Netflix / bless / 105

95%

Pull #62

travis-ci

Allows username validation against IAM groups

This change gives the option to validate the remote username against
the IAM groups containing the user invoking the lambda function. This
is an optional feature which is used in conjunction with kmsauth.

For example, if there were two groups of users, you could put your
admins in the ssh-admin IAM group to allow them to generate certificates
with a remote_username of 'admin'. Users with fewer permissions could be
in the ssh-user group to allow them to generate certificates for the 'user'
account.

The group name is configurable, however they must all be in a consistent
format, and must all contain the relevant remote_username once.

13 of 13 new or added lines in 2 files covered. (100.0%)

532 of 563 relevant lines covered (94.49%)

0.94 hits per line