IAM Toolbox (Preview)

Retrieves the authorization details for a specific access denied request. The details include the request context, the evaluations performed, and the policies that were evaluated.

Use this operation to understand why a request was denied. Supported services include an authorization ID in the access denied error message. Pass that ID to this operation to retrieve the details.

Authorization details are available for at least 24 hours after the denial.

To use this operation, you must have the iam:GetRequestAuthorizationDetails permission.

See also: AWS API Documentation

Request Syntax

client.get_request_authorization_details(
    authorizationId='string',
    nextToken='string'
)

type authorizationId:

string

param authorizationId:

[REQUIRED]

The authorization ID received in the access denied error message. This ID identifies the specific request to retrieve details for.

type nextToken:

string

param nextToken:

The pagination token from a previous call, used to retrieve the next page of evaluations. Omit this value on the first call.

rtype:

dict

returns:

Response Syntax

{
    'requestContext': {
        'string': {...}|[...]|123|123.4|'string'|True|None
    },
    'evaluations': [
        {
            'action': 'string',
            'resource': 'string',
            'context': {
                'string': {...}|[...]|123|123.4|'string'|True|None
            },
            'evaluatedEffect': 'ALLOW'|'EXPLICIT_DENY'|'IMPLICIT_DENY',
            'matchedPolicies': [
                {
                    'uri': 'string',
                    'matchedStatements': [
                        {
                            'sid': 'string',
                            'evaluatedEffect': 'ALLOW'|'DENY'
                        },
                    ]
                },
            ]
        },
    ],
    'policies': [
        {
            'type': 'IDENTITY_BASED_POLICY'|'RESOURCE_BASED_POLICY'|'PERMISSIONS_BOUNDARY'|'SESSION_POLICY'|'SERVICE_CONTROL_POLICY'|'RESOURCE_CONTROL_POLICY'|'VPC_ENDPOINT_POLICY',
            'inline': True|False,
            'uri': 'string',
            'attachedTo': [
                {
                    'arn': 'string'
                },
            ]
        },
    ],
    'nextToken': 'string'
}

Response Structure

• (dict) --

  • requestContext (dict) --

    The request context is the set of context keys and values that apply to the entire request and are shared by all evaluations.

    • (string) --

      • (:ref:`document<document>`) --

  • evaluations (list) --

    The list of evaluations for this request. Each evaluation shows how a single action and resource pair was evaluated. This includes the context, the effect, and any policies that matched.

    • (dict) --

      Represents an individual evaluation for a single action and resource pair. This includes the context, the resulting effect, and any policies that matched.

      • action (string) --

        The action evaluated for this request (for example, iam:PassRole).

      • resource (string) --

        The resource that the action targeted. This is typically a resource ARN, but can be a wildcard ARN that matches multiple resources, or empty for actions that are not resource-specific.

      • context (dict) --

        The context keys and values specific to this evaluation. These are applied on top of the request context.

        • (string) --

          • (:ref:`document<document>`) --

      • evaluatedEffect (string) --

        The result of the evaluation. Valid values:

        • ALLOW - The action was allowed.

        • EXPLICIT_DENY - The action was explicitly denied by a policy.

        • IMPLICIT_DENY - The action was denied because no policy allowed it.

      • matchedPolicies (list) --

        The policies that matched during evaluation of this action and resource. An implicit denial produces no matched policies.

        • (dict) --

          A policy that matched during evaluation, referenced by URI. The URI corresponds to a policy in the top-level policies list.

          • uri (string) --

            The URI of the policy. This cross-references an entry in the top-level policies list. The value depends on the policy type:

            • For managed policies, this is the policy ARN.

            • For inline policies, this is an opaque identifier.

          • matchedStatements (list) --

            The statements within the policy that matched during the evaluation.

            • (dict) --

              A statement that matched during evaluation.

              • sid (string) --

                The statement ID (Sid). If the statement has no Sid, one is generated for reference.

              • evaluatedEffect (string) --

                The evaluated effect of this statement. Valid values:

                • ALLOW - The statement allows the action.

                • DENY - The statement denies the action.

  • policies (list) --

    The list of policies that were evaluated.

    • (dict) --

      Contains details about a policy evaluated during authorization. Details include the policy type, whether it is inline or managed, a URI that identifies it, and the entities it is attached to.

      • type (string) --

        The type of policy. Valid values:

        • IDENTITY_BASED_POLICY - An identity-based policy attached to an IAM user, group, or role.

        • PERMISSIONS_BOUNDARY - A permissions boundary for an IAM entity.

        • RESOURCE_BASED_POLICY - A resource-based policy attached to a resource.

        • RESOURCE_CONTROL_POLICY - A resource control policy (RCP) in AWS Organizations.

        • SERVICE_CONTROL_POLICY - A service control policy (SCP) in AWS Organizations.

        • SESSION_POLICY - A session policy passed during role assumption or federation.

        • VPC_ENDPOINT_POLICY - A VPC endpoint policy.

      • inline (boolean) --

        Specifies whether this is an inline policy ( true) or a managed policy ( false).

      • uri (string) --

        A URI that identifies the policy. Use this URI to cross-reference the policy with the matching policies in each evaluation. The value depends on the policy type:

        • For managed policies, this is the policy ARN.

        • For inline policies, which have no ARN, this is an opaque identifier.

      • attachedTo (list) --

        The entities that the policy is attached to. For identity, session, and resource-based policies, this is typically a single entity. For organization control policies (SCPs and RCPs), it can be multiple entities at different levels of the organization hierarchy.

        • (dict) --

          An entity that a policy is attached to, identified by its ARN.

          • arn (string) --

            The ARN of the entity that the policy is attached to. The ARN format depends on the policy type:

            • For identity, session, and permissions boundary policies, this is the principal ARN (for example, an IAM role or user ARN).

            • For resource-based policies, this is the resource ARN.

            • For organization control policies (SCPs and RCPs), this is the AWS Organizations ARN of the account, organizational unit, or root.

  • nextToken (string) --

    The pagination token for retrieving the next page of evaluations. This value is absent when there are no more results.