アクセス制御

class User {
  +userId
  +name
  :
}

class Identifier {
  +clientId
  +clientSecret
  :
}

class Password {
  +hashedPassword
  :
}

class AttachedSecurityPolicy {
  +securityPolicyId
  :
}

class SecurityPolicy {
  +policyDocument
  :
}

User "1" *-- "many" Identifier
User "1" --- "1" Password
User "1" *-- "<=10" AttachedSecurityPolicy
AttachedSecurityPolicy "1" -- "1" SecurityPolicy

note "認証情報(クレデンシャル)\n各サービスのAPIにアクセスするために必要となる情報" as IdentifierNote
Identifier .. IdentifierNote

note "パスワード\nマネージメントコンソールにサブアカウントとしてログインするための情報" as PasswordNote
Password .. PasswordNote

note "ユーザーのアクセス権限" as AttachedSecurityPolicyNote
AttachedSecurityPolicy .. AttachedSecurityPolicyNote

note "権限設定" as SecurityPolicyNote
SecurityPolicy .. SecurityPolicyNote

{
  "Version": "2016-04-01",
  "Statements": [
    {
      "Effect": "Allow",
      "Actions": [
        "*"
      ],
      "Resources": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2016-04-01",
  "Statements": [
    {
      "Effect": "Allow",
      "Actions": [
        "Gs2Inbox:*"
      ],
      "Resources": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2016-04-01",
  "Statements": [
    {
      "Effect": "Allow",
      "Actions": [
        "Gs2Inbox:SendMessage",
        "Gs2Inbox:DescribeMessage",
        "Gs2Inbox:ReadMessage",
        "Gs2Inbox:DeleteMessage"
      ],
      "Resources": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2016-04-01",
  "Statements": [
    {
      "Effect": "Allow",
      "Actions": [
        "Gs2Inbox:SendMessage"
      ],
      "Resources": [
        "grn:gs2:{region}:{ownerId}:inbox:namespace-0001",
        "grn:gs2:{region}:{ownerId}:inbox:namespace-0001:*"
      ]
    }
  ]
}