aws accessanalyzer start-policy-generation

Starts the policy generation request. AWS CLI reference

1 example 3 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To start a policy generation request

The following start-policy-generation example starts a policy generation request in your AWS account.

aws accessanalyzer start-policy-generation --policy-generation-details '{"principalArn":"arn:aws:iam::123456789012:role/Admin"}' --cloud-trail-details file://myfile.json

Identify

--policy-generation-detailsContains the ARN of the IAM entity (user or role) for which you are generating a policy.

--cloud-trail-detailsA CloudTrailDetails object that contains details about a Trail that you want to analyze to generate policies.

Contents of myfile.json:

{
    "accessRole": "arn:aws:iam::123456789012:role/service-role/AccessAnalyzerMonitorServiceRole",
    "startTime": "2024-02-13T00:30:00Z",
    "trails": [
        {
            "allRegions": true,
            "cloudTrailArn": "arn:aws:cloudtrail:us-west-2:123456789012:trail/my-trail"
        }
    ]
}

Its output

{
    "jobId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
}

For more information, see IAM Access Analyzer policy generation in the AWS IAM User Guide.

Options

3 in the AWS CLI reference

--client-tokenA unique, case-sensitive identifier that you provide to ensure the idempotency of the request.

--cloud-trail-detailsA CloudTrailDetails object that contains details about a Trail that you want to analyze to generate policies.

--policy-generation-detailsContains the ARN of the IAM entity (user or role) for which you are generating a policy.