Rust AWS权限管理库aws-sdk-verifiedpermissions使用指南

概述

aws-sdk-verifiedpermissions是AWS官方提供的Rust SDK，用于与Amazon Verified Permissions服务交互，实现云服务的细粒度访问控制。该服务基于Cedar策略语言，允许开发者构建精细的权限管理系统。

主要功能

• 创建和管理权限策略
• 验证用户对资源的访问权限
• 管理策略存储库
• 细粒度的访问控制决策

使用方法

1. 添加依赖

首先在Cargo.toml中添加依赖：

[dependencies]
aws-config = "0.55"
aws-sdk-verifiedpermissions = "0.10"
tokio = { version = "1", features = ["full"] }

2. 初始化客户端

use aws_sdk_verifiedpermissions::Client;

async fn create_client() -> Client {
    let config = aws_config::load_from_env().await;
    Client::new(&config)
}

3. 创建策略存储

use aws_sdk_verifiedpermissions::model::ValidationSettings;

async fn create_policy_store(client: &Client) -> Result<(), Box<dyn std::error::Error>> {
    let validation_settings = ValidationSettings::builder()
        .mode("STRICT")  // 或"OFF"
        .build();
    
    let response = client.create_policy_store()
        .validation_settings(validation_settings)
        .send()
        .await?;
    
    println!("Policy Store ID: {:?}", response.policy_store_id());
    Ok(())
}

4. 创建策略

use aws_sdk_verifiedpermissions::model::PolicyDefinition;

async fn create_policy(
    client: &Client,
    store_id: &str,
    policy: &str,
) -> Result<(), Box<dyn std::error::Error>> {
    let policy_def = PolicyDefinition::builder()
        .static_(policy)  // Cedar策略语言
        .build();
    
    client.create_policy()
        .policy_store_id(store_id)
        .definition(policy_def)
        .send()
        .await?;
    
    Ok(())
}

5. 验证访问权限

use aws_sdk_verifiedpermissions::model::{EntityIdentifier, ActionIdentifier, ResourceIdentifier};

async fn is_authorized(
    client: &Client,
    store_id: &str,
    principal: &str,
    action: &str,
    resource: &str,
) -> Result<bool, Box<dyn std::error::Error>> {
    let principal_entity = EntityIdentifier::builder()
        .entity_type("User")
        .entity_id(principal)
        .build();
    
    let action_entity = ActionIdentifier::builder()
        .action_type("Action")
        .action_id(action)
        .build();
    
    let resource_entity = ResourceIdentifier::builder()
        .entity_type("Resource"
        .entity_id(resource)
        .build();
    
    let response = client.is_authorized()
        .policy_store_id(store_id)
        .principal(principal_entity)
        .action(action_entity)
        .resource(resource_entity)
        .send()
        .await?;
    
    Ok(response.decision() == "ALLOW")
}

示例策略

以下是一个Cedar策略示例，允许用户"alice"对"document1"执行"read"操作：

permit(
    principal == User::"alice",
    action == Action::"read",
    resource == Document::"document1"
);

完整示例

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = create_client().await;
    
    // 创建策略存储
    let store_id = {
        let response = client.create_policy_store()
            .validation_settings(ValidationSettings::builder().mode("STRICT").build())
            .send()
            .await?;
        response.policy_store_id().unwrap().to_string()
    };
    
    // 创建策略
    let policy = r#"
        permit(
            principal == User::"alice",
            action == Action::"read",
            resource == Document::"document1"
        );
    "#;
    client.create_policy()
        .policy_store_id(&store_id)
        .definition(PolicyDefinition::builder().static_(policy).build())
        .send()
        .await?;
    
    // 验证权限
    let allowed = is_authorized(
        &client,
        &store_id,
        "alice",
        "read",
        "document1"
    ).await?;
    println!("用户alice是否有读取document1的权限: {}", allowed);
    
    Ok(())
}

最佳实践

1. 使用"STRICT"验证模式确保策略安全性
2. 将常用策略模板化以减少重复代码
3. 定期审核和测试策略
4. 使用策略组来管理相关权限
5. 实现适当的错误处理和日志记录