Retrieves information about a group (batch) of policies.
+ *The BatchGetPolicy operation doesn't have its own IAM
+ * permission. To authorize this operation for Amazon Web Services principals, include the permission
+ * verifiedpermissions:GetPolicy in their IAM policies.
You don't have sufficient access to perform this action.
+ * + * @throws {@link InternalServerException} (server fault) + *The request failed because of an internal error. Try your request again later
+ * + * @throws {@link ThrottlingException} (client fault) + *The request failed because it exceeded a throttling quota.
+ * + * @throws {@link ValidationException} (client fault) + *The request failed because one or more input parameters don't satisfy their constraint + * requirements. The output is provided as a list of fields and a reason for each field that + * isn't valid.
+ *The possible reasons include the following:
+ *+ * UnrecognizedEntityType + *
+ *The policy includes an entity type that isn't found in the schema.
+ *+ * UnrecognizedActionId + *
+ *The policy includes an action id that isn't found in the schema.
+ *+ * InvalidActionApplication + *
+ *The policy includes an action that, according to the schema, doesn't support + * the specified principal and resource.
+ *+ * UnexpectedType + *
+ *The policy included an operand that isn't a valid type for the specified + * operation.
+ *+ * IncompatibleTypes + *
+ *The types of elements included in a set, or the types of
+ * expressions used in an if...then...else clause aren't compatible in
+ * this context.
+ * MissingAttribute + *
+ *The policy attempts to access a record or entity attribute that isn't + * specified in the schema. Test for the existence of the attribute first before + * attempting to access its value. For more information, see the has (presence of attribute test) operator in the + * Cedar Policy Language Guide.
+ *+ * UnsafeOptionalAttributeAccess + *
+ *The policy attempts to access a record or entity attribute that is optional + * and isn't guaranteed to be present. Test for the existence of the attribute + * first before attempting to access its value. For more information, see the + * has (presence of attribute test) operator in the + * Cedar Policy Language Guide.
+ *+ * ImpossiblePolicy + *
+ *Cedar has determined that a policy condition always evaluates to false. If + * the policy is always false, it can never apply to any query, and so it can never + * affect an authorization decision.
+ *+ * WrongNumberArguments + *
+ *The policy references an extension type with the wrong number of + * arguments.
+ *+ * FunctionArgumentValidationError + *
+ *Cedar couldn't parse the argument passed to an extension type. For example, + * a string that is to be parsed as an IPv4 address can contain only digits and the + * period character.
+ *Base exception class for all service exceptions from VerifiedPermissions service.
+ * + * @public + * @example To retrieve details about a policy + * ```javascript + * // The following example retrieves information about the specified policy contained in the specified policy store. In this example, the requested policy is a template-linked policy, so it returns the ID of the policy template, and the specific principal and resource used by this policy. + * const input = { + * "requests": [ + * { + * "policyId": "PWv5M6d5HePx3gVVLKY1nK", + * "policyStoreId": "ERZeDpRc34dkYZeb6FZRVC" + * }, + * { + * "policyId": "LzFn6KgLWvv4Mbegus35jn", + * "policyStoreId": "ERZeDpRc34dkYZeb6FZRVC" + * }, + * { + * "policyId": "77gLjer8H5o3mvrnMGrSL5", + * "policyStoreId": "ERZeDpRc34dkYZeb6FZRVC" + * } + * ] + * }; + * const command = new BatchGetPolicyCommand(input); + * const response = await client.send(command); + * /* response == + * { + * "errors": [], + * "results": [ + * { + * "createdDate": "2024-10-18T18:53:39.258153Z", + * "definition": { + * "static": { + * "description": "Users can manage account resources in any account they own", + * "statement": "permit (principal, action in PhotoFlash::Action::\"ManageAccount\",resource) when { resource in principal.Account };" + * } + * }, + * "lastUpdatedDate": "2024-10-18T18:53:39.258153Z", + * "policyId": "PWv5M6d5HePx3gVVLKY1nK", + * "policyStoreId": "ERZeDpRc34dkYZeb6FZRVC", + * "policyType": "STATIC" + * }, + * { + * "createdDate": "2024-10-18T18:57:03.305027Z", + * "definition": { + * "static": { + * "description": "User alice can't delete any photos.", + * "statement": "forbid (principal == PhotoFlash::User::\"alice\", action in [PhotoFlash::Action::\"DeletePhoto\"], resource);" + * } + * }, + * "lastUpdatedDate": "2024-10-18T18:57:03.305027Z", + * "policyId": "LzFn6KgLWvv4Mbegus35jn", + * "policyStoreId": "ERZeDpRc34dkYZeb6FZRVC", + * "policyType": "STATIC" + * }, + * { + * "createdDate": "2024-10-18T18:57:48.005343Z", + * "definition": { + * "static": { + * "description": "User alice can view and delete photos.", + * "statement": "permit (principal == PhotoFlash::User::\"alice\", action in [PhotoFlash::Action::\"DeletePhoto\", PhotoFlash::Action::\"ViewPhoto\"], resource);" + * } + * }, + * "lastUpdatedDate": "2024-10-18T18:57:48.005343Z", + * "policyId": "77gLjer8H5o3mvrnMGrSL5", + * "policyStoreId": "ERZeDpRc34dkYZeb6FZRVC", + * "policyType": "STATIC" + * } + * ] + * } + * *\/ + * // example id: example-1 + * ``` + * + */ +export class BatchGetPolicyCommand extends $Command + .classBuilder< + BatchGetPolicyCommandInput, + BatchGetPolicyCommandOutput, + VerifiedPermissionsClientResolvedConfig, + ServiceInputTypes, + ServiceOutputTypes + >() + .ep(commonParams) + .m(function (this: any, Command: any, cs: any, config: VerifiedPermissionsClientResolvedConfig, o: any) { + return [ + getSerdePlugin(config, this.serialize, this.deserialize), + getEndpointPlugin(config, Command.getEndpointParameterInstructions()), + ]; + }) + .s("VerifiedPermissions", "BatchGetPolicy", {}) + .n("VerifiedPermissionsClient", "BatchGetPolicyCommand") + .f(void 0, BatchGetPolicyOutputFilterSensitiveLog) + .ser(se_BatchGetPolicyCommand) + .de(de_BatchGetPolicyCommand) + .build() { + /** @internal type navigation helper, not in runtime. */ + protected declare static __types: { + api: { + input: BatchGetPolicyInput; + output: BatchGetPolicyOutput; + }; + sdk: { + input: BatchGetPolicyCommandInput; + output: BatchGetPolicyCommandOutput; + }; + }; +} diff --git a/clients/client-verifiedpermissions/src/commands/BatchIsAuthorizedCommand.ts b/clients/client-verifiedpermissions/src/commands/BatchIsAuthorizedCommand.ts index 0e4d17b3474dc..3ce9abb133c67 100644 --- a/clients/client-verifiedpermissions/src/commands/BatchIsAuthorizedCommand.ts +++ b/clients/client-verifiedpermissions/src/commands/BatchIsAuthorizedCommand.ts @@ -94,11 +94,15 @@ export interface BatchIsAuthorizedCommandOutput extends BatchIsAuthorizedOutput, * record: { // RecordAttribute * "Information about a policy that you include in a BatchGetPolicy API request.
The identifier of the policy store where the policy you want information about is stored.
+ * @public + */ + policyStoreId: string | undefined; + + /** + *The identifier of the policy you want information about.
+ * @public + */ + policyId: string | undefined; +} + +/** + * @public + */ +export interface BatchGetPolicyInput { + /** + *An array of up to 100 policies you want information about.
+ * @public + */ + requests: BatchGetPolicyInputItem[] | undefined; +} + /** * @public * @enum */ -export const Decision = { - ALLOW: "ALLOW", - DENY: "DENY", +export const BatchGetPolicyErrorCode = { + POLICY_NOT_FOUND: "POLICY_NOT_FOUND", + POLICY_STORE_NOT_FOUND: "POLICY_STORE_NOT_FOUND", } as const; /** * @public */ -export type Decision = (typeof Decision)[keyof typeof Decision]; +export type BatchGetPolicyErrorCode = (typeof BatchGetPolicyErrorCode)[keyof typeof BatchGetPolicyErrorCode]; /** - *Contains information about one of the policies that determined an authorization - * decision.
- *This data type is used as an element in a response parameter for the IsAuthorized, BatchIsAuthorized, and IsAuthorizedWithToken - * operations.
- *Example: "determiningPolicies":[\{"policyId":"SPEXAMPLEabcdefg111111"\}]
- *
Contains the information about an error resulting from a BatchGetPolicy API call.
The Id of a policy that determined to an authorization decision.
- *Example: "policyId":"SPEXAMPLEabcdefg111111"
- *
The error code that was returned.
+ * @public + */ + code: BatchGetPolicyErrorCode | undefined; + + /** + *The identifier of the policy store associated with the failed request.
+ * @public + */ + policyStoreId: string | undefined; + + /** + *The identifier of the policy associated with the failed request.
* @public */ policyId: string | undefined; + + /** + *A detailed error message.
+ * @public + */ + message: string | undefined; } /** - *Contains a description of an evaluation error.
- *This data type is a response parameter of the IsAuthorized, BatchIsAuthorized, and IsAuthorizedWithToken operations.
+ *A structure that contains details about a static policy. It includes the description and + * policy body.
+ *This data type is used within a PolicyDefinition structure as + * part of a request parameter for the CreatePolicy operation.
* @public */ -export interface EvaluationErrorItem { +export interface StaticPolicyDefinitionDetail { /** - *The error description.
+ *A description of the static policy.
* @public */ - errorDescription: string | undefined; + description?: string; + + /** + *The content of the static policy written in the Cedar policy language.
+ * @public + */ + statement: string | undefined; } /** - *The request failed because of an internal error. Try your request again later
+ *Contains information about a policy that was created by instantiating a policy template.
* @public */ -export class InternalServerException extends __BaseException { - readonly name: "InternalServerException" = "InternalServerException"; - readonly $fault: "server" = "server"; - $retryable = {}; +export interface TemplateLinkedPolicyDefinitionDetail { /** - * @internal + *The unique identifier of the policy template used to create this policy.
+ * @public */ - constructor(opts: __ExceptionOptionTypeThe principal associated with this template-linked policy. Verified Permissions substitutes this principal for the
+ * ?principal placeholder in the policy template when it evaluates an authorization
+ * request.
The resource associated with this template-linked policy. Verified Permissions substitutes this resource for the
+ * ?resource placeholder in the policy template when it evaluates an authorization
+ * request.
A structure that describes a policy definition. It must always have either an
+ * static or a templateLinked element.
This data type is used as a response parameter for the GetPolicy operation.
+ * @public + */ +export type PolicyDefinitionDetail = + | PolicyDefinitionDetail.StaticMember + | PolicyDefinitionDetail.TemplateLinkedMember + | PolicyDefinitionDetail.$UnknownMember; + +/** + * @public + */ +export namespace PolicyDefinitionDetail { + /** + *Information about a static policy that wasn't created with a policy template.
+ * @public + */ + export interface StaticMember { + static: StaticPolicyDefinitionDetail; + templateLinked?: never; + $unknown?: never; + } + + /** + *Information about a template-linked policy that was created by instantiating a policy template.
+ * @public + */ + export interface TemplateLinkedMember { + static?: never; + templateLinked: TemplateLinkedPolicyDefinitionDetail; + $unknown?: never; + } + + /** + * @public + */ + export interface $UnknownMember { + static?: never; + templateLinked?: never; + $unknown: [string, any]; + } + + export interface VisitorThe request failed because it references a resource that doesn't exist.
+ *Contains information about a policy returned from a BatchGetPolicy API request.
The unique ID of the resource referenced in the failed request.
+ *The identifier of the policy store where the policy you want information about is stored.
* @public */ - resourceId: string | undefined; + policyStoreId: string | undefined; /** - *The resource type of the resource referenced in the failed request.
+ *The identifier of the policy you want information about.
* @public */ - resourceType: ResourceType | undefined; + policyId: string | undefined; + /** + *The type of the policy. This is one of the following values:
+ *
+ * STATIC
+ *
+ * TEMPLATE_LINKED
+ *
The policy definition of an item in the list of policies returned.
+ * @public + */ + definition: PolicyDefinitionDetail | undefined; + + /** + *The date and time the policy was created.
+ * @public + */ + createdDate: Date | undefined; + + /** + *The date and time the policy was most recently updated.
+ * @public + */ + lastUpdatedDate: Date | undefined; +} + +/** + * @public + */ +export interface BatchGetPolicyOutput { + /** + *Information about the policies listed in the request that were successfully returned. These results are returned in the order they were requested.
+ * @public + */ + results: BatchGetPolicyOutputItem[] | undefined; + + /** + *Information about the policies from the request that resulted in an error. These results are returned in the order they were requested.
+ * @public + */ + errors: BatchGetPolicyErrorItem[] | undefined; +} + +/** + *The request failed because of an internal error. Try your request again later
+ * @public + */ +export class InternalServerException extends __BaseException { + readonly name: "InternalServerException" = "InternalServerException"; + readonly $fault: "server" = "server"; + $retryable = {}; /** * @internal */ - constructor(opts: __ExceptionOptionTypeThe list of fields that aren't valid.
+ * @public + */ + fieldList?: ValidationExceptionField[]; + + /** + * @internal + */ + constructor(opts: __ExceptionOptionTypeContains information about one of the policies that determined an authorization + * decision.
+ *This data type is used as an element in a response parameter for the IsAuthorized, BatchIsAuthorized, and IsAuthorizedWithToken + * operations.
+ *Example: "determiningPolicies":[\{"policyId":"SPEXAMPLEabcdefg111111"\}]
+ *
The Id of a policy that determined to an authorization decision.
+ *Example: "policyId":"SPEXAMPLEabcdefg111111"
+ *
Contains a description of an evaluation error.
+ *This data type is a response parameter of the IsAuthorized, BatchIsAuthorized, and IsAuthorizedWithToken operations.
+ * @public + */ +export interface EvaluationErrorItem { + /** + *The error description.
+ * @public + */ + errorDescription: string | undefined; +} + +/** + * @public + * @enum + */ +export const ResourceType = { + IDENTITY_SOURCE: "IDENTITY_SOURCE", + POLICY: "POLICY", + POLICY_STORE: "POLICY_STORE", + POLICY_TEMPLATE: "POLICY_TEMPLATE", + SCHEMA: "SCHEMA", +} as const; + +/** + * @public + */ +export type ResourceType = (typeof ResourceType)[keyof typeof ResourceType]; + +/** + *The request failed because it references a resource that doesn't exist.
+ * @public + */ +export class ResourceNotFoundException extends __BaseException { + readonly name: "ResourceNotFoundException" = "ResourceNotFoundException"; readonly $fault: "client" = "client"; /** - *The list of fields that aren't valid.
+ *The unique ID of the resource referenced in the failed request.
* @public */ - fieldList?: ValidationExceptionField[]; + resourceId: string | undefined; + + /** + *The resource type of the resource referenced in the failed request.
+ * @public + */ + resourceType: ResourceType | undefined; /** * @internal */ - constructor(opts: __ExceptionOptionTypeA structure that contains details about a static policy. It includes the description and - * policy body.
- *This data type is used within a PolicyDefinition structure as - * part of a request parameter for the CreatePolicy operation.
- * @public - */ -export interface StaticPolicyDefinitionDetail { - /** - *A description of the static policy.
- * @public - */ - description?: string; - - /** - *The content of the static policy written in the Cedar policy language.
- * @public - */ - statement: string | undefined; -} - -/** - *Contains information about a policy that was created by instantiating a policy template.
- * @public - */ -export interface TemplateLinkedPolicyDefinitionDetail { - /** - *The unique identifier of the policy template used to create this policy.
- * @public - */ - policyTemplateId: string | undefined; - - /** - *The principal associated with this template-linked policy. Verified Permissions substitutes this principal for the
- * ?principal placeholder in the policy template when it evaluates an authorization
- * request.
The resource associated with this template-linked policy. Verified Permissions substitutes this resource for the
- * ?resource placeholder in the policy template when it evaluates an authorization
- * request.
A structure that describes a policy definition. It must always have either an
- * static or a templateLinked element.
This data type is used as a response parameter for the GetPolicy operation.
- * @public - */ -export type PolicyDefinitionDetail = - | PolicyDefinitionDetail.StaticMember - | PolicyDefinitionDetail.TemplateLinkedMember - | PolicyDefinitionDetail.$UnknownMember; - -/** - * @public - */ -export namespace PolicyDefinitionDetail { - /** - *Information about a static policy that wasn't created with a policy template.
- * @public - */ - export interface StaticMember { - static: StaticPolicyDefinitionDetail; - templateLinked?: never; - $unknown?: never; - } - - /** - *Information about a template-linked policy that was created by instantiating a policy template.
- * @public - */ - export interface TemplateLinkedMember { - static?: never; - templateLinked: TemplateLinkedPolicyDefinitionDetail; - $unknown?: never; - } - - /** - * @public - */ - export interface $UnknownMember { - static?: never; - templateLinked?: never; - $unknown: [string, any]; - } - - export interface VisitorThe identifier of the PolicyStore where the policy you want information about is + *
The identifier of the policy store where the policy you want information about is * stored.
* @public */ @@ -4011,7 +4155,9 @@ export interface UpdatePolicyStoreOutput { */ export type AttributeValue = | AttributeValue.BooleanMember + | AttributeValue.DecimalMember | AttributeValue.EntityIdentifierMember + | AttributeValue.IpaddrMember | AttributeValue.LongMember | AttributeValue.RecordMember | AttributeValue.SetMember @@ -4036,6 +4182,8 @@ export namespace AttributeValue { string?: never; set?: never; record?: never; + ipaddr?: never; + decimal?: never; $unknown?: never; } @@ -4053,6 +4201,8 @@ export namespace AttributeValue { string?: never; set?: never; record?: never; + ipaddr?: never; + decimal?: never; $unknown?: never; } @@ -4069,6 +4219,8 @@ export namespace AttributeValue { string?: never; set?: never; record?: never; + ipaddr?: never; + decimal?: never; $unknown?: never; } @@ -4086,6 +4238,8 @@ export namespace AttributeValue { string: string; set?: never; record?: never; + ipaddr?: never; + decimal?: never; $unknown?: never; } @@ -4102,6 +4256,8 @@ export namespace AttributeValue { string?: never; set: AttributeValue[]; record?: never; + ipaddr?: never; + decimal?: never; $unknown?: never; } @@ -4119,6 +4275,44 @@ export namespace AttributeValue { string?: never; set?: never; record: RecordAn attribute value of ipaddr type.
+ *Example: \{"ip": "192.168.1.100"\}
+ *
An attribute value of decimal type.
+ *Example: \{"decimal": "1.1"\}
+ *
A series of Allow or Deny decisions for each request, and
- * the policies that produced them.
A series of Allow or Deny decisions for each request, and
- * the policies that produced them.
An attribute value of Record\n type.
\nExample: {\"record\": { \"keyName\": {} } }\n
An attribute value of ipaddr type.
\nExample: {\"ip\": \"192.168.1.100\"}\n
An attribute value of decimal type.
\nExample: {\"decimal\": \"1.1\"}\n
Retrieves information about a group (batch) of policies.
\nThe BatchGetPolicy operation doesn't have its own IAM\n permission. To authorize this operation for Amazon Web Services principals, include the permission\n verifiedpermissions:GetPolicy in their IAM policies.
The error code that was returned.
", + "smithy.api#required": {} + } + }, + "policyStoreId": { + "target": "smithy.api#String", + "traits": { + "smithy.api#documentation": "The identifier of the policy store associated with the failed request.
", + "smithy.api#required": {} + } + }, + "policyId": { + "target": "smithy.api#String", + "traits": { + "smithy.api#documentation": "The identifier of the policy associated with the failed request.
", + "smithy.api#required": {} + } + }, + "message": { + "target": "smithy.api#String", + "traits": { + "smithy.api#documentation": "A detailed error message.
", + "smithy.api#required": {} + } + } + }, + "traits": { + "smithy.api#documentation": "Contains the information about an error resulting from a BatchGetPolicy API call.
An array of up to 100 policies you want information about.
", + "smithy.api#required": {} + } + } + }, + "traits": { + "smithy.api#input": {} + } + }, + "com.amazonaws.verifiedpermissions#BatchGetPolicyInputItem": { + "type": "structure", + "members": { + "policyStoreId": { + "target": "com.amazonaws.verifiedpermissions#PolicyStoreId", + "traits": { + "smithy.api#documentation": "The identifier of the policy store where the policy you want information about is stored.
", + "smithy.api#required": {} + } + }, + "policyId": { + "target": "com.amazonaws.verifiedpermissions#PolicyId", + "traits": { + "smithy.api#documentation": "The identifier of the policy you want information about.
", + "smithy.api#required": {} + } + } + }, + "traits": { + "smithy.api#documentation": "Information about a policy that you include in a BatchGetPolicy API request.
Information about the policies listed in the request that were successfully returned. These results are returned in the order they were requested.
", + "smithy.api#required": {} + } + }, + "errors": { + "target": "com.amazonaws.verifiedpermissions#BatchGetPolicyErrorList", + "traits": { + "smithy.api#documentation": "Information about the policies from the request that resulted in an error. These results are returned in the order they were requested.
", + "smithy.api#required": {} + } + } + }, + "traits": { + "smithy.api#output": {} + } + }, + "com.amazonaws.verifiedpermissions#BatchGetPolicyOutputItem": { + "type": "structure", + "members": { + "policyStoreId": { + "target": "com.amazonaws.verifiedpermissions#PolicyStoreId", + "traits": { + "smithy.api#documentation": "The identifier of the policy store where the policy you want information about is stored.
", + "smithy.api#required": {} + } + }, + "policyId": { + "target": "com.amazonaws.verifiedpermissions#PolicyId", + "traits": { + "smithy.api#documentation": "The identifier of the policy you want information about.
", + "smithy.api#required": {} + } + }, + "policyType": { + "target": "com.amazonaws.verifiedpermissions#PolicyType", + "traits": { + "smithy.api#documentation": "The type of the policy. This is one of the following values:
\n\n STATIC\n
\n TEMPLATE_LINKED\n
The policy definition of an item in the list of policies returned.
", + "smithy.api#required": {} + } + }, + "createdDate": { + "target": "com.amazonaws.verifiedpermissions#TimestampFormat", + "traits": { + "smithy.api#documentation": "The date and time the policy was created.
", + "smithy.api#required": {} + } + }, + "lastUpdatedDate": { + "target": "com.amazonaws.verifiedpermissions#TimestampFormat", + "traits": { + "smithy.api#documentation": "The date and time the policy was most recently updated.
", + "smithy.api#required": {} + } + } + }, + "traits": { + "smithy.api#documentation": "Contains information about a policy returned from a BatchGetPolicy API request.
A series of Allow or Deny decisions for each request, and\n the policies that produced them.
A series of Allow or Deny decisions for each request, and\n the policies that produced them. These results are returned in the order they were requested.
A series of Allow or Deny decisions for each request, and\n the policies that produced them.
A series of Allow or Deny decisions for each request, and\n the policies that produced them. These results are returned in the order they were requested.
The identifier of the PolicyStore where the policy you want information about is\n stored.
", + "smithy.api#documentation": "The identifier of the policy store where the policy you want information about is\n stored.
", "smithy.api#required": {} } }, @@ -4392,6 +4702,11 @@ "target": "com.amazonaws.verifiedpermissions#PutSchema" } ], + "collectionOperations": [ + { + "target": "com.amazonaws.verifiedpermissions#BatchGetPolicy" + } + ], "resources": [ { "target": "com.amazonaws.verifiedpermissions#IdentitySource" @@ -4842,8 +5157,7 @@ "type": "string", "traits": { "smithy.api#length": { - "min": 1, - "max": 100000 + "min": 1 }, "smithy.api#sensitive": {} }