Access Analyzer

Creates a recommendation for an unused permissions finding.

See also: AWS API Documentation

Request Syntax

client.generate_finding_recommendation(
    analyzerArn='string',
    id='string'
)

type analyzerArn:

string

param analyzerArn:

[REQUIRED]

The ARN of the analyzer used to generate the finding recommendation.

type id:

string

param id:

[REQUIRED]

The unique ID for the finding recommendation.

returns:

None

Checks whether a resource policy can grant public access to the specified resource type.

See also: AWS API Documentation

Request Syntax

client.check_no_public_access(
    policyDocument='string',
    resourceType='AWS::DynamoDB::Table'|'AWS::DynamoDB::Stream'|'AWS::EFS::FileSystem'|'AWS::OpenSearchService::Domain'|'AWS::Kinesis::Stream'|'AWS::Kinesis::StreamConsumer'|'AWS::KMS::Key'|'AWS::Lambda::Function'|'AWS::S3::Bucket'|'AWS::S3::AccessPoint'|'AWS::S3Express::DirectoryBucket'|'AWS::S3::Glacier'|'AWS::S3Outposts::Bucket'|'AWS::S3Outposts::AccessPoint'|'AWS::SecretsManager::Secret'|'AWS::SNS::Topic'|'AWS::SQS::Queue'|'AWS::IAM::AssumeRolePolicyDocument'
)

type policyDocument:

string

param policyDocument:

[REQUIRED]

The JSON policy document to evaluate for public access.

type resourceType:

string

param resourceType:

[REQUIRED]

The type of resource to evaluate for public access. For example, to check for public access to Amazon S3 buckets, you can choose AWS::S3::Bucket for the resource type.

For resource types not supported as valid values, IAM Access Analyzer will return an error.

rtype:

dict

returns:

Response Syntax

{
    'result': 'PASS'|'FAIL',
    'message': 'string',
    'reasons': [
        {
            'description': 'string',
            'statementIndex': 123,
            'statementId': 'string'
        },
    ]
}

Response Structure

• (dict) --

  • result (string) --

    The result of the check for public access to the specified resource type. If the result is PASS, the policy doesn't allow public access to the specified resource type. If the result is FAIL, the policy might allow public access to the specified resource type.

  • message (string) --

    The message indicating whether the specified policy allows public access to resources.

  • reasons (list) --

    A list of reasons why the specified resource policy grants public access for the resource type.

    • (dict) --

      Contains information about the reasoning why a check for access passed or failed.

      • description (string) --

        A description of the reasoning of a result of checking for access.

      • statementIndex (integer) --

        The index number of the reason statement.

      • statementId (string) --

        The identifier for the reason statement.

Retrieves information about a finding recommendation for the specified analyzer.

See also: AWS API Documentation

Request Syntax

client.get_finding_recommendation(
    analyzerArn='string',
    id='string',
    maxResults=123,
    nextToken='string'
)

type analyzerArn:

string

param analyzerArn:

[REQUIRED]

The ARN of the analyzer used to generate the finding recommendation.

type id:

string

param id:

[REQUIRED]

The unique ID for the finding recommendation.

type maxResults:

integer

param maxResults:

The maximum number of results to return in the response.

type nextToken:

string

param nextToken:

A token used for pagination of results returned.

rtype:

dict

returns:

Response Syntax

{
    'startedAt': datetime(2015, 1, 1),
    'completedAt': datetime(2015, 1, 1),
    'nextToken': 'string',
    'error': {
        'code': 'string',
        'message': 'string'
    },
    'resourceArn': 'string',
    'recommendedSteps': [
        {
            'unusedPermissionsRecommendedStep': {
                'policyUpdatedAt': datetime(2015, 1, 1),
                'recommendedAction': 'CREATE_POLICY'|'DETACH_POLICY',
                'recommendedPolicy': 'string',
                'existingPolicyId': 'string'
            }
        },
    ],
    'recommendationType': 'UnusedPermissionRecommendation',
    'status': 'SUCCEEDED'|'FAILED'|'IN_PROGRESS'
}

Response Structure

• (dict) --

  • startedAt (datetime) --

    The time at which the retrieval of the finding recommendation was started.

  • completedAt (datetime) --

    The time at which the retrieval of the finding recommendation was completed.

  • nextToken (string) --

    A token used for pagination of results returned.

  • error (dict) --

    Detailed information about the reason that the retrieval of a recommendation for the finding failed.

    • code (string) --

      The error code for a failed retrieval of a recommendation for a finding.

    • message (string) --

      The error message for a failed retrieval of a recommendation for a finding.

  • resourceArn (string) --

    The ARN of the resource of the finding.

  • recommendedSteps (list) --

    A group of recommended steps for the finding.

    • (dict) --

      Contains information about a recommended step for an unused access analyzer finding.

      • unusedPermissionsRecommendedStep (dict) --

        A recommended step for an unused permissions finding.

        • policyUpdatedAt (datetime) --

          The time at which the existing policy for the unused permissions finding was last updated.

        • recommendedAction (string) --

          A recommendation of whether to create or detach a policy for an unused permissions finding.

        • recommendedPolicy (string) --

          If the recommended action for the unused permissions finding is to replace the existing policy, the contents of the recommended policy to replace the policy specified in the existingPolicyId field.

        • existingPolicyId (string) --

          If the recommended action for the unused permissions finding is to detach a policy, the ID of an existing policy to be detached.

  • recommendationType (string) --

    The type of recommendation for the finding.

  • status (string) --

    The status of the retrieval of the finding recommendation.

{'access': {'resources': ['string']}}

Checks whether the specified access isn't allowed by a policy.

See also: AWS API Documentation

Request Syntax

client.check_access_not_granted(
    policyDocument='string',
    access=[
        {
            'actions': [
                'string',
            ],
            'resources': [
                'string',
            ]
        },
    ],
    policyType='IDENTITY_POLICY'|'RESOURCE_POLICY'
)

type policyDocument:

string

param policyDocument:

[REQUIRED]

The JSON policy document to use as the content for the policy.

type access:

list

param access:

[REQUIRED]

An access object containing the permissions that shouldn't be granted by the specified policy. If only actions are specified, IAM Access Analyzer checks for access of the actions on all resources in the policy. If only resources are specified, then IAM Access Analyzer checks which actions have access to the specified resources. If both actions and resources are specified, then IAM Access Analyzer checks which of the specified actions have access to the specified resources.

• (dict) --

  Contains information about actions and resources that define permissions to check against a policy.

  • actions (list) --

    A list of actions for the access permissions. Any strings that can be used as an action in an IAM policy can be used in the list of actions to check.

    • (string) --

  • resources (list) --

    A list of resources for the access permissions. Any strings that can be used as a resource in an IAM policy can be used in the list of resources to check.

    • (string) --

type policyType:

string

param policyType:

[REQUIRED]

The type of policy. Identity policies grant permissions to IAM principals. Identity policies include managed and inline policies for IAM roles, users, and groups.

Resource policies grant permissions on Amazon Web Services resources. Resource policies include trust policies for IAM roles and bucket policies for Amazon S3 buckets. You can provide a generic input such as identity policy or resource policy or a specific input such as managed policy or Amazon S3 bucket policy.

rtype:

dict

returns:

Response Syntax

{
    'result': 'PASS'|'FAIL',
    'message': 'string',
    'reasons': [
        {
            'description': 'string',
            'statementIndex': 123,
            'statementId': 'string'
        },
    ]
}

Response Structure

• (dict) --

  • result (string) --

    The result of the check for whether the access is allowed. If the result is PASS, the specified policy doesn't allow any of the specified permissions in the access object. If the result is FAIL, the specified policy might allow some or all of the permissions in the access object.

  • message (string) --

    The message indicating whether the specified access is allowed.

  • reasons (list) --

    A description of the reasoning of the result.

    • (dict) --

      Contains information about the reasoning why a check for access passed or failed.

      • description (string) --

        A description of the reasoning of a result of checking for access.

      • statementIndex (integer) --

        The index number of the reason statement.

      • statementId (string) --

        The identifier for the reason statement.