Features

AWS IAM External Permission Checks

AWS IAM external permission checks let externally authenticated callers carry an AWS IAM principal ARN as evidence for an explicit, fail-closed authorization check. Eden RBAC still runs first; AWS IAM principals do not grant Eden permissions by themselves.

This is not the whole third-party auth story. Eden supports generic OIDC and provider presets such as Okta, Microsoft Entra ID, Google Workspace, Auth0, AWS Cognito, Keycloak, OneLogin, and PingOne for authentication. AWS IAM is the current provider-specific external permission engine that can run after those identity and Eden RBAC layers.

Capabilities

Capability	Behavior
External principal resolution	OIDC-family tokens can carry `aws_iam_principal_arn`, or groups can map to AWS IAM principal ARNs.
Explicit permission API	`POST /api/v1/iam/external-permissions/aws/template-check` runs a saved AWS IAM simulation template server-side.
Fail-closed decisions	Missing principal, ambiguous principal, template failure, malformed output, deny, or missing action/resource coverage blocks.
Access introspection	`GET /api/v1/iam/access/endpoints/{endpoint}` includes safe `external_permission_principals`.
Safe evidence	Evidence includes provider, principal source, status, counts, and coverage only.

External Auth Configuration

This example uses Okta, but the same principal claim can come from any configured OIDC-family provider.

toml

[auth.external]
mode = "hybrid"
provider = "okta"
issuer = "https://customer.okta.com/oauth2/default"
audience = "api://eden"
org_id = "customer-prod"
org_uuid = "00000000-0000-0000-0000-000000000001"
aws_iam_principal_arn_claim = "aws_iam_principal_arn"

[[auth.external.group_aws_iam_principals]]
group = "document-reviewers"
principal_arn = "arn:aws:iam::123456789012:role/DocumentReviewer"

Template Check Request

json

{
  "template_id": "aws-regulated-document-read-check",
  "principal": {
    "provider": "aws_iam",
    "source": "token_principal",
    "principal": "arn:aws:iam::123456789012:role/DocumentReviewer"
  },
  "fields": {},
  "principal_field": "policy_source_arn",
  "action_names_field": "action_names",
  "resource_arns_field": "resource_arns",
  "action_names": ["s3:GetObject"],
  "resource_arns": ["arn:aws:s3:::regulated-documents/doc-8842.pdf"]
}

Eden injects the selected token principal, actions, and resources into the saved AWS Read template. The caller cannot submit precomputed IAM simulation output as an allow decision.

Enforcement Model

The check is explicit and opt-in. Eden RBAC remains the baseline authorization layer, then the AWS IAM check can add a downstream allow/deny decision for the requested AWS action and resource set.

Condition	Result
No matching principal in the token context	Fail closed.
Multiple ambiguous principals	Fail closed.
Simulation template cannot run	Fail closed.
AWS returns deny or no explicit allow	Fail closed.
Simulation output omits an expected action/resource pair	Fail closed.
Every expected action/resource pair is explicitly allowed	Allow the external permission check to pass.

Evidence

Evidence records include provider, principal source, template UUID, endpoint UUID, action/resource coverage status, counts, and decision status. They do not include raw secrets, rendered AWS requests, rendered AWS responses, or caller-submitted allow decisions.