aws iot test-authorization

Tests if a specified principal is authorized to perform an IoT action on a specified resource. AWS CLI reference

1 example 6 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To test your AWS IoT policies

The following test-authorization example tests the AWS IoT policies associated with the specified principal.

aws iot test-authorization --auth-infos actionType=CONNECT,resources=arn:aws:iot:us-west-2:123456789012:client/client1 --principal arn:aws:iot:us-west-2:123456789012:cert/aab1068f7f43ac3e3cae4b3a8aa3f308d2a750e6350507962e32c1eb465d9775

Identify

--auth-infosA list of authorization info objects.

--principalThe principal.

Its output, shortened

{
    "authResults": [
        {
            "authInfo": {
                "actionType": "CONNECT",
                "resources": [
                    "arn:aws:iot:us-west-2:123456789012:client/client1"
                ]
            },
            "allowed": {
                "policies": [
                    {
                        "policyName": "TestPolicyAllowed",
                        "policyArn": "arn:aws:iot:us-west-2:123456789012:policy/TestPolicyAllowed"
                    }
                ]
            },
            "denied": {
                "implicitDeny": {
                    "policies": [
                        {
                            "policyName": "TestPolicyDenied",
                            "policyArn": "arn:aws:iot:us-west-2:123456789012:policy/TestPolicyDenied"
                        }
                    ]
                },
                "explicitDeny": {
                    "policies": [
                        {
                            "policyName": "TestPolicyExplicitDenied",
… 10 more lines

For more information, see AWS IoT Core policies in the AWS IoT Core Developer Guide.

Options

6 in the AWS CLI reference

--auth-infosA list of authorization info objects.

--client-idThe MQTT client ID.

--cognito-identity-pool-idThe Cognito identity pool ID.

--policy-names-to-addWhen testing custom authorization, the policies specified here are treated as if they are attached to the principal being authorized.

--policy-names-to-skipWhen testing custom authorization, the policies specified here are treated as if they are not attached to the principal being authorized.

--principalThe principal.