Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external or unused access, you first need to create an analyzer.
External access analyzers help identify potential risks of accessing resources by enabling you to identify any resource policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview public and cross-account access to your resources before deploying permissions changes.
Unused access analyzers help identify potential identity access risks by enabling you to identify unused IAM roles, unused access keys, unused console passwords, and IAM principals with unused service and action-level permissions.
Beyond findings, IAM Access Analyzer provides basic and custom policy checks to validate IAM policies before deploying permissions changes. You can use policy generation to refine permissions by attaching a policy generated using access activity logged in CloudTrail logs.
This guide describes the IAM Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see Identity and Access Management Access Analyzer in the IAM User Guide.
tags: - name: Package paths: /v1/package/versions/copy: POST: summary: Amazon Web Services Copypackageversions description: ' Copies package versions from one repository to another repository in the same domain. You must specify versions or versionRevisions. You cannot specify both. ' operationId: amazonWebServicesCopyPackageVersions tags: - Package /v1/package: POST: summary: Amazon Web Services Putpackageoriginconfiguration description: Sets the package origin configuration for a package. The package origin configuration determines how new versions of a package can be added to a repository. You can allow or block direct publishing of new package versions, or ingestion and retaining of new package versions from an external connection or upstream source. For more information about package origin controls and configuration, see Editing package origin controls in the CodeArtifact User Guide. PutPackageOriginConfiguration can be called on a package that doesn't yet exist in the repository. When called on a package that does not exist, a package is created in the repository with no versions and the requested restrictions are set on the package. This can be used to preemptively block ingesting or retaining any versions from external connections or upstream repositories, or to block publishing any versions of the package into the repository before connecting any package managers or publishers to the repository. operationId: amazonWebServicesPutPackageOriginConfiguration tags: - Package /v1/package/versions/delete: POST: summary: Amazon Web Services Deletepackageversions description: ' Deletes one or more versions of a package. A deleted package version cannot be restored in your repository. If you want to remove a package version from your repository and be able to restore it later, set its status to Archived. Archived packages cannot be downloaded from a repository and don''t show up with list package APIs (for example, ListPackageVersions), but you can restore them using UpdatePackageVersionsStatus. ' operationId: amazonWebServicesDeletePackageVersions tags: - Package /v1/package/version: GET: summary: Amazon Web Services Describepackageversion description: ' Returns a PackageVersionDescription object that contains information about the requested package version. ' operationId: amazonWebServicesDescribePackageVersion tags: - Package /v1/package/versions/dispose: POST: summary: Amazon Web Services Disposepackageversions description: ' Deletes the assets in package versions and sets the package versions'' status to Disposed. A disposed package version cannot be restored in your repository because its assets are deleted. To view all disposed package versions in a repository, use ListPackageVersions and set the status parameter to Disposed. To view information about a disposed package version, use DescribePackageVersion. ' operationId: amazonWebServicesDisposePackageVersions tags: - Package /v1/package/version/asset: GET: summary: Amazon Web Services Getpackageversionasset description: ' Returns an asset (or file) that is in a package. For example, for a Maven package version, use GetPackageVersionAsset to download a JAR file, a POM file, or any other assets in the package version. ' operationId: amazonWebServicesGetPackageVersionAsset tags: - Package /v1/package/version/readme: GET: summary: Amazon Web Services Getpackageversionreadme description: ' Gets the readme file or descriptive text for a package version. The returned text might contain formatting. For example, it might contain formatting for Markdown or reStructuredText. ' operationId: amazonWebServicesGetPackageVersionReadme tags: - Package /v1/package/version/assets: POST: summary: Amazon Web Services Listpackageversionassets description: ' Returns a list of AssetSummary objects for assets in a package version. ' operationId: amazonWebServicesListPackageVersionAssets tags: - Package /v1/package/version/dependencies: POST: summary: Amazon Web Services Listpackageversiondependencies description: ' Returns the direct dependencies for a package version. The dependencies are returned as PackageDependency objects. CodeArtifact extracts the dependencies for a package version from the metadata file for the package format (for example, the package.json file for npm packages and the pom.xml file for Maven). Any package version dependencies that are not listed in the configuration file are not returned. ' operationId: amazonWebServicesListPackageVersionDependencies tags: - Package /v1/package/versions: POST: summary: Amazon Web Services Listpackageversions description: ' Returns a list of PackageVersionSummary objects for package versions in a repository that match the request parameters. Package versions of all statuses will be returned by default when calling list-package-versions with no --status parameter. ' operationId: amazonWebServicesListPackageVersions tags: - Package /v1/package/version/publish: POST: summary: Amazon Web Services Publishpackageversion description: 'Creates a new package version containing one or more assets (or files). The unfinished flag can be used to keep the package version in the Unfinished state until all of its assets have been uploaded (see Package version status in the CodeArtifact user guide). To set the package version’s status to Published, omit the unfinished flag when uploading the final asset, or set the status using UpdatePackageVersionStatus. Once a package version’s status is set to Published, it cannot change back to Unfinished. Only generic packages can be published using this API. For more information, see Using generic packages in the CodeArtifact User Guide. ' operationId: amazonWebServicesPublishPackageVersion tags: - Package /v1/package/versions/update_status: POST: summary: Amazon Web Services Updatepackageversionsstatus description: ' Updates the status of one or more versions of a package. Using UpdatePackageVersionsStatus, you can update the status of package versions to Archived, Published, or Unlisted. To set the status of a package version to Disposed, use DisposePackageVersions. ' operationId: amazonWebServicesUpdatePackageVersionsStatus tags: - Package