validate_policy ¶

def validate_policy(
    self,
    policy_document: "capo_accessanalyzer.types.policy_document.PolicyDocument",
    policy_type: "capo_accessanalyzer.types.policy_type.PolicyType",
    *,
    config_overrides: Optional[AccessAnalyzerClientConfig] = None,
    locale: Optional["capo_accessanalyzer.types.locale.Locale"] = None,
    max_results: Optional[int] = None,
    next_token: Optional["capo_accessanalyzer.types.token.Token"] = None,
    validate_policy_resource_type: Optional[
        "capo_accessanalyzer.types.validate_policy_resource_type.ValidatePolicyResourceType"
    ] = None,
) -> "capo_accessanalyzer.types.validate_policy_response.ValidatePolicyResponse":
    """<p>Requests the validation of a policy and returns a list of findings. The findings help you identify issues and provide actionable recommendations to resolve the issue and enable you to author functional policies that meet security best practices. </p>

    Args:
        locale: <p>The locale to use for localizing the findings.</p>
        max_results: <p>The maximum number of results to return in the response.</p>
        next_token: <p>A token used for pagination of results returned.</p>
        policy_document: <p>The JSON policy document to use as the content for the policy.</p>
        policy_type: <p>The type of policy to validate. Identity policies grant permissions to IAM principals. Identity policies include managed and inline policies for IAM roles, users, and groups.</p> <p>Resource policies grant permissions on Amazon Web Services resources. Resource policies include trust policies for IAM roles and bucket policies for Amazon S3 buckets. You can provide a generic input such as identity policy or resource policy or a specific input such as managed policy or Amazon S3 bucket policy. </p> <p>Service control policies (SCPs) are a type of organization policy attached to an Amazon Web Services organization, organizational unit (OU), or an account.</p>
        validate_policy_resource_type: <p>The type of resource to attach to your resource policy. Specify a value for the policy validation resource type only if the policy type is <code>RESOURCE_POLICY</code>. For example, to validate a resource policy to attach to an Amazon S3 bucket, you can choose <code>AWS::S3::Bucket</code> for the policy validation resource type.</p> <p>For resource types not supported as valid values, IAM Access Analyzer runs policy checks that apply to all resource policies. For example, to validate a resource policy to attach to a KMS key, do not specify a value for the policy validation resource type and IAM Access Analyzer will run policy checks that apply to all resource policies.</p>

    Raises:
        capo_accessanalyzer.errors.access_denied_exception.AccessDeniedException: <p>You do not have sufficient access to perform this action.</p>
        capo_accessanalyzer.errors.internal_server_exception.InternalServerException: <p>Internal server error.</p>
        capo_accessanalyzer.errors.throttling_exception.ThrottlingException: <p>Throttling limit exceeded error.</p>
        capo_accessanalyzer.errors.validation_exception.ValidationException: <p>Validation exception error.</p>
        capo_accessanalyzer.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_accessanalyzer.types.validate_policy_request.ValidatePolicyRequest]",
    ) -> OperationResponse[
        "capo_accessanalyzer.types.validate_policy_response.ValidatePolicyResponse"
    ]:
        import capo_accessanalyzer._operations.access_analyzer.validate_policy

        output, http_response = (
            capo_accessanalyzer._operations.access_analyzer.validate_policy.validate_policy(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("ValidatePolicy")
    )
    input_: capo_accessanalyzer.types.validate_policy_request.ValidatePolicyRequest = {
        "policy_document": policy_document,
        "policy_type": policy_type,
    }
    if locale is not None:
        input_["locale"] = locale
    if max_results is not None:
        input_["max_results"] = max_results
    if next_token is not None:
        input_["next_token"] = next_token
    if validate_policy_resource_type is not None:
        input_["validate_policy_resource_type"] = validate_policy_resource_type

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output