Skip to content

Commit c5dc054

Browse files
author
awstools
committed
feat(client-accessanalyzer): IAM Access Analyzer now provides policy recommendations to help resolve unused permissions for IAM roles and users. Additionally, IAM Access Analyzer now extends its custom policy checks to detect when IAM policies grant public access or access to critical resources ahead of deployments.
1 parent dde3dbe commit c5dc054

13 files changed

+1766
-11
lines changed

‎clients/client-accessanalyzer/README.md

+24
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,14 @@ CheckNoNewAccess
257257

258258
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/accessanalyzer/command/CheckNoNewAccessCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/CheckNoNewAccessCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/CheckNoNewAccessCommandOutput/)
259259

260+
</details>
261+
<details>
262+
<summary>
263+
CheckNoPublicAccess
264+
</summary>
265+
266+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/accessanalyzer/command/CheckNoPublicAccessCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/CheckNoPublicAccessCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/CheckNoPublicAccessCommandOutput/)
267+
260268
</details>
261269
<details>
262270
<summary>
@@ -297,6 +305,14 @@ DeleteArchiveRule
297305

298306
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/accessanalyzer/command/DeleteArchiveRuleCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/DeleteArchiveRuleCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/DeleteArchiveRuleCommandOutput/)
299307

308+
</details>
309+
<details>
310+
<summary>
311+
GenerateFindingRecommendation
312+
</summary>
313+
314+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/accessanalyzer/command/GenerateFindingRecommendationCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/GenerateFindingRecommendationCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/GenerateFindingRecommendationCommandOutput/)
315+
300316
</details>
301317
<details>
302318
<summary>
@@ -337,6 +353,14 @@ GetFinding
337353

338354
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/accessanalyzer/command/GetFindingCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/GetFindingCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/GetFindingCommandOutput/)
339355

356+
</details>
357+
<details>
358+
<summary>
359+
GetFindingRecommendation
360+
</summary>
361+
362+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/accessanalyzer/command/GetFindingRecommendationCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/GetFindingRecommendationCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-accessanalyzer/Interface/GetFindingRecommendationCommandOutput/)
363+
340364
</details>
341365
<details>
342366
<summary>

‎clients/client-accessanalyzer/src/AccessAnalyzer.ts

+69
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,11 @@ import {
2323
CheckNoNewAccessCommandInput,
2424
CheckNoNewAccessCommandOutput,
2525
} from "./commands/CheckNoNewAccessCommand";
26+
import {
27+
CheckNoPublicAccessCommand,
28+
CheckNoPublicAccessCommandInput,
29+
CheckNoPublicAccessCommandOutput,
30+
} from "./commands/CheckNoPublicAccessCommand";
2631
import {
2732
CreateAccessPreviewCommand,
2833
CreateAccessPreviewCommandInput,
@@ -48,6 +53,11 @@ import {
4853
DeleteArchiveRuleCommandInput,
4954
DeleteArchiveRuleCommandOutput,
5055
} from "./commands/DeleteArchiveRuleCommand";
56+
import {
57+
GenerateFindingRecommendationCommand,
58+
GenerateFindingRecommendationCommandInput,
59+
GenerateFindingRecommendationCommandOutput,
60+
} from "./commands/GenerateFindingRecommendationCommand";
5161
import {
5262
GetAccessPreviewCommand,
5363
GetAccessPreviewCommandInput,
@@ -65,6 +75,11 @@ import {
6575
GetArchiveRuleCommandOutput,
6676
} from "./commands/GetArchiveRuleCommand";
6777
import { GetFindingCommand, GetFindingCommandInput, GetFindingCommandOutput } from "./commands/GetFindingCommand";
78+
import {
79+
GetFindingRecommendationCommand,
80+
GetFindingRecommendationCommandInput,
81+
GetFindingRecommendationCommandOutput,
82+
} from "./commands/GetFindingRecommendationCommand";
6883
import {
6984
GetFindingV2Command,
7085
GetFindingV2CommandInput,
@@ -157,16 +172,19 @@ const commands = {
157172
CancelPolicyGenerationCommand,
158173
CheckAccessNotGrantedCommand,
159174
CheckNoNewAccessCommand,
175+
CheckNoPublicAccessCommand,
160176
CreateAccessPreviewCommand,
161177
CreateAnalyzerCommand,
162178
CreateArchiveRuleCommand,
163179
DeleteAnalyzerCommand,
164180
DeleteArchiveRuleCommand,
181+
GenerateFindingRecommendationCommand,
165182
GetAccessPreviewCommand,
166183
GetAnalyzedResourceCommand,
167184
GetAnalyzerCommand,
168185
GetArchiveRuleCommand,
169186
GetFindingCommand,
187+
GetFindingRecommendationCommand,
170188
GetFindingV2Command,
171189
GetGeneratedPolicyCommand,
172190
ListAccessPreviewFindingsCommand,
@@ -256,6 +274,23 @@ export interface AccessAnalyzer {
256274
cb: (err: any, data?: CheckNoNewAccessCommandOutput) => void
257275
): void;
258276

277+
/**
278+
* @see {@link CheckNoPublicAccessCommand}
279+
*/
280+
checkNoPublicAccess(
281+
args: CheckNoPublicAccessCommandInput,
282+
options?: __HttpHandlerOptions
283+
): Promise<CheckNoPublicAccessCommandOutput>;
284+
checkNoPublicAccess(
285+
args: CheckNoPublicAccessCommandInput,
286+
cb: (err: any, data?: CheckNoPublicAccessCommandOutput) => void
287+
): void;
288+
checkNoPublicAccess(
289+
args: CheckNoPublicAccessCommandInput,
290+
options: __HttpHandlerOptions,
291+
cb: (err: any, data?: CheckNoPublicAccessCommandOutput) => void
292+
): void;
293+
259294
/**
260295
* @see {@link CreateAccessPreviewCommand}
261296
*/
@@ -335,6 +370,23 @@ export interface AccessAnalyzer {
335370
cb: (err: any, data?: DeleteArchiveRuleCommandOutput) => void
336371
): void;
337372

373+
/**
374+
* @see {@link GenerateFindingRecommendationCommand}
375+
*/
376+
generateFindingRecommendation(
377+
args: GenerateFindingRecommendationCommandInput,
378+
options?: __HttpHandlerOptions
379+
): Promise<GenerateFindingRecommendationCommandOutput>;
380+
generateFindingRecommendation(
381+
args: GenerateFindingRecommendationCommandInput,
382+
cb: (err: any, data?: GenerateFindingRecommendationCommandOutput) => void
383+
): void;
384+
generateFindingRecommendation(
385+
args: GenerateFindingRecommendationCommandInput,
386+
options: __HttpHandlerOptions,
387+
cb: (err: any, data?: GenerateFindingRecommendationCommandOutput) => void
388+
): void;
389+
338390
/**
339391
* @see {@link GetAccessPreviewCommand}
340392
*/
@@ -405,6 +457,23 @@ export interface AccessAnalyzer {
405457
cb: (err: any, data?: GetFindingCommandOutput) => void
406458
): void;
407459

460+
/**
461+
* @see {@link GetFindingRecommendationCommand}
462+
*/
463+
getFindingRecommendation(
464+
args: GetFindingRecommendationCommandInput,
465+
options?: __HttpHandlerOptions
466+
): Promise<GetFindingRecommendationCommandOutput>;
467+
getFindingRecommendation(
468+
args: GetFindingRecommendationCommandInput,
469+
cb: (err: any, data?: GetFindingRecommendationCommandOutput) => void
470+
): void;
471+
getFindingRecommendation(
472+
args: GetFindingRecommendationCommandInput,
473+
options: __HttpHandlerOptions,
474+
cb: (err: any, data?: GetFindingRecommendationCommandOutput) => void
475+
): void;
476+
408477
/**
409478
* @see {@link GetFindingV2Command}
410479
*/

‎clients/client-accessanalyzer/src/AccessAnalyzerClient.ts

+18
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,10 @@ import {
6363
CheckAccessNotGrantedCommandOutput,
6464
} from "./commands/CheckAccessNotGrantedCommand";
6565
import { CheckNoNewAccessCommandInput, CheckNoNewAccessCommandOutput } from "./commands/CheckNoNewAccessCommand";
66+
import {
67+
CheckNoPublicAccessCommandInput,
68+
CheckNoPublicAccessCommandOutput,
69+
} from "./commands/CheckNoPublicAccessCommand";
6670
import {
6771
CreateAccessPreviewCommandInput,
6872
CreateAccessPreviewCommandOutput,
@@ -71,6 +75,10 @@ import { CreateAnalyzerCommandInput, CreateAnalyzerCommandOutput } from "./comma
7175
import { CreateArchiveRuleCommandInput, CreateArchiveRuleCommandOutput } from "./commands/CreateArchiveRuleCommand";
7276
import { DeleteAnalyzerCommandInput, DeleteAnalyzerCommandOutput } from "./commands/DeleteAnalyzerCommand";
7377
import { DeleteArchiveRuleCommandInput, DeleteArchiveRuleCommandOutput } from "./commands/DeleteArchiveRuleCommand";
78+
import {
79+
GenerateFindingRecommendationCommandInput,
80+
GenerateFindingRecommendationCommandOutput,
81+
} from "./commands/GenerateFindingRecommendationCommand";
7482
import { GetAccessPreviewCommandInput, GetAccessPreviewCommandOutput } from "./commands/GetAccessPreviewCommand";
7583
import {
7684
GetAnalyzedResourceCommandInput,
@@ -79,6 +87,10 @@ import {
7987
import { GetAnalyzerCommandInput, GetAnalyzerCommandOutput } from "./commands/GetAnalyzerCommand";
8088
import { GetArchiveRuleCommandInput, GetArchiveRuleCommandOutput } from "./commands/GetArchiveRuleCommand";
8189
import { GetFindingCommandInput, GetFindingCommandOutput } from "./commands/GetFindingCommand";
90+
import {
91+
GetFindingRecommendationCommandInput,
92+
GetFindingRecommendationCommandOutput,
93+
} from "./commands/GetFindingRecommendationCommand";
8294
import { GetFindingV2CommandInput, GetFindingV2CommandOutput } from "./commands/GetFindingV2Command";
8395
import { GetGeneratedPolicyCommandInput, GetGeneratedPolicyCommandOutput } from "./commands/GetGeneratedPolicyCommand";
8496
import {
@@ -131,16 +143,19 @@ export type ServiceInputTypes =
131143
| CancelPolicyGenerationCommandInput
132144
| CheckAccessNotGrantedCommandInput
133145
| CheckNoNewAccessCommandInput
146+
| CheckNoPublicAccessCommandInput
134147
| CreateAccessPreviewCommandInput
135148
| CreateAnalyzerCommandInput
136149
| CreateArchiveRuleCommandInput
137150
| DeleteAnalyzerCommandInput
138151
| DeleteArchiveRuleCommandInput
152+
| GenerateFindingRecommendationCommandInput
139153
| GetAccessPreviewCommandInput
140154
| GetAnalyzedResourceCommandInput
141155
| GetAnalyzerCommandInput
142156
| GetArchiveRuleCommandInput
143157
| GetFindingCommandInput
158+
| GetFindingRecommendationCommandInput
144159
| GetFindingV2CommandInput
145160
| GetGeneratedPolicyCommandInput
146161
| ListAccessPreviewFindingsCommandInput
@@ -168,16 +183,19 @@ export type ServiceOutputTypes =
168183
| CancelPolicyGenerationCommandOutput
169184
| CheckAccessNotGrantedCommandOutput
170185
| CheckNoNewAccessCommandOutput
186+
| CheckNoPublicAccessCommandOutput
171187
| CreateAccessPreviewCommandOutput
172188
| CreateAnalyzerCommandOutput
173189
| CreateArchiveRuleCommandOutput
174190
| DeleteAnalyzerCommandOutput
175191
| DeleteArchiveRuleCommandOutput
192+
| GenerateFindingRecommendationCommandOutput
176193
| GetAccessPreviewCommandOutput
177194
| GetAnalyzedResourceCommandOutput
178195
| GetAnalyzerCommandOutput
179196
| GetArchiveRuleCommandOutput
180197
| GetFindingCommandOutput
198+
| GetFindingRecommendationCommandOutput
181199
| GetFindingV2CommandOutput
182200
| GetGeneratedPolicyCommandOutput
183201
| ListAccessPreviewFindingsCommandOutput

‎clients/client-accessanalyzer/src/commands/CheckAccessNotGrantedCommand.ts

+4-1
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,10 @@ export interface CheckAccessNotGrantedCommandOutput extends CheckAccessNotGrante
4343
* policyDocument: "STRING_VALUE", // required
4444
* access: [ // AccessList // required
4545
* { // Access
46-
* actions: [ // ActionsList // required
46+
* actions: [ // ActionsList
47+
* "STRING_VALUE",
48+
* ],
49+
* resources: [ // ResourcesList
4750
* "STRING_VALUE",
4851
* ],
4952
* },

‎clients/client-accessanalyzer/src/commands/CheckNoPublicAccessCommand.ts

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
// smithy-typescript generated code
2+
import { getEndpointPlugin } from "@smithy/middleware-endpoint";
3+
import { getSerdePlugin } from "@smithy/middleware-serde";
4+
import { Command as $Command } from "@smithy/smithy-client";
5+
import { MetadataBearer as __MetadataBearer } from "@smithy/types";
6+
7+
import { AccessAnalyzerClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../AccessAnalyzerClient";
8+
import { commonParams } from "../endpoint/EndpointParameters";
9+
import {
10+
CheckNoPublicAccessRequest,
11+
CheckNoPublicAccessRequestFilterSensitiveLog,
12+
CheckNoPublicAccessResponse,
13+
} from "../models/models_0";
14+
import { de_CheckNoPublicAccessCommand, se_CheckNoPublicAccessCommand } from "../protocols/Aws_restJson1";
15+
16+
/**
17+
* @public
18+
*/
19+
export type { __MetadataBearer };
20+
export { $Command };
21+
/**
22+
* @public
23+
*
24+
* The input for {@link CheckNoPublicAccessCommand}.
25+
*/
26+
export interface CheckNoPublicAccessCommandInput extends CheckNoPublicAccessRequest {}
27+
/**
28+
* @public
29+
*
30+
* The output of {@link CheckNoPublicAccessCommand}.
31+
*/
32+
export interface CheckNoPublicAccessCommandOutput extends CheckNoPublicAccessResponse, __MetadataBearer {}
33+
34+
/**
35+
* <p>Checks whether a resource policy can grant public access to the specified resource
36+
* type.</p>
37+
* @example
38+
* Use a bare-bones client and the command you need to make an API call.
39+
* ```javascript
40+
* import { AccessAnalyzerClient, CheckNoPublicAccessCommand } from "@aws-sdk/client-accessanalyzer"; // ES Modules import
41+
* // const { AccessAnalyzerClient, CheckNoPublicAccessCommand } = require("@aws-sdk/client-accessanalyzer"); // CommonJS import
42+
* const client = new AccessAnalyzerClient(config);
43+
* const input = { // CheckNoPublicAccessRequest
44+
* policyDocument: "STRING_VALUE", // required
45+
* resourceType: "STRING_VALUE", // required
46+
* };
47+
* const command = new CheckNoPublicAccessCommand(input);
48+
* const response = await client.send(command);
49+
* // { // CheckNoPublicAccessResponse
50+
* // result: "STRING_VALUE",
51+
* // message: "STRING_VALUE",
52+
* // reasons: [ // ReasonSummaryList
53+
* // { // ReasonSummary
54+
* // description: "STRING_VALUE",
55+
* // statementIndex: Number("int"),
56+
* // statementId: "STRING_VALUE",
57+
* // },
58+
* // ],
59+
* // };
60+
*
61+
* ```
62+
*
63+
* @param CheckNoPublicAccessCommandInput - {@link CheckNoPublicAccessCommandInput}
64+
* @returns {@link CheckNoPublicAccessCommandOutput}
65+
* @see {@link CheckNoPublicAccessCommandInput} for command's `input` shape.
66+
* @see {@link CheckNoPublicAccessCommandOutput} for command's `response` shape.
67+
* @see {@link AccessAnalyzerClientResolvedConfig | config} for AccessAnalyzerClient's `config` shape.
68+
*
69+
* @throws {@link AccessDeniedException} (client fault)
70+
* <p>You do not have sufficient access to perform this action.</p>
71+
*
72+
* @throws {@link InternalServerException} (server fault)
73+
* <p>Internal server error.</p>
74+
*
75+
* @throws {@link InvalidParameterException} (client fault)
76+
* <p>The specified parameter is invalid.</p>
77+
*
78+
* @throws {@link ThrottlingException} (client fault)
79+
* <p>Throttling limit exceeded error.</p>
80+
*
81+
* @throws {@link UnprocessableEntityException} (client fault)
82+
* <p>The specified entity could not be processed.</p>
83+
*
84+
* @throws {@link ValidationException} (client fault)
85+
* <p>Validation exception error.</p>
86+
*
87+
* @throws {@link AccessAnalyzerServiceException}
88+
* <p>Base exception class for all service exceptions from AccessAnalyzer service.</p>
89+
*
90+
* @public
91+
*/
92+
export class CheckNoPublicAccessCommand extends $Command
93+
.classBuilder<
94+
CheckNoPublicAccessCommandInput,
95+
CheckNoPublicAccessCommandOutput,
96+
AccessAnalyzerClientResolvedConfig,
97+
ServiceInputTypes,
98+
ServiceOutputTypes
99+
>()
100+
.ep({
101+
...commonParams,
102+
})
103+
.m(function (this: any, Command: any, cs: any, config: AccessAnalyzerClientResolvedConfig, o: any) {
104+
return [
105+
getSerdePlugin(config, this.serialize, this.deserialize),
106+
getEndpointPlugin(config, Command.getEndpointParameterInstructions()),
107+
];
108+
})
109+
.s("AccessAnalyzer", "CheckNoPublicAccess", {})
110+
.n("AccessAnalyzerClient", "CheckNoPublicAccessCommand")
111+
.f(CheckNoPublicAccessRequestFilterSensitiveLog, void 0)
112+
.ser(se_CheckNoPublicAccessCommand)
113+
.de(de_CheckNoPublicAccessCommand)
114+
.build() {}

0 commit comments

Comments
 (0)