Retrieves the authorization details for a specific access denied request. The details include the request context, the evaluations performed, and the policies that were evaluated.
Use this operation to understand why a request was denied. Supported services include an authorization ID in the access denied error message. Pass that ID to this operation to retrieve the details.
Authorization details are available for at least 24 hours after the denial.
To use this operation, you must have the iam:GetRequestAuthorizationDetails permission.
Parameters:
-
authorization_id
(str)
–
The authorization ID received in the access denied error message. This ID identifies the specific request to retrieve details for.
-
next_token
(Optional[str], default:
None
)
–
The pagination token from a previous call, used to retrieve the next page of evaluations. Omit this value on the first call.
Raises:
-
AccessDeniedException
–
The caller does not have sufficient access to perform this action.
-
InternalServerException
–
An unexpected error occurred while processing the request. Try again.
-
ResourceNotFoundException
–
The requested authorization details do not exist in this region or have expired. Verify that the authorization ID from the access denied error message is correct and the call is made in the region where the denial occurred. Ensure that the calling principal belongs to the same account or organization as the original denied request.
-
ValidationException
–
The request is malformed or is missing one or more required parameters. Check the request parameters and try again.
-
UnknownServiceError
–
The service returned an error code this client does not model.
Source code in docs_src/capo_iam_toolbox/_services/iam_toolbox.py
| def get_request_authorization_details(
self,
authorization_id: str,
*,
config_overrides: Optional[IAMToolboxClientConfig] = None,
next_token: Optional[str] = None,
) -> "capo_iam_toolbox.types.get_request_authorization_details_output.GetRequestAuthorizationDetailsOutput":
"""<p>Retrieves the authorization details for a specific access denied request. The details include the request context, the evaluations performed, and the policies that were evaluated.</p> <p>Use this operation to understand why a request was denied. Supported services include an authorization ID in the access denied error message. Pass that ID to this operation to retrieve the details.</p> <p>Authorization details are available for at least 24 hours after the denial.</p> <p>To use this operation, you must have the <code>iam:GetRequestAuthorizationDetails</code> permission.</p>
Args:
authorization_id: <p>The authorization ID received in the access denied error message. This ID identifies the specific request to retrieve details for.</p>
next_token: <p>The pagination token from a previous call, used to retrieve the next page of evaluations. Omit this value on the first call.</p>
Raises:
capo_iam_toolbox.errors.access_denied_exception.AccessDeniedException: <p>The caller does not have sufficient access to perform this action.</p>
capo_iam_toolbox.errors.internal_server_exception.InternalServerException: <p>An unexpected error occurred while processing the request. Try again.</p>
capo_iam_toolbox.errors.resource_not_found_exception.ResourceNotFoundException: <p>The requested authorization details do not exist in this region or have expired. Verify that the authorization ID from the access denied error message is correct and the call is made in the region where the denial occurred. Ensure that the calling principal belongs to the same account or organization as the original denied request.</p>
capo_iam_toolbox.errors.validation_exception.ValidationException: <p>The request is malformed or is missing one or more required parameters. Check the request parameters and try again.</p>
capo_iam_toolbox.errors.UnknownServiceError: The service returned an error code this client does not model.
"""
def _handler(
req: "OperationRequest[capo_iam_toolbox.types.get_request_authorization_details_input.GetRequestAuthorizationDetailsInput]",
) -> OperationResponse[
"capo_iam_toolbox.types.get_request_authorization_details_output.GetRequestAuthorizationDetailsOutput"
]:
import capo_iam_toolbox._operations.auth_request_service.get_request_authorization_details
output, http_response = (
capo_iam_toolbox._operations.auth_request_service.get_request_authorization_details.get_request_authorization_details(
req.options, req.input
)
)
return OperationResponse(output=output, response=http_response)
interceptors_, options_ = self.operation_options(
config_overrides, OperationLogging("GetRequestAuthorizationDetails")
)
input_: capo_iam_toolbox.types.get_request_authorization_details_input.GetRequestAuthorizationDetailsInput = {
"authorization_id": authorization_id
}
if next_token is not None:
input_["next_token"] = next_token
response = execute_pipeline(
OperationRequest(input=input_, options=options_),
handler=_handler,
interceptors=list(interceptors_),
)
response.response.close()
return response.output
|