Skip to content

Commit

Permalink
feat(client-accessanalyzer): This release adds support for external a…
Browse files Browse the repository at this point in the history 
…ccess findings for S3 directory buckets to help you easily identify cross-account access. Updated service API, documentation, and paginators.
  • Loading branch information
awstools committed Nov 28, 2023
1 parent 75831cb commit 4feb52a
Show file tree
Hide file tree
Showing 5 changed files with 96 additions and 2 deletions.
3 changes: 3 additions & 0 deletions clients/client-accessanalyzer/src/commands/CreateAccessPreviewCommand.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,9 @@ export interface CreateAccessPreviewCommandOutput extends CreateAccessPreviewRes
* sqsQueue: { // SqsQueueConfiguration
* queuePolicy: "STRING_VALUE",
* },
* s3ExpressDirectoryBucket: { // S3ExpressDirectoryBucketConfiguration
* bucketPolicy: "STRING_VALUE",
* },
* },
* },
* clientToken: "STRING_VALUE",
Expand Down
3 changes: 3 additions & 0 deletions clients/client-accessanalyzer/src/commands/GetAccessPreviewCommand.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,9 @@ export interface GetAccessPreviewCommandOutput extends GetAccessPreviewResponse,
* // sqsQueue: { // SqsQueueConfiguration
* // queuePolicy: "STRING_VALUE",
* // },
* // s3ExpressDirectoryBucket: { // S3ExpressDirectoryBucketConfiguration
* // bucketPolicy: "STRING_VALUE",
* // },
* // },
* // },
* // createdAt: new Date("TIMESTAMP"), // required
Expand Down
58 changes: 57 additions & 1 deletion clients/client-accessanalyzer/src/models/models_0.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1830,6 +1830,25 @@ export interface S3BucketConfiguration {
accessPoints?: Record<string, S3AccessPointConfiguration>;
}

/**
* @public
* <p>Proposed access control configuration for an Amazon S3 directory bucket. You can propose a
* configuration for a new Amazon S3 directory bucket or an existing Amazon S3 directory bucket that you
* own by specifying the Amazon S3 bucket policy. If the configuration is for an existing Amazon S3
* directory bucket and you do not specify the Amazon S3 bucket policy, the access preview uses the
* existing policy attached to the directory bucket. If the access preview is for a new
* resource and you do not specify the Amazon S3 bucket policy, the access preview assumes an
* directory bucket without a policy. To propose deletion of an existing bucket policy, you
* can specify an empty string. For more information about bucket policy limits, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam-example-bucket-policies.html">Example bucket policies</a>.</p>
*/
export interface S3ExpressDirectoryBucketConfiguration {
/**
* @public
* <p>The proposed bucket policy for the Amazon S3 directory bucket.</p>
*/
bucketPolicy?: string;
}

/**
* @public
* <p>The configuration for a Secrets Manager secret. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html">CreateSecret</a>.</p>
Expand Down Expand Up @@ -1914,6 +1933,7 @@ export type Configuration =
| Configuration.RdsDbClusterSnapshotMember
| Configuration.RdsDbSnapshotMember
| Configuration.S3BucketMember
| Configuration.S3ExpressDirectoryBucketMember
| Configuration.SecretsManagerSecretMember
| Configuration.SnsTopicMember
| Configuration.SqsQueueMember
Expand All @@ -1939,6 +1959,7 @@ export namespace Configuration {
s3Bucket?: never;
snsTopic?: never;
sqsQueue?: never;
s3ExpressDirectoryBucket?: never;
$unknown?: never;
}

Expand All @@ -1958,6 +1979,7 @@ export namespace Configuration {
s3Bucket?: never;
snsTopic?: never;
sqsQueue?: never;
s3ExpressDirectoryBucket?: never;
$unknown?: never;
}

Expand All @@ -1977,6 +1999,7 @@ export namespace Configuration {
s3Bucket?: never;
snsTopic?: never;
sqsQueue?: never;
s3ExpressDirectoryBucket?: never;
$unknown?: never;
}

Expand All @@ -1996,6 +2019,7 @@ export namespace Configuration {
s3Bucket?: never;
snsTopic?: never;
sqsQueue?: never;
s3ExpressDirectoryBucket?: never;
$unknown?: never;
}

Expand All @@ -2015,6 +2039,7 @@ export namespace Configuration {
s3Bucket?: never;
snsTopic?: never;
sqsQueue?: never;
s3ExpressDirectoryBucket?: never;
$unknown?: never;
}

Expand All @@ -2034,6 +2059,7 @@ export namespace Configuration {
s3Bucket?: never;
snsTopic?: never;
sqsQueue?: never;
s3ExpressDirectoryBucket?: never;
$unknown?: never;
}

Expand All @@ -2053,6 +2079,7 @@ export namespace Configuration {
s3Bucket?: never;
snsTopic?: never;
sqsQueue?: never;
s3ExpressDirectoryBucket?: never;
$unknown?: never;
}

Expand All @@ -2072,12 +2099,13 @@ export namespace Configuration {
s3Bucket?: never;
snsTopic?: never;
sqsQueue?: never;
s3ExpressDirectoryBucket?: never;
$unknown?: never;
}

/**
* @public
* <p>The access control configuration is for an Amazon S3 Bucket. </p>
* <p>The access control configuration is for an Amazon S3 bucket. </p>
*/
export interface S3BucketMember {
ebsSnapshot?: never;
Expand All @@ -2091,6 +2119,7 @@ export namespace Configuration {
s3Bucket: S3BucketConfiguration;
snsTopic?: never;
sqsQueue?: never;
s3ExpressDirectoryBucket?: never;
$unknown?: never;
}

Expand All @@ -2110,6 +2139,7 @@ export namespace Configuration {
s3Bucket?: never;
snsTopic: SnsTopicConfiguration;
sqsQueue?: never;
s3ExpressDirectoryBucket?: never;
$unknown?: never;
}

Expand All @@ -2129,6 +2159,27 @@ export namespace Configuration {
s3Bucket?: never;
snsTopic?: never;
sqsQueue: SqsQueueConfiguration;
s3ExpressDirectoryBucket?: never;
$unknown?: never;
}

/**
* @public
* <p>The access control configuration is for an Amazon S3 directory bucket.</p>
*/
export interface S3ExpressDirectoryBucketMember {
ebsSnapshot?: never;
ecrRepository?: never;
iamRole?: never;
efsFileSystem?: never;
kmsKey?: never;
rdsDbClusterSnapshot?: never;
rdsDbSnapshot?: never;
secretsManagerSecret?: never;
s3Bucket?: never;
snsTopic?: never;
sqsQueue?: never;
s3ExpressDirectoryBucket: S3ExpressDirectoryBucketConfiguration;
$unknown?: never;
}

Expand All @@ -2147,6 +2198,7 @@ export namespace Configuration {
s3Bucket?: never;
snsTopic?: never;
sqsQueue?: never;
s3ExpressDirectoryBucket?: never;
$unknown: [string, any];
}

Expand All @@ -2162,6 +2214,7 @@ export namespace Configuration {
s3Bucket: (value: S3BucketConfiguration) => T;
snsTopic: (value: SnsTopicConfiguration) => T;
sqsQueue: (value: SqsQueueConfiguration) => T;
s3ExpressDirectoryBucket: (value: S3ExpressDirectoryBucketConfiguration) => T;
_: (name: string, value: any) => T;
}

Expand All @@ -2177,6 +2230,8 @@ export namespace Configuration {
if (value.s3Bucket !== undefined) return visitor.s3Bucket(value.s3Bucket);
if (value.snsTopic !== undefined) return visitor.snsTopic(value.snsTopic);
if (value.sqsQueue !== undefined) return visitor.sqsQueue(value.sqsQueue);
if (value.s3ExpressDirectoryBucket !== undefined)
return visitor.s3ExpressDirectoryBucket(value.s3ExpressDirectoryBucket);
return visitor._(value.$unknown[0], value.$unknown[1]);
};
}
Expand Down Expand Up @@ -2388,6 +2443,7 @@ export type ResourceType =
| "AWS::RDS::DBClusterSnapshot"
| "AWS::RDS::DBSnapshot"
| "AWS::S3::Bucket"
| "AWS::S3Express::DirectoryBucket"
| "AWS::SNS::Topic"
| "AWS::SQS::Queue"
| "AWS::SecretsManager::Secret";
Expand Down
5 changes: 5 additions & 0 deletions clients/client-accessanalyzer/src/protocols/Aws_restJson1.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,7 @@ import {
S3AccessPointConfiguration,
S3BucketAclGrantConfiguration,
S3BucketConfiguration,
S3ExpressDirectoryBucketConfiguration,
S3PublicAccessBlockConfiguration,
SecretsManagerSecretConfiguration,
ServiceQuotaExceededException,
Expand Down Expand Up @@ -3343,6 +3344,8 @@ const se_CloudTrailDetails = (input: CloudTrailDetails, context: __SerdeContext)

// se_S3BucketConfiguration omitted.

// se_S3ExpressDirectoryBucketConfiguration omitted.

// se_S3PublicAccessBlockConfiguration omitted.

// se_SecretsManagerSecretConfiguration omitted.
Expand Down Expand Up @@ -3822,6 +3825,8 @@ const de_PolicyGenerationList = (output: any, context: __SerdeContext): PolicyGe

// de_S3BucketConfiguration omitted.

// de_S3ExpressDirectoryBucketConfiguration omitted.

// de_S3PublicAccessBlockConfiguration omitted.

// de_SecretsManagerSecretConfiguration omitted.
Expand Down
29 changes: 28 additions & 1 deletion codegen/sdk-codegen/aws-models/accessanalyzer.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2327,7 +2327,7 @@
"s3Bucket": {
"target": "com.amazonaws.accessanalyzer#S3BucketConfiguration",
"traits": {
"smithy.api#documentation": "<p>The access control configuration is for an Amazon S3 Bucket. </p>"
"smithy.api#documentation": "<p>The access control configuration is for an Amazon S3 bucket. </p>"
}
},
"snsTopic": {
Expand All @@ -2341,6 +2341,12 @@
"traits": {
"smithy.api#documentation": "<p>The access control configuration is for an Amazon SQS queue. </p>"
}
},
"s3ExpressDirectoryBucket": {
"target": "com.amazonaws.accessanalyzer#S3ExpressDirectoryBucketConfiguration",
"traits": {
"smithy.api#documentation": "<p>The access control configuration is for an Amazon S3 directory bucket.</p>"
}
}
},
"traits": {
Expand Down Expand Up @@ -5826,6 +5832,10 @@
{
"value": "AWS::SNS::Topic",
"name": "AWS_SNS_TOPIC"
},
{
"value": "AWS::S3Express::DirectoryBucket",
"name": "AWS_S3EXPRESS_DIRECTORYBUCKET"
}
]
}
Expand Down Expand Up @@ -5937,6 +5947,23 @@
"com.amazonaws.accessanalyzer#S3BucketPolicy": {
"type": "string"
},
"com.amazonaws.accessanalyzer#S3ExpressDirectoryBucketConfiguration": {
"type": "structure",
"members": {
"bucketPolicy": {
"target": "com.amazonaws.accessanalyzer#S3ExpressDirectoryBucketPolicy",
"traits": {
"smithy.api#documentation": "<p>The proposed bucket policy for the Amazon S3 directory bucket.</p>"
}
}
},
"traits": {
"smithy.api#documentation": "<p>Proposed access control configuration for an Amazon S3 directory bucket. You can propose a\n configuration for a new Amazon S3 directory bucket or an existing Amazon S3 directory bucket that you\n own by specifying the Amazon S3 bucket policy. If the configuration is for an existing Amazon S3\n directory bucket and you do not specify the Amazon S3 bucket policy, the access preview uses the\n existing policy attached to the directory bucket. If the access preview is for a new\n resource and you do not specify the Amazon S3 bucket policy, the access preview assumes an\n directory bucket without a policy. To propose deletion of an existing bucket policy, you\n can specify an empty string. For more information about bucket policy limits, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-security-iam-example-bucket-policies.html\">Example bucket policies</a>.</p>"
}
},
"com.amazonaws.accessanalyzer#S3ExpressDirectoryBucketPolicy": {
"type": "string"
},
"com.amazonaws.accessanalyzer#S3PublicAccessBlockConfiguration": {
"type": "structure",
"members": {
Expand Down

0 comments on commit 4feb52a

Please sign in to comment.