Merging multiple Policies

[drusellers]

Have you thought about how you would implement merging multiple policies? I'm looking at the AWS IAM approach, where I can have a group with multiple policies. How would I compile all of these together?

Based on what I'm seeing, I could pull out a collection of allow_me Policy objects, (ignoring the identities bit). Then I could merge the statements into one vector of Statement (have to figure out EffectOrd).

With the unified Statements everything would work. To align with IAM (which may not be a goal of the project), we would need to make sure that any Denied would override Allow.

Thank you for any thoughts.

Related Reading:

• https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html