check_access_not_granted ¶

def check_access_not_granted(
    self,
    policy_document: "capo_accessanalyzer.types.access_check_policy_document.AccessCheckPolicyDocument",
    access: "capo_accessanalyzer.types.access_list.AccessList",
    policy_type: "capo_accessanalyzer.types.access_check_policy_type.AccessCheckPolicyType",
    *,
    config_overrides: Optional[AccessAnalyzerClientConfig] = None,
) -> "capo_accessanalyzer.types.check_access_not_granted_response.CheckAccessNotGrantedResponse":
    """<p>Checks whether the specified access isn't allowed by a policy.</p>

    Args:
        policy_document: <p>The JSON policy document to use as the content for the policy.</p>
        access: <p>An access object containing the permissions that shouldn't be granted by the specified policy. If only actions are specified, IAM Access Analyzer checks for access to peform at least one of the actions on any resource in the policy. If only resources are specified, then IAM Access Analyzer checks for access to perform any action on at least one of the resources. If both actions and resources are specified, IAM Access Analyzer checks for access to perform at least one of the specified actions on at least one of the specified resources.</p>
        policy_type: <p>The type of policy. Identity policies grant permissions to IAM principals. Identity policies include managed and inline policies for IAM roles, users, and groups.</p> <p>Resource policies grant permissions on Amazon Web Services resources. Resource policies include trust policies for IAM roles and bucket policies for Amazon S3 buckets.</p>

    Raises:
        capo_accessanalyzer.errors.access_denied_exception.AccessDeniedException: <p>You do not have sufficient access to perform this action.</p>
        capo_accessanalyzer.errors.internal_server_exception.InternalServerException: <p>Internal server error.</p>
        capo_accessanalyzer.errors.invalid_parameter_exception.InvalidParameterException: <p>The specified parameter is invalid.</p>
        capo_accessanalyzer.errors.throttling_exception.ThrottlingException: <p>Throttling limit exceeded error.</p>
        capo_accessanalyzer.errors.unprocessable_entity_exception.UnprocessableEntityException: <p>The specified entity could not be processed.</p>
        capo_accessanalyzer.errors.validation_exception.ValidationException: <p>Validation exception error.</p>
        capo_accessanalyzer.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        Passing check. Restrictive identity policy.

        >>> client.check_access_not_granted(access=[{'actions': ['s3:PutObject']}], policy_document='{"Version":"2012-10-17","Id":"123","Statement":[{"Sid":"AllowJohnDoe","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/JohnDoe"},"Action":"s3:GetObject","Resource":"*"}]}', policy_type='RESOURCE_POLICY')
        Passing check. Restrictive S3 Bucket resource policy.

        >>> client.check_access_not_granted(access=[{'resources': ['arn:aws:s3:::sensitive-bucket/*']}], policy_document='{"Version":"2012-10-17","Id":"123","Statement":[{"Sid":"AllowJohnDoe","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/JohnDoe"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::non-sensitive-bucket/*"}]}', policy_type='RESOURCE_POLICY')
        Failing check. Permissive S3 Bucket resource policy.

        >>> client.check_access_not_granted(access=[{'resources': ['arn:aws:s3:::my-bucket/*']}], policy_document='{"Version":"2012-10-17","Id":"123","Statement":[{"Sid":"AllowJohnDoe","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/JohnDoe"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}]}', policy_type='RESOURCE_POLICY')
    """

    def _handler(
        req: "OperationRequest[capo_accessanalyzer.types.check_access_not_granted_request.CheckAccessNotGrantedRequest]",
    ) -> OperationResponse[
        "capo_accessanalyzer.types.check_access_not_granted_response.CheckAccessNotGrantedResponse"
    ]:
        import capo_accessanalyzer._operations.access_analyzer.check_access_not_granted

        output, http_response = (
            capo_accessanalyzer._operations.access_analyzer.check_access_not_granted.check_access_not_granted(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_accessanalyzer.types.check_access_not_granted_request.CheckAccessNotGrantedRequest",
    ) -> dict[str, Any]:
        import capo_accessanalyzer.types.check_access_not_granted_request

        return capo_accessanalyzer.types.check_access_not_granted_request.redact_sensitive(
            input_
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging("CheckAccessNotGranted", redact_input=_redact_input),
    )
    input_: capo_accessanalyzer.types.check_access_not_granted_request.CheckAccessNotGrantedRequest = {
        "policy_document": policy_document,
        "access": access,
        "policy_type": policy_type,
    }

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output