com.spotify.styx.api

Interface ServiceAccountUsageAuthorizer

All Known Implementing Classes:

ServiceAccountUsageAuthorizer.Impl

Functional Interface:

This is a functional interface and can therefore be used as the assignment target for a lambda expression or method reference.

@FunctionalInterface
public interface ServiceAccountUsageAuthorizer

Verifies that a user is authorized to use a service account in a workflow by verifying that the user has a specific role either on the service account itself or in the project of the service account.

This requires the following permissions:

• resourcemanager.projects.getIamPolicy
• iam.serviceAccounts.getIamPolicy

Nested Class Summary

Nested Classes

Modifier and Type	Interface and Description
static class	ServiceAccountUsageAuthorizer.AllAuthorizationPolicy A policy that always enforces authorization.
static interface	ServiceAccountUsageAuthorizer.AuthorizationPolicy A policy that decides whether to enforce an authorization decision.
static class	ServiceAccountUsageAuthorizer.Impl
static class	ServiceAccountUsageAuthorizer.NoAuthorizationPolicy A policy that does not enforce any authorization.
static class	ServiceAccountUsageAuthorizer.WhitelistAuthorizationPolicy A policy that only enforces authorization for a set of workflows.

Field Summary

Fields

Modifier and Type	Field and Description
static ServiceAccountUsageAuthorizer	NOP

Method Summary

Modifier and Type	Method and Description
void	authorizeServiceAccountUsage(WorkflowId workflowId, String serviceAccount, com.google.api.client.googleapis.auth.oauth2.GoogleIdToken idToken)
static ServiceAccountUsageAuthorizer	create(String serviceAccountUserRole, ServiceAccountUsageAuthorizer.AuthorizationPolicy authorizationPolicy, com.google.api.client.googleapis.auth.oauth2.GoogleCredential credential, String serviceName)

Field Detail

NOP

static final ServiceAccountUsageAuthorizer NOP

Method Detail

authorizeServiceAccountUsage

void authorizeServiceAccountUsage(WorkflowId workflowId,
                                  String serviceAccount,
                                  com.google.api.client.googleapis.auth.oauth2.GoogleIdToken idToken)

create

static ServiceAccountUsageAuthorizer create(String serviceAccountUserRole,
                                            ServiceAccountUsageAuthorizer.AuthorizationPolicy authorizationPolicy,
                                            com.google.api.client.googleapis.auth.oauth2.GoogleCredential credential,
                                            String serviceName)