IAM Access Analyzer
API Reference
API Version 2019-11-01
IAM Access Analyzer: API Reference
Copyright © Amazon Web Services, Inc. and/or its affiliates. All rights reserved.
Amazon's trademarks and trade dress may not be used in connection with any product or service that is not Amazon's, in any manner that is likely to cause confusion among customers, or in any manner that disparages or discredits Amazon. All other trademarks not owned by Amazon are the property of their respective owners, who may or may not be affiliated with, connected to, or sponsored by Amazon.
Table of Contents
Welcome ... 1
Actions ... 2
ApplyArchiveRule ... 3
Request Syntax ... 3
URI Request Parameters ... 3
Request Body ... 3
Response Syntax ... 3
Response Elements ... 4
Errors ... 4
See Also ... 4
CancelPolicyGeneration ... 5
Request Syntax ... 5
URI Request Parameters ... 5
Request Body ... 5
Response Syntax ... 5
Response Elements ... 5
Errors ... 5
See Also ... 6
CreateAccessPreview ... 7
Request Syntax ... 7
URI Request Parameters ... 8
Request Body ... 8
Response Syntax ... 8
Response Elements ... 9
Errors ... 9
See Also ... 10
CreateAnalyzer ... 11
Request Syntax ... 11
URI Request Parameters ... 11
Request Body ... 11
Response Syntax ... 12
Response Elements ... 12
Errors ... 12
See Also ... 13
CreateArchiveRule ... 14
Request Syntax ... 14
URI Request Parameters ... 14
Request Body ... 14
Response Syntax ... 15
Response Elements ... 15
Errors ... 15
See Also ... 16
DeleteAnalyzer ... 17
Request Syntax ... 17
URI Request Parameters ... 17
Request Body ... 17
Response Syntax ... 17
Response Elements ... 17
Errors ... 17
See Also ... 18
DeleteArchiveRule ... 19
Request Syntax ... 19
URI Request Parameters ... 19
Request Body ... 19
Response Syntax ... 19
Response Elements ... 19
Errors ... 19
See Also ... 20
GetAccessPreview ... 21
Request Syntax ... 21
URI Request Parameters ... 21
Request Body ... 21
Response Syntax ... 21
Response Elements ... 22
Errors ... 23
See Also ... 23
GetAnalyzedResource ... 24
Request Syntax ... 24
URI Request Parameters ... 24
Request Body ... 24
Response Syntax ... 24
Response Elements ... 24
Errors ... 25
See Also ... 25
GetAnalyzer ... 26
Request Syntax ... 26
URI Request Parameters ... 26
Request Body ... 26
Response Syntax ... 26
Response Elements ... 26
Errors ... 27
See Also ... 27
GetArchiveRule ... 28
Request Syntax ... 28
URI Request Parameters ... 28
Request Body ... 28
Response Syntax ... 28
Response Elements ... 29
Errors ... 29
See Also ... 29
GetFinding ... 31
Request Syntax ... 31
URI Request Parameters ... 31
Request Body ... 31
Response Syntax ... 31
Response Elements ... 32
Errors ... 32
See Also ... 32
GetGeneratedPolicy ... 34
Request Syntax ... 34
URI Request Parameters ... 34
Request Body ... 34
Response Syntax ... 34
Response Elements ... 35
Errors ... 35
See Also ... 36
ListAccessPreviewFindings ... 37
Request Syntax ... 37
URI Request Parameters ... 37
Request Body ... 37
Response Syntax ... 38
Response Elements ... 38
Errors ... 39
See Also ... 39
ListAccessPreviews ... 41
Request Syntax ... 41
URI Request Parameters ... 41
Request Body ... 41
Response Syntax ... 41
Response Elements ... 41
Errors ... 42
See Also ... 42
ListAnalyzedResources ... 44
Request Syntax ... 44
URI Request Parameters ... 44
Request Body ... 44
Response Syntax ... 45
Response Elements ... 45
Errors ... 45
See Also ... 46
ListAnalyzers ... 47
Request Syntax ... 47
URI Request Parameters ... 47
Request Body ... 47
Response Syntax ... 47
Response Elements ... 48
Errors ... 48
See Also ... 48
ListArchiveRules ... 50
Request Syntax ... 50
URI Request Parameters ... 50
Request Body ... 50
Response Syntax ... 50
Response Elements ... 51
Errors ... 51
See Also ... 51
ListFindings ... 53
Request Syntax ... 53
URI Request Parameters ... 53
Request Body ... 53
Response Syntax ... 54
Response Elements ... 54
Errors ... 55
See Also ... 55
ListPolicyGenerations ... 57
Request Syntax ... 57
URI Request Parameters ... 57
Request Body ... 57
Response Syntax ... 57
Response Elements ... 57
Errors ... 58
See Also ... 58
ListTagsForResource ... 59
Request Syntax ... 59
URI Request Parameters ... 59
Request Body ... 59
Response Syntax ... 59
Response Elements ... 59
Errors ... 59
See Also ... 60
StartPolicyGeneration ... 61
Request Syntax ... 61
URI Request Parameters ... 61
Request Body ... 61
Response Syntax ... 62
Response Elements ... 62
Errors ... 62
See Also ... 63
StartResourceScan ... 64
Request Syntax ... 64
URI Request Parameters ... 64
Request Body ... 64
Response Syntax ... 64
Response Elements ... 64
Errors ... 64
See Also ... 65
TagResource ... 66
Request Syntax ... 66
URI Request Parameters ... 66
Request Body ... 66
Response Syntax ... 66
Response Elements ... 66
Errors ... 66
See Also ... 67
UntagResource ... 68
Request Syntax ... 68
URI Request Parameters ... 68
Request Body ... 68
Response Syntax ... 68
Response Elements ... 68
Errors ... 68
See Also ... 69
UpdateArchiveRule ... 70
Request Syntax ... 70
URI Request Parameters ... 70
Request Body ... 70
Response Syntax ... 71
Response Elements ... 71
Errors ... 71
See Also ... 71
UpdateFindings ... 73
Request Syntax ... 73
URI Request Parameters ... 73
Request Body ... 73
Response Syntax ... 74
Response Elements ... 74
Errors ... 74
See Also ... 74
ValidatePolicy ... 76
Request Syntax ... 76
URI Request Parameters ... 76
Request Body ... 76
Response Syntax ... 77
Response Elements ... 78
Errors ... 78
See Also ... 78
Data Types ... 80
AccessPreview ... 82
Contents ... 82
See Also ... 83
AccessPreviewFinding ... 84
Contents ... 84
See Also ... 86
AccessPreviewStatusReason ... 87
Contents ... 87
See Also ... 87
AccessPreviewSummary ... 88
Contents ... 88
See Also ... 88
AclGrantee ... 90
Contents ... 90
See Also ... 90
AnalyzedResource ... 91
Contents ... 91
See Also ... 92
AnalyzedResourceSummary ... 93
Contents ... 93
See Also ... 93
AnalyzerSummary ... 94
Contents ... 94
See Also ... 95
ArchiveRuleSummary ... 96
Contents ... 96
See Also ... 96
CloudTrailDetails ... 97
Contents ... 97
See Also ... 97
CloudTrailProperties ... 98
Contents ... 98
See Also ... 98
Configuration ... 99
Contents ... 99
See Also ... 99
Criterion ... 100
Contents ... 100
See Also ... 100
Finding ... 101
Contents ... 101
See Also ... 102
FindingSource ... 104
Contents ... 104
See Also ... 104
FindingSourceDetail ... 105
Contents ... 105
See Also ... 105
FindingSummary ... 106
Contents ... 106
See Also ... 107
GeneratedPolicy ... 109
Contents ... 109
See Also ... 109
GeneratedPolicyProperties ... 110
Contents ... 110
See Also ... 110
GeneratedPolicyResult ... 111
Contents ... 111
See Also ... 111
IamRoleConfiguration ... 112
Contents ... 112
See Also ... 112
InlineArchiveRule ... 113
Contents ... 113
See Also ... 113
InternetConfiguration ... 114
Contents ... 114
See Also ... 114
JobDetails ... 115
Contents ... 115
See Also ... 115
JobError ... 116
Contents ... 116
See Also ... 116
KmsGrantConfiguration ... 117
Contents ... 117
See Also ... 117
KmsGrantConstraints ... 119
Contents ... 119
See Also ... 119
KmsKeyConfiguration ... 120
Contents ... 120
See Also ... 120
Location ... 121
Contents ... 121
See Also ... 121
NetworkOriginConfiguration ... 122
Contents ... 122
See Also ... 122
PathElement ... 123
Contents ... 123
See Also ... 123
PolicyGeneration ... 124
Contents ... 124
See Also ... 124
PolicyGenerationDetails ... 126
Contents ... 126
See Also ... 126
Position ... 127
Contents ... 127
See Also ... 127
S3AccessPointConfiguration ... 128
Contents ... 128
See Also ... 128
S3BucketAclGrantConfiguration ... 129
Contents ... 129
See Also ... 129
S3BucketConfiguration ... 130
Contents ... 130
See Also ... 130
S3PublicAccessBlockConfiguration ... 132
Contents ... 132
See Also ... 132
SecretsManagerSecretConfiguration ... 133
Contents ... 133
See Also ... 133
SortCriteria ... 134
Contents ... 134
See Also ... 134
Span ... 135
Contents ... 135
See Also ... 135
SqsQueueConfiguration ... 136
Contents ... 136
See Also ... 136
StatusReason ... 137
Contents ... 137
See Also ... 137
Substring ... 138
Contents ... 138
See Also ... 138
Trail ... 139
Contents ... 139
See Also ... 139
TrailProperties ... 140
Contents ... 140
See Also ... 140
ValidatePolicyFinding ... 141
Contents ... 141
See Also ... 141
ValidationExceptionField ... 143
Contents ... 143
See Also ... 143
VpcConfiguration ... 144
Contents ... 144
See Also ... 144
Common Parameters ... 145
Common Errors ... 147
Welcome
AWS Identity and Access Management Access Analyzer helps identify potential resource-access risks by enabling you to identify any policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your AWS environment. An external principal can be another AWS account, a root user, an IAM user or role, a federated user, an AWS service, or an anonymous user. You can also use IAM Access Analyzer to preview and validate public and cross-account access to your resources before deploying permissions changes. This guide describes the AWS Identity and Access Management Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see AWS Identity and Access Management Access Analyzer in the IAM User Guide.
To start using IAM Access Analyzer, you first need to create an analyzer.
This document was last published on March 6, 2022.
Actions
The following actions are supported:
• ApplyArchiveRule (p. 3)
• CancelPolicyGeneration (p. 5)
• CreateAccessPreview (p. 7)
• CreateAnalyzer (p. 11)
• CreateArchiveRule (p. 14)
• DeleteAnalyzer (p. 17)
• DeleteArchiveRule (p. 19)
• GetAccessPreview (p. 21)
• GetAnalyzedResource (p. 24)
• GetAnalyzer (p. 26)
• GetArchiveRule (p. 28)
• GetFinding (p. 31)
• GetGeneratedPolicy (p. 34)
• ListAccessPreviewFindings (p. 37)
• ListAccessPreviews (p. 41)
• ListAnalyzedResources (p. 44)
• ListAnalyzers (p. 47)
• ListArchiveRules (p. 50)
• ListFindings (p. 53)
• ListPolicyGenerations (p. 57)
• ListTagsForResource (p. 59)
• StartPolicyGeneration (p. 61)
• StartResourceScan (p. 64)
• TagResource (p. 66)
• UntagResource (p. 68)
• UpdateArchiveRule (p. 70)
• UpdateFindings (p. 73)
• ValidatePolicy (p. 76)
ApplyArchiveRule
ApplyArchiveRule
Retroactively applies the archive rule to existing findings that meet the archive rule criteria.
Request Syntax
PUT /archive-rule HTTP/1.1 Content-type: application/json { "analyzerArn": "string", "clientToken": "string", "ruleName": "string"
}
URI Request Parameters
The request does not use any URI parameters.
Request Body
The request accepts the following data in JSON format.
analyzerArn (p. 3)
The Amazon resource name (ARN) of the analyzer.
Type: String
Pattern: [^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}
Required: Yes clientToken (p. 3) A client token.
Type: String Required: No ruleName (p. 3)
The name of the rule to apply.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern: [A-Za-z][A-Za-z0-9_.-]*
Required: Yes
Response Syntax
HTTP/1.1 200
Response Elements
Response Elements
If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
CancelPolicyGeneration
CancelPolicyGeneration
Cancels the requested policy generation.
Request Syntax
PUT /policy/generation/jobId HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
jobId (p. 5)
The JobId that is returned by the StartPolicyGeneration operation. The JobId can be used with GetGeneratedPolicy to retrieve the generated policies or used with CancelPolicyGeneration to cancel the policy generation request.
Required: Yes
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Response Elements
If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429
See Also
ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
CreateAccessPreview
CreateAccessPreview
Creates an access preview that allows you to preview IAM Access Analyzer findings for your resource before deploying resource permissions.
Request Syntax
PUT /access-preview HTTP/1.1 Content-type: application/json { "analyzerArn": "string", "clientToken": "string", "configurations": { "string" : { "iamRole": {
"trustPolicy": "string"
},
"kmsKey": { "grants": [ {
"constraints": {
"encryptionContextEquals": { "string" : "string"
},
"encryptionContextSubset": { "string" : "string"
} },
"granteePrincipal": "string", "issuingAccount": "string", "operations": [ "string" ], "retiringPrincipal": "string"
} ],
"keyPolicies": { "string" : "string"
} },
"s3Bucket": {
"accessPoints": { "string" : {
"accessPointPolicy": "string", "networkOrigin": {
"internetConfiguration": { },
"vpcConfiguration": { "vpcId": "string"
} },
"publicAccessBlock": {
"ignorePublicAcls": boolean, "restrictPublicBuckets": boolean }
} },
"bucketAclGrants": [ {
"grantee": { "id": "string", "uri": "string"
},
URI Request Parameters
"permission": "string"
} ],
"bucketPolicy": "string", "bucketPublicAccessBlock": { "ignorePublicAcls": boolean, "restrictPublicBuckets": boolean }
},
"secretsManagerSecret": { "kmsKeyId": "string", "secretPolicy": "string"
},
"sqsQueue": {
"queuePolicy": "string"
} } }}
URI Request Parameters
The request does not use any URI parameters.
Request Body
The request accepts the following data in JSON format.
analyzerArn (p. 7)
The ARN of the account analyzer used to generate the access preview. You can only create an access preview for analyzers with an Account type and Active status.
Type: String
Pattern: [^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}
Required: Yes clientToken (p. 7) A client token.
Type: String Required: No configurations (p. 7)
Access control configuration for your resource that is used to generate the access preview. The access preview includes findings for external access allowed to the resource with the proposed access control configuration. The configuration must contain exactly one element.
Type: String to Configuration (p. 99) object map Required: Yes
Response Syntax
HTTP/1.1 200
Response Elements
Content-type: application/json { "id": "string"
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
id (p. 8)
The unique ID for the access preview.
Type: String
Pattern: [a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 ConflictException
A conflict exception error.
HTTP Status Code: 409 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ServiceQuotaExceededException
Service quote met error.
HTTP Status Code: 402 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
See Also
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
CreateAnalyzer
CreateAnalyzer
Creates an analyzer for your account.
Request Syntax
PUT /analyzer HTTP/1.1
Content-type: application/json { "analyzerName": "string", "archiveRules": [ {
"filter": { "string" : {
"contains": [ "string" ], "eq": [ "string" ], "exists": boolean, "neq": [ "string" ] }
},
"ruleName": "string"
} ],
"clientToken": "string", "tags": {
"string" : "string"
},
"type": "string"
}
URI Request Parameters
The request does not use any URI parameters.
Request Body
The request accepts the following data in JSON format.
analyzerName (p. 11)
The name of the analyzer to create.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern: [A-Za-z][A-Za-z0-9_.-]*
Required: Yes archiveRules (p. 11)
Specifies the archive rules to add for the analyzer. Archive rules automatically archive findings that meet the criteria you define for the rule.
Type: Array of InlineArchiveRule (p. 113) objects Required: No
Response Syntax
clientToken (p. 11) A client token.
Type: String Required: No tags (p. 11)
The tags to apply to the analyzer.
Type: String to string map Required: No
type (p. 11)
The type of analyzer to create. Only ACCOUNT and ORGANIZATION analyzers are supported. You can create only one analyzer per account per Region. You can create up to 5 analyzers per organization per Region.
Type: String
Valid Values: ACCOUNT | ORGANIZATION Required: Yes
Response Syntax
HTTP/1.1 200
Content-type: application/json { "arn": "string"
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
arn (p. 12)
The ARN of the analyzer that was created by the request.
Type: String
Pattern: [^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
See Also
HTTP Status Code: 403 ConflictException
A conflict exception error.
HTTP Status Code: 409 InternalServerException
Internal server error.
HTTP Status Code: 500 ServiceQuotaExceededException
Service quote met error.
HTTP Status Code: 402 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
CreateArchiveRule
CreateArchiveRule
Creates an archive rule for the specified analyzer. Archive rules automatically archive new findings that meet the criteria you define when you create the rule.
To learn about filter keys that you can use to create an archive rule, see IAM Access Analyzer filter keys in the IAM User Guide.
Request Syntax
PUT /analyzer/analyzerName/archive-rule HTTP/1.1 Content-type: application/json
{ "clientToken": "string", "filter": {
"string" : {
"contains": [ "string" ], "eq": [ "string" ], "exists": boolean, "neq": [ "string" ] }
},
"ruleName": "string"
}
URI Request Parameters
The request uses the following URI parameters.
analyzerName (p. 14)
The name of the created analyzer.
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern: [A-Za-z][A-Za-z0-9_.-]*
Required: Yes
Request Body
The request accepts the following data in JSON format.
clientToken (p. 14) A client token.
Type: String Required: No filter (p. 14)
The criteria for the rule.
Type: String to Criterion (p. 100) object map
Response Syntax
Required: Yes ruleName (p. 14)
The name of the rule to create.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern: [A-Za-z][A-Za-z0-9_.-]*
Required: Yes
Response Syntax
HTTP/1.1 200
Response Elements
If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 ConflictException
A conflict exception error.
HTTP Status Code: 409 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ServiceQuotaExceededException
Service quote met error.
HTTP Status Code: 402 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429
See Also
ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
DeleteAnalyzer
DeleteAnalyzer
Deletes the specified analyzer. When you delete an analyzer, IAM Access Analyzer is disabled for the account or organization in the current or specific Region. All findings that were generated by the analyzer are deleted. You cannot undo this action.
Request Syntax
DELETE /analyzer/analyzerName?clientToken=clientToken HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
analyzerName (p. 17)
The name of the analyzer to delete.
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern: [A-Za-z][A-Za-z0-9_.-]*
Required: Yes clientToken (p. 17)
A client token.
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Response Elements
If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
See Also
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
DeleteArchiveRule
DeleteArchiveRule
Deletes the specified archive rule.
Request Syntax
DELETE /analyzer/analyzerName/archive-rule/ruleName?clientToken=clientToken HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
analyzerName (p. 19)
The name of the analyzer that associated with the archive rule to delete.
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern: [A-Za-z][A-Za-z0-9_.-]*
Required: Yes clientToken (p. 19)
A client token.
ruleName (p. 19)
The name of the rule to delete.
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern: [A-Za-z][A-Za-z0-9_.-]*
Required: Yes
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Response Elements
If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
See Also
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
GetAccessPreview
GetAccessPreview
Retrieves information about an access preview for the specified analyzer.
Request Syntax
GET /access-preview/accessPreviewId?analyzerArn=analyzerArn HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
accessPreviewId (p. 21)
The unique ID for the access preview.
Pattern: [a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}
Required: Yes analyzerArn (p. 21)
The ARN of the analyzer used to generate the access preview.
Pattern: [^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}
Required: Yes
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Content-type: application/json { "accessPreview": {
"analyzerArn": "string", "configurations": { "string" : { "iamRole": {
"trustPolicy": "string"
},
"kmsKey": { "grants": [ {
"constraints": {
"encryptionContextEquals": { "string" : "string"
},
"encryptionContextSubset": { "string" : "string"
} },
"granteePrincipal": "string",
Response Elements
"issuingAccount": "string", "operations": [ "string" ], "retiringPrincipal": "string"
} ],
"keyPolicies": { "string" : "string"
} },
"s3Bucket": { "accessPoints": { "string" : {
"accessPointPolicy": "string", "networkOrigin": {
"internetConfiguration": { },
"vpcConfiguration": { "vpcId": "string"
} },
"publicAccessBlock": {
"ignorePublicAcls": boolean, "restrictPublicBuckets": boolean }
} },
"bucketAclGrants": [ {
"grantee": { "id": "string", "uri": "string"
},
"permission": "string"
} ],
"bucketPolicy": "string", "bucketPublicAccessBlock": { "ignorePublicAcls": boolean, "restrictPublicBuckets": boolean }
},
"secretsManagerSecret": { "kmsKeyId": "string", "secretPolicy": "string"
},
"sqsQueue": {
"queuePolicy": "string"
} } },
"createdAt": number, "id": "string", "status": "string", "statusReason": { "code": "string"
} }}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
Errors
accessPreview (p. 21)
An object that contains information about the access preview.
Type: AccessPreview (p. 82) object
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
GetAnalyzedResource
GetAnalyzedResource
Retrieves information about a resource that was analyzed.
Request Syntax
GET /analyzed-resource?analyzerArn=analyzerArn&resourceArn=resourceArn HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
analyzerArn (p. 24)
The ARN of the analyzer to retrieve information from.
Pattern: [^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}
Required: Yes resourceArn (p. 24)
The ARN of the resource to retrieve information about.
Pattern: arn:[^:]*:[^:]*:[^:]*:[^:]*:.*
Required: Yes
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Content-type: application/json {
"resource": {
"actions": [ "string" ], "analyzedAt": number, "createdAt": number, "error": "string", "isPublic": boolean, "resourceArn": "string",
"resourceOwnerAccount": "string", "resourceType": "string",
"sharedVia": [ "string" ], "status": "string",
"updatedAt": number }
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
Errors
The following data is returned in JSON format by the service.
resource (p. 24)
An AnalyzedResource object that contains information that IAM Access Analyzer found when it analyzed the resource.
Type: AnalyzedResource (p. 91) object
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
GetAnalyzer
GetAnalyzer
Retrieves information about the specified analyzer.
Request Syntax
GET /analyzer/analyzerName HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
analyzerName (p. 26)
The name of the analyzer retrieved.
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern: [A-Za-z][A-Za-z0-9_.-]*
Required: Yes
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Content-type: application/json {
"analyzer": { "arn": "string", "createdAt": number,
"lastResourceAnalyzed": "string", "lastResourceAnalyzedAt": number, "name": "string",
"status": "string", "statusReason": { "code": "string"
},
"tags": {
"string" : "string"
},
"type": "string"
} }
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
Errors
analyzer (p. 26)
An AnalyzerSummary object that contains information about the analyzer.
Type: AnalyzerSummary (p. 94) object
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
GetArchiveRule
GetArchiveRule
Retrieves information about an archive rule.
To learn about filter keys that you can use to create an archive rule, see IAM Access Analyzer filter keys in the IAM User Guide.
Request Syntax
GET /analyzer/analyzerName/archive-rule/ruleName HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
analyzerName (p. 28)
The name of the analyzer to retrieve rules from.
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern: [A-Za-z][A-Za-z0-9_.-]*
Required: Yes ruleName (p. 28)
The name of the rule to retrieve.
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern: [A-Za-z][A-Za-z0-9_.-]*
Required: Yes
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Content-type: application/json { "archiveRule": {
"createdAt": number, "filter": {
"string" : {
"contains": [ "string" ], "eq": [ "string" ], "exists": boolean, "neq": [ "string" ] }
},
"ruleName": "string",
Response Elements
"updatedAt": number }}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
archiveRule (p. 28)
Contains information about an archive rule.
Type: ArchiveRuleSummary (p. 96) object
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
See Also
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
GetFinding
GetFinding
Retrieves information about the specified finding.
Request Syntax
GET /finding/id?analyzerArn=analyzerArn HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
analyzerArn (p. 31)
The ARN of the analyzer that generated the finding.
Pattern: [^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}
Required: Yes id (p. 31)
The ID of the finding to retrieve.
Required: Yes
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Content-type: application/json {
"finding": {
"action": [ "string" ], "analyzedAt": number, "condition": {
"string" : "string"
},
"createdAt": number, "error": "string", "id": "string", "isPublic": boolean, "principal": {
"string" : "string"
},
"resource": "string",
"resourceOwnerAccount": "string", "resourceType": "string",
"sources": [ {
"detail": {
"accessPointArn": "string"
Response Elements
},
"type": "string"
} ],
"status": "string", "updatedAt": number }}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
finding (p. 31)
A finding object that contains finding details.
Type: Finding (p. 101) object
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
See Also
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
GetGeneratedPolicy
GetGeneratedPolicy
Retrieves the policy that was generated using StartPolicyGeneration.
Request Syntax
GET /policy/generation/jobId?
includeResourcePlaceholders=includeResourcePlaceholders&includeServiceLevelTemplate=includeServiceLevelTemplate HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
includeResourcePlaceholders (p. 34)
The level of detail that you want to generate. You can specify whether to generate policies with placeholders for resource ARNs for actions that support resource level granularity in policies.
For example, in the resource section of a policy, you can receive a placeholder such as
"Resource":"arn:aws:s3:::${BucketName}" instead of "*".
includeServiceLevelTemplate (p. 34)
The level of detail that you want to generate. You can specify whether to generate service-level policies.
IAM Access Analyzer uses iam:servicelastaccessed to identify services that have been used recently to create this service-level template.
jobId (p. 34)
The JobId that is returned by the StartPolicyGeneration operation. The JobId can be used with GetGeneratedPolicy to retrieve the generated policies or used with CancelPolicyGeneration to cancel the policy generation request.
Required: Yes
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Content-type: application/json { "generatedPolicyResult": { "generatedPolicies": [ {
"policy": "string"
} ],
"properties": {
"cloudTrailProperties": {
Response Elements
"endTime": number, "startTime": number, "trailProperties": [ {
"allRegions": boolean, "cloudTrailArn": "string", "regions": [ "string" ] }
] },
"isComplete": boolean, "principalArn": "string"
} },
"jobDetails": {
"completedOn": number, "jobError": {
"code": "string", "message": "string"
},
"jobId": "string", "startedOn": number, "status": "string"
} }
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
generatedPolicyResult (p. 34)
A GeneratedPolicyResult object that contains the generated policies and associated details.
Type: GeneratedPolicyResult (p. 111) object jobDetails (p. 34)
A GeneratedPolicyDetails object that contains details about the generated policy.
Type: JobDetails (p. 115) object
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ThrottlingException
Throttling limit exceeded error.
See Also
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
ListAccessPreviewFindings
ListAccessPreviewFindings
Retrieves a list of access preview findings generated by the specified access preview.
Request Syntax
POST /access-preview/accessPreviewId HTTP/1.1 Content-type: application/json
{
"analyzerArn": "string", "filter": {
"string" : {
"contains": [ "string" ], "eq": [ "string" ], "exists": boolean, "neq": [ "string" ] }
},
"maxResults": number, "nextToken": "string"
}
URI Request Parameters
The request uses the following URI parameters.
accessPreviewId (p. 37)
The unique ID for the access preview.
Pattern: [a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}
Required: Yes
Request Body
The request accepts the following data in JSON format.
analyzerArn (p. 37)
The ARN of the analyzer used to generate the access.
Type: String
Pattern: [^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}
Required: Yes filter (p. 37)
Criteria to filter the returned findings.
Type: String to Criterion (p. 100) object map Required: No
Response Syntax
maxResults (p. 37)
The maximum number of results to return in the response.
Type: Integer Required: No nextToken (p. 37)
A token used for pagination of results returned.
Type: String Required: No
Response Syntax
HTTP/1.1 200
Content-type: application/json { "findings": [
{
"action": [ "string" ], "changeType": "string", "condition": {
"string" : "string"
},
"createdAt": number, "error": "string",
"existingFindingId": "string", "existingFindingStatus": "string", "id": "string",
"isPublic": boolean, "principal": {
"string" : "string"
},
"resource": "string",
"resourceOwnerAccount": "string", "resourceType": "string",
"sources": [ {
"detail": {
"accessPointArn": "string"
},
"type": "string"
} ],
"status": "string"
} ],
"nextToken": "string"
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
Errors
findings (p. 38)
A list of access preview findings that match the specified filter criteria.
Type: Array of AccessPreviewFinding (p. 84) objects nextToken (p. 38)
A token used for pagination of results returned.
Type: String
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 ConflictException
A conflict exception error.
HTTP Status Code: 409 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
See Also
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
ListAccessPreviews
ListAccessPreviews
Retrieves a list of access previews for the specified analyzer.
Request Syntax
GET /access-preview?analyzerArn=analyzerArn&maxResults=maxResults&nextToken=nextToken HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
analyzerArn (p. 41)
The ARN of the analyzer used to generate the access preview.
Pattern: [^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}
Required: Yes maxResults (p. 41)
The maximum number of results to return in the response.
nextToken (p. 41)
A token used for pagination of results returned.
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Content-type: application/json { "accessPreviews": [
{
"analyzerArn": "string", "createdAt": number, "id": "string", "status": "string", "statusReason": { "code": "string"
} } ],
"nextToken": "string"
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
Errors
The following data is returned in JSON format by the service.
accessPreviews (p. 41)
A list of access previews retrieved for the analyzer.
Type: Array of AccessPreviewSummary (p. 88) objects nextToken (p. 41)
A token used for pagination of results returned.
Type: String
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
See Also
• AWS SDK for Python
• AWS SDK for Ruby V3
ListAnalyzedResources
ListAnalyzedResources
Retrieves a list of resources of the specified type that have been analyzed by the specified analyzer..
Request Syntax
POST /analyzed-resource HTTP/1.1 Content-type: application/json { "analyzerArn": "string", "maxResults": number, "nextToken": "string", "resourceType": "string"
}
URI Request Parameters
The request does not use any URI parameters.
Request Body
The request accepts the following data in JSON format.
analyzerArn (p. 44)
The ARN of the analyzer to retrieve a list of analyzed resources from.
Type: String
Pattern: [^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}
Required: Yes maxResults (p. 44)
The maximum number of results to return in the response.
Type: Integer Required: No nextToken (p. 44)
A token used for pagination of results returned.
Type: String Required: No resourceType (p. 44)
The type of resource.
Type: String
Valid Values: AWS::S3::Bucket | AWS::IAM::Role | AWS::SQS::Queue | AWS::Lambda::Function | AWS::Lambda::LayerVersion | AWS::KMS::Key | AWS::SecretsManager::Secret
Response Syntax
Required: No
Response Syntax
HTTP/1.1 200
Content-type: application/json { "analyzedResources": [ {
"resourceArn": "string",
"resourceOwnerAccount": "string", "resourceType": "string"
} ],
"nextToken": "string"
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
analyzedResources (p. 45)
A list of resources that were analyzed.
Type: Array of AnalyzedResourceSummary (p. 93) objects nextToken (p. 45)
A token used for pagination of results returned.
Type: String
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ResourceNotFoundException
The specified resource could not be found.
HTTP Status Code: 404 ThrottlingException
Throttling limit exceeded error.
See Also
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
ListAnalyzers
ListAnalyzers
Retrieves a list of analyzers.
Request Syntax
GET /analyzer?maxResults=maxResults&nextToken=nextToken&type=type HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
maxResults (p. 47)
The maximum number of results to return in the response.
nextToken (p. 47)
A token used for pagination of results returned.
type (p. 47)
The type of analyzer.
Valid Values: ACCOUNT | ORGANIZATION
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Content-type: application/json { "analyzers": [
{
"arn": "string", "createdAt": number,
"lastResourceAnalyzed": "string", "lastResourceAnalyzedAt": number, "name": "string",
"status": "string", "statusReason": { "code": "string"
},
"tags": {
"string" : "string"
},
"type": "string"
} ],
"nextToken": "string"
}
Response Elements
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
analyzers (p. 47)
The analyzers retrieved.
Type: Array of AnalyzerSummary (p. 94) objects nextToken (p. 47)
A token used for pagination of results returned.
Type: String
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
See Also
• AWS SDK for Ruby V3
ListArchiveRules
ListArchiveRules
Retrieves a list of archive rules created for the specified analyzer.
Request Syntax
GET /analyzer/analyzerName/archive-rule?maxResults=maxResults&nextToken=nextToken HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
analyzerName (p. 50)
The name of the analyzer to retrieve rules from.
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern: [A-Za-z][A-Za-z0-9_.-]*
Required: Yes maxResults (p. 50)
The maximum number of results to return in the request.
nextToken (p. 50)
A token used for pagination of results returned.
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Content-type: application/json { "archiveRules": [
{
"createdAt": number, "filter": {
"string" : {
"contains": [ "string" ], "eq": [ "string" ], "exists": boolean, "neq": [ "string" ] }
},
"ruleName": "string", "updatedAt": number }
],
"nextToken": "string"
}
Response Elements
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
archiveRules (p. 50)
A list of archive rules created for the specified analyzer.
Type: Array of ArchiveRuleSummary (p. 96) objects nextToken (p. 50)
A token used for pagination of results returned.
Type: String
Errors
For information about the errors that are common to all actions, see Common Errors (p. 147).
AccessDeniedException
You do not have sufficient access to perform this action.
HTTP Status Code: 403 InternalServerException
Internal server error.
HTTP Status Code: 500 ThrottlingException
Throttling limit exceeded error.
HTTP Status Code: 429 ValidationException
Validation exception error.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
See Also
• AWS SDK for Ruby V3
ListFindings
ListFindings
Retrieves a list of findings generated by the specified analyzer.
To learn about filter keys that you can use to retrieve a list of findings, see IAM Access Analyzer filter keys in the IAM User Guide.
Request Syntax
POST /finding HTTP/1.1
Content-type: application/json { "analyzerArn": "string", "filter": {
"string" : {
"contains": [ "string" ], "eq": [ "string" ], "exists": boolean, "neq": [ "string" ] }
},
"maxResults": number, "nextToken": "string", "sort": {
"attributeName": "string", "orderBy": "string"
}}
URI Request Parameters
The request does not use any URI parameters.
Request Body
The request accepts the following data in JSON format.
analyzerArn (p. 53)
The ARN of the analyzer to retrieve findings from.
Type: String
Pattern: [^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}
Required: Yes filter (p. 53)
A filter to match for the findings to return.
Type: String to Criterion (p. 100) object map Required: No
maxResults (p. 53)
The maximum number of results to return in the response.
