1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
|
// Code generated by smithy-go-codegen DO NOT EDIT.
package verifiedpermissions
import (
"context"
"fmt"
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
"github.com/aws/aws-sdk-go-v2/aws/signer/v4"
"github.com/aws/aws-sdk-go-v2/service/verifiedpermissions/types"
"github.com/aws/smithy-go/middleware"
smithyhttp "github.com/aws/smithy-go/transport/http"
)
// Makes an authorization decision about a service request described in the
// parameters. The information in the parameters can also define additional context
// that Verified Permissions can include in the evaluation. The request is
// evaluated against all matching policies in the specified policy store. The
// result of the decision is either Allow or Deny , along with a list of the
// policies that resulted in the decision.
func (c *Client) IsAuthorized(ctx context.Context, params *IsAuthorizedInput, optFns ...func(*Options)) (*IsAuthorizedOutput, error) {
if params == nil {
params = &IsAuthorizedInput{}
}
result, metadata, err := c.invokeOperation(ctx, "IsAuthorized", params, optFns, c.addOperationIsAuthorizedMiddlewares)
if err != nil {
return nil, err
}
out := result.(*IsAuthorizedOutput)
out.ResultMetadata = metadata
return out, nil
}
type IsAuthorizedInput struct {
// Specifies the ID of the policy store. Policies in this policy store will be
// used to make an authorization decision for the input.
//
// This member is required.
PolicyStoreId *string
// Specifies the requested action to be authorized. For example, is the principal
// authorized to perform this action on the resource?
Action *types.ActionIdentifier
// Specifies additional context that can be used to make more granular
// authorization decisions.
Context types.ContextDefinition
// Specifies the list of resources and principals and their associated attributes
// that Verified Permissions can examine when evaluating the policies. You can
// include only principal and resource entities in this parameter; you can't
// include actions. You must specify actions in the schema.
Entities types.EntitiesDefinition
// Specifies the principal for which the authorization decision is to be made.
Principal *types.EntityIdentifier
// Specifies the resource for which the authorization decision is to be made.
Resource *types.EntityIdentifier
noSmithyDocumentSerde
}
type IsAuthorizedOutput struct {
// An authorization decision that indicates if the authorization request should be
// allowed or denied.
//
// This member is required.
Decision types.Decision
// The list of determining policies used to make the authorization decision. For
// example, if there are two matching policies, where one is a forbid and the other
// is a permit, then the forbid policy will be the determining policy. In the case
// of multiple matching permit policies then there would be multiple determining
// policies. In the case that no policies match, and hence the response is DENY,
// there would be no determining policies.
//
// This member is required.
DeterminingPolicies []types.DeterminingPolicyItem
// Errors that occurred while making an authorization decision, for example, a
// policy references an Entity or entity Attribute that does not exist in the
// slice.
//
// This member is required.
Errors []types.EvaluationErrorItem
// Metadata pertaining to the operation's result.
ResultMetadata middleware.Metadata
noSmithyDocumentSerde
}
func (c *Client) addOperationIsAuthorizedMiddlewares(stack *middleware.Stack, options Options) (err error) {
if err := stack.Serialize.Add(&setOperationInputMiddleware{}, middleware.After); err != nil {
return err
}
err = stack.Serialize.Add(&awsAwsjson10_serializeOpIsAuthorized{}, middleware.After)
if err != nil {
return err
}
err = stack.Deserialize.Add(&awsAwsjson10_deserializeOpIsAuthorized{}, middleware.After)
if err != nil {
return err
}
if err := addProtocolFinalizerMiddlewares(stack, options, "IsAuthorized"); err != nil {
return fmt.Errorf("add protocol finalizers: %v", err)
}
if err = addlegacyEndpointContextSetter(stack, options); err != nil {
return err
}
if err = addSetLoggerMiddleware(stack, options); err != nil {
return err
}
if err = awsmiddleware.AddClientRequestIDMiddleware(stack); err != nil {
return err
}
if err = smithyhttp.AddComputeContentLengthMiddleware(stack); err != nil {
return err
}
if err = addResolveEndpointMiddleware(stack, options); err != nil {
return err
}
if err = v4.AddComputePayloadSHA256Middleware(stack); err != nil {
return err
}
if err = addRetryMiddlewares(stack, options); err != nil {
return err
}
if err = awsmiddleware.AddRawResponseToMetadata(stack); err != nil {
return err
}
if err = awsmiddleware.AddRecordResponseTiming(stack); err != nil {
return err
}
if err = addClientUserAgent(stack, options); err != nil {
return err
}
if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil {
return err
}
if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil {
return err
}
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
return err
}
if err = addOpIsAuthorizedValidationMiddleware(stack); err != nil {
return err
}
if err = stack.Initialize.Add(newServiceMetadataMiddleware_opIsAuthorized(options.Region), middleware.Before); err != nil {
return err
}
if err = awsmiddleware.AddRecursionDetection(stack); err != nil {
return err
}
if err = addRequestIDRetrieverMiddleware(stack); err != nil {
return err
}
if err = addResponseErrorMiddleware(stack); err != nil {
return err
}
if err = addRequestResponseLogging(stack, options); err != nil {
return err
}
if err = addDisableHTTPSMiddleware(stack, options); err != nil {
return err
}
return nil
}
func newServiceMetadataMiddleware_opIsAuthorized(region string) *awsmiddleware.RegisterServiceMetadata {
return &awsmiddleware.RegisterServiceMetadata{
Region: region,
ServiceID: ServiceID,
OperationName: "IsAuthorized",
}
}
|
