tvaultapi/src/main/java/com/tmobile/cso/vault/api/service/IAMServiceAccountsService.java
public boolean isAuthorizedToAddPermissionInIAMSvcAcc(UserDetails userDetails, String serviceAccount, String token,
			boolean isPartOfOnboard) {
		// IAM admin users can add sudo policy for owner while onboarding the service account
		if (userDetails.isAdmin() || isPartOfOnboard) {
			return true;
		}
		// Owner of the service account can add/remove users, groups, aws roles and approles to service account
		String ownerPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.
				getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.IAM_SVC_ACC_PATH_PREFIX).
				append("_").append(serviceAccount).toString();
		String [] policies = policyUtils.getCurrentPolicies(tokenUtils.getSelfServiceToken(), userDetails.getUsername(), userDetails);
		if (ArrayUtils.contains(policies, ownerPolicy)) {
			return true;
		}
		return false;
	}
/**
	 * Check if user has the permission to add user to the IAM Service Account.
	 *
	 * @param userDetails
	 * @param serviceAccount
	 * @param access
	 * @param token
	 * @return
	 */
Check if user has the permission to add user to the IAM Service Account.
Check if user has the permission to add user to the IAM Service Account .
public boolean isAuthorizedToAddPermissionInIAMSvcAcc(UserDetails userDetails, String serviceAccount, String token,
			boolean isPartOfOnboard) {
		if (userDetails.isAdmin() || isPartOfOnboard) {
			return true;
		}
		String ownerPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.
				getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.IAM_SVC_ACC_PATH_PREFIX).
				append("_").append(serviceAccount).toString();
		String [] policies = policyUtils.getCurrentPolicies(tokenUtils.getSelfServiceToken(), userDetails.getUsername(), userDetails);
		if (ArrayUtils.contains(policies, ownerPolicy)) {
			return true;
		}
		return false;
	}
public boolean isAuthorizedToAddPermissionInIAMSvcAcc ( UserDetails userDetails , String serviceAccount , String token , boolean isPartOfOnboard ) { if ( userDetails . isAdmin ( ) || isPartOfOnboard ) { return true ; } String ownerPolicy = new StringBuffer ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . SUDO_POLICY ) ) . append ( TVaultConstants . IAM_SVC_ACC_PATH_PREFIX ) . append ( "_" ) . append ( serviceAccount ) . toString ( ) ; String [ ] policies = policyUtils . getCurrentPolicies ( tokenUtils . getSelfServiceToken ( ) , userDetails . getUsername ( ) , userDetails ) ; if ( ArrayUtils . contains ( policies , ownerPolicy ) ) { return true ; } return false ; }
Check if user has the permission to add user to the IAM Service Account.
Check if user has the permission to add user to the IAM Service Account .
// IAM admin users can add sudo policy for owner while onboarding the service account // Owner of the service account can add/remove users, groups, aws roles and approles to service account