validate_resource_policy ¶

def validate_resource_policy(
    self,
    resource_policy: "capo_secrets_manager.types.non_empty_resource_policy_type.NonEmptyResourcePolicyType",
    *,
    config_overrides: Optional[SecretsManagerClientConfig] = None,
    secret_id: Optional[
        "capo_secrets_manager.types.secret_id_type.SecretIdType"
    ] = None,
) -> "capo_secrets_manager.types.validate_resource_policy_response.ValidateResourcePolicyResponse":
    r"""<p>Validates that a resource policy does not grant a wide range of principals access to your secret. A resource-based policy is optional for secrets.</p> <p>The API performs three checks when validating the policy:</p> <ul> <li> <p>Sends a call to <a href="https://aws.amazon.com/blogs/security/protect-sensitive-data-in-the-cloud-with-automated-reasoning-zelkova/">Zelkova</a>, an automated reasoning engine, to ensure your resource policy does not allow broad access to your secret, for example policies that use a wildcard for the principal.</p> </li> <li> <p>Checks for correct syntax in a policy.</p> </li> <li> <p>Verifies the policy does not lock out a caller.</p> </li> </ul> <p>Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p> <p> <b>Required permissions: </b> <code>secretsmanager:ValidateResourcePolicy</code> and <code>secretsmanager:PutResourcePolicy</code>. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions"> IAM policy actions for Secrets Manager</a> and <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html">Authentication and access control in Secrets Manager</a>. </p>

    Args:
        secret_id: <p>The ARN or name of the secret with the resource-based policy you want to validate.</p>
        resource_policy: <p>A JSON-formatted string that contains an Amazon Web Services resource-based policy. The policy in the string identifies who can access or manage this secret and its versions. For example policies, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_examples.html">Permissions policy examples</a>.</p>

    Raises:
        capo_secrets_manager.errors.internal_service_error.InternalServiceError: <p>An error occurred on the server side.</p>
        capo_secrets_manager.errors.invalid_parameter_exception.InvalidParameterException: <p>The parameter name or value is invalid.</p>
        capo_secrets_manager.errors.invalid_request_exception.InvalidRequestException: <p>A parameter value is not valid for the current state of the resource.</p> <p>Possible causes:</p> <ul> <li> <p>The secret is scheduled for deletion.</p> </li> <li> <p>You tried to enable rotation on a secret that doesn't already have a Lambda function ARN configured and you didn't include such an ARN as a parameter in this call. </p> </li> <li> <p>The secret is managed by another service, and you must use that service to update it. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/service-linked-secrets.html">Secrets managed by other Amazon Web Services services</a>.</p> </li> </ul>
        capo_secrets_manager.errors.malformed_policy_document_exception.MalformedPolicyDocumentException: <p>The resource policy has syntax errors.</p>
        capo_secrets_manager.errors.resource_not_found_exception.ResourceNotFoundException: <p>Secrets Manager can't find the resource that you asked for.</p>
        capo_secrets_manager.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        To validate a resource-based policy to a secret
        The following example shows how to validate a resource-based policy to a secret.

        >>> client.validate_resource_policy(secret_id='MyTestDatabaseSecret', resource_policy='{\n"Version":"2012-10-17",\n"Statement":[{\n"Effect":"Allow",\n"Principal":{\n"AWS":"arn:aws:iam::123456789012:root"\n},\n"Action":"secretsmanager:GetSecretValue",\n"Resource":"*"\n}]\n}')
    """

    def _handler(
        req: "OperationRequest[capo_secrets_manager.types.validate_resource_policy_request.ValidateResourcePolicyRequest]",
    ) -> OperationResponse[
        "capo_secrets_manager.types.validate_resource_policy_response.ValidateResourcePolicyResponse"
    ]:
        import capo_secrets_manager._operations.secretsmanager.validate_resource_policy

        output, http_response = (
            capo_secrets_manager._operations.secretsmanager.validate_resource_policy.validate_resource_policy(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("ValidateResourcePolicy")
    )
    input_: capo_secrets_manager.types.validate_resource_policy_request.ValidateResourcePolicyRequest = {
        "resource_policy": resource_policy
    }
    if secret_id is not None:
        input_["secret_id"] = secret_id

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output