Skip to content

Evaluation

Source code in docs_src/capo_iam_toolbox/types/evaluation.py 
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
class Evaluation(TypedDict, closed=True):
    action: "str"
    """<p>The action evaluated for this request (for example, <code>iam:PassRole</code>).</p>"""
    resource: "str"
    """<p>The resource that the action targeted. This is typically a resource ARN, but can be a wildcard ARN that matches multiple resources, or empty for actions that are not resource-specific.</p>"""
    context: NotRequired[
        "capo_iam_toolbox.types.authorization_context.AuthorizationContext"
    ]
    """<p>The context keys and values specific to this evaluation. These are applied on top of the request context.</p>"""
    evaluated_effect: NotRequired[
        "capo_iam_toolbox.types.evaluated_effect.EvaluatedEffect"
    ]
    """<p>The result of the evaluation. Valid values:</p> <ul> <li> <p> <code>ALLOW</code> - The action was allowed.</p> </li> <li> <p> <code>EXPLICIT_DENY</code> - The action was explicitly denied by a policy.</p> </li> <li> <p> <code>IMPLICIT_DENY</code> - The action was denied because no policy allowed it.</p> </li> </ul>"""
    matched_policies: NotRequired[
        "capo_iam_toolbox.types.matched_policy_list.MatchedPolicyList"
    ]
    """<p>The policies that matched during evaluation of this action and resource. An implicit denial produces no matched policies.</p>"""

action instance-attribute 

action: str

The action evaluated for this request (for example, iam:PassRole).

context instance-attribute 

context: NotRequired[AuthorizationContext]

The context keys and values specific to this evaluation. These are applied on top of the request context.

evaluated_effect instance-attribute 

evaluated_effect: NotRequired[EvaluatedEffect]

The result of the evaluation. Valid values:

  • ALLOW - The action was allowed.

  • EXPLICIT_DENY - The action was explicitly denied by a policy.

  • IMPLICIT_DENY - The action was denied because no policy allowed it.

matched_policies instance-attribute 

matched_policies: NotRequired[MatchedPolicyList]

The policies that matched during evaluation of this action and resource. An implicit denial produces no matched policies.

resource instance-attribute 

resource: str

The resource that the action targeted. This is typically a resource ARN, but can be a wildcard ARN that matches multiple resources, or empty for actions that are not resource-specific.