openapi: 3.1.0 info: title: Amazon Web Services accessanalyzer 2012 09 25 Apps API description:

Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external or unused access, you first need to create an analyzer.

External access analyzers help identify potential risks of accessing resources by enabling you to identify any resource policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview public and cross-account access to your resources before deploying permissions changes.

Unused access analyzers help identify potential identity access risks by enabling you to identify unused IAM roles, unused access keys, unused console passwords, and IAM principals with unused service and action-level permissions.

Beyond findings, IAM Access Analyzer provides basic and custom policy checks to validate IAM policies before deploying permissions changes. You can use policy generation to refine permissions by attaching a policy generated using access activity logged in CloudTrail logs.

This guide describes the IAM Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see Identity and Access Management Access Analyzer in the IAM User Guide.

tags: - name: Apps paths: /apps: GET: summary: Amazon Web Services Listapps description: 'Returns a list of the existing Amplify apps. ' operationId: amazonWebServicesListApps tags: - Apps /apps/{appId}/backendenvironments: GET: summary: Amazon Web Services Listbackendenvironments description: 'Lists the backend environments for an Amplify app. ' operationId: amazonWebServicesListBackendEnvironments tags: - Apps /apps/{appId}/branches: GET: summary: Amazon Web Services Listbranches description: ' Lists the branches of an Amplify app. ' operationId: amazonWebServicesListBranches tags: - Apps /apps/{appId}/branches/{branchName}/deployments: POST: summary: Amazon Web Services Createdeployment description: Creates a deployment for a manually deployed Amplify app. Manually deployed apps are not connected to a repository. The maximum duration between the CreateDeployment call and the StartDeployment call cannot exceed 8 hours. If the duration exceeds 8 hours, the StartDeployment call and the associated Job will fail. operationId: amazonWebServicesCreateDeployment tags: - Apps /apps/{appId}/domains: GET: summary: Amazon Web Services Listdomainassociations description: ' Returns the domain associations for an Amplify app. ' operationId: amazonWebServicesListDomainAssociations tags: - Apps /apps/{appId}/webhooks: GET: summary: Amazon Web Services Listwebhooks description: 'Returns a list of webhooks for an Amplify app. ' operationId: amazonWebServicesListWebhooks tags: - Apps /apps/{appId}: POST: summary: Amazon Web Services Updateapp description: 'Updates an existing Amplify app. ' operationId: amazonWebServicesUpdateApp tags: - Apps /apps/{appId}/backendenvironments/{environmentName}: GET: summary: Amazon Web Services Getbackendenvironment description: 'Returns a backend environment for an Amplify app. ' operationId: amazonWebServicesGetBackendEnvironment tags: - Apps /apps/{appId}/branches/{branchName}: POST: summary: Amazon Web Services Updatebranch description: ' Updates a branch for an Amplify app. ' operationId: amazonWebServicesUpdateBranch tags: - Apps /apps/{appId}/domains/{domainName}: POST: summary: Amazon Web Services Updatedomainassociation description: ' Creates a new domain association for an Amplify app.' operationId: amazonWebServicesUpdateDomainAssociation tags: - Apps /apps/{appId}/branches/{branchName}/jobs/{jobId}: GET: summary: Amazon Web Services Getjob description: ' Returns a job for a branch of an Amplify app. ' operationId: amazonWebServicesGetJob tags: - Apps /apps/{appId}/accesslogs: POST: summary: Amazon Web Services Generateaccesslogs description: 'Returns the website access logs for a specific time range using a presigned URL. ' operationId: amazonWebServicesGenerateAccessLogs tags: - Apps /apps/{appId}/branches/{branchName}/jobs/{jobId}/artifacts: GET: summary: Amazon Web Services Listartifacts description: 'Returns a list of artifacts for a specified app, branch, and job. ' operationId: amazonWebServicesListArtifacts tags: - Apps /apps/{appId}/branches/{branchName}/jobs: POST: summary: Amazon Web Services Startjob description: ' Starts a new job for a branch of an Amplify app. ' operationId: amazonWebServicesStartJob tags: - Apps /apps/{appId}/branches/{branchName}/deployments/start: POST: summary: Amazon Web Services Startdeployment description: Starts a deployment for a manually deployed app. Manually deployed apps are not connected to a repository. The maximum duration between the CreateDeployment call and the StartDeployment call cannot exceed 8 hours. If the duration exceeds 8 hours, the StartDeployment call and the associated Job will fail. operationId: amazonWebServicesStartDeployment tags: - Apps /apps/{appId}/branches/{branchName}/jobs/{jobId}/stop: DELETE: summary: Amazon Web Services Stopjob description: ' Stops a job that is in progress for a branch of an Amplify app. ' operationId: amazonWebServicesStopJob tags: - Apps /v1/apps: GET: summary: Amazon Web Services Getapps description: Retrieves information about all the applications that are associated with your Amazon Pinpoint account. operationId: amazonWebServicesGetApps tags: - Apps /v1/apps/{application-id}/campaigns: GET: summary: Amazon Web Services Getcampaigns description: Retrieves information about the status, configuration, and other settings for all the campaigns that are associated with an application. operationId: amazonWebServicesGetCampaigns tags: - Apps /v1/apps/{application-id}/jobs/export: GET: summary: Amazon Web Services Getexportjobs description: Retrieves information about the status and settings of all the export jobs for an application. operationId: amazonWebServicesGetExportJobs tags: - Apps /v1/apps/{application-id}/jobs/import: GET: summary: Amazon Web Services Getimportjobs description: Retrieves information about the status and settings of all the import jobs for an application. operationId: amazonWebServicesGetImportJobs tags: - Apps /v1/apps/{application-id}/journeys: GET: summary: Amazon Web Services Listjourneys description: Retrieves information about the status, configuration, and other settings for all the journeys that are associated with an application. operationId: amazonWebServicesListJourneys tags: - Apps /v1/apps/{application-id}/segments: GET: summary: Amazon Web Services Getsegments description: Retrieves information about the configuration, dimension, and other settings for all the segments that are associated with an application. operationId: amazonWebServicesGetSegments tags: - Apps /v1/apps/{application-id}/channels/adm: PUT: summary: Amazon Web Services Updateadmchannel description: Enables the ADM channel for an application or updates the status and settings of the ADM channel for an application. operationId: amazonWebServicesUpdateAdmChannel tags: - Apps /v1/apps/{application-id}/channels/apns: PUT: summary: Amazon Web Services Updateapnschannel description: Enables the APNs channel for an application or updates the status and settings of the APNs channel for an application. operationId: amazonWebServicesUpdateApnsChannel tags: - Apps /v1/apps/{application-id}/channels/apns_sandbox: PUT: summary: Amazon Web Services Updateapnssandboxchannel description: Enables the APNs sandbox channel for an application or updates the status and settings of the APNs sandbox channel for an application. operationId: amazonWebServicesUpdateApnsSandboxChannel tags: - Apps /v1/apps/{application-id}/channels/apns_voip: PUT: summary: Amazon Web Services Updateapnsvoipchannel description: Enables the APNs VoIP channel for an application or updates the status and settings of the APNs VoIP channel for an application. operationId: amazonWebServicesUpdateApnsVoipChannel tags: - Apps /v1/apps/{application-id}/channels/apns_voip_sandbox: PUT: summary: Amazon Web Services Updateapnsvoipsandboxchannel description: Enables the APNs VoIP sandbox channel for an application or updates the status and settings of the APNs VoIP sandbox channel for an application. operationId: amazonWebServicesUpdateApnsVoipSandboxChannel tags: - Apps /v1/apps/{application-id}: GET: summary: Amazon Web Services Getapp description: Retrieves information about an application. operationId: amazonWebServicesGetApp tags: - Apps /v1/apps/{application-id}/channels/baidu: PUT: summary: Amazon Web Services Updatebaiduchannel description: Enables the Baidu channel for an application or updates the status and settings of the Baidu channel for an application. operationId: amazonWebServicesUpdateBaiduChannel tags: - Apps /v1/apps/{application-id}/campaigns/{campaign-id}: PUT: summary: Amazon Web Services Updatecampaign description: Updates the configuration and other settings for a campaign. operationId: amazonWebServicesUpdateCampaign tags: - Apps /v1/apps/{application-id}/channels/email: PUT: summary: Amazon Web Services Updateemailchannel description: Enables the email channel for an application or updates the status and settings of the email channel for an application. operationId: amazonWebServicesUpdateEmailChannel tags: - Apps /v1/apps/{application-id}/endpoints/{endpoint-id}: PUT: summary: Amazon Web Services Updateendpoint description: Creates a new endpoint for an application or updates the settings and attributes of an existing endpoint for an application. You can also use this operation to define custom attributes for an endpoint. If an update includes one or more values for a custom attribute, Amazon Pinpoint replaces (overwrites) any existing values with the new values. operationId: amazonWebServicesUpdateEndpoint tags: - Apps /v1/apps/{application-id}/eventstream: POST: summary: Amazon Web Services Puteventstream description: Creates a new event stream for an application or updates the settings of an existing event stream for an application. operationId: amazonWebServicesPutEventStream tags: - Apps /v1/apps/{application-id}/channels/gcm: PUT: summary: Amazon Web Services Updategcmchannel description: Enables the GCM channel for an application or updates the status and settings of the GCM channel for an application. operationId: amazonWebServicesUpdateGcmChannel tags: - Apps /v1/apps/{application-id}/journeys/{journey-id}: PUT: summary: Amazon Web Services Updatejourney description: Updates the configuration and other settings for a journey. operationId: amazonWebServicesUpdateJourney tags: - Apps /v1/apps/{application-id}/segments/{segment-id}: PUT: summary: Amazon Web Services Updatesegment description: Creates a new segment for an application or updates the configuration, dimension, and other settings for an existing segment that's associated with an application. operationId: amazonWebServicesUpdateSegment tags: - Apps /v1/apps/{application-id}/channels/sms: PUT: summary: Amazon Web Services Updatesmschannel description: Enables the SMS channel for an application or updates the status and settings of the SMS channel for an application. operationId: amazonWebServicesUpdateSmsChannel tags: - Apps /v1/apps/{application-id}/users/{user-id}: GET: summary: Amazon Web Services Getuserendpoints description: Retrieves information about all the endpoints that are associated with a specific user ID. operationId: amazonWebServicesGetUserEndpoints tags: - Apps /v1/apps/{application-id}/channels/voice: PUT: summary: Amazon Web Services Updatevoicechannel description: Enables the voice channel for an application or updates the status and settings of the voice channel for an application. operationId: amazonWebServicesUpdateVoiceChannel tags: - Apps /v1/apps/{application-id}/kpis/daterange/{kpi-name}: GET: summary: Amazon Web Services Getapplicationdaterangekpi description: Retrieves (queries) pre-aggregated data for a standard metric that applies to an application. operationId: amazonWebServicesGetApplicationDateRangeKpi tags: - Apps /v1/apps/{application-id}/settings: PUT: summary: Amazon Web Services Updateapplicationsettings description: Updates the settings for an application. operationId: amazonWebServicesUpdateApplicationSettings tags: - Apps /v1/apps/{application-id}/campaigns/{campaign-id}/activities: GET: summary: Amazon Web Services Getcampaignactivities description: Retrieves information about all the activities for a campaign. operationId: amazonWebServicesGetCampaignActivities tags: - Apps /v1/apps/{application-id}/campaigns/{campaign-id}/kpis/daterange/{kpi-name}: GET: summary: Amazon Web Services Getcampaigndaterangekpi description: Retrieves (queries) pre-aggregated data for a standard metric that applies to a campaign. operationId: amazonWebServicesGetCampaignDateRangeKpi tags: - Apps /v1/apps/{application-id}/campaigns/{campaign-id}/versions/{version}: GET: summary: Amazon Web Services Getcampaignversion description: Retrieves information about the status, configuration, and other settings for a specific version of a campaign. operationId: amazonWebServicesGetCampaignVersion tags: - Apps /v1/apps/{application-id}/campaigns/{campaign-id}/versions: GET: summary: Amazon Web Services Getcampaignversions description: Retrieves information about the status, configuration, and other settings for all versions of a campaign. operationId: amazonWebServicesGetCampaignVersions tags: - Apps /v1/apps/{application-id}/channels: GET: summary: Amazon Web Services Getchannels description: Retrieves information about the history and status of each channel for an application. operationId: amazonWebServicesGetChannels tags: - Apps /v1/apps/{application-id}/jobs/export/{job-id}: GET: summary: Amazon Web Services Getexportjob description: Retrieves information about the status and settings of a specific export job for an application. operationId: amazonWebServicesGetExportJob tags: - Apps /v1/apps/{application-id}/jobs/import/{job-id}: GET: summary: Amazon Web Services Getimportjob description: Retrieves information about the status and settings of a specific import job for an application. operationId: amazonWebServicesGetImportJob tags: - Apps /v1/apps/{application-id}/endpoints/{endpoint-id}/inappmessages: GET: summary: Amazon Web Services Getinappmessages description: Retrieves the in-app messages targeted for the provided endpoint ID. operationId: amazonWebServicesGetInAppMessages tags: - Apps /v1/apps/{application-id}/journeys/{journey-id}/kpis/daterange/{kpi-name}: GET: summary: Amazon Web Services Getjourneydaterangekpi description: Retrieves (queries) pre-aggregated data for a standard engagement metric that applies to a journey. operationId: amazonWebServicesGetJourneyDateRangeKpi tags: - Apps /v1/apps/{application-id}/journeys/{journey-id}/activities/{journey-activity-id}/execution-metrics: GET: summary: Amazon Web Services Getjourneyexecutionactivitymetrics description: Retrieves (queries) pre-aggregated data for a standard execution metric that applies to a journey activity. operationId: amazonWebServicesGetJourneyExecutionActivityMetrics tags: - Apps /v1/apps/{application-id}/journeys/{journey-id}/execution-metrics: GET: summary: Amazon Web Services Getjourneyexecutionmetrics description: Retrieves (queries) pre-aggregated data for a standard execution metric that applies to a journey. operationId: amazonWebServicesGetJourneyExecutionMetrics tags: - Apps /v1/apps/{application-id}/journeys/{journey-id}/runs/{run-id}/activities/{journey-activity-id}/execution-metrics: GET: summary: Amazon Web Services Getjourneyrunexecutionactivitymetrics description: Retrieves (queries) pre-aggregated data for a standard run execution metric that applies to a journey activity. operationId: amazonWebServicesGetJourneyRunExecutionActivityMetrics tags: - Apps /v1/apps/{application-id}/journeys/{journey-id}/runs/{run-id}/execution-metrics: GET: summary: Amazon Web Services Getjourneyrunexecutionmetrics description: Retrieves (queries) pre-aggregated data for a standard run execution metric that applies to a journey. operationId: amazonWebServicesGetJourneyRunExecutionMetrics tags: - Apps /v1/apps/{application-id}/journeys/{journey-id}/runs: GET: summary: Amazon Web Services Getjourneyruns description: Provides information about the runs of a journey. operationId: amazonWebServicesGetJourneyRuns tags: - Apps /v1/apps/{application-id}/segments/{segment-id}/jobs/export: GET: summary: Amazon Web Services Getsegmentexportjobs description: Retrieves information about the status and settings of the export jobs for a segment. operationId: amazonWebServicesGetSegmentExportJobs tags: - Apps /v1/apps/{application-id}/segments/{segment-id}/jobs/import: GET: summary: Amazon Web Services Getsegmentimportjobs description: Retrieves information about the status and settings of the import jobs for a segment. operationId: amazonWebServicesGetSegmentImportJobs tags: - Apps /v1/apps/{application-id}/segments/{segment-id}/versions/{version}: GET: summary: Amazon Web Services Getsegmentversion description: Retrieves information about the configuration, dimension, and other settings for a specific version of a segment that's associated with an application. operationId: amazonWebServicesGetSegmentVersion tags: - Apps /v1/apps/{application-id}/segments/{segment-id}/versions: GET: summary: Amazon Web Services Getsegmentversions description: Retrieves information about the configuration, dimension, and other settings for all the versions of a specific segment that's associated with an application. operationId: amazonWebServicesGetSegmentVersions tags: - Apps /v1/apps/{application-id}/events: POST: summary: Amazon Web Services Putevents description: Creates a new event to record for endpoints, or creates or updates endpoint data that existing events are associated with. operationId: amazonWebServicesPutEvents tags: - Apps /v1/apps/{application-id}/attributes/{attribute-type}: PUT: summary: Amazon Web Services Removeattributes description: Removes one or more custom attributes, of the same attribute type, from the application. Existing endpoints still have the attributes but Amazon Pinpoint will stop capturing new or changed values for these attributes. operationId: amazonWebServicesRemoveAttributes tags: - Apps /v1/apps/{application-id}/messages: POST: summary: Amazon Web Services Sendmessages description: Creates and sends a direct message. operationId: amazonWebServicesSendMessages tags: - Apps /v1/apps/{application-id}/otp: POST: summary: Amazon Web Services Sendotpmessage description: Send an OTP message operationId: amazonWebServicesSendOTPMessage tags: - Apps /v1/apps/{application-id}/users-messages: POST: summary: Amazon Web Services Sendusersmessages description: Creates and sends a message to a list of users. operationId: amazonWebServicesSendUsersMessages tags: - Apps /v1/apps/{application-id}/endpoints: PUT: summary: Amazon Web Services Updateendpointsbatch description: Creates a new batch of endpoints for an application or updates the settings and attributes of a batch of existing endpoints for an application. You can also use this operation to define custom attributes for a batch of endpoints. If an update includes one or more values for a custom attribute, Amazon Pinpoint replaces (overwrites) any existing values with the new values. operationId: amazonWebServicesUpdateEndpointsBatch tags: - Apps /v1/apps/{application-id}/journeys/{journey-id}/state: PUT: summary: Amazon Web Services Updatejourneystate description: Pause, resume or cancels (stops) a journey. operationId: amazonWebServicesUpdateJourneyState tags: - Apps /v1/apps/{application-id}/verify-otp: POST: summary: Amazon Web Services Verifyotpmessage description: Verify an OTP operationId: amazonWebServicesVerifyOTPMessage tags: - Apps