goto / guardian

Guardian is a tool for extensible and universal data access with automated access workflows and security controls across data stores, analytical systems, and cloud products.

Home Page:https://goto.github.io/guardian/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Support expression in additional appeals criteria

rahmatrhd opened this issue · comments

Summary
Additional appeals are created when the specified criteria are fulfilled. Currently, the criteria only support a few fields around resource. Therefore, it's not possible to create criteria based on other appeal properties such as account_id or account_type.

Proposed solution
Introduce expression in the RequirementTrigger and evaluate using existing expression library. Available parameter would be $appeal
Additionally, once we have expression, existing Conditions won't be necessary as expression will cover anything support by Conditions right now. We can deprecate or even delete it.

type RequirementTrigger struct {
	ProviderType string
	ProviderURN  string
	ResourceType string
	ResourceURN  string
	Role         string
- 	Conditions   []*Condition
+	Expression   string 
}