aws accessanalyzer create-access-preview

Creates an access preview that allows you to preview IAM Access Analyzer findings for your resource before deploying resource permissions. AWS CLI reference

1 example 3 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To create an access preview that allows you to preview IAM Access Analyzer findings for your resource before deploying resource permissions

The following create-access-preview example creates an access preview that allows you to preview IAM Access Analyzer findings for your resource before deploying resource permissions in your AWS account.

aws accessanalyzer create-access-preview --analyzer-arn arn:aws:access-analyzer:us-west-2:123456789012:analyzer/ConsoleAnalyzer-account --configurations file://myfile.json

Identify

--analyzer-arnThe ARN of the account analyzer used to generate the access preview.

--configurationsAccess control configuration for your resource that is used to generate the access preview.

Contents of myfile.json:

{
    "arn:aws:s3:::amzn-s3-demo-bucket": {
        "s3Bucket": {
            "bucketPolicy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":[\"arn:aws:iam::123456789012:root\"]},\"Action\":[\"s3:PutObject\",\"s3:PutObjectAcl\"],\"Resource\":\"arn:aws:s3:::amzn-s3-demo-bucket/*\"}]}",
            "bucketPublicAccessBlock": {
                "ignorePublicAcls": true,
                "restrictPublicBuckets": true
            },
            "bucketAclGrants": [
                {
                    "grantee": {
                        "id": "79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be"
                    },
                    "permission": "READ"
                }
            ]
        }
    }
}

Its output

{
    "id": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
}

For more information, see Previewing access with IAM Access Analyzer APIs in the AWS IAM User Guide.

Options

3 in the AWS CLI reference

--analyzer-arnThe ARN of the account analyzer used to generate the access preview.

--client-tokenA client token.

--configurationsAccess control configuration for your resource that is used to generate the access preview.