Pangea AuthZ Tuples for Inherited Permissions

inherited-permissions.sh

# This creates the tuples for our nested folders

curl -sSLX POST 'https://authz.aws.us.pangea.cloud/v1/tuple/create' \
-H 'Authorization: Bearer TOKEN' \
-H 'Content-Type: application/json' \
-d '{"tuples":[{
	"resource":{"type":"folder","id":"Website"},
	"subject":{"type":"folder","id":"Marketing"},
	"relation":"parent"
}]}'

curl -sSLX POST 'https://authz.aws.us.pangea.cloud/v1/tuple/create' \
-H 'Authorization: Bearer TOKEN' \
-H 'Content-Type: application/json' \
-d '{"tuples":[{
	"resource":{"type":"folder","id":"Budget"},
	"subject":{"type":"folder","id":"Marketing"},
	"relation":"parent"
}]}'

curl -sSLX POST 'https://authz.aws.us.pangea.cloud/v1/tuple/create' \
-H 'Authorization: Bearer TOKEN' \
-H 'Content-Type: application/json' \
-d '{"tuples":[{
	"resource":{"type":"folder","id":"Assets"},
	"subject":{"type":"folder","id":"Website"},
	"relation":"parent"
}]}'

curl -sSLX POST 'https://authz.aws.us.pangea.cloud/v1/tuple/create' \
-H 'Authorization: Bearer TOKEN' \
-H 'Content-Type: application/json' \
-d '{"tuples":[{
	"resource":{"type":"folder","id":"Content"},
	"subject":{"type":"folder","id":"Website"},
	"relation":"parent"
}]}'

# This assigns a user the owner role for the root folder

curl -sSLX POST 'https://authz.aws.us.pangea.cloud/v1/tuple/create' \
-H 'Authorization: Bearer TOKEN' \
-H 'Content-Type: application/json' \
-d '{"tuples":[{
	"resource":{"type":"folder","id":"Marketing"},
	"subject":{"type":"user","id":"Keith"},
	"relation":"owner"
}]}'

# This are the permissions checks

curl -sSLX POST 'https://authz.aws.us.pangea.cloud/v1/check' \
-H "Authorization: Bearer TOKEN" \
-H 'Content-Type: application/json' \
-d '{"subject":{"type":"user","id":"Keith"},
	"action":"read",
	"resource":{"type":"folder","id":"Marketing"}}' | jq .


curl -sSLX POST 'https://authz.aws.us.pangea.cloud/v1/check' \
-H "Authorization: Bearer TOKEN" \
-H 'Content-Type: application/json' \
-d '{"subject":{"type":"user","id":"Keith"},
	"action":"read",
	"resource":{"type":"folder","id":"Website"}}' | jq .

curl -sSLX POST 'https://authz.aws.us.pangea.cloud/v1/check' \
-H "Authorization: Bearer TOKEN" \
-H 'Content-Type: application/json' \
-d '{"subject":{"type":"user","id":"Keith"},
	"action":"read",
	"resource":{"type":"folder","id":"Assets"}}' | jq .

# And this is a permissions check with debug enabled

curl -sSLX POST 'https://authz.aws.us.pangea.cloud/v1/check' \
-H "Authorization: Bearer TOKEN" \
-H 'Content-Type: application/json' \
-d '{"subject":{"type":"user","id":"Keith"},
	"action":"read",
	"debug":true,
	"resource":{"type":"folder","id":"Assets"}}' | jq .