Package-level declarations
Types
Base class for all service related exceptions thrown by the AccessAnalyzer client
You do not have sufficient access to perform this action.
Contains information about an access preview.
An access preview finding generated by the access preview.
Provides more details about the current status of the access preview. For example, if the creation of the access preview fails, a Failed status is returned. This failure can be due to an internal issue with the analysis or due to an invalid proposed resource configuration.
Contains a summary of information about an access preview.
You specify each grantee as a type-value pair using one of these types. You can specify only one type of grantee. For more information, see PutBucketAcl.
Contains information about analysis rules for the analyzer. Analysis rules determine which entities will generate findings based on the criteria you define when you create the rule.
The criteria for an analysis rule for an analyzer. The criteria determine which entities will generate findings.
Contains details about the analyzed resource.
Contains the ARN of the analyzed resource.
Contains information about the configuration of an analyzer for an Amazon Web Services organization or account.
Contains information about the analyzer.
Retroactively applies an archive rule.
Contains information about an archive rule. Archive rules automatically archive new findings that meet the criteria you define when you create the rule.
Contains information about CloudTrail access.
Contains information about CloudTrail access.
Access control configuration structures for your resource. You specify the configuration as a type-value pair. You can specify only one type of access control configuration.
A conflict exception error.
Creates an analyzer.
The response to the request to create an analyzer.
Creates an archive rule.
The criteria to use in the filter that defines the archive rule. For more information on available filter keys, see IAM Access Analyzer filter keys.
Deletes an analyzer.
Deletes an archive rule.
The proposed access control configuration for a DynamoDB stream. You can propose a configuration for a new DynamoDB stream or an existing DynamoDB stream that you own by specifying the policy for the DynamoDB stream. For more information, see PutResourcePolicy.
The proposed access control configuration for a DynamoDB table or index. You can propose a configuration for a new DynamoDB table or index or an existing DynamoDB table or index that you own by specifying the policy for the DynamoDB table or index. For more information, see PutResourcePolicy.
The proposed access control configuration for an Amazon EBS volume snapshot. You can propose a configuration for a new Amazon EBS volume snapshot or an Amazon EBS volume snapshot that you own by specifying the user IDs, groups, and optional KMS encryption key. For more information, see ModifySnapshotAttribute.
The proposed access control configuration for an Amazon ECR repository. You can propose a configuration for a new Amazon ECR repository or an existing Amazon ECR repository that you own by specifying the Amazon ECR policy. For more information, see Repository.
The proposed access control configuration for an Amazon EFS file system. You can propose a configuration for a new Amazon EFS file system or an existing Amazon EFS file system that you own by specifying the Amazon EFS policy. For more information, see Using file systems in Amazon EFS.
Contains information about an external access finding.
Provides aggregate statistics about the findings for the specified external access analyzer.
Contains information about the findings for an Amazon Web Services account in an organization unused access analyzer.
Contains information about an external access or unused access finding. Only one parameter can be used in a FindingDetails object.
The source of the finding. This indicates how the access that generated the finding is granted. It is populated for Amazon S3 bucket findings.
Includes details about how the access that generated the finding is granted. This is populated for Amazon S3 bucket findings.
Contains information about the aggregate statistics for an external or unused access analyzer. Only one parameter can be used in a FindingsStatistics object.
Contains information about a finding.
Contains information about a finding.
Contains the text for the generated policy.
Contains the generated policy details.
Contains the text for the generated policy and its details.
Retrieves an analyzed resource.
The response to the request.
Retrieves an analyzer.
The response to the request.
Retrieves an archive rule.
The response to the request.
Retrieves a finding.
The response to the request.
The proposed access control configuration for an IAM role. You can propose a configuration for a new IAM role or an existing IAM role that you own by specifying the trust policy. If the configuration is for a new IAM role, you must specify the trust policy. If the configuration is for an existing IAM role that you own and you do not propose the trust policy, the access preview uses the existing trust policy for the role. The proposed trust policy cannot be an empty string. For more information about role trust policy limits, see IAM and STS quotas.
An criterion statement in an archive rule. Each archive rule may have multiple criteria.
Internal server error.
This configuration sets the network origin for the Amazon S3 access point or multi-region access point to Internet.
The specified parameter is invalid.
Contains details about the policy generation request.
A proposed grant configuration for a KMS key. For more information, see CreateGrant.
Use this structure to propose allowing cryptographic operations in the grant only when the operation request includes the specified encryption context. You can specify only one type of encryption context. An empty map is treated as not specified. For more information, see GrantConstraints.
Proposed access control configuration for a KMS key. You can propose a configuration for a new KMS key or an existing KMS key that you own by specifying the key policy and KMS grant configuration. If the configuration is for an existing key and you do not specify the key policy, the access preview uses the existing policy for the key. If the access preview is for a new resource and you do not specify the key policy, then the access preview uses the default key policy. The proposed key policy cannot be an empty string. For more information, see Default key policy. For more information about key policy limits, see Resource quotas.
Retrieves a list of resources that have been analyzed.
The response to the request.
Retrieves a list of analyzers.
The response to the request.
Retrieves a list of archive rules created for the specified analyzer.
The response to the request.
Retrieves a list of findings generated by the specified analyzer.
The response to the request.
Retrieves a list of tags applied to the specified resource.
The response to the request.
The proposed InternetConfiguration or VpcConfiguration to apply to the Amazon S3 access point. You can make the access point accessible from the internet, or you can specify that all requests made through that access point must originate from a specific virtual private cloud (VPC). You can specify only one type of network configuration. For more information, see Creating access points.
A single element in a path through the JSON representation of a policy.
Contains details about the policy generation status and properties.
Contains the ARN details about the IAM entity for which the policy is generated.
The values for a manual Amazon RDS DB cluster snapshot attribute.
The proposed access control configuration for an Amazon RDS DB cluster snapshot. You can propose a configuration for a new Amazon RDS DB cluster snapshot or an Amazon RDS DB cluster snapshot that you own by specifying the RdsDbClusterSnapshotAttributeValue and optional KMS encryption key. For more information, see ModifyDBClusterSnapshotAttribute.
The name and values of a manual Amazon RDS DB snapshot attribute. Manual DB snapshot attributes are used to authorize other Amazon Web Services accounts to restore a manual DB snapshot.
The proposed access control configuration for an Amazon RDS DB snapshot. You can propose a configuration for a new Amazon RDS DB snapshot or an Amazon RDS DB snapshot that you own by specifying the RdsDbSnapshotAttributeValue and optional KMS encryption key. For more information, see ModifyDBSnapshotAttribute.
Contains information about the reasoning why a check for access passed or failed.
Contains information about the reason that the retrieval of a recommendation for a finding failed.
Contains information about a recommended step for an unused access analyzer finding.
The specified resource could not be found.
Contains information about the total number of active cross-account and public findings for a resource type of an external access analyzer.
The configuration for an Amazon S3 access point or multi-region access point for the bucket. You can propose up to 10 access points or multi-region access points per bucket. If the proposed Amazon S3 access point configuration is for an existing bucket, the access preview uses the proposed access point configuration in place of the existing access points. To propose an access point without a policy, you can provide an empty string as the access point policy. For more information, see Creating access points. For more information about access point policy limits, see Access points restrictions and limitations.
A proposed access control list grant configuration for an Amazon S3 bucket. For more information, see How to Specify an ACL.
Proposed access control configuration for an Amazon S3 bucket. You can propose a configuration for a new Amazon S3 bucket or an existing Amazon S3 bucket that you own by specifying the Amazon S3 bucket policy, bucket ACLs, bucket BPA settings, Amazon S3 access points, and multi-region access points attached to the bucket. If the configuration is for an existing Amazon S3 bucket and you do not specify the Amazon S3 bucket policy, the access preview uses the existing policy attached to the bucket. If the access preview is for a new resource and you do not specify the Amazon S3 bucket policy, the access preview assumes a bucket without a policy. To propose deletion of an existing bucket policy, you can specify an empty string. For more information about bucket policy limits, see Bucket Policy Examples.
Proposed configuration for an access point attached to an Amazon S3 directory bucket. You can propose up to 10 access points per bucket. If the proposed access point configuration is for an existing Amazon S3 directory bucket, the access preview uses the proposed access point configuration in place of the existing access points. To propose an access point without a policy, you can provide an empty string as the access point policy. For more information about access points for Amazon S3 directory buckets, see Managing access to directory buckets with access points in the Amazon Simple Storage Service User Guide.
Proposed access control configuration for an Amazon S3 directory bucket. You can propose a configuration for a new Amazon S3 directory bucket or an existing Amazon S3 directory bucket that you own by specifying the Amazon S3 bucket policy. If the configuration is for an existing Amazon S3 directory bucket and you do not specify the Amazon S3 bucket policy, the access preview uses the existing policy attached to the directory bucket. If the access preview is for a new resource and you do not specify the Amazon S3 bucket policy, the access preview assumes an directory bucket without a policy. To propose deletion of an existing bucket policy, you can specify an empty string. For more information about Amazon S3 directory bucket policies, see Example bucket policies for directory buckets in the Amazon Simple Storage Service User Guide.
The PublicAccessBlock configuration to apply to this Amazon S3 bucket. If the proposed configuration is for an existing Amazon S3 bucket and the configuration is not specified, the access preview uses the existing setting. If the proposed configuration is for a new bucket and the configuration is not specified, the access preview uses false. If the proposed configuration is for a new access point or multi-region access point and the access point BPA configuration is not specified, the access preview uses true. For more information, see PublicAccessBlockConfiguration.
The configuration for a Secrets Manager secret. For more information, see CreateSecret.
Service quote met error.
The proposed access control configuration for an Amazon SNS topic. You can propose a configuration for a new Amazon SNS topic or an existing Amazon SNS topic that you own by specifying the policy. If the configuration is for an existing Amazon SNS topic and you do not specify the Amazon SNS policy, then the access preview uses the existing Amazon SNS policy for the topic. If the access preview is for a new resource and you do not specify the policy, then the access preview assumes an Amazon SNS topic without a policy. To propose deletion of an existing Amazon SNS topic policy, you can specify an empty string for the Amazon SNS policy. For more information, see Topic.
The criteria used to sort.
The proposed access control configuration for an Amazon SQS queue. You can propose a configuration for a new Amazon SQS queue or an existing Amazon SQS queue that you own by specifying the Amazon SQS policy. If the configuration is for an existing Amazon SQS queue and you do not specify the Amazon SQS policy, the access preview uses the existing Amazon SQS policy for the queue. If the access preview is for a new resource and you do not specify the policy, the access preview assumes an Amazon SQS queue without a policy. To propose deletion of an existing Amazon SQS queue policy, you can specify an empty string for the Amazon SQS policy. For more information about Amazon SQS policy limits, see Quotas related to policies.
Starts a scan of the policies applied to the specified resource.
Provides more details about the current status of the analyzer. For example, if the creation for the analyzer fails, a Failed status is returned. For an analyzer with organization as the type, this failure can be due to an issue with creating the service-linked roles required in the member accounts of the Amazon Web Services organization.
Adds a tag to the specified resource.
The response to the request.
Throttling limit exceeded error.
Contains details about the CloudTrail trail being analyzed to generate a policy.
The specified entity could not be processed.
Removes a tag from the specified resource.
The response to the request.
Contains information about an unused access analyzer.
Provides aggregate statistics about the findings for the specified unused access analyzer.
Contains information about the total number of findings for a type of unused access.
Contains information about an unused access finding for an action. IAM Access Analyzer charges for unused access analysis based on the number of IAM roles and users analyzed per month. For more details on pricing, see IAM Access Analyzer pricing.
Contains information about an unused access finding for an IAM role. IAM Access Analyzer charges for unused access analysis based on the number of IAM roles and users analyzed per month. For more details on pricing, see IAM Access Analyzer pricing.
Contains information about an unused access finding for an IAM user access key. IAM Access Analyzer charges for unused access analysis based on the number of IAM roles and users analyzed per month. For more details on pricing, see IAM Access Analyzer pricing.
Contains information about an unused access finding for an IAM user password. IAM Access Analyzer charges for unused access analysis based on the number of IAM roles and users analyzed per month. For more details on pricing, see IAM Access Analyzer pricing.
Contains information about an unused access finding for a permission. IAM Access Analyzer charges for unused access analysis based on the number of IAM roles and users analyzed per month. For more details on pricing, see IAM Access Analyzer pricing.
Contains information about the action to take for a policy in an unused permissions finding.
Updates the specified archive rule.
Updates findings with the new values provided in the request.
A finding in a policy. Each finding is an actionable recommendation that can be used to improve the policy.
Validation exception error.
Contains information about a validation exception.
The proposed virtual private cloud (VPC) configuration for the Amazon S3 access point. VPC configuration does not apply to multi-region access points. For more information, see VpcConfiguration.