Struct InternalAccessDetails

#[non_exhaustive]
pub struct InternalAccessDetails {
    pub action: Option<Vec<String>>,
    pub condition: Option<HashMap<String, String>>,
    pub principal: Option<HashMap<String, String>>,
    pub principal_owner_account: Option<String>,
    pub access_type: Option<InternalAccessType>,
    pub principal_type: Option<PrincipalType>,
    pub sources: Option<Vec<FindingSource>>,
    pub resource_control_policy_restriction: Option<ResourceControlPolicyRestriction>,
    pub service_control_policy_restriction: Option<ServiceControlPolicyRestriction>,
}

Contains information about an internal access finding. This includes details about the access that was identified within your Amazon Web Services organization or account.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

action: Option<Vec<String>>

The action in the analyzed policy statement that has internal access permission to use.

condition: Option<HashMap<String, String>>

The condition in the analyzed policy statement that resulted in an internal access finding.

principal: Option<HashMap<String, String>>

The principal that has access to a resource within the internal environment.

principal_owner_account: Option<String>

The Amazon Web Services account ID that owns the principal identified in the internal access finding.

access_type: Option<InternalAccessType>

The type of internal access identified in the finding. This indicates how the access is granted within your Amazon Web Services environment.

principal_type: Option<PrincipalType>

The type of principal identified in the internal access finding, such as IAM role or IAM user.

sources: Option<Vec<FindingSource>>

The sources of the internal access finding. This indicates how the access that generated the finding is granted within your Amazon Web Services environment.

resource_control_policy_restriction: Option<ResourceControlPolicyRestriction>

The type of restriction applied to the finding by the resource owner with an Organizations resource control policy (RCP).

• APPLICABLE: There is an RCP present in the organization but IAM Access Analyzer does not include it in the evaluation of effective permissions. For example, if s3:DeleteObject is blocked by the RCP and the restriction is APPLICABLE, then s3:DeleteObject would still be included in the list of actions for the finding. Only applicable to internal access findings with the account as the zone of trust.

• FAILED_TO_EVALUATE_RCP: There was an error evaluating the RCP.

• NOT_APPLICABLE: There was no RCP present in the organization. For internal access findings with the account as the zone of trust, NOT_APPLICABLE could also indicate that there was no RCP applicable to the resource.

• APPLIED: An RCP is present in the organization and IAM Access Analyzer included it in the evaluation of effective permissions. For example, if s3:DeleteObject is blocked by the RCP and the restriction is APPLIED, then s3:DeleteObject would not be included in the list of actions for the finding. Only applicable to internal access findings with the organization as the zone of trust.

service_control_policy_restriction: Option<ServiceControlPolicyRestriction>

The type of restriction applied to the finding by an Organizations service control policy (SCP).

• APPLICABLE: There is an SCP present in the organization but IAM Access Analyzer does not include it in the evaluation of effective permissions. Only applicable to internal access findings with the account as the zone of trust.

• FAILED_TO_EVALUATE_SCP: There was an error evaluating the SCP.

• NOT_APPLICABLE: There was no SCP present in the organization. For internal access findings with the account as the zone of trust, NOT_APPLICABLE could also indicate that there was no SCP applicable to the principal.

• APPLIED: An SCP is present in the organization and IAM Access Analyzer included it in the evaluation of effective permissions. Only applicable to internal access findings with the organization as the zone of trust.

Implementations

impl InternalAccessDetails

pub fn action(&self) -> &[String]

The action in the analyzed policy statement that has internal access permission to use.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .action.is_none().

pub fn condition(&self) -> Option<&HashMap<String, String>>

The condition in the analyzed policy statement that resulted in an internal access finding.

pub fn principal(&self) -> Option<&HashMap<String, String>>

The principal that has access to a resource within the internal environment.

pub fn principal_owner_account(&self) -> Option<&str>

The Amazon Web Services account ID that owns the principal identified in the internal access finding.

pub fn access_type(&self) -> Option<&InternalAccessType>

The type of internal access identified in the finding. This indicates how the access is granted within your Amazon Web Services environment.

pub fn principal_type(&self) -> Option<&PrincipalType>

The type of principal identified in the internal access finding, such as IAM role or IAM user.

pub fn sources(&self) -> &[FindingSource]

The sources of the internal access finding. This indicates how the access that generated the finding is granted within your Amazon Web Services environment.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .sources.is_none().

pub fn resource_control_policy_restriction( &self, ) -> Option<&ResourceControlPolicyRestriction>

The type of restriction applied to the finding by the resource owner with an Organizations resource control policy (RCP).

• APPLICABLE: There is an RCP present in the organization but IAM Access Analyzer does not include it in the evaluation of effective permissions. For example, if s3:DeleteObject is blocked by the RCP and the restriction is APPLICABLE, then s3:DeleteObject would still be included in the list of actions for the finding. Only applicable to internal access findings with the account as the zone of trust.

• FAILED_TO_EVALUATE_RCP: There was an error evaluating the RCP.

• NOT_APPLICABLE: There was no RCP present in the organization. For internal access findings with the account as the zone of trust, NOT_APPLICABLE could also indicate that there was no RCP applicable to the resource.

• APPLIED: An RCP is present in the organization and IAM Access Analyzer included it in the evaluation of effective permissions. For example, if s3:DeleteObject is blocked by the RCP and the restriction is APPLIED, then s3:DeleteObject would not be included in the list of actions for the finding. Only applicable to internal access findings with the organization as the zone of trust.

pub fn service_control_policy_restriction( &self, ) -> Option<&ServiceControlPolicyRestriction>

The type of restriction applied to the finding by an Organizations service control policy (SCP).

• APPLICABLE: There is an SCP present in the organization but IAM Access Analyzer does not include it in the evaluation of effective permissions. Only applicable to internal access findings with the account as the zone of trust.

• FAILED_TO_EVALUATE_SCP: There was an error evaluating the SCP.

• NOT_APPLICABLE: There was no SCP present in the organization. For internal access findings with the account as the zone of trust, NOT_APPLICABLE could also indicate that there was no SCP applicable to the principal.

• APPLIED: An SCP is present in the organization and IAM Access Analyzer included it in the evaluation of effective permissions. Only applicable to internal access findings with the organization as the zone of trust.

impl InternalAccessDetails

pub fn builder() -> InternalAccessDetailsBuilder

Creates a new builder-style object to manufacture InternalAccessDetails.

Trait Implementations

impl Clone for InternalAccessDetails

fn clone(&self) -> InternalAccessDetails

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for InternalAccessDetails

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for InternalAccessDetails

fn eq(&self, other: &InternalAccessDetails) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for InternalAccessDetails