Adds KindIdentityCenter umbrella resource kind
#48730
Conversation
The Identity Center integration manages several resource types, and specifying individal condition statements for each kind is both unwieldy and unnecessary - anyone that can manipulate one of these resources should be able to manilpate them all in the same way. In order to simplify things, this patch introduces an umbrella `KindIdentityCenter` that will represent _any_ `KindIdentityCenter*` resource in Role conditions and RBAC checks.
tcsc
added
no-changelog
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
Updates the default implicit rules to refrence the new `KindIdentityCenter` resource kind. Also updates comments on the covered `KindIdentityCenter*` kinds with a reminder to user `KindIdentityCenter` in RBAC checks.
api/types/constants.go
Outdated
| // KindIdentityCenterAccount describes an Identity-Center managed AWS Account | ||
| // DO NOT USE THIS KIND IN RBAC CHECKS: use KindIdentityCenter instead |
There was a problem hiding this comment.
This seems error prone.
What if we made these constants the SubKind?
There was a problem hiding this comment.
I don't know if we need to make these sub-kinds (that would probably complicate existing resources/caching quite a bit) but @tcsc what we usually do in these cases is in the ACL layer you check whether identity has either specific permission or the more broad one so e.g. in the service methods that deal with IC accounts, you would see check KindIdentityCenterAccount or KindIdentityCenter. We do this with e.g. connectors - there are kinds for each specific connector type and the kind that covers all auth connectors.
So I would do that, and remove these "DO NOT USE ..." comments because they do look error prone. I also don't see where this new kind is being used, only that it's added to the default roles - is that PR coming to teleport.e next?
public-teleport-github-review-bot
bot
removed request for
ravicious,
Tener and
smallinsky
The Identity Center integration manages several resource types,
and specifying individal condition statements for each kind is
both unwieldy and unnecessary - anyone that can manipulate one
of these resources should be able to manilpate them all in the
same way.
In order to simplify things, this patch introduces an umbrella
KindIdentityCenterthat will represent anyKindIdentityCenter*resource in Role conditions and RBAC checks.