make resource-access value rewrite configurable/generic

[havetisyan]

Description

getResourceAccessList api in ZMS had some special handling for a couple of actions. Rather than having the actions to be hardcoded in the server, there is now a new interface called ResourceValueUpdater that the system administrator may implement to extend the functionality in the server without having to include any company specific code into Athenz.

Contribution Checklist:

• The pull request does not introduce any breaking changes
• I have read the contribution guidelines.
• Create an issue and link to the pull request.

Attach Screenshots (Optional)

[gemini-code-assist]

Summary of Changes

Hello @havetisyan, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the flexibility and extensibility of the getResourceAccessList API within Athenz. Previously, specific resource value rewriting logic for actions like AWS and GCP role assumptions was hardcoded. This change introduces a generic ResourceValueUpdater interface, allowing system administrators to define and plug in their own custom resource value update logic. The existing cloud-specific logic has been refactored into separate, configurable modules, managed by a new ResourceUpdaterManager. Additionally, the getResourceAccessList API has been extended with an optional filter parameter, providing more granular control over resource queries. This refactoring promotes a more modular and maintainable codebase, reducing the need for core server modifications for custom resource handling.

Highlights

• New Extensibility Interface: The core change introduces a new ResourceValueUpdater interface, allowing system administrators to implement custom logic for rewriting resource values in the getResourceAccessList API. This replaces previous hardcoded handling for specific actions like AWS and GCP role assumptions.
• Refactored Cloud-Specific Logic: The existing AWS and GCP resource generation logic has been refactored from DBService.java into dedicated, independent classes: AwsAssumeRoleResourceUpdater and GcpAssumeRoleResourceUpdater. These classes now implement the new ResourceValueUpdater interface.
• Dynamic Updater Management: A ResourceUpdaterManager has been added to dynamically load and manage ResourceValueUpdater implementations. This manager can be configured via a new athenz.zms.assertion_resource_updaters property in zms.properties, enabling administrators to plug in their own custom updaters.
• API Enhancement with Filter Parameter: The getResourceAccessList API across Go and Java clients, as well as the ZMS core, has been extended to accept an optional filter parameter. This allows for more granular control when querying resource access lists.
• CLI Tooling Updates: The zmscli (Go client CLI) has been updated to support the new filter parameter for the show-resource command, providing users with enhanced filtering capabilities directly from the command line.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request refactors the resource access list API to make resource value rewriting configurable and generic. It introduces a new ResourceValueUpdater interface to decouple action-specific logic from the core DBService. The changes are well-structured and achieve the goal of making the system more extensible. I've left a few comments on potential improvements, mainly regarding a comment typo, a minor code style improvement in the new ResourceUpdaterManager, and enhancing test coverage for the new updater classes.