openapi: 3.0.0
info:
  version: 2019-11-01
  x-release: v4
  title: Access Analyzer Access Preview#analyzerArn Analyzed Resource#analyzerArn&resourceArn API
  description: <p>Identity and Access Management Access Analyzer helps identify potential resource-access risks by enabling you to identify any policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview and validate public and cross-account access to your resources before deploying permissions changes. This guide describes the Identity and Access Management Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html">Identity and Access Management Access Analyzer</a> in the <b>IAM User Guide</b>.</p> <p>To start using IAM Access Analyzer, you first need to create an analyzer.</p>
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_twitter.com_awscloud_profile_image.png
    backgroundColor: '#FFFFFF'
  termsOfService: https://aws.amazon.com/service-terms/
  contact:
    name: Mike Ralphson
    email: mike.ralphson@gmail.com
    url: https://github.com/mermade/aws2openapi
    x-twitter: PermittedSoc
  license:
    name: Apache 2.0 License
    url: http://www.apache.org/licenses/
  x-providerName: amazonaws.com
  x-serviceName: accessanalyzer
  x-aws-signingName: access-analyzer
  x-origin:
  - contentType: application/json
    url: https://raw.githubusercontent.com/aws/aws-sdk-js/master/apis/accessanalyzer-2019-11-01.normal.json
    converter:
      url: https://github.com/mermade/aws2openapi
      version: 1.0.0
    x-apisguru-driver: external
  x-apiClientRegistration:
    url: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct
  x-apisguru-categories:
  - cloud
  x-preferred: true
servers:
- url: http://access-analyzer.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Access Analyzer multi-region endpoint
- url: https://access-analyzer.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Access Analyzer multi-region endpoint
- url: http://access-analyzer.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Access Analyzer endpoint for China (Beijing) and China (Ningxia)
- url: https://access-analyzer.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Access Analyzer endpoint for China (Beijing) and China (Ningxia)
security:
- hmac: []
tags:
- name: Analyzed Resource#analyzerArn&resourceArn
paths:
  /analyzed-resource#analyzerArn&resourceArn:
    parameters:
    - $ref: '#/components/parameters/X-Amz-Content-Sha256'
    - $ref: '#/components/parameters/X-Amz-Date'
    - $ref: '#/components/parameters/X-Amz-Algorithm'
    - $ref: '#/components/parameters/X-Amz-Credential'
    - $ref: '#/components/parameters/X-Amz-Security-Token'
    - $ref: '#/components/parameters/X-Amz-Signature'
    - $ref: '#/components/parameters/X-Amz-SignedHeaders'
    get:
      operationId: GetAnalyzedResource
      description: Retrieves information about a resource that was analyzed.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetAnalyzedResourceResponse'
        '480':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '481':
          description: ValidationException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationException'
        '482':
          description: InternalServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '483':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '484':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
      parameters:
      - name: analyzerArn
        in: query
        required: true
        description: The <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html#permission-resources">ARN of the analyzer</a> to retrieve information from.
        schema:
          type: string
          pattern: '[^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}'
      - name: resourceArn
        in: query
        required: true
        description: The ARN of the resource to retrieve information about.
        schema:
          type: string
          pattern: arn:[^:]*:[^:]*:[^:]*:[^:]*:.*
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      summary: Amazon IAM Access Analyzer Get Analyzed Resource
      tags:
      - Analyzed Resource#analyzerArn&resourceArn
components:
  parameters:
    X-Amz-Credential:
      name: X-Amz-Credential
      in: header
      schema:
        type: string
      required: false
    X-Amz-Algorithm:
      name: X-Amz-Algorithm
      in: header
      schema:
        type: string
      required: false
    X-Amz-Content-Sha256:
      name: X-Amz-Content-Sha256
      in: header
      schema:
        type: string
      required: false
    X-Amz-Security-Token:
      name: X-Amz-Security-Token
      in: header
      schema:
        type: string
      required: false
    X-Amz-SignedHeaders:
      name: X-Amz-SignedHeaders
      in: header
      schema:
        type: string
      required: false
    X-Amz-Date:
      name: X-Amz-Date
      in: header
      schema:
        type: string
      required: false
    X-Amz-Signature:
      name: X-Amz-Signature
      in: header
      schema:
        type: string
      required: false
  schemas:
    String:
      type: string
    InternalServerException: {}
    ThrottlingException: {}
    SharedViaList:
      type: array
      items:
        $ref: '#/components/schemas/String'
    GetAnalyzedResourceResponse:
      type: object
      properties:
        resource:
          allOf:
          - $ref: '#/components/schemas/AnalyzedResource'
          - description: An <code>AnalyzedResource</code> object that contains information that IAM Access Analyzer found when it analyzed the resource.
      description: The response to the request.
    Boolean:
      type: boolean
    ActionList:
      type: array
      items:
        $ref: '#/components/schemas/String'
    ResourceType:
      type: string
      enum:
      - AWS::S3::Bucket
      - AWS::IAM::Role
      - AWS::SQS::Queue
      - AWS::Lambda::Function
      - AWS::Lambda::LayerVersion
      - AWS::KMS::Key
      - AWS::SecretsManager::Secret
      - AWS::EFS::FileSystem
      - AWS::EC2::Snapshot
      - AWS::ECR::Repository
      - AWS::RDS::DBSnapshot
      - AWS::RDS::DBClusterSnapshot
      - AWS::SNS::Topic
    AnalyzedResource:
      type: object
      required:
      - resourceArn
      - resourceType
      - createdAt
      - analyzedAt
      - updatedAt
      - isPublic
      - resourceOwnerAccount
      properties:
        resourceArn:
          allOf:
          - $ref: '#/components/schemas/ResourceArn'
          - description: The ARN of the resource that was analyzed.
        resourceType:
          allOf:
          - $ref: '#/components/schemas/ResourceType'
          - description: The type of the resource that was analyzed.
        createdAt:
          allOf:
          - $ref: '#/components/schemas/Timestamp'
          - description: The time at which the finding was created.
        analyzedAt:
          allOf:
          - $ref: '#/components/schemas/Timestamp'
          - description: The time at which the resource was analyzed.
        updatedAt:
          allOf:
          - $ref: '#/components/schemas/Timestamp'
          - description: The time at which the finding was updated.
        isPublic:
          allOf:
          - $ref: '#/components/schemas/Boolean'
          - description: Indicates whether the policy that generated the finding grants public access to the resource.
        actions:
          allOf:
          - $ref: '#/components/schemas/ActionList'
          - description: The actions that an external principal is granted permission to use by the policy that generated the finding.
        sharedVia:
          allOf:
          - $ref: '#/components/schemas/SharedViaList'
          - description: Indicates how the access that generated the finding is granted. This is populated for Amazon S3 bucket findings.
        status:
          allOf:
          - $ref: '#/components/schemas/FindingStatus'
          - description: The current status of the finding generated from the analyzed resource.
        resourceOwnerAccount:
          allOf:
          - $ref: '#/components/schemas/String'
          - description: The Amazon Web Services account ID that owns the resource.
        error:
          allOf:
          - $ref: '#/components/schemas/String'
          - description: An error message.
      description: Contains details about the analyzed resource.
    ResourceNotFoundException: {}
    AccessDeniedException: {}
    Timestamp:
      type: string
      format: date-time
    FindingStatus:
      type: string
      enum:
      - ACTIVE
      - ARCHIVED
      - RESOLVED
    ValidationException: {}
    ResourceArn:
      type: string
      pattern: arn:[^:]*:[^:]*:[^:]*:[^:]*:.*
  securitySchemes:
    hmac:
      type: apiKey
      name: Authorization
      in: header
      description: Amazon Signature authorization v4
      x-amazon-apigateway-authtype: awsSigv4
externalDocs:
  description: Amazon Web Services documentation
  url: https://docs.aws.amazon.com/access-analyzer/
x-hasEquivalentPaths: true