put_resource_policy async ¶

async def put_resource_policy(
    self,
    resource_arn: "capo_eventbridgev2.types.event_bus_arn.EventBusArn",
    policy_document: "capo_eventbridgev2.types.policy_document.PolicyDocument",
    *,
    config_overrides: Optional[AsyncEventBridgeV2ClientConfig] = None,
    policy_name: Optional["capo_eventbridgev2.types.policy_name.PolicyName"] = None,
    expected_revision_id: Optional[
        "capo_eventbridgev2.types.policy_revision_id.PolicyRevisionId"
    ] = None,
) -> "capo_eventbridgev2.types.put_resource_policy_response.PutResourcePolicyResponse":
    """Attaches a named resource policy to an event bus — the only resource type that supports policies; other resource ARNs are rejected. Each bus holds two named policies: "default" (customer-managed, full IAM policy language including Deny) and "AWS_RAM" (written exclusively by AWS Resource Access Manager to reflect resource shares). Both policies are evaluated on cross-account authorization; an explicit Deny in either overrides an Allow in the other. Operations that omit PolicyName target "default". A "default" policy that would grant public access is rejected with PublicPolicyException and is not attached; this check is always on and cannot be disabled.

    Args:
        policy_name: Which named policy to write. Defaults to "default", the customer-managed policy, when omitted (a write AWS Resource Access Manager makes on the owner's behalf resolves to "AWS_RAM" instead). The two writers are exclusive in both directions — only Resource Access Manager can write "AWS_RAM", and only the bus owner can write "default" — so naming the other party's policy fails with AccessDeniedException. A well-formed name that is neither of the two fails with InvalidInputException.
        expected_revision_id: The write succeeds only if the named policy's current revision ID matches this value; a policy that does not exist yet matches only the sentinel "NO_POLICY" (create-only). On mismatch the operation fails with ConflictException. When omitted, the write is unconditional. Every attempt stores a newly generated revision ID, so retrying an unanswered request can conflict with the caller's own earlier attempt; read the policy back and compare it with the one you intended before treating a conflict as another writer's change.

    Raises:
        capo_eventbridgev2.errors.access_denied_exception.AccessDeniedException: The caller does not have the permissions required to perform the operation. This error is also returned when the operation cannot use the AWS KMS key for the event bus.
        capo_eventbridgev2.errors.internal_exception.InternalException: The request failed because of an internal service error. Retry the request.
        capo_eventbridgev2.errors.invalid_input_exception.InvalidInputException: A request parameter is missing or not valid.
        capo_eventbridgev2.errors.throttling_exception.ThrottlingException: The request was throttled because it exceeds a request rate limit. Retry the request with backoff.
        capo_eventbridgev2.errors.concurrent_modification_exception.ConcurrentModificationException: Another change to the resource is already in progress. Retry the request.
        capo_eventbridgev2.errors.conflict_exception.ConflictException: A client-supplied precondition (e.g. ExpectedRevisionId on a resource-policy write) did not match the current state of the resource. Retrying the same request will fail again; re-read the resource and re-evaluate before retrying. A conditional request is not retry-safe on its own. If an earlier attempt committed but its response never reached the caller, retrying fails with this error, which is indistinguishable from another writer having won. Compare the resource's current contents with what the request intended: a successful attempt stores a revision ID the caller never saw, so the revision alone cannot tell the two apart, but matching contents mean the change took effect.
        capo_eventbridgev2.errors.policy_length_exceeded_exception.PolicyLengthExceededException: The policy document is larger than the account's resource policy size quota, or larger than the service maximum.
        capo_eventbridgev2.errors.public_policy_exception.PublicPolicyException: The policy was rejected because it would grant public access to the event bus. A statement grants public access when its principal is a wildcard and no condition limits the callers to specific AWS accounts or principals. To fix it, replace the wildcard principal with specific principals, or add a condition that limits the callers to specific AWS accounts. Conditions on event content (events:source, events:detail-type, events:Metadata/*) do not identify the caller and do not make a wildcard principal non-public. Returned only for the "default" policy; the "AWS_RAM" policy is composed by AWS Resource Access Manager and never grants public access.
        capo_eventbridgev2.errors.resource_not_found_exception.ResourceNotFoundException: The resource does not exist.
        capo_eventbridgev2.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    async def _handler(
        req: "AsyncOperationRequest[capo_eventbridgev2.types.put_resource_policy_request.PutResourcePolicyRequest]",
    ) -> AsyncOperationResponse[
        "capo_eventbridgev2.types.put_resource_policy_response.PutResourcePolicyResponse"
    ]:
        import capo_eventbridgev2._operations.aws_events_v2.put_resource_policy

        (
            output,
            http_response,
        ) = await capo_eventbridgev2._operations.aws_events_v2.put_resource_policy.async_put_resource_policy(
            req.options, req.input
        )
        return AsyncOperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("PutResourcePolicy")
    )
    input_: capo_eventbridgev2.types.put_resource_policy_request.PutResourcePolicyRequest = {
        "resource_arn": resource_arn,
        "policy_document": policy_document,
    }
    if policy_name is not None:
        input_["policy_name"] = policy_name
    if expected_revision_id is not None:
        input_["expected_revision_id"] = expected_revision_id

    response = await aexecute_pipeline(
        AsyncOperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    await response.response.aclose()
    return response.output