Request Syntax URI Request Parameters Request Body Response Syntax Response Elements Errors See Also

CheckAccessNotGranted

Checks whether the specified access isn't allowed by a policy.

Request Syntax


POST /policy/check-access-not-granted HTTP/1.1
Content-type: application/json

{
   "access": [ 
      { 
         "actions": [ "string" ],
         "resources": [ "string" ]
      }
   ],
   "policyDocument": "string",
   "policyType": "string"
}

URI Request Parameters

The request does not use any URI parameters.

Request Body

The request accepts the following data in JSON format.

access

An access object containing the permissions that shouldn't be granted by the specified policy. If only actions are specified, IAM Access Analyzer checks for access to peform at least one of the actions on any resource in the policy. If only resources are specified, then IAM Access Analyzer checks for access to perform any action on at least one of the resources. If both actions and resources are specified, IAM Access Analyzer checks for access to perform at least one of the specified actions on at least one of the specified resources.

Type: Array of Access objects

Array Members: Minimum number of 0 items. Maximum number of 1 item.

Required: Yes

policyDocument

The JSON policy document to use as the content for the policy.

Type: String

Required: Yes

policyType

The type of policy. Identity policies grant permissions to IAM principals. Identity policies include managed and inline policies for IAM roles, users, and groups.

Resource policies grant permissions on AWS resources. Resource policies include trust policies for IAM roles and bucket policies for Amazon S3 buckets.

Type: String

Valid Values: IDENTITY_POLICY | RESOURCE_POLICY

Required: Yes

Response Syntax


HTTP/1.1 200
Content-type: application/json

{
   "message": "string",
   "reasons": [ 
      { 
         "description": "string",
         "statementId": "string",
         "statementIndex": number
      }
   ],
   "result": "string"
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

message

The message indicating whether the specified access is allowed.

Type: String

reasons

A description of the reasoning of the result.

Type: Array of ReasonSummary objects

result

The result of the check for whether the access is allowed. If the result is PASS, the specified policy doesn't allow any of the specified permissions in the access object. If the result is FAIL, the specified policy might allow some or all of the permissions in the access object.

Type: String

Valid Values: PASS | FAIL

Errors

For information about the errors that are common to all actions, see Common Errors.

AccessDeniedException

You do not have sufficient access to perform this action.

HTTP Status Code: 403

InternalServerException

Internal server error.

HTTP Status Code: 500

InvalidParameterException

The specified parameter is invalid.

HTTP Status Code: 400

ThrottlingException

Throttling limit exceeded error.

HTTP Status Code: 429

UnprocessableEntityException

The specified entity could not be processed.

HTTP Status Code: 422

ValidationException

Validation exception error.

HTTP Status Code: 400