Module aws_sdk_accessanalyzer::types

Data structures used by operation inputs/outputs.

Modules

• builders
  Builders
• error
  Error types that Access Analyzer can respond with.

Structs

• Access

  Contains information about actions and resources that define permissions to check against a policy.

• AccessPreview

  Contains information about an access preview.

• AccessPreviewFinding

  An access preview finding generated by the access preview.

• AccessPreviewStatusReason

  Provides more details about the current status of the access preview. For example, if the creation of the access preview fails, a Failed status is returned. This failure can be due to an internal issue with the analysis or due to an invalid proposed resource configuration.

• AccessPreviewSummary

  Contains a summary of information about an access preview.

• AnalyzedResource

  Contains details about the analyzed resource.

• AnalyzedResourceSummary

  Contains the ARN of the analyzed resource.

• AnalyzerSummary

  Contains information about the analyzer.

• ArchiveRuleSummary

  Contains information about an archive rule.

• CloudTrailDetails

  Contains information about CloudTrail access.

• CloudTrailProperties

  Contains information about CloudTrail access.

• Criterion

  The criteria to use in the filter that defines the archive rule. For more information on available filter keys, see IAM Access Analyzer filter keys.

• DynamodbStreamConfiguration

  The proposed access control configuration for a DynamoDB stream. You can propose a configuration for a new DynamoDB stream or an existing DynamoDB stream that you own by specifying the policy for the DynamoDB stream. For more information, see PutResourcePolicy.

  • If the configuration is for an existing DynamoDB stream and you do not specify the DynamoDB policy, then the access preview uses the existing DynamoDB policy for the stream.

  • If the access preview is for a new resource and you do not specify the policy, then the access preview assumes a DynamoDB stream without a policy.

  • To propose deletion of an existing DynamoDB stream policy, you can specify an empty string for the DynamoDB policy.

• DynamodbTableConfiguration

  The proposed access control configuration for a DynamoDB table or index. You can propose a configuration for a new DynamoDB table or index or an existing DynamoDB table or index that you own by specifying the policy for the DynamoDB table or index. For more information, see PutResourcePolicy.

  • If the configuration is for an existing DynamoDB table or index and you do not specify the DynamoDB policy, then the access preview uses the existing DynamoDB policy for the table or index.

  • If the access preview is for a new resource and you do not specify the policy, then the access preview assumes a DynamoDB table without a policy.

  • To propose deletion of an existing DynamoDB table or index policy, you can specify an empty string for the DynamoDB policy.

• EbsSnapshotConfiguration

  The proposed access control configuration for an Amazon EBS volume snapshot. You can propose a configuration for a new Amazon EBS volume snapshot or an Amazon EBS volume snapshot that you own by specifying the user IDs, groups, and optional KMS encryption key. For more information, see ModifySnapshotAttribute.

• EcrRepositoryConfiguration

  The proposed access control configuration for an Amazon ECR repository. You can propose a configuration for a new Amazon ECR repository or an existing Amazon ECR repository that you own by specifying the Amazon ECR policy. For more information, see Repository.

  • If the configuration is for an existing Amazon ECR repository and you do not specify the Amazon ECR policy, then the access preview uses the existing Amazon ECR policy for the repository.

  • If the access preview is for a new resource and you do not specify the policy, then the access preview assumes an Amazon ECR repository without a policy.

  • To propose deletion of an existing Amazon ECR repository policy, you can specify an empty string for the Amazon ECR policy.

• EfsFileSystemConfiguration

  The proposed access control configuration for an Amazon EFS file system. You can propose a configuration for a new Amazon EFS file system or an existing Amazon EFS file system that you own by specifying the Amazon EFS policy. For more information, see Using file systems in Amazon EFS.

  • If the configuration is for an existing Amazon EFS file system and you do not specify the Amazon EFS policy, then the access preview uses the existing Amazon EFS policy for the file system.

  • If the access preview is for a new resource and you do not specify the policy, then the access preview assumes an Amazon EFS file system without a policy.

  • To propose deletion of an existing Amazon EFS file system policy, you can specify an empty string for the Amazon EFS policy.

• ExternalAccessDetails

  Contains information about an external access finding.

• Finding

  Contains information about a finding.

• FindingSource

  The source of the finding. This indicates how the access that generated the finding is granted. It is populated for Amazon S3 bucket findings.

• FindingSourceDetail

  Includes details about how the access that generated the finding is granted. This is populated for Amazon S3 bucket findings.

• FindingSummary

  Contains information about a finding.

• FindingSummaryV2

  Contains information about a finding.

• GeneratedPolicy

  Contains the text for the generated policy.

• GeneratedPolicyProperties

  Contains the generated policy details.

• GeneratedPolicyResult

  Contains the text for the generated policy and its details.

• IamRoleConfiguration

  The proposed access control configuration for an IAM role. You can propose a configuration for a new IAM role or an existing IAM role that you own by specifying the trust policy. If the configuration is for a new IAM role, you must specify the trust policy. If the configuration is for an existing IAM role that you own and you do not propose the trust policy, the access preview uses the existing trust policy for the role. The proposed trust policy cannot be an empty string. For more information about role trust policy limits, see IAM and STS quotas.

• InlineArchiveRule

  An criterion statement in an archive rule. Each archive rule may have multiple criteria.

• InternetConfiguration

  This configuration sets the network origin for the Amazon S3 access point or multi-region access point to Internet.

• JobDetails

  Contains details about the policy generation request.

• JobError

  Contains the details about the policy generation error.

• KmsGrantConfiguration

  A proposed grant configuration for a KMS key. For more information, see CreateGrant.

• KmsGrantConstraints

  Use this structure to propose allowing cryptographic operations in the grant only when the operation request includes the specified encryption context. You can specify only one type of encryption context. An empty map is treated as not specified. For more information, see GrantConstraints.

• KmsKeyConfiguration

  Proposed access control configuration for a KMS key. You can propose a configuration for a new KMS key or an existing KMS key that you own by specifying the key policy and KMS grant configuration. If the configuration is for an existing key and you do not specify the key policy, the access preview uses the existing policy for the key. If the access preview is for a new resource and you do not specify the key policy, then the access preview uses the default key policy. The proposed key policy cannot be an empty string. For more information, see Default key policy. For more information about key policy limits, see Resource quotas.

• Location

  A location in a policy that is represented as a path through the JSON representation and a corresponding span.

• PolicyGeneration

  Contains details about the policy generation status and properties.

• PolicyGenerationDetails

  Contains the ARN details about the IAM entity for which the policy is generated.

• Position

  A position in a policy.

• RdsDbClusterSnapshotConfiguration

  The proposed access control configuration for an Amazon RDS DB cluster snapshot. You can propose a configuration for a new Amazon RDS DB cluster snapshot or an Amazon RDS DB cluster snapshot that you own by specifying the RdsDbClusterSnapshotAttributeValue and optional KMS encryption key. For more information, see ModifyDBClusterSnapshotAttribute.

• RdsDbSnapshotConfiguration

  The proposed access control configuration for an Amazon RDS DB snapshot. You can propose a configuration for a new Amazon RDS DB snapshot or an Amazon RDS DB snapshot that you own by specifying the RdsDbSnapshotAttributeValue and optional KMS encryption key. For more information, see ModifyDBSnapshotAttribute.

• ReasonSummary

  Contains information about the reasoning why a check for access passed or failed.

• RecommendationError

  Contains information about the reason that the retrieval of a recommendation for a finding failed.

• S3AccessPointConfiguration

  The configuration for an Amazon S3 access point or multi-region access point for the bucket. You can propose up to 10 access points or multi-region access points per bucket. If the proposed Amazon S3 access point configuration is for an existing bucket, the access preview uses the proposed access point configuration in place of the existing access points. To propose an access point without a policy, you can provide an empty string as the access point policy. For more information, see Creating access points. For more information about access point policy limits, see Access points restrictions and limitations.

• S3BucketAclGrantConfiguration

  A proposed access control list grant configuration for an Amazon S3 bucket. For more information, see How to Specify an ACL.

• S3BucketConfiguration

  Proposed access control configuration for an Amazon S3 bucket. You can propose a configuration for a new Amazon S3 bucket or an existing Amazon S3 bucket that you own by specifying the Amazon S3 bucket policy, bucket ACLs, bucket BPA settings, Amazon S3 access points, and multi-region access points attached to the bucket. If the configuration is for an existing Amazon S3 bucket and you do not specify the Amazon S3 bucket policy, the access preview uses the existing policy attached to the bucket. If the access preview is for a new resource and you do not specify the Amazon S3 bucket policy, the access preview assumes a bucket without a policy. To propose deletion of an existing bucket policy, you can specify an empty string. For more information about bucket policy limits, see Bucket Policy Examples.

• S3ExpressDirectoryBucketConfiguration

  Proposed access control configuration for an Amazon S3 directory bucket. You can propose a configuration for a new Amazon S3 directory bucket or an existing Amazon S3 directory bucket that you own by specifying the Amazon S3 bucket policy. If the configuration is for an existing Amazon S3 directory bucket and you do not specify the Amazon S3 bucket policy, the access preview uses the existing policy attached to the directory bucket. If the access preview is for a new resource and you do not specify the Amazon S3 bucket policy, the access preview assumes an directory bucket without a policy. To propose deletion of an existing bucket policy, you can specify an empty string. For more information about Amazon S3 directory bucket policies, see Example directory bucket policies for S3 Express One Zone.

• S3PublicAccessBlockConfiguration

  The PublicAccessBlock configuration to apply to this Amazon S3 bucket. If the proposed configuration is for an existing Amazon S3 bucket and the configuration is not specified, the access preview uses the existing setting. If the proposed configuration is for a new bucket and the configuration is not specified, the access preview uses false. If the proposed configuration is for a new access point or multi-region access point and the access point BPA configuration is not specified, the access preview uses true. For more information, see PublicAccessBlockConfiguration.

• SecretsManagerSecretConfiguration

  The configuration for a Secrets Manager secret. For more information, see CreateSecret.

  You can propose a configuration for a new secret or an existing secret that you own by specifying the secret policy and optional KMS encryption key. If the configuration is for an existing secret and you do not specify the secret policy, the access preview uses the existing policy for the secret. If the access preview is for a new resource and you do not specify the policy, the access preview assumes a secret without a policy. To propose deletion of an existing policy, you can specify an empty string. If the proposed configuration is for a new secret and you do not specify the KMS key ID, the access preview uses the Amazon Web Services managed key aws/secretsmanager. If you specify an empty string for the KMS key ID, the access preview uses the Amazon Web Services managed key of the Amazon Web Services account. For more information about secret policy limits, see Quotas for Secrets Manager..

• SnsTopicConfiguration

  The proposed access control configuration for an Amazon SNS topic. You can propose a configuration for a new Amazon SNS topic or an existing Amazon SNS topic that you own by specifying the policy. If the configuration is for an existing Amazon SNS topic and you do not specify the Amazon SNS policy, then the access preview uses the existing Amazon SNS policy for the topic. If the access preview is for a new resource and you do not specify the policy, then the access preview assumes an Amazon SNS topic without a policy. To propose deletion of an existing Amazon SNS topic policy, you can specify an empty string for the Amazon SNS policy. For more information, see Topic.

• SortCriteria

  The criteria used to sort.

• Span

  A span in a policy. The span consists of a start position (inclusive) and end position (exclusive).

• SqsQueueConfiguration

  The proposed access control configuration for an Amazon SQS queue. You can propose a configuration for a new Amazon SQS queue or an existing Amazon SQS queue that you own by specifying the Amazon SQS policy. If the configuration is for an existing Amazon SQS queue and you do not specify the Amazon SQS policy, the access preview uses the existing Amazon SQS policy for the queue. If the access preview is for a new resource and you do not specify the policy, the access preview assumes an Amazon SQS queue without a policy. To propose deletion of an existing Amazon SQS queue policy, you can specify an empty string for the Amazon SQS policy. For more information about Amazon SQS policy limits, see Quotas related to policies.

• StatusReason

  Provides more details about the current status of the analyzer. For example, if the creation for the analyzer fails, a Failed status is returned. For an analyzer with organization as the type, this failure can be due to an issue with creating the service-linked roles required in the member accounts of the Amazon Web Services organization.

• Substring

  A reference to a substring of a literal string in a JSON document.

• Trail

  Contains details about the CloudTrail trail being analyzed to generate a policy.

• TrailProperties

  Contains details about the CloudTrail trail being analyzed to generate a policy.

• UnusedAccessConfiguration

  Contains information about an unused access analyzer.

• UnusedAction

  Contains information about an unused access finding for an action. IAM Access Analyzer charges for unused access analysis based on the number of IAM roles and users analyzed per month. For more details on pricing, see IAM Access Analyzer pricing.

• UnusedIamRoleDetails

  Contains information about an unused access finding for an IAM role. IAM Access Analyzer charges for unused access analysis based on the number of IAM roles and users analyzed per month. For more details on pricing, see IAM Access Analyzer pricing.

• UnusedIamUserAccessKeyDetails

  Contains information about an unused access finding for an IAM user access key. IAM Access Analyzer charges for unused access analysis based on the number of IAM roles and users analyzed per month. For more details on pricing, see IAM Access Analyzer pricing.

• UnusedIamUserPasswordDetails

  Contains information about an unused access finding for an IAM user password. IAM Access Analyzer charges for unused access analysis based on the number of IAM roles and users analyzed per month. For more details on pricing, see IAM Access Analyzer pricing.

• UnusedPermissionDetails

  Contains information about an unused access finding for a permission. IAM Access Analyzer charges for unused access analysis based on the number of IAM roles and users analyzed per month. For more details on pricing, see IAM Access Analyzer pricing.

• UnusedPermissionsRecommendedStep

  Contains information about the action to take for a policy in an unused permissions finding.

• ValidatePolicyFinding

  A finding in a policy. Each finding is an actionable recommendation that can be used to improve the policy.

• ValidationExceptionField

  Contains information about a validation exception.

• VpcConfiguration

  The proposed virtual private cloud (VPC) configuration for the Amazon S3 access point. VPC configuration does not apply to multi-region access points. For more information, see VpcConfiguration.

Enums

• AccessCheckPolicyType
  When writing a match expression against AccessCheckPolicyType, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• AccessCheckResourceType
  When writing a match expression against AccessCheckResourceType, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• AccessPreviewStatus
  When writing a match expression against AccessPreviewStatus, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• AccessPreviewStatusReasonCode
  When writing a match expression against AccessPreviewStatusReasonCode, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• AclGrantee

  You specify each grantee as a type-value pair using one of these types. You can specify only one type of grantee. For more information, see PutBucketAcl.

• AclPermission
  When writing a match expression against AclPermission, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• AnalyzerConfiguration

  Contains information about the configuration of an unused access analyzer for an Amazon Web Services organization or account.

• AnalyzerStatus
  When writing a match expression against AnalyzerStatus, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• CheckAccessNotGrantedResult
  When writing a match expression against CheckAccessNotGrantedResult, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• CheckNoNewAccessResult
  When writing a match expression against CheckNoNewAccessResult, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• CheckNoPublicAccessResult
  When writing a match expression against CheckNoPublicAccessResult, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• Configuration

  Access control configuration structures for your resource. You specify the configuration as a type-value pair. You can specify only one type of access control configuration.

• FindingChangeType
  When writing a match expression against FindingChangeType, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• FindingDetails

  Contains information about an external access or unused access finding. Only one parameter can be used in a FindingDetails object.

• FindingSourceType
  When writing a match expression against FindingSourceType, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• FindingStatus
  When writing a match expression against FindingStatus, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• FindingStatusUpdate
  When writing a match expression against FindingStatusUpdate, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• FindingType
  When writing a match expression against FindingType, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• JobErrorCode
  When writing a match expression against JobErrorCode, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• JobStatus
  When writing a match expression against JobStatus, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• KmsGrantOperation
  When writing a match expression against KmsGrantOperation, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• Locale
  When writing a match expression against Locale, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• NetworkOriginConfiguration

  The proposed InternetConfiguration or VpcConfiguration to apply to the Amazon S3 access point. VpcConfiguration does not apply to multi-region access points. You can make the access point accessible from the internet, or you can specify that all requests made through that access point must originate from a specific virtual private cloud (VPC). You can specify only one type of network configuration. For more information, see Creating access points.

• OrderBy
  When writing a match expression against OrderBy, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• PathElement

  A single element in a path through the JSON representation of a policy.

• PolicyType
  When writing a match expression against PolicyType, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• RdsDbClusterSnapshotAttributeValue

  The values for a manual Amazon RDS DB cluster snapshot attribute.

• RdsDbSnapshotAttributeValue

  The name and values of a manual Amazon RDS DB snapshot attribute. Manual DB snapshot attributes are used to authorize other Amazon Web Services accounts to restore a manual DB snapshot.

• ReasonCode
  When writing a match expression against ReasonCode, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• RecommendationType
  When writing a match expression against RecommendationType, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• RecommendedRemediationAction
  When writing a match expression against RecommendedRemediationAction, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• RecommendedStep

  Contains information about a recommended step for an unused access analyzer finding.

• ResourceType
  When writing a match expression against ResourceType, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• Status
  When writing a match expression against Status, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• Type
  When writing a match expression against Type, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• ValidatePolicyFindingType
  When writing a match expression against ValidatePolicyFindingType, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• ValidatePolicyResourceType
  When writing a match expression against ValidatePolicyResourceType, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.
• ValidationExceptionReason
  When writing a match expression against ValidationExceptionReason, it is important to ensure your code is forward-compatible. That is, if a match arm handles a case for a feature that is supported by the service but has not been represented as an enum variant in a current version of SDK, your code should continue to work when you upgrade SDK to a future version in which the enum does include a variant for that feature.