Enum Class ManagerAwsCapabilityCatalog.Capability

java.lang.Object
java.lang.Enum<ManagerAwsCapabilityCatalog.Capability>
com.cloudforge.core.manager.ManagerAwsCapabilityCatalog.Capability
All Implemented Interfaces:
Serializable, Comparable<ManagerAwsCapabilityCatalog.Capability>, Constable
Enclosing class:
ManagerAwsCapabilityCatalog
public static enum ManagerAwsCapabilityCatalog.Capability extends Enum<ManagerAwsCapabilityCatalog.Capability>

  • Enum Constant Details

    • CFN_INVENTORY

      public static final ManagerAwsCapabilityCatalog.Capability CFN_INVENTORY

    • CFN_DELETE

      public static final ManagerAwsCapabilityCatalog.Capability CFN_DELETE

    • ECS_DESCRIBE

      public static final ManagerAwsCapabilityCatalog.Capability ECS_DESCRIBE

    • ECS_UPDATE_SERVICE

      public static final ManagerAwsCapabilityCatalog.Capability ECS_UPDATE_SERVICE

    • ECS_STOP_TASK

      public static final ManagerAwsCapabilityCatalog.Capability ECS_STOP_TASK

    • RDS_DESCRIBE

      public static final ManagerAwsCapabilityCatalog.Capability RDS_DESCRIBE

    • RDS_SNAPSHOT

      public static final ManagerAwsCapabilityCatalog.Capability RDS_SNAPSHOT

    • RDS_RESTORE

      public static final ManagerAwsCapabilityCatalog.Capability RDS_RESTORE

    • RDS_ENGINE_UPGRADE

      public static final ManagerAwsCapabilityCatalog.Capability RDS_ENGINE_UPGRADE

    • LOGS_READ

      public static final ManagerAwsCapabilityCatalog.Capability LOGS_READ

    • AUDIT_MANAGER_READ

      public static final ManagerAwsCapabilityCatalog.Capability AUDIT_MANAGER_READ

    • COGNITO_USER_MANAGEMENT

      public static final ManagerAwsCapabilityCatalog.Capability COGNITO_USER_MANAGEMENT
      "Cognito as the whole Users directory" -- the separate, admin-opted-in feature that lets the Users page and its API manage a Cognito User Pool's users directly instead of the local DB (see CognitoUserManagementService/CognitoPoolLookupService and manager_auth_backend.cognito_enabled). Without this in the operator baseline, even the pool-lookup step fails with cognito-idp:ListUserPools denied before the feature can do anything. ListUserPools itself has no per-pool resource to scope by (it's what discovers the pool ID in the first place), so this whole group stays Resource: "*" like every other operator-baseline capability in this catalog.

    • CFN_DEPLOY

      public static final ManagerAwsCapabilityCatalog.Capability CFN_DEPLOY
      Direct-deploy path for creating/updating CloudForge-managed AWS infrastructure — deploy:create in ManagerPolicyCatalog (admin-only) routes here. Deliberately NOT part of ManagerAwsCapabilityCatalog.operatorBaseline() — unlike every other capability in this catalog, these actions can create/modify arbitrary infrastructure, not just operate on what already exists, so they must never be silently included in the default operator policy. ManagerOperatorIamSupport (cloudforge-api) attaches these with aws:RequestTag/aws:ResourceTag/iam:ResourceTag conditions scoping them to CloudForge-managed resources — this catalog only lists the actions; the conditions live where the CDK PolicyStatement actually gets built, since this module has no CDK dependency.

    • SC_PROVISION

      public static final ManagerAwsCapabilityCatalog.Capability SC_PROVISION
      deploy:catalog (constrained, manager+admin) routes here — Service Catalog provisioning against pre-published products only; no CFN/IAM/EC2 permissions on Manager's own role for this path at all. Also not part of ManagerAwsCapabilityCatalog.operatorBaseline().

    • SELF_PERMISSION_CHECK

      public static final ManagerAwsCapabilityCatalog.Capability SELF_PERMISSION_CHECK
      Lets a cross-account connection's role verify its own effective permissions via iam:SimulatePrincipalPolicy — this is how AccountsController's "Validate connection" surfaces a real least-privilege report (which of CrossAccountRoleTemplateFactory's granted actions actually evaluate to Allow) instead of just proving sts:AssumeRole works. Simulate-only — never executes anything, so this is safe to grant broadly. Connections whose role predates this capability simply report "unable to verify" rather than failing validation outright; see StsAssumeRoleService#checkPermissions.

  • Method Details

    • values

      public static ManagerAwsCapabilityCatalog.Capability[] values()
      Returns an array containing the constants of this enum class, in the order they are declared.
      Returns:
      an array containing the constants of this enum class, in the order they are declared

    • valueOf

      public static ManagerAwsCapabilityCatalog.Capability valueOf(String name)
      Returns the enum constant of this class with the specified name. The string must match exactly an identifier used to declare an enum constant in this class. (Extraneous whitespace characters are not permitted.)
      Parameters:
      name - the name of the enum constant to be returned.
      Returns:
      the enum constant with the specified name
      Throws:
      IllegalArgumentException - if this enum class has no constant with the specified name
      NullPointerException - if the argument is null

    • iamActions

      public List<String> iamActions()