check_no_public_access ¶

def check_no_public_access(
    self,
    policy_document: "capo_accessanalyzer.types.access_check_policy_document.AccessCheckPolicyDocument",
    resource_type: "capo_accessanalyzer.types.access_check_resource_type.AccessCheckResourceType",
    *,
    config_overrides: Optional[AccessAnalyzerClientConfig] = None,
) -> "capo_accessanalyzer.types.check_no_public_access_response.CheckNoPublicAccessResponse":
    """<p>Checks whether a resource policy can grant public access to the specified resource type.</p>

    Args:
        policy_document: <p>The JSON policy document to evaluate for public access.</p>
        resource_type: <p>The type of resource to evaluate for public access. For example, to check for public access to Amazon S3 buckets, you can choose <code>AWS::S3::Bucket</code> for the resource type.</p> <p>For resource types not supported as valid values, IAM Access Analyzer will return an error.</p>

    Raises:
        capo_accessanalyzer.errors.access_denied_exception.AccessDeniedException: <p>You do not have sufficient access to perform this action.</p>
        capo_accessanalyzer.errors.internal_server_exception.InternalServerException: <p>Internal server error.</p>
        capo_accessanalyzer.errors.invalid_parameter_exception.InvalidParameterException: <p>The specified parameter is invalid.</p>
        capo_accessanalyzer.errors.throttling_exception.ThrottlingException: <p>Throttling limit exceeded error.</p>
        capo_accessanalyzer.errors.unprocessable_entity_exception.UnprocessableEntityException: <p>The specified entity could not be processed.</p>
        capo_accessanalyzer.errors.validation_exception.ValidationException: <p>Validation exception error.</p>
        capo_accessanalyzer.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        Passing check. S3 Bucket policy without public access.

        >>> client.check_no_public_access(policy_document='{"Version":"2012-10-17","Statement":[{"Sid":"Bob","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111122223333:user/JohnDoe"},"Action":["s3:GetObject"]}]}', resource_type='AWS::S3::Bucket')
        Failing check. S3 Bucket policy with public access.

        >>> client.check_no_public_access(policy_document='{"Version":"2012-10-17","Statement":[{"Sid":"Bob","Effect":"Allow","Principal":"*","Action":["s3:GetObject"]}]}', resource_type='AWS::S3::Bucket')
    """

    def _handler(
        req: "OperationRequest[capo_accessanalyzer.types.check_no_public_access_request.CheckNoPublicAccessRequest]",
    ) -> OperationResponse[
        "capo_accessanalyzer.types.check_no_public_access_response.CheckNoPublicAccessResponse"
    ]:
        import capo_accessanalyzer._operations.access_analyzer.check_no_public_access

        output, http_response = (
            capo_accessanalyzer._operations.access_analyzer.check_no_public_access.check_no_public_access(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_accessanalyzer.types.check_no_public_access_request.CheckNoPublicAccessRequest",
    ) -> dict[str, Any]:
        import capo_accessanalyzer.types.check_no_public_access_request

        return capo_accessanalyzer.types.check_no_public_access_request.redact_sensitive(
            input_
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging("CheckNoPublicAccess", redact_input=_redact_input),
    )
    input_: capo_accessanalyzer.types.check_no_public_access_request.CheckNoPublicAccessRequest = {
        "policy_document": policy_document,
        "resource_type": resource_type,
    }

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output