vaultrs/auth/
aws.rs

1use crate::{
2    api::{
3        self,
4        auth::aws::requests::{Ec2LoginRequest, IamLoginRequest},
5        AuthInfo,
6    },
7    client::Client,
8    error::ClientError,
9};
10
11// See [IamLoginRequest]
12pub async fn iam_login(
13    client: &impl Client,
14    mount: &str,
15    iam_http_request_method: &str,
16    iam_request_url: &str,
17    iam_request_headers: &str,
18    iam_request_body: &str,
19    role: Option<&str>,
20) -> Result<AuthInfo, ClientError> {
21    let mut endpoint = IamLoginRequest::builder();
22
23    endpoint
24        .iam_http_request_method(iam_http_request_method)
25        .iam_request_url(iam_request_url)
26        .iam_request_headers(iam_request_headers)
27        .iam_request_body(iam_request_body);
28
29    if let Some(role) = role {
30        endpoint.role(role);
31    }
32
33    api::auth(client, endpoint.mount(mount).build().unwrap()).await
34}
35
36// See [Ec2LoginRequest]
37pub async fn ec2_login(
38    client: &impl Client,
39    mount: &str,
40    pkcs7: &str,
41    nonce: Option<&str>,
42    role: Option<&str>,
43) -> Result<AuthInfo, ClientError> {
44    let mut endpoint = Ec2LoginRequest::builder();
45
46    if let Some(nonce) = nonce {
47        endpoint.nonce(nonce);
48    }
49    if let Some(role) = role {
50        endpoint.role(role);
51    }
52    api::auth(client, endpoint.mount(mount).pkcs7(pkcs7).build().unwrap()).await
53}
54
55// modules structure depends on URI,
56// e.g /auth/aws/config/client -> `mod config { mod client { fn set, fn read, fn delete }}`
57pub mod config {
58    pub mod client {
59        use crate::{
60            api::{
61                self,
62                auth::aws::{
63                    requests::{
64                        ConfigureClientRequest, ConfigureClientRequestBuilder,
65                        DeleteClientConfigurationRequest, ReadClientConfigurationRequest,
66                        RotateRootCredentialsRequest,
67                    },
68                    responses::{ReadClientConfigurationResponse, RotateRootCredentialsResponse},
69                },
70            },
71            client::Client,
72            error::ClientError,
73        };
74
75        /// Configures the credentials required to perform API calls to AWS as well as custom endpoints to talk to AWS APIs.
76        ///
77        /// See [ConfigureClientRequest]
78        pub async fn set(
79            client: &impl Client,
80            mount: &str,
81            opts: Option<&mut ConfigureClientRequestBuilder>,
82        ) -> Result<(), ClientError> {
83            let mut t = ConfigureClientRequest::builder();
84            let endpoint = opts.unwrap_or(&mut t).mount(mount).build().unwrap();
85            api::exec_with_empty(client, endpoint).await
86        }
87
88        /// Returns the previously configured AWS access credentials.
89        ///
90        /// See [ReadClientConfigurationResponse]
91        pub async fn read(
92            client: &impl Client,
93            mount: &str,
94        ) -> Result<ReadClientConfigurationResponse, ClientError> {
95            let endpoint = ReadClientConfigurationRequest::builder()
96                .mount(mount)
97                .build()
98                .unwrap();
99            api::exec_with_result(client, endpoint).await
100        }
101
102        /// Deletes the previously configured AWS access credentials.
103        ///
104        /// See [DeleteClientConfigurationRequest]
105        pub async fn delete(client: &impl Client, mount: &str) -> Result<(), ClientError> {
106            let endpoint = DeleteClientConfigurationRequest::builder()
107                .mount(mount)
108                .build()
109                .unwrap();
110            api::exec_with_empty(client, endpoint).await
111        }
112
113        /// When you have configured Vault with static credentials, you can use this function to have Vault rotate the access key it used.
114        ///
115        /// See [RotateRootCredentialsRequest]
116        pub async fn rotate_root_credentials(
117            client: &impl Client,
118            mount: &str,
119        ) -> Result<RotateRootCredentialsResponse, ClientError> {
120            let endpoint = RotateRootCredentialsRequest::builder()
121                .mount(mount)
122                .build()
123                .unwrap();
124            api::exec_with_result(client, endpoint).await
125        }
126    }
127
128    pub mod identity {
129        use crate::{
130            api::{
131                self,
132                auth::aws::{
133                    requests::{
134                        ConfigureIdentityRequest, ConfigureIdentityRequestBuilder,
135                        ReadIdentityConfigurationRequest,
136                    },
137                    responses::ReadIdentityConfigurationResponse,
138                },
139            },
140            client::Client,
141            error::ClientError,
142        };
143
144        /// This configures the way that Vault interacts with the Identity store.
145        ///
146        /// See [ConfigureIdentityRequest]
147        pub async fn set(
148            client: &impl Client,
149            mount: &str,
150            opts: Option<&mut ConfigureIdentityRequestBuilder>,
151        ) -> Result<(), ClientError> {
152            let mut t = ConfigureIdentityRequest::builder();
153            let endpoint = opts.unwrap_or(&mut t).mount(mount).build().unwrap();
154            api::exec_with_empty(client, endpoint).await
155        }
156
157        /// Returns the previously configured Identity integration configuration
158        ///
159        /// See [ReadIdentityConfigurationResponse]
160        pub async fn read(
161            client: &impl Client,
162            mount: &str,
163        ) -> Result<ReadIdentityConfigurationResponse, ClientError> {
164            let endpoint = ReadIdentityConfigurationRequest::builder()
165                .mount(mount)
166                .build()
167                .unwrap();
168            api::exec_with_result(client, endpoint).await
169        }
170    }
171
172    pub mod certificate {
173        use crate::{
174            api::{
175                self,
176                auth::aws::{
177                    requests::{
178                        CreateCertificateConfigurationRequest,
179                        CreateCertificateConfigurationRequestBuilder,
180                        DeleteCertificateConfigurationRequest,
181                        ListCertificateConfigurationsRequest, ReadCertificateConfigurationRequest,
182                    },
183                    responses::{
184                        ListCertificateConfigurationsResponse, ReadCertificateConfigurationResponse,
185                    },
186                },
187            },
188            client::Client,
189            error::ClientError,
190        };
191
192        /// Registers an AWS public key to be used to verify the instance identity documents.
193        ///
194        /// See [CreateCertificateConfigurationRequest]
195        pub async fn create(
196            client: &impl Client,
197            mount: &str,
198            cert_name: &str,
199            aws_public_cert: &str,
200            opts: Option<&mut CreateCertificateConfigurationRequestBuilder>,
201        ) -> Result<(), ClientError> {
202            let mut t = CreateCertificateConfigurationRequest::builder();
203            let endpoint = opts
204                .unwrap_or(&mut t)
205                .mount(mount)
206                .cert_name(cert_name)
207                .aws_public_cert(aws_public_cert)
208                .build()
209                .unwrap();
210            api::exec_with_empty(client, endpoint).await
211        }
212
213        /// Returns the previously configured AWS public key.
214        ///
215        /// See [ReadCertificateConfigurationResponse]
216        pub async fn read(
217            client: &impl Client,
218            mount: &str,
219            cert_name: &str,
220        ) -> Result<ReadCertificateConfigurationResponse, ClientError> {
221            let endpoint = ReadCertificateConfigurationRequest::builder()
222                .mount(mount)
223                .cert_name(cert_name)
224                .build()
225                .unwrap();
226            api::exec_with_result(client, endpoint).await
227        }
228
229        /// Removes the previously configured AWS public key.
230        ///
231        /// See [DeleteCertificateConfigurationRequest]
232        pub async fn delete(
233            client: &impl Client,
234            mount: &str,
235            cert_name: &str,
236        ) -> Result<(), ClientError> {
237            let endpoint = DeleteCertificateConfigurationRequest::builder()
238                .mount(mount)
239                .cert_name(cert_name)
240                .build()
241                .unwrap();
242            api::exec_with_empty(client, endpoint).await
243        }
244
245        /// Lists all the AWS public certificates that are registered with the method.
246        ///
247        /// See [ListCertificateConfigurationsResponse]
248        pub async fn list(
249            client: &impl Client,
250            mount: &str,
251        ) -> Result<ListCertificateConfigurationsResponse, ClientError> {
252            let endpoint = ListCertificateConfigurationsRequest::builder()
253                .mount(mount)
254                .build()
255                .unwrap();
256            api::exec_with_result(client, endpoint).await
257        }
258    }
259
260    pub mod sts {
261        use crate::{
262            api::{
263                self,
264                auth::aws::{
265                    requests::{
266                        CreateStsRoleRequest, DeleteStsRoleRequest, ListStsRolesRequest,
267                        ReadStsRoleRequest,
268                    },
269                    responses::{ListStsRolesResponse, ReadStsRoleResponse},
270                },
271            },
272            client::Client,
273            error::ClientError,
274        };
275
276        /// Allows the explicit association of STS roles to satellite AWS accounts.
277        ///
278        /// See [CreateStsRoleRequest]
279        pub async fn create(
280            client: &impl Client,
281            mount: &str,
282            account_id: &str,
283            sts_role: &str,
284        ) -> Result<(), ClientError> {
285            let endpoint = CreateStsRoleRequest::builder()
286                .mount(mount)
287                .account_id(account_id)
288                .sts_role(sts_role)
289                .build()
290                .unwrap();
291            api::exec_with_empty(client, endpoint).await
292        }
293
294        /// Returns the previously configured STS role.
295        ///
296        /// See [ReadStsRoleResponse]
297        pub async fn read(
298            client: &impl Client,
299            mount: &str,
300            account_id: &str,
301        ) -> Result<ReadStsRoleResponse, ClientError> {
302            let endpoint = ReadStsRoleRequest::builder()
303                .mount(mount)
304                .account_id(account_id)
305                .build()
306                .unwrap();
307            api::exec_with_result(client, endpoint).await
308        }
309
310        /// Lists all the AWS Account IDs for which an STS role is registered.
311        ///
312        /// See [ListStsRolesResponse]
313        pub async fn list(
314            client: &impl Client,
315            mount: &str,
316        ) -> Result<ListStsRolesResponse, ClientError> {
317            let endpoint = ListStsRolesRequest::builder().mount(mount).build().unwrap();
318            api::exec_with_result(client, endpoint).await
319        }
320
321        /// Deletes a previously configured AWS account/STS role association.
322        ///
323        /// See [DeleteStsRoleRequest]
324        pub async fn delete(
325            client: &impl Client,
326            mount: &str,
327            account_id: &str,
328        ) -> Result<(), ClientError> {
329            let endpoint = DeleteStsRoleRequest::builder()
330                .mount(mount)
331                .account_id(account_id)
332                .build()
333                .unwrap();
334            api::exec_with_empty(client, endpoint).await
335        }
336    }
337
338    pub mod tidy {
339        pub mod identity_access_list {
340            use crate::{
341                api::{
342                    self,
343                    auth::aws::{
344                        requests::{
345                            ConfigureIdentityAccessListTidyOperationRequest,
346                            ConfigureIdentityAccessListTidyOperationRequestBuilder,
347                            DeleteIdentityAccessListTidySettingsRequest,
348                            ReadIdentityAccessListTidySettingsRequest,
349                        },
350                        responses::ReadIdentityAccessListTidySettingsResponse,
351                    },
352                },
353                client::Client,
354                error::ClientError,
355            };
356
357            /// Configures the periodic tidying operation of the access listed identity entries.
358            ///
359            /// See [ConfigureIdentityAccessListTidyOperationRequest]
360            pub async fn set(
361                client: &impl Client,
362                mount: &str,
363                opts: Option<&mut ConfigureIdentityAccessListTidyOperationRequestBuilder>,
364            ) -> Result<(), ClientError> {
365                let mut t = ConfigureIdentityAccessListTidyOperationRequest::builder();
366                let endpoint = opts.unwrap_or(&mut t).mount(mount).build().unwrap();
367                api::exec_with_empty(client, endpoint).await
368            }
369
370            /// Returns the previously configured periodic access list tidying settings.
371            ///
372            /// See [ReadIdentityAccessListTidySettingsResponse]
373            pub async fn read(
374                client: &impl Client,
375                mount: &str,
376            ) -> Result<ReadIdentityAccessListTidySettingsResponse, ClientError> {
377                let endpoint = ReadIdentityAccessListTidySettingsRequest::builder()
378                    .mount(mount)
379                    .build()
380                    .unwrap();
381                api::exec_with_result(client, endpoint).await
382            }
383
384            /// Deletes the previously configured periodic access list tidying settings.
385            ///
386            /// See [DeleteIdentityAccessListTidySettingsRequest]
387            pub async fn delete(client: &impl Client, mount: &str) -> Result<(), ClientError> {
388                let endpoint = DeleteIdentityAccessListTidySettingsRequest::builder()
389                    .mount(mount)
390                    .build()
391                    .unwrap();
392                api::exec_with_empty(client, endpoint).await
393            }
394        }
395
396        pub mod role_tag_deny_list {
397            use crate::{
398                api::{
399                    self,
400                    auth::aws::{
401                        requests::{
402                            ConfigureRoleTagDenyListTidyOperationRequest,
403                            ConfigureRoleTagDenyListTidyOperationRequestBuilder,
404                            DeleteRoleTagDenyListTidySettingsRequest,
405                            ReadRoleTagDenyListTidySettingsRequest,
406                        },
407                        responses::ReadRoleTagDenyListTidySettingsResponse,
408                    },
409                },
410                client::Client,
411                error::ClientError,
412            };
413
414            /// Configures the periodic tidying operation of the deny listed role tag entries.
415            ///
416            /// See [ConfigureRoleTagDenyListTidyOperationRequest]
417            pub async fn set(
418                client: &impl Client,
419                mount: &str,
420                opts: Option<&mut ConfigureRoleTagDenyListTidyOperationRequestBuilder>,
421            ) -> Result<(), ClientError> {
422                let mut t = ConfigureRoleTagDenyListTidyOperationRequest::builder();
423                let endpoint = opts.unwrap_or(&mut t).mount(mount).build().unwrap();
424                api::exec_with_empty(client, endpoint).await
425            }
426
427            /// Returns the previously configured periodic deny list tidying settings.
428            ///
429            /// See [ReadRoleTagDenyListTidySettingsResponse]
430            pub async fn read(
431                client: &impl Client,
432                mount: &str,
433            ) -> Result<ReadRoleTagDenyListTidySettingsResponse, ClientError> {
434                let endpoint = ReadRoleTagDenyListTidySettingsRequest::builder()
435                    .mount(mount)
436                    .build()
437                    .unwrap();
438                api::exec_with_result(client, endpoint).await
439            }
440
441            /// Deletes the previously configured periodic access list tidying settings.
442            ///
443            /// See [DeleteRoleTagDenyListTidySettingsRequest]
444            pub async fn delete(client: &impl Client, mount: &str) -> Result<(), ClientError> {
445                let endpoint = DeleteRoleTagDenyListTidySettingsRequest::builder()
446                    .mount(mount)
447                    .build()
448                    .unwrap();
449                api::exec_with_empty(client, endpoint).await
450            }
451        }
452    }
453}
454
455pub mod role {
456    use crate::{
457        api::{
458            self,
459            auth::aws::{
460                requests::{
461                    CreateRoleRequest, CreateRoleRequestBuilder, CreateRoleTagRequest,
462                    CreateRoleTagRequestBuilder, DeleteRoleRequest, ListRolesRequest,
463                    ReadRoleRequest,
464                },
465                responses::{CreateRoleTagResponse, ListRolesResponse, ReadRoleResponse},
466            },
467        },
468        client::Client,
469        error::ClientError,
470    };
471
472    /// Registers a role in the method
473    ///
474    /// See [CreateRoleRequest]
475    pub async fn create(
476        client: &impl Client,
477        mount: &str,
478        role: &str,
479        opts: Option<&mut CreateRoleRequestBuilder>,
480    ) -> Result<(), ClientError> {
481        let mut t = CreateRoleRequest::builder();
482        let endpoint = opts
483            .unwrap_or(&mut t)
484            .mount(mount)
485            .role(role)
486            .build()
487            .unwrap();
488        api::exec_with_empty(client, endpoint).await
489    }
490
491    /// Returns the previously registered role configuration
492    ///
493    /// See [ReadRoleResponse]
494    pub async fn read(
495        client: &impl Client,
496        mount: &str,
497        role: &str,
498    ) -> Result<ReadRoleResponse, ClientError> {
499        let endpoint = ReadRoleRequest::builder()
500            .mount(mount)
501            .role(role)
502            .build()
503            .unwrap();
504        api::exec_with_result(client, endpoint).await
505    }
506
507    /// Lists all the roles that are registered with the method
508    ///
509    /// See [ListRolesResponse]
510    pub async fn list(client: &impl Client, mount: &str) -> Result<ListRolesResponse, ClientError> {
511        let endpoint = ListRolesRequest::builder().mount(mount).build().unwrap();
512        api::exec_with_result(client, endpoint).await
513    }
514
515    /// Deletes the previously registered role
516    ///
517    /// See [DeleteRoleRequest]
518    pub async fn delete(client: &impl Client, mount: &str, role: &str) -> Result<(), ClientError> {
519        let endpoint = DeleteRoleRequest::builder()
520            .mount(mount)
521            .role(role)
522            .build()
523            .unwrap();
524        api::exec_with_empty(client, endpoint).await
525    }
526
527    /// Creates a role tag on the role
528    ///
529    /// See [CreateRoleTagRequest]
530    pub async fn create_tag(
531        client: &impl Client,
532        mount: &str,
533        role: &str,
534        opts: Option<&mut CreateRoleTagRequestBuilder>,
535    ) -> Result<CreateRoleTagResponse, ClientError> {
536        let mut t = CreateRoleTagRequest::builder();
537        let endpoint = opts
538            .unwrap_or(&mut t)
539            .mount(mount)
540            .role(role)
541            .build()
542            .unwrap();
543        api::exec_with_result(client, endpoint).await
544    }
545}
546
547pub mod role_tag_deny_list {
548    use crate::{
549        api::{
550            self,
551            auth::aws::{
552                requests::{
553                    DeleteDenyListTagsRequest, ListDenyListTagsRequest,
554                    PlaceRoleTagsInDenyListRequest, ReadRoleTagDenyListRequest,
555                    TidyDenyListTagsRequest, TidyDenyListTagsRequestBuilder,
556                },
557                responses::{ListDenyListTagsResponse, ReadRoleTagDenyListResponse},
558            },
559        },
560        client::Client,
561        error::ClientError,
562    };
563
564    /// Places a valid role tag in a deny list
565    ///
566    /// See [PlaceRoleTagsInDenyListRequest]
567    pub async fn create(
568        client: &impl Client,
569        mount: &str,
570        tag_value: &str,
571    ) -> Result<(), ClientError> {
572        let endpoint = PlaceRoleTagsInDenyListRequest::builder()
573            .mount(mount)
574            .tag_value(tag_value)
575            .build()
576            .unwrap();
577        api::exec_with_empty(client, endpoint).await
578    }
579
580    /// Returns the deny list entry of a previously deny listed role tag.
581    ///
582    /// See [ReadRoleTagDenyListResponse]
583    pub async fn read(
584        client: &impl Client,
585        mount: &str,
586        tag_value: &str,
587    ) -> Result<ReadRoleTagDenyListResponse, ClientError> {
588        let endpoint = ReadRoleTagDenyListRequest::builder()
589            .mount(mount)
590            .tag_value(tag_value)
591            .build()
592            .unwrap();
593        api::exec_with_result(client, endpoint).await
594    }
595
596    /// Lists all the role tags that are deny listed
597    ///
598    /// See [ListDenyListTagsResponse]
599    pub async fn list(
600        client: &impl Client,
601        mount: &str,
602    ) -> Result<ListDenyListTagsResponse, ClientError> {
603        let endpoint = ListDenyListTagsRequest::builder()
604            .mount(mount)
605            .build()
606            .unwrap();
607        api::exec_with_result(client, endpoint).await
608    }
609
610    /// Deletes a deny listed role tag
611    ///
612    /// See [DeleteDenyListTagsRequest]
613    pub async fn delete(
614        client: &impl Client,
615        mount: &str,
616        tag_value: &str,
617    ) -> Result<(), ClientError> {
618        let endpoint = DeleteDenyListTagsRequest::builder()
619            .mount(mount)
620            .tag_value(tag_value)
621            .build()
622            .unwrap();
623        api::exec_with_empty(client, endpoint).await
624    }
625
626    /// Cleans up the entries in the deny listed based on expiration time on the entry and safety_buffer.
627    ///
628    /// See [TidyDenyListTagsRequest]
629    pub async fn tidy(
630        client: &impl Client,
631        mount: &str,
632        opts: Option<&mut TidyDenyListTagsRequestBuilder>,
633    ) -> Result<(), ClientError> {
634        let mut t = TidyDenyListTagsRequest::builder();
635        let endpoint = opts.unwrap_or(&mut t).mount(mount).build().unwrap();
636        api::exec_with_empty(client, endpoint).await
637    }
638}
639
640pub mod identity_access_list {
641    use crate::{
642        api::{
643            self,
644            auth::aws::{
645                requests::{
646                    DeleteIdentityAccessListEntriesRequest, ListIdentityAccessListEntriesRequest,
647                    ReadIdentityAccessListInformationRequest, TidyIdentityAccessListEntriesRequest,
648                    TidyIdentityAccessListEntriesRequestBuilder,
649                },
650                responses::{
651                    ListIdentityAccessListEntriesResponse,
652                    ReadIdentityAccessListInformationResponse,
653                },
654            },
655        },
656        client::Client,
657        error::ClientError,
658    };
659
660    /// Returns an entry in the identity access list.
661    ///
662    /// See [ReadIdentityAccessListInformationResponse]
663    pub async fn read(
664        client: &impl Client,
665        mount: &str,
666        instance_id: &str,
667    ) -> Result<ReadIdentityAccessListInformationResponse, ClientError> {
668        let endpoint = ReadIdentityAccessListInformationRequest::builder()
669            .mount(mount)
670            .instance_id(instance_id)
671            .build()
672            .unwrap();
673        api::exec_with_result(client, endpoint).await
674    }
675
676    /// Deletes a cache of the successful login from an instance
677    ///
678    /// See [DeleteIdentityAccessListEntriesRequest]
679    pub async fn delete(
680        client: &impl Client,
681        mount: &str,
682        instance_id: &str,
683    ) -> Result<(), ClientError> {
684        let endpoint = DeleteIdentityAccessListEntriesRequest::builder()
685            .mount(mount)
686            .instance_id(instance_id)
687            .build()
688            .unwrap();
689        api::exec_with_empty(client, endpoint).await
690    }
691
692    /// Lists all the instance IDs that are in the access list of successful logins
693    ///
694    /// See [ListIdentityAccessListEntriesResponse]
695    pub async fn list(
696        client: &impl Client,
697        mount: &str,
698    ) -> Result<ListIdentityAccessListEntriesResponse, ClientError> {
699        let endpoint = ListIdentityAccessListEntriesRequest::builder()
700            .mount(mount)
701            .build()
702            .unwrap();
703        api::exec_with_result(client, endpoint).await
704    }
705
706    /// Cleans up the entries in the access list based on expiration time andsafety_buffer
707    ///
708    /// See [TidyIdentityAccessListEntriesRequest]
709    pub async fn tidy(
710        client: &impl Client,
711        mount: &str,
712        opts: Option<&mut TidyIdentityAccessListEntriesRequestBuilder>,
713    ) -> Result<(), ClientError> {
714        let mut t = TidyIdentityAccessListEntriesRequest::builder();
715        let endpoint = opts.unwrap_or(&mut t).mount(mount).build().unwrap();
716        api::exec_with_empty(client, endpoint).await
717    }
718}
vaultrs/auth/aws.rs

vaultrs/auth/
aws.rs
