Trent Clarke c3975a937b [AWSIC] Tightened filter validation and application (#67234) ...

Fixes a couple of issues discovered the Identity Center resource filtering code:

 1. The regex-based filters compile their regexes on every search, rather
    than once up front. This is not as bad as it sounds due to Teleport's
    regex cache, but it is still not ideal.
 2. The filter validation and execution steps behave differently, so that
    it is possible for an invalid filter to make in past validation and
    only be discovered while the plugin is running.
 3. The volume log spam generated by a poorly-formed filter that managed
    to make it past validation would *astronomical*.

This patch addresses those issues by

 1. Compiling the wire-format, protobuf filter objects from the plugin
    spec into a known-good filter at construction time, and using that
    as the runtime definition of the filter.
 2. Compiling the filter regexes during this construction-time setup
    rather than just hoping that they are cached by Teleport
 2. Validating the filter stack once during this compilation phase,
    rather than forcing the runtime matching code to be super very
    defensive. This also removes inconsistent behaviour between the
    validation at construction time vs. run time.

2026-06-19 03:48:01 +00:00

..

awsconfigfile

Write AWS config files with stricter permissions (#66825)

2026-05-21 00:14:03 +00:00

identitycenter

[AWSIC] Tightened filter validation and application (#67234)

2026-06-19 03:48:01 +00:00