ExStorageService.IAM.Policy (ex_storage_service v0.6.2)

IAM Policy engine backed by Concord key-value store.

Policies are stored with the key pattern: "policy:{policy_id}" User-policy attachments are stored as: "user_policies:{user_id}"

Policy evaluation follows AWS-style logic:

Collect all matching statements from the user's attached policies
If any statement has effect :deny -> DENY
If any statement has effect :allow -> ALLOW
Otherwise -> DENY (default deny)

Statement format: %{effect: :allow | :deny, actions: ["s3:GetObject", "s3:"], resources: ["arn:ess:::bucket/"]}

Summary

Types

effect()

statement()

t()

Functions

action_matches?(pattern, action)

Checks if an action matches any of the given action patterns. Supports wildcard patterns like "s3:" or "".

attach_policy(user_id, policy_id)

Attaches a policy to a user.

bucket_scoped_statements(bucket)

Returns a bucket-scoped policy statement list for the given bucket. Allows all S3 actions but only on the specified bucket and its objects.

create_policy(name, statements)

Creates a new policy with the given name and list of statements.

delete_policy(policy_id)

Deletes a policy by its ID.

detach_policy(user_id, policy_id)

Detaches a policy from a user.

evaluate(user_id, action, resource)

Evaluates whether a user is allowed to perform an action on a resource.

full_access_statements()

Returns a FullAccess policy statement list.

get_policy(policy_id)

Retrieves a policy by its ID.

get_user_policies(user_id)

Gets all policies attached to a user.

list_policies()

Lists all policies.

read_only_statements()

Returns a ReadOnly policy statement list.

read_write_statements()

Returns a ReadWrite policy statement list.

resource_matches?(pattern, resource)

Checks if a resource matches any of the given resource patterns. Supports glob-style patterns like "arn:ess:::bucket/" or "".

update_policy(policy_id, attrs)

Updates a policy's fields (e.g., statements).

Types

effect()

@type effect() :: :allow | :deny

statement()

@type statement() :: %{
  effect: effect(),
  actions: [String.t()],
  resources: [String.t()]
}

t()

@type t() :: %{
  id: String.t(),
  name: String.t(),
  statements: [statement()],
  created_at: String.t()
}

Functions

action_matches?(pattern, action)

@spec action_matches?(String.t(), String.t()) :: boolean()

Checks if an action matches any of the given action patterns. Supports wildcard patterns like "s3:" or "".

attach_policy(user_id, policy_id)

@spec attach_policy(String.t(), String.t()) :: :ok | {:error, term()}

Attaches a policy to a user.

bucket_scoped_statements(bucket)

@spec bucket_scoped_statements(String.t()) :: [statement()]

Returns a bucket-scoped policy statement list for the given bucket. Allows all S3 actions but only on the specified bucket and its objects.

create_policy(name, statements)

@spec create_policy(String.t(), [statement()]) :: {:ok, t()} | {:error, term()}

Creates a new policy with the given name and list of statements.

delete_policy(policy_id)

@spec delete_policy(String.t()) :: :ok | {:error, :not_found | term()}

Deletes a policy by its ID.

detach_policy(user_id, policy_id)

@spec detach_policy(String.t(), String.t()) :: :ok | {:error, term()}

Detaches a policy from a user.

evaluate(user_id, action, resource)

@spec evaluate(String.t(), String.t(), String.t()) :: :allow | :deny

Evaluates whether a user is allowed to perform an action on a resource.

Returns :allow or :deny.

full_access_statements()

@spec full_access_statements() :: [statement()]

Returns a FullAccess policy statement list.

get_policy(policy_id)

@spec get_policy(String.t()) :: {:ok, t()} | {:error, :not_found | term()}

Retrieves a policy by its ID.

get_user_policies(user_id)

@spec get_user_policies(String.t()) :: {:ok, [t()]} | {:error, term()}

Gets all policies attached to a user.

list_policies()

@spec list_policies() :: {:ok, [t()]} | {:error, term()}

Lists all policies.

read_only_statements()

@spec read_only_statements() :: [statement()]

Returns a ReadOnly policy statement list.

read_write_statements()

@spec read_write_statements() :: [statement()]

Returns a ReadWrite policy statement list.

resource_matches?(pattern, resource)

@spec resource_matches?(String.t(), String.t()) :: boolean()

Checks if a resource matches any of the given resource patterns. Supports glob-style patterns like "arn:ess:::bucket/" or "".

update_policy(policy_id, attrs)

@spec update_policy(String.t(), map()) :: {:ok, t()} | {:error, :not_found | term()}

Updates a policy's fields (e.g., statements).