IAMToolboxPreview / Paginator / GetRequestAuthorizationDetails

GetRequestAuthorizationDetails¶

class IAMToolboxPreview.Paginator.GetRequestAuthorizationDetails¶

paginator = client.get_paginator('get_request_authorization_details')

paginate(**kwargs)¶

Creates an iterator that will paginate through responses from IAMToolboxPreview.Client.get_request_authorization_details().

Request Syntax

response_iterator = paginator.paginate(
    authorizationId='string',
    PaginationConfig={
        'MaxItems': 123,
        'StartingToken': 'string'
    }
)

Parameters:

authorizationId (string) –
[REQUIRED]

The authorization ID received in the access denied error message. This ID identifies the specific request to retrieve details for.
PaginationConfig (dict) –
A dictionary that provides parameters to control pagination.
- MaxItems (integer) –
  
  The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken will be provided in the output that you can use to resume pagination.
- StartingToken (string) –
  
  A token to specify where to start paginating. This is the NextToken from a previous response.

Return type:

dict

Returns:

Response Syntax

{
    'requestContext': {
        'string': {...}|[...]|123|123.4|'string'|True|None
    },
    'evaluations': [
        {
            'action': 'string',
            'resource': 'string',
            'context': {
                'string': {...}|[...]|123|123.4|'string'|True|None
            },
            'evaluatedEffect': 'ALLOW'|'EXPLICIT_DENY'|'IMPLICIT_DENY',
            'matchedPolicies': [
                {
                    'uri': 'string',
                    'matchedStatements': [
                        {
                            'sid': 'string',
                            'evaluatedEffect': 'ALLOW'|'DENY'
                        },
                    ]
                },
            ]
        },
    ],
    'policies': [
        {
            'type': 'IDENTITY_BASED_POLICY'|'RESOURCE_BASED_POLICY'|'PERMISSIONS_BOUNDARY'|'SESSION_POLICY'|'SERVICE_CONTROL_POLICY'|'RESOURCE_CONTROL_POLICY'|'VPC_ENDPOINT_POLICY',
            'inline': True|False,
            'uri': 'string',
            'attachedTo': [
                {
                    'arn': 'string'
                },
            ]
        },
    ],
    'NextToken': 'string'
}

Response Structure

(dict) –
- requestContext (dict) –
  
  The request context is the set of context keys and values that apply to the entire request and are shared by all evaluations.
  - (string) –
    - (document) –
- evaluations (list) –
  
  The list of evaluations for this request. Each evaluation shows how a single action and resource pair was evaluated. This includes the context, the effect, and any policies that matched.
  - (dict) –
    
    Represents an individual evaluation for a single action and resource pair. This includes the context, the resulting effect, and any policies that matched.
    - action (string) –
      
      The action evaluated for this request (for example, iam:PassRole).
    - resource (string) –
      
      The resource that the action targeted. This is typically a resource ARN, but can be a wildcard ARN that matches multiple resources, or empty for actions that are not resource-specific.
    - context (dict) –
      
      The context keys and values specific to this evaluation. These are applied on top of the request context.
      - (string) –
        
        (document) –
    - evaluatedEffect (string) –
      
      The result of the evaluation. Valid values:
      - ALLOW - The action was allowed.
      - EXPLICIT_DENY - The action was explicitly denied by a policy.
      - IMPLICIT_DENY - The action was denied because no policy allowed it.
    - matchedPolicies (list) –
      
      The policies that matched during evaluation of this action and resource. An implicit denial produces no matched policies.
      - (dict) –
        
        A policy that matched during evaluation, referenced by URI. The URI corresponds to a policy in the top-level policies list.
        
        uri (string) –
        
        The URI of the policy. This cross-references an entry in the top-level policies list. The value depends on the policy type:
        
        For managed policies, this is the policy ARN.
        
        For inline policies, this is an opaque identifier.
        
        matchedStatements (list) –
        
        The statements within the policy that matched during the evaluation.
        
        (dict) –
        
        A statement that matched during evaluation.
        
        sid (string) –
        
        The statement ID (Sid). If the statement has no Sid, one is generated for reference.
        
        evaluatedEffect (string) –
        
        The evaluated effect of this statement. Valid values:
        
        ALLOW - The statement allows the action.
        
        DENY - The statement denies the action.
- policies (list) –
  
  The list of policies that were evaluated.
  - (dict) –
    
    Contains details about a policy evaluated during authorization. Details include the policy type, whether it is inline or managed, a URI that identifies it, and the entities it is attached to.
    - type (string) –
      
      The type of policy. Valid values:
      - IDENTITY_BASED_POLICY - An identity-based policy attached to an IAM user, group, or role.
      - PERMISSIONS_BOUNDARY - A permissions boundary for an IAM entity.
      - RESOURCE_BASED_POLICY - A resource-based policy attached to a resource.
      - RESOURCE_CONTROL_POLICY - A resource control policy (RCP) in AWS Organizations.
      - SERVICE_CONTROL_POLICY - A service control policy (SCP) in AWS Organizations.
      - SESSION_POLICY - A session policy passed during role assumption or federation.
      - VPC_ENDPOINT_POLICY - A VPC endpoint policy.
    - inline (boolean) –
      
      Specifies whether this is an inline policy ( true) or a managed policy ( false).
    - uri (string) –
      
      A URI that identifies the policy. Use this URI to cross-reference the policy with the matching policies in each evaluation. The value depends on the policy type:
      - For managed policies, this is the policy ARN.
      - For inline policies, which have no ARN, this is an opaque identifier.
    - attachedTo (list) –
      
      The entities that the policy is attached to. For identity, session, and resource-based policies, this is typically a single entity. For organization control policies (SCPs and RCPs), it can be multiple entities at different levels of the organization hierarchy.
      - (dict) –
        
        An entity that a policy is attached to, identified by its ARN.
        
        arn (string) –
        
        The ARN of the entity that the policy is attached to. The ARN format depends on the policy type:
        
        For identity, session, and permissions boundary policies, this is the principal ARN (for example, an IAM role or user ARN).
        
        For resource-based policies, this is the resource ARN.
        
        For organization control policies (SCPs and RCPs), this is the AWS Organizations ARN of the account, organizational unit, or root.
- NextToken (string) –
  
  A token to resume pagination.