aws accessanalyzer validate-policy

Requests the validation of a policy and returns a list of findings. AWS CLI reference

1 example 6 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To request the validation of a policy and returns a list of findings

The following validate-policy example requests the validation of a policy and returns a list of findings. The policy in the example is a role trust policy for an Amazon Cognito role used for web identity federation. The findings generated from the trust policy relate to an empty Sid element value and a mismatched policy principal due to the incorrect assume role action being used, sts:AssumeRole. The correct assume role action for use with Cognito is sts:AssumeRoleWithWebIdentity.

aws accessanalyzer validate-policy --policy-document file://myfile.json --policy-type RESOURCE_POLICYIdentify

--policy-documentThe JSON policy document to use as the content for the policy.

--policy-typeThe type of policy to validate.

Contents of myfile.json:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Federated": "cognito-identity.amazonaws.com"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession"
            ],
            "Condition": {
                "StringEquals": {
                    "cognito-identity.amazonaws.com:aud": "us-west-2_EXAMPLE"
                }
            }
        }
    ]
}

Its output, shortened

{
    "findings": [
        {
            "findingDetails": "Add a value to the empty string in the Sid element.",
            "findingType": "SUGGESTION",
            "issueCode": "EMPTY_SID_VALUE",
            "learnMoreLink": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.html#access-analyzer-reference-policy-checks-suggestion-empty-sid-value",
            "locations": [
                {
                    "path": [
                        {
                            "value": "Statement"
                        },
                        {
                            "index": 0
                        },
                        {
                            "value": "Sid"
                        }
                    ],
                    "span": {
                        "end": {
                            "column": 21,
                            "line": 5,
                            "offset": 81
                        },
                        "start": {
                            "column": 19,
                            "line": 5,
                            "offset": 79
… 138 more lines

For more information, see Checks for validating policies in the AWS IAM User Guide.

Options

6 in the AWS CLI reference

--localeThe locale to use for localizing the findings.

--max-resultsThe maximum number of results to return in the response.

--next-tokenA token used for pagination of results returned.

--policy-documentThe JSON policy document to use as the content for the policy.

--policy-typeThe type of policy to validate.

--validate-policy-resource-typeThe type of resource to attach to your resource policy.