2020-06-10 17:58:52 -04:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2023-02-02 17:15:17 -08:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
|
|
2020-06-10 17:58:52 -04:00
|
|
|
/*
|
2020-08-10 17:15:02 -04:00
|
|
|
Package perms provides the boundary permissions engine using grants which are
|
2020-06-10 17:58:52 -04:00
|
|
|
tied to IAM Roles within a Scope.
|
|
|
|
|
|
|
|
|
|
A really useful page to be aware of when looking at ACLs is
|
|
|
|
|
https://hashicorp.atlassian.net/wiki/spaces/ICU/pages/866976600/API+Actions+and+Permissions
|
|
|
|
|
speaking of which: TODO: put that chart in public docs.
|
|
|
|
|
|
|
|
|
|
Anyways, from that page you can see that there are really only a few patterns of
|
|
|
|
|
ACLs that are ever allowed:
|
|
|
|
|
|
|
|
|
|
* type=<resource.type>;actions=<action>
|
|
|
|
|
* id=<resource.id>;actions=<action>
|
|
|
|
|
* id=<pin>;type=<resource.type>;actions=<action>
|
|
|
|
|
|
|
|
|
|
and of course a matching scope.
|
|
|
|
|
|
|
|
|
|
This makes it actually quite simple to perform the ACL checking. Much of ACL
|
|
|
|
|
construction is thus synthesizing something reasonable from a set of Grants.
|
|
|
|
|
*/
|
|
|
|
|
package perms
|
