접근 제어

class User {
  +userId
  +name
  :
}

class Identifier {
  +clientId
  +clientSecret
  :
}

class Password {
  +hashedPassword
  :
}

class AttachedSecurityPolicy {
  +securityPolicyId
  :
}

class SecurityPolicy {
  +policyDocument
  :
}

User "1" *-- "many" Identifier
User "1" --- "1" Password
User "1" *-- "<=10" AttachedSecurityPolicy
AttachedSecurityPolicy "1" -- "1" SecurityPolicy

note "인증 정보(크리덴셜)\n각 서비스의 API에 접근하기 위해 필요한 정보" as IdentifierNote
Identifier .. IdentifierNote

note "비밀번호\n관리 콘솔에 서브 계정으로 로그인하기 위한 정보" as PasswordNote
Password .. PasswordNote

note "사용자의 접근 권한" as AttachedSecurityPolicyNote
AttachedSecurityPolicy .. AttachedSecurityPolicyNote

note "권한 설정" as SecurityPolicyNote
SecurityPolicy .. SecurityPolicyNote

{
  "Version": "2016-04-01",
  "Statements": [
    {
      "Effect": "Allow",
      "Actions": [
        "*"
      ],
      "Resources": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2016-04-01",
  "Statements": [
    {
      "Effect": "Allow",
      "Actions": [
        "Gs2Inbox:*"
      ],
      "Resources": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2016-04-01",
  "Statements": [
    {
      "Effect": "Allow",
      "Actions": [
        "Gs2Inbox:SendMessage",
        "Gs2Inbox:DescribeMessage",
        "Gs2Inbox:ReadMessage",
        "Gs2Inbox:DeleteMessage"
      ],
      "Resources": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2016-04-01",
  "Statements": [
    {
      "Effect": "Allow",
      "Actions": [
        "Gs2Inbox:SendMessage"
      ],
      "Resources": [
        "grn:gs2:{region}:{ownerId}:inbox:namespace-0001",
        "grn:gs2:{region}:{ownerId}:inbox:namespace-0001:*"
      ]
    }
  ]
}