ExStorageService.IAM.AccessKey (ex_storage_service v0.6.4)

IAM Access Key management backed by Concord key-value store.

Access keys are stored with the key pattern: "access_key:{access_key_id}" The secret access key is encrypted at rest using AES-256-CTR with the master key from application config.

Summary

Types

status()

t()

Functions

activate_key(access_key_id)

Activates an access key.

create_access_key(user_id)

Creates a new access key pair for the given user. Returns the access key with the plaintext secret (only time it's available).

create_fixed_access_key(user_id, access_key_id, secret_access_key)

Creates an access key with fixed ID and secret. Useful for dev/test.

deactivate_key(access_key_id)

Deactivates an access key.

delete_key(access_key_id)

Deletes an access key.

get_access_key(access_key_id)

Retrieves an access key by its access key ID, with the secret decrypted.

list_user_keys(user_id)

Lists all access keys for a given user. Secrets are NOT included in the listing (masked).

lookup_by_access_key_id(access_key_id)

Looks up an access key by its ID and returns the key data with user_id. Used by the authentication plug to verify signatures.

Types

status()

@type status() :: :active | :inactive

t()

@type t() :: %{
  access_key_id: String.t(),
  secret_access_key: String.t(),
  user_id: String.t(),
  status: status(),
  created_at: String.t()
}

Functions

activate_key(access_key_id)

@spec activate_key(String.t()) :: {:ok, map()} | {:error, :not_found | term()}

Activates an access key.

create_access_key(user_id)

@spec create_access_key(String.t()) :: {:ok, t()} | {:error, term()}

Creates a new access key pair for the given user. Returns the access key with the plaintext secret (only time it's available).

create_fixed_access_key(user_id, access_key_id, secret_access_key)

@spec create_fixed_access_key(String.t(), String.t(), String.t()) ::
  {:ok, t()} | {:error, term()}

Creates an access key with fixed ID and secret. Useful for dev/test.

deactivate_key(access_key_id)

@spec deactivate_key(String.t()) :: {:ok, map()} | {:error, :not_found | term()}

Deactivates an access key.

delete_key(access_key_id)

@spec delete_key(String.t()) :: :ok | {:error, :not_found | term()}

Deletes an access key.

get_access_key(access_key_id)

@spec get_access_key(String.t()) :: {:ok, t()} | {:error, :not_found | term()}

Retrieves an access key by its access key ID, with the secret decrypted.

list_user_keys(user_id)

@spec list_user_keys(String.t()) :: {:ok, [map()]} | {:error, term()}

Lists all access keys for a given user. Secrets are NOT included in the listing (masked).

lookup_by_access_key_id(access_key_id)

@spec lookup_by_access_key_id(String.t()) ::
  {:ok, t()} | {:error, :not_found | term()}

Looks up an access key by its ID and returns the key data with user_id. Used by the authentication plug to verify signatures.