aws accessanalyzer check-no-public-access

Checks whether a resource policy can grant public access to the specified resource type. AWS CLI reference

1 example 2 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To check whether a resource policy can grant public access to the specified resource type

The following check-no-public-access example checks whether a resource policy can grant public access to the specified resource type.

aws accessanalyzer check-no-public-access --policy-document file://check-no-public-access-myfile.json --resource-type AWS::S3::Bucket

Identify

--policy-documentThe JSON policy document to evaluate for public access.

--resource-typeThe type of resource to evaluate for public access.

Contents of check-no-public-access-myfile.json:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CheckNoPublicAccess",
            "Effect": "Allow",
            "Principal": { "AWS": "arn:aws:iam::123456789012:user/JohnDoe" },
            "Action": [
                "s3:GetObject"
            ]
        }
    ]
}

Its output

{
    "result": "PASS",
    "message": "The resource policy does not grant public access for the given resource type."
}

For more information, see Previewing access with IAM Access Analyzer APIs in the AWS IAM User Guide.

Options

2 in the AWS CLI reference

--policy-documentThe JSON policy document to evaluate for public access.

--resource-typeThe type of resource to evaluate for public access.