AccessManagementClient.h

Go to the documentation of this file.

/*
* Copyright 2010-2015 Amazon.com, Inc. or its affiliates. All Rights Reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License").
* You may not use this file except in compliance with the License.
* A copy of the License is located at
*
*  http://aws.amazon.com/apache2.0
*
* or in the "license" file accompanying this file. This file is distributed
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied. See the License for the specific language governing
* permissions and limitations under the License.
*/
#pragma once

#include <aws/access-management/AccessManagement_EXPORTS.h>

#include <aws/core/utils/memory/AWSMemory.h>
#include <aws/core/utils/memory/stl/AWSString.h>

#include <functional>

namespace Aws
{
namespace CognitoIdentity
{

class CognitoIdentityClient;

} // namespace CognitoIdentity;

namespace IAM
{

class IAMClient;

namespace Model
{
class Group;
class Policy;
class Role;
class User;

} // Model
} // namespace IAM

namespace AccessManagement
{

enum class QueryResult
{
    YES,
    NO,
    FAILURE
};

enum class IdentityPoolRoleBindingType
{
    AUTHENTICATED,
    UNAUTHENTICATED
};

class AWS_ACCESS_MANAGEMENT_API AccessManagementClient
{
    public:

        AccessManagementClient(std::shared_ptr< Aws::IAM::IAMClient >& iamClient, std::shared_ptr< Aws::CognitoIdentity::CognitoIdentityClient >& cognitoClient);
        ~AccessManagementClient();

        using PolicyGeneratorFunction = std::function< Aws::String(void) >;

        // Misc
        static Aws::String ExtractAccountIdFromArn(const Aws::String& arn);

        // Compound Operation API for IAM
        bool GetOrCreateGroup (const Aws::String& groupName, Aws::IAM::Model::Group& groupData);
        bool GetOrCreatePolicy(const Aws::String& policyName, const PolicyGeneratorFunction& policyGenerator, Aws::IAM::Model::Policy& policyData);
        bool GetOrCreateRole  (const Aws::String& roleName, const PolicyGeneratorFunction& assumedPolicyGenerator, Aws::IAM::Model::Role& roleData);
        bool GetOrCreateUser  (const Aws::String& userName, Aws::IAM::Model::User& userData);
        Aws::String GetAccountId();

        bool AttachPolicyToGroupIfNot(const Aws::IAM::Model::Policy& policyData, const Aws::String& groupName);
        bool AttachPolicyToRoleIfNot (const Aws::IAM::Model::Policy& policyData, const Aws::String& roleName);
        bool AttachPolicyToUserIfNot (const Aws::IAM::Model::Policy& policyData, const Aws::String& userName);

        bool AddUserToGroupIfNot(const Aws::String& userName, const Aws::String& groupName);

        bool VerifyOrCreateCredentialsFileForUser(const Aws::String& credentialsFilename, const Aws::String& userName);

        // Compound Operation API for Cognito
        bool GetOrCreateIdentityPool(const Aws::String& poolName, bool allowUnauthenticated, Aws::String& identityPoolId);

        bool BindRoleToIdentityPoolIfNot(const Aws::String& identityPoolId, const Aws::String& roleArn, IdentityPoolRoleBindingType roleKey);


        // Simple IAM API
        // State query
        QueryResult GetGroup (const Aws::String& groupName,  Aws::IAM::Model::Group&  groupData);
        QueryResult GetPolicy(const Aws::String& policyName, Aws::IAM::Model::Policy& policyData);
        QueryResult GetRole  (const Aws::String& roleName,   Aws::IAM::Model::Role&   roleData);
        QueryResult GetUser  (const Aws::String& userName,   Aws::IAM::Model::User&   userData);

        // Creation
        bool CreateGroup (const Aws::String& groupName, Aws::IAM::Model::Group& groupData);
        bool CreatePolicy(const Aws::String& policyName, const Aws::String& policyDocument, Aws::IAM::Model::Policy& policyData);
        bool CreateRole  (const Aws::String& roleName, const Aws::String& assumedPolicyDocument, Aws::IAM::Model::Role& roleData);
        bool CreateUser  (const Aws::String& userName, Aws::IAM::Model::User& userData);

        // Policy-Principal Relations
        bool AttachPolicyToGroup(const Aws::String& policyArn, const Aws::String& groupName);
        bool AttachPolicyToRole (const Aws::String& policyArn, const Aws::String& roleName);
        bool AttachPolicyToUser (const Aws::String& policyArn, const Aws::String& userName);

        bool DetachPolicyFromGroup(const Aws::String& policyArn, const Aws::String& groupName);
        bool DetachPolicyFromRole (const Aws::String& policyArn, const Aws::String& roleName);
        bool DetachPolicyFromUser (const Aws::String& policyArn, const Aws::String& userName);

        QueryResult IsPolicyAttachedToGroup(const Aws::String& policyName, const Aws::String& groupName);
        QueryResult IsPolicyAttachedToRole (const Aws::String& policyName, const Aws::String& roleName);
        QueryResult IsPolicyAttachedToUser (const Aws::String& policyName, const Aws::String& userName);

        // User-Group Relations
        QueryResult IsUserInGroup(const Aws::String& userName, const Aws::String& groupName);
        bool AddUserToGroup      (const Aws::String& userName, const Aws::String& groupName);
        bool RemoveUserFromGroup (const Aws::String& userName, const Aws::String& groupName);

        // Deletion
        bool DeleteGroup (const Aws::String& groupName);
        bool DeletePolicy(const Aws::String& policyName);
        bool DeleteRole  (const Aws::String& roleName);
        bool DeleteUser  (const Aws::String& userName);       

        bool DoesCredentialsFileExist    (const Aws::String& credentialsFilename);
        bool CreateCredentialsFileForUser(const Aws::String& credentialsFilename, const Aws::String& userName);

        //
        // Cognito integration
        QueryResult GetIdentityPool   (const Aws::String& poolName, Aws::String& identityPoolId);
        bool        CreateIdentityPool(const Aws::String& poolName, bool allowUnauthenticated, Aws::String& identityPoolId);
        bool        DeleteIdentityPool(const Aws::String& poolName);


        QueryResult IsRoleBoundToIdentityPool(const Aws::String& identityPoolId, const Aws::String& roleArn, IdentityPoolRoleBindingType roleKey);
        bool        BindRoleToIdentityPool   (const Aws::String& identityPoolId, const Aws::String& roleArn, IdentityPoolRoleBindingType roleKey);

    private:

        bool RemoveUsersFromGroup(const Aws::String& groupName);
        bool DetachPoliciesFromGroup(const Aws::String& groupName);
        bool DeleteInlinePoliciesFromGroup(const Aws::String& groupName);

        bool DeleteAccessKeysForUser(const Aws::String& userName);
        bool RemoveUserFromGroups(const Aws::String& userName);
        bool RemoveCertificatesFromUser(const Aws::String& userName);
        bool RemovePasswordFromUser(const Aws::String& userName);
        bool DeleteInlinePoliciesFromUser(const Aws::String& userName);
        bool RemoveMFAFromUser(const Aws::String& userName);
        bool DetachPoliciesFromUser(const Aws::String& userName);

        bool RemovePolicyFromEntities(const Aws::String& policyArn);

        bool RemoveRoleFromInstanceProfiles(const Aws::String& roleName);
        bool DeleteInlinePoliciesFromRole(const Aws::String& roleName);
        bool DetachPoliciesFromRole(const Aws::String& roleName);

        std::shared_ptr< Aws::IAM::IAMClient > m_iamClient;
        std::shared_ptr< Aws::CognitoIdentity::CognitoIdentityClient > m_cognitoClient;

};




} // namespace AccessManagement
} // namespace Aws