary):");
    for result in &role_results.evaluation_results {
        let status = match result.eval_decision.as_str() {
            "allowed" => "✅ ALLOWED",
            "denied" => "❌ DENIED",
            _ => "⚠️  IMPLICIT DENY",
        };
        println!("  {} → {} ", result.eval_action_name, status);
    }
    println!("\n📝 Notice:");
    println!("   • Read operations (Get*, Describe*) are ALLOWED");
    println!("   • Write operations (Put*, Run*) are DENIED by boundary\n");

    // ==========================================
    // Part 7: Removing Boundaries
    // ==========================================
    println!("📋 Part 7: Removing Permissions Boundaries\n");

    let delete_user_boundary = DeletePermissionsBoundaryRequest {
        principal_type: PrincipalType::User,
        principal_name: "alice".to_string(),
    };
    boundary_service
        .delete_permissions_boundary(delete_user_boundary)
        .await?;
    println!("✅ Removed boundary from alice");
    println!("   Effect: Alice now has full admin permissions again\n");

    let delete_role_boundary = DeletePermissionsBoundaryRequest {
        principal_type: PrincipalType::Role,
        principal_name: "DeveloperRole".to_string(),
    };
    boundary_service
        .delete_permissions_boundary(delete_role_boundary)
        .await?;
    println!("✅ Removed boundary from DeveloperRole\n");

    // ==========================================
    // Part 8: Real-World Use Cases
    // ==========================================
    println!("📋 Part 8: Real-World Use Cases\n");
    println!("Use Case 1: Sandbox Environments");
    println!("  - Attach boundaries to prevent developers from:");
    println!("    • Creating IAM users/roles");
    println!("    • Modifying billing/account settings");
    println!("    • Accessing production resources\n");

    println!("Use Case 2: Contractor Access");
    println!("  - Limit contractors to specific services:");
    println!("    • Allow S3 and Lambda only");
    println!("    • Prevent infrastructure changes");
    println!("    • Ensure audit trail compliance\n");

    println!("Use Case 3: Delegated Administration");
    println!("  - Allow team leads to create users but:");
    println!("    • Boundary prevents privilege escalation");
    println!("    • New users inherit safe permission limits");
    println!("    • Central security team controls boundaries\n");

    println!("Use Case 4: Multi-Tenant SaaS");
    println!("  - Each tenant gets a boundary policy:");
    println!("    • Restricts access to tenant-specific resources");
    println!("    • Prevents cross-tenant data access");
    println!("    • Simplifies per-tenant permission management\n");

    println!("=== Example 23 Complete ===");
    println!("\n🎓 Key Takeaways:");
    println!("  1. Boundaries set maximum permissions (ceiling)");
    println!("  2. Effective permissions = identity policies ∩ boundary");
    println!("  3. Both identity policy AND boundary must allow an action");
    println!("  4. Boundaries prevent privilege escalation");
    println!("  5. Use for security controls, sandboxes, and delegation");

    Ok(())
}

pub async fn get_role(&self, role_name: &str) -> Result<Option<Role>>

Get a role by name

pub async fn update_role(&self, request: UpdateRoleRequest) -> Result<Role>

Update a role

pub async fn delete_role(&self, role_name: &str) -> Result<()>

Delete a role

pub async fn list_roles( &self, request: ListRolesRequest, ) -> Result<(Vec<Role>, bool, Option<String>)>

List roles with optional filtering

Examples found in repository

examples/12_provider_specific_features.rs (lines 140-143)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Provider-Specific Features ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));

    // === AWS: IAM ROLES WITH TRUST POLICIES ===
    println!("Step 1: AWS IAM Role with Trust Policy...\n");

    let _aws_provider = Arc::new(AwsProvider::new());
    let aws_service = RoleService::new(store.clone(), "123456789012".to_string());

    let aws_trust_policy = r#"{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "lambda.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}"#;

    let aws_role_req = CreateRoleRequest {
        role_name: "lambda-execution-role".to_string(),
        path: Some("/service-roles/".to_string()),
        assume_role_policy_document: aws_trust_policy.to_string(),
        description: Some("Role for Lambda function execution".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };

    let aws_role = aws_service.create_role(aws_role_req).await?;
    println!("✓ Created AWS Lambda execution role:");
    println!("  - ARN: {}", aws_role.arn);
    println!("  - Trust Policy: Allows lambda.amazonaws.com to assume");
    println!("  - Use case: Serverless function execution");

    // === GCP: SERVICE ACCOUNT PATTERN ===
    println!("\n\nStep 2: GCP Service Account Pattern...\n");

    let _gcp_provider = Arc::new(GcpProvider::new("my-gcp-project".to_string()));
    let gcp_service = RoleService::new(store.clone(), "my-gcp-project".to_string());

    let gcp_trust_policy = r#"{
  "bindings": [{
    "role": "roles/iam.serviceAccountUser",
    "members": ["serviceAccount:compute@my-gcp-project.iam.gserviceaccount.com"]
  }]
}"#;

    let gcp_role_req = CreateRoleRequest {
        role_name: "compute-service-account".to_string(),
        path: Some("/service-accounts/".to_string()),
        assume_role_policy_document: gcp_trust_policy.to_string(),
        description: Some("Service account for Compute Engine".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };

    let gcp_role = gcp_service.create_role(gcp_role_req).await?;
    println!("✓ Created GCP service account:");
    println!("  - ARN: {}", gcp_role.arn);
    println!("  - Bindings: Compute Engine service usage");
    println!("  - Use case: VM instance identity");

    // === AZURE: MANAGED IDENTITY PATTERN ===
    println!("\n\nStep 3: Azure Managed Identity Pattern...\n");

    let _azure_provider = Arc::new(AzureProvider::new(
        "my-subscription".to_string(),
        "default-rg".to_string(),
    ));
    let azure_service = RoleService::new(store.clone(), "my-subscription".to_string());

    let azure_trust_policy = r#"{
  "properties": {
    "principalType": "ServicePrincipal",
    "tenantId": "tenant-id",
    "type": "SystemAssigned"
  }
}"#;

    let azure_role_req = CreateRoleRequest {
        role_name: "app-managed-identity".to_string(),
        path: Some("/managed-identities/".to_string()),
        assume_role_policy_document: azure_trust_policy.to_string(),
        description: Some("Managed identity for App Service".to_string()),
        max_session_duration: Some(3600),
        permissions_boundary: None,
        tags: None,
    };

    let azure_role = azure_service.create_role(azure_role_req).await?;
    println!("✓ Created Azure managed identity:");
    println!("  - ARN: {}", azure_role.arn);
    println!("  - Type: System-assigned managed identity");
    println!("  - Use case: App Service authentication");

    // === COMPARE PATTERNS ===
    println!("\n\nStep 4: Comparing provider identity patterns...\n");

    println!("AWS IAM Roles:");
    println!("- Trust policies define who can assume the role");
    println!("- Used for cross-account and service-to-service access");
    println!("- Temporary credentials via STS");
    println!();
    println!("GCP Service Accounts:");
    println!("- Special type of account for applications");
    println!("- IAM bindings control permissions");
    println!("- Can be impersonated by other principals");
    println!();
    println!("Azure Managed Identities:");
    println!("- Automatically managed by Azure");
    println!("- System-assigned (bound to resource) or User-assigned");
    println!("- No credential management required");

    // === DEMONSTRATE UNIFIED VIEW ===
    println!("\n\nStep 5: Unified view across providers...\n");

    let (all_roles, _, _) = aws_service
        .list_roles(ListRolesRequest {
            path_prefix: None,
            pagination: None,
        })
        .await?;
    println!(
        "✓ Total roles/identities across all providers: {}",
        all_roles.len()
    );
    for role in &all_roles {
        let provider = if role.arn.contains("aws") {
            "AWS"
        } else if role.arn.contains("gcp") {
            "GCP"
        } else {
            "Azure"
        };
        println!("  - {} ({}) → {}", role.role_name, provider, role.arn);
    }

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- Each provider has unique identity patterns");
    println!("- WAMI abstracts differences while preserving provider semantics");
    println!("- Trust policies define security boundaries");
    println!("- Choose patterns based on provider strengths");

    Ok(())
}