accessanalyzer

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 21 Imported by: 0

README

IAM Access Analyzer

Parity grade: A · SDK aws-sdk-go-v2/service/accessanalyzer@v1.48.0 · last audited 2026-07-12 (7d7a3363)

Coverage

Metric Value
Operations audited 39 (33 ok, 6 partial)
Feature families 1 (1 ok)
Known gaps 4
Deferred items 1
Resource leaks clean
Known gaps
  • GetFindingV2/ListFindingsV2 findingDetails ([]types.FindingDetails union) and findingType always empty/absent -- large feature (5 distinct nested detail shapes: ExternalAccessDetails, UnusedIAMRoleDetails, UnusedIAMUserAccessKeyDetails, UnusedIAMUserPasswordDetails, UnusedPermissionDetails) not modeled by InMemoryBackend at all; fabricating one shape would itself be a disguised partial stub, so left as an explicit gap per parity-principles #1 rather than fixed this pass. No bd issue filed yet.
  • ListAccessPreviewFindings returns the v1 Finding shape instead of AccessPreviewFinding (missing changeType/existingFindingId/existingFindingStatus). No bd issue filed yet.
  • UpdateAnalyzer's Configuration (AnalyzerConfiguration union, used for internal/unused-access analyzer settings) is accepted on neither request read nor persisted; response always returns an empty configuration object. Low impact since Configuration is optional on the wire.
  • pathAnalyzedResource ("analyzedResource", camelCase, no hyphen) is dead legacy routing left over from before the real "analyzed-resource" (hyphenated) path was added; RouteMatcher still claims it but parseRESTPath/parseRESTPathAppendixA never resolve an op for it, so it 404s. Harmless (no real SDK client sends this path) but worth deleting in a future cleanup pass.
Deferred
  • backend.go/backend_appendixa.go internal locking/persistence audited only incidentally (via the findingToJSON accountID threading change); no correctness issues observed, but a dedicated pass wasn't done this round

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrAnalyzerNotFound is returned when the named analyzer does not exist.
	ErrAnalyzerNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrAnalyzerAlreadyExists is returned when creating a duplicate analyzer.
	ErrAnalyzerAlreadyExists = awserr.New("ConflictException", awserr.ErrConflict)
	// ErrArchiveRuleNotFound is returned when the named archive rule does not exist.
	ErrArchiveRuleNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrArchiveRuleAlreadyExists is returned when creating a duplicate archive rule.
	ErrArchiveRuleAlreadyExists = awserr.New("ConflictException", awserr.ErrConflict)
	// ErrFindingNotFound is returned when a finding ID is not found.
	ErrFindingNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrValidation is returned on invalid input.
	ErrValidation = awserr.New("ValidationException", awserr.ErrInvalidParameter)
)
View Source 
var ErrAccessPreviewNotFound = newNotFoundErr("AccessPreviewNotFound")

ErrAccessPreviewNotFound is returned when an access preview is not found.

View Source 
var ErrAnalyzedResourceNotFound = newNotFoundErr("AnalyzedResourceNotFound")

ErrAnalyzedResourceNotFound is returned when an analyzed resource is not found.

View Source 
var ErrNilAppContext = errors.New("accessanalyzer: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

View Source 
var ErrPolicyGenerationNotFound = newNotFoundErr("PolicyGenerationNotFound")

ErrPolicyGenerationNotFound is returned when a policy generation job is not found.

Functions

This section is empty.

Types

type AccessPreview 

type AccessPreview struct {
	CreatedAt   time.Time
	ID          string
	AnalyzerArn string
	Status      AccessPreviewStatus
}

AccessPreview represents an access preview.

type AccessPreviewStatus 

type AccessPreviewStatus string

AccessPreviewStatus represents the status of an access preview. 

const (
	AccessPreviewStatusCompleted AccessPreviewStatus = "COMPLETED"
	AccessPreviewStatusCreating  AccessPreviewStatus = "CREATING"
	AccessPreviewStatusFailed    AccessPreviewStatus = "FAILED"
)

type AccessSpec 

type AccessSpec struct {
	Actions   []string `json:"actions"`
	Resources []string `json:"resources"`
}

AccessSpec is the access argument shape for CheckAccessNotGranted.

type AnalyzedResource 

type AnalyzedResource struct {
	AnalyzedAt   time.Time
	CreatedAt    time.Time
	UpdatedAt    time.Time
	ResourceArn  string
	ResourceType string
	AnalyzerArn  string
	IsPublic     bool
}

AnalyzedResource represents a resource analyzed by an analyzer.

type Analyzer 

type Analyzer struct {
	Tags                   map[string]string `json:"tags,omitempty"`
	LastResourceAnalyzedAt *time.Time        `json:"lastResourceAnalyzedAt,omitempty"`
	CreatedAt              time.Time         `json:"createdAt"`
	Arn                    string            `json:"arn"`
	Name                   string            `json:"name"`
	Type                   AnalyzerType      `json:"type"`
	Status                 AnalyzerStatus    `json:"status"`
}

Analyzer represents an IAM Access Analyzer analyzer.

type AnalyzerStatus 

type AnalyzerStatus string

AnalyzerStatus represents the status of an analyzer. 

const (
	AnalyzerStatusActive   AnalyzerStatus = "ACTIVE"
	AnalyzerStatusCreating AnalyzerStatus = "CREATING"
	AnalyzerStatusDisabled AnalyzerStatus = "DISABLED"
	AnalyzerStatusFailed   AnalyzerStatus = "FAILED"
)

type AnalyzerType 

type AnalyzerType string

AnalyzerType represents the type of an Access Analyzer analyzer. 

const (
	AnalyzerTypeAccount                  AnalyzerType = "ACCOUNT"
	AnalyzerTypeOrganization             AnalyzerType = "ORGANIZATION"
	AnalyzerTypeAccountUnusedAccess      AnalyzerType = "ACCOUNT_UNUSED_ACCESS"
	AnalyzerTypeOrganizationUnusedAccess AnalyzerType = "ORGANIZATION_UNUSED_ACCESS"
)

type ArchiveRule 

type ArchiveRule struct {
	Filter       map[string]FilterCriterion `json:"filter"`
	CreatedAt    time.Time                  `json:"createdAt"`
	UpdatedAt    time.Time                  `json:"updatedAt"`
	RuleName     string                     `json:"ruleName"`
	AnalyzerName string                     `json:"-"`
}

ArchiveRule represents an archive rule for an analyzer.

AnalyzerName identifies the owning analyzer. It is never part of the wire response (archiveRuleToJSON in handler_archive_rules.go builds that by hand), so it is tagged json:"-"; it exists purely so archiveRuleKeyFn (store_setup.go) can derive the composite "analyzerName|ruleName" store.Table key from the value alone, matching the primary key of the map[string]map[string]*ArchiveRule this type used to live in.

type FilterCriterion 

type FilterCriterion struct {
	Contains []string `json:"contains,omitempty"`
	Eq       []string `json:"eq,omitempty"`
	Exists   *bool    `json:"exists,omitempty"`
	Neq      []string `json:"neq,omitempty"`
}

FilterCriterion is a single criterion in a finding filter.

type Finding 

type Finding struct {
	UpdatedAt    time.Time         `json:"updatedAt"`
	CreatedAt    time.Time         `json:"createdAt"`
	Principal    map[string]string `json:"principal,omitempty"`
	Condition    map[string]string `json:"condition,omitempty"`
	IsPublic     *bool             `json:"isPublic,omitempty"`
	ID           string            `json:"id"`
	AnalyzerArn  string            `json:"analyzerArn"`
	Status       FindingStatus     `json:"status"`
	ResourceType string            `json:"resourceType"`
	ResourceArn  string            `json:"resourceArn"`
	Action       []string          `json:"action,omitempty"`
}

Finding represents a single IAM Access Analyzer finding.

type FindingRecommendation 

type FindingRecommendation struct {
	CompletedAt        *time.Time
	StartedAt          time.Time
	ID                 string
	AnalyzerArn        string
	RecommendationType string
	Status             string
}

FindingRecommendation represents a recommendation record for a finding.

type FindingStatus 

type FindingStatus string

FindingStatus represents the status of a finding. 

const (
	FindingStatusActive   FindingStatus = "ACTIVE"
	FindingStatusArchived FindingStatus = "ARCHIVED"
	FindingStatusResolved FindingStatus = "RESOLVED"
)

type Handler 

type Handler struct {
	Backend StorageBackend
}

Handler handles Access Analyzer HTTP requests.

func NewHandler 

func NewHandler(b StorageBackend) *Handler

NewHandler constructs a new Handler.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns every operation this handler routes, across all operation families (analyzers, archive rules, findings, analyzed resources, generated policies, access previews, policy validation, tags).

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset resets the backend.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend. See Snapshot's doc comment for why this delegation was previously missing.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Access Analyzer requests by path prefix. For /tags/{ARN} paths, only matches when the ARN belongs to Access Analyzer (i.e. contains ":access-analyzer:") to avoid intercepting tag requests for other services.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

Before this Phase 3.3 conversion, InMemoryBackend already implemented Snapshot/Restore, but Handler never delegated to them -- setupPersistence in cli.go only registers a service.Registerable with the persistence.Manager if the Handler itself (the value actually returned by Provider.Init and passed to setupPersistence) satisfies the Snapshot/ Restore duck-typed interface, so Access Analyzer state was silently never persisted at all. Adding this method (and Restore below) is the dead-wiring fix that makes the backend's (now registry-backed) persistence reachable.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend implements StorageBackend using in-memory maps.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend constructs a new InMemoryBackend.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the backend's account ID.

func (*InMemoryBackend) AddAnalyzedResource 

func (b *InMemoryBackend) AddAnalyzedResource(
	analyzerArn, resourceArn, resourceType string,
	isPublic bool,
) (*AnalyzedResource, error)

AddAnalyzedResource adds a synthetic analyzed resource (for testing).

func (*InMemoryBackend) AddFinding 

func (b *InMemoryBackend) AddFinding(
	analyzerName, resourceType, resourceArn string,
	action []string,
	principal map[string]string,
	isPublic *bool,
) (*Finding, error)

AddFinding adds a synthetic finding to an analyzer (for testing / resource scan simulation).

func (*InMemoryBackend) ApplyArchiveRule 

func (b *InMemoryBackend) ApplyArchiveRule(analyzerArn, ruleName string) error

ApplyArchiveRule applies all archive rules for an analyzer to its findings. Findings that match any archive rule filter are archived.

func (*InMemoryBackend) CancelPolicyGeneration 

func (b *InMemoryBackend) CancelPolicyGeneration(jobID string) error

CancelPolicyGeneration cancels a policy generation job.

func (*InMemoryBackend) CreateAccessPreview 

func (b *InMemoryBackend) CreateAccessPreview(analyzerArn string) (*AccessPreview, error)

CreateAccessPreview creates a new access preview.

func (*InMemoryBackend) CreateAnalyzer 

func (b *InMemoryBackend) CreateAnalyzer(
	name string,
	analyzerType AnalyzerType,
	tags map[string]string,
) (*Analyzer, error)

CreateAnalyzer creates a new analyzer.

func (*InMemoryBackend) CreateArchiveRule 

func (b *InMemoryBackend) CreateArchiveRule(
	analyzerName, ruleName string,
	filter map[string]FilterCriterion,
) (*ArchiveRule, error)

CreateArchiveRule adds an archive rule to an analyzer and immediately archives all active findings for that analyzer (AWS auto-apply behavior).

func (*InMemoryBackend) CreateServiceLinkedAnalyzer 

func (b *InMemoryBackend) CreateServiceLinkedAnalyzer(analyzerType AnalyzerType) (*Analyzer, error)

CreateServiceLinkedAnalyzer creates an analyzer with a generated service-linked name.

func (*InMemoryBackend) DeleteAnalyzer 

func (b *InMemoryBackend) DeleteAnalyzer(name string) error

DeleteAnalyzer removes an analyzer and all its findings and archive rules.

func (*InMemoryBackend) DeleteArchiveRule 

func (b *InMemoryBackend) DeleteArchiveRule(analyzerName, ruleName string) error

DeleteArchiveRule removes an archive rule.

func (*InMemoryBackend) GenerateFindingRecommendation 

func (b *InMemoryBackend) GenerateFindingRecommendation(analyzerArn, findingID string) error

GenerateFindingRecommendation records a recommendation request for a finding.

func (*InMemoryBackend) GetAccessPreview 

func (b *InMemoryBackend) GetAccessPreview(accessPreviewID string) (*AccessPreview, error)

GetAccessPreview returns an access preview by ID.

func (*InMemoryBackend) GetAnalyzedResource 

func (b *InMemoryBackend) GetAnalyzedResource(analyzerArn, resourceArn string) (*AnalyzedResource, error)

GetAnalyzedResource returns an analyzed resource for an analyzer by resource ARN.

func (*InMemoryBackend) GetAnalyzer 

func (b *InMemoryBackend) GetAnalyzer(name string) (*Analyzer, error)

GetAnalyzer returns the named analyzer.

func (*InMemoryBackend) GetArchiveRule 

func (b *InMemoryBackend) GetArchiveRule(analyzerName, ruleName string) (*ArchiveRule, error)

GetArchiveRule returns the named archive rule.

func (*InMemoryBackend) GetFinding 

func (b *InMemoryBackend) GetFinding(analyzerName, findingID string) (*Finding, error)

GetFinding returns a finding by ID.

func (*InMemoryBackend) GetFindingRecommendation 

func (b *InMemoryBackend) GetFindingRecommendation(
	analyzerArn, findingID string,
) (*FindingRecommendation, error)

GetFindingRecommendation returns recommendations for a finding.

func (*InMemoryBackend) GetFindingV2 

func (b *InMemoryBackend) GetFindingV2(analyzerArn, findingID string) (*Finding, error)

GetFindingV2 returns a finding in V2 format (same data, different shape).

func (*InMemoryBackend) GetFindingsStatistics 

func (b *InMemoryBackend) GetFindingsStatistics(analyzerArn string) (map[string]int, error)

GetFindingsStatistics returns counts of findings by status for an analyzer.

func (*InMemoryBackend) GetPolicyGeneration 

func (b *InMemoryBackend) GetPolicyGeneration(jobID string) (*PolicyGeneration, error)

GetPolicyGeneration returns a policy generation job by ID.

func (*InMemoryBackend) ListAccessPreviewFindings 

func (b *InMemoryBackend) ListAccessPreviewFindings(
	accessPreviewID string,
	maxResults int,
	nextToken string,
) ([]*Finding, string, error)

ListAccessPreviewFindings returns findings from the analyzer associated with the preview.

func (*InMemoryBackend) ListAccessPreviews 

func (b *InMemoryBackend) ListAccessPreviews(analyzerArn string) ([]*AccessPreview, error)

ListAccessPreviews returns all access previews for a given analyzerArn.

func (*InMemoryBackend) ListAnalyzedResources 

func (b *InMemoryBackend) ListAnalyzedResources(
	analyzerArn, resourceType string,
	maxResults int,
	nextToken string,
) ([]*AnalyzedResource, string, error)

ListAnalyzedResources returns analyzed resources for an analyzer, optionally filtered by type.

func (*InMemoryBackend) ListAnalyzers 

func (b *InMemoryBackend) ListAnalyzers(analyzerType string) ([]*Analyzer, error)

ListAnalyzers returns all analyzers, optionally filtered by type.

func (*InMemoryBackend) ListArchiveRules 

func (b *InMemoryBackend) ListArchiveRules(analyzerName string) ([]*ArchiveRule, error)

ListArchiveRules returns all archive rules for an analyzer.

func (*InMemoryBackend) ListFindings 

func (b *InMemoryBackend) ListFindings(
	analyzerName string,
	_ map[string]FilterCriterion,
	status string,
	maxResults int,
	nextToken string,
) ([]*Finding, string, error)

ListFindings returns findings for an analyzer, optionally filtered.

func (*InMemoryBackend) ListFindingsV2 

func (b *InMemoryBackend) ListFindingsV2(
	analyzerArn, status string,
	maxResults int,
	nextToken string,
) ([]*Finding, string, error)

ListFindingsV2 returns findings in V2 format for an analyzer identified by ARN.

func (*InMemoryBackend) ListPolicyGenerations 

func (b *InMemoryBackend) ListPolicyGenerations(principalArn string) ([]*PolicyGeneration, error)

ListPolicyGenerations returns all policy generation jobs, optionally filtered by principalArn.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(resourceARN string) (map[string]string, error)

ListTagsForResource returns all tags for a resource.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the backend's region.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore deserializes state from JSON. It implements persistence.Persistable.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serializes current state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) StartPolicyGeneration 

func (b *InMemoryBackend) StartPolicyGeneration(principalArn string) (*PolicyGeneration, error)

StartPolicyGeneration creates a new policy generation job.

func (*InMemoryBackend) StartResourceScan 

func (b *InMemoryBackend) StartResourceScan(analyzerARN string, _ string) error

StartResourceScan records that a scan was initiated for a resource (no-op in simulation).

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(resourceARN string, kv map[string]string) error

TagResource sets tags on a resource by ARN.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(resourceARN string, tagKeys []string) error

UntagResource removes tags from a resource by ARN.

func (*InMemoryBackend) UpdateAnalyzer 

func (b *InMemoryBackend) UpdateAnalyzer(name string) (*Analyzer, error)

UpdateAnalyzer updates an analyzer (currently a no-op — configuration not stored).

func (*InMemoryBackend) UpdateArchiveRule 

func (b *InMemoryBackend) UpdateArchiveRule(
	analyzerName, ruleName string,
	filter map[string]FilterCriterion,
) (*ArchiveRule, error)

UpdateArchiveRule replaces the filter on an archive rule.

func (*InMemoryBackend) UpdateFindings 

func (b *InMemoryBackend) UpdateFindings(
	analyzerName string,
	findingIDs []string,
	status FindingStatus,
) error

UpdateFindings archives or marks active the specified findings.

type PolicyCheckResult 

type PolicyCheckResult struct {
	Result  string           `json:"result"`
	Message string           `json:"message"`
	Reasons []map[string]any `json:"reasons,omitempty"`
}

PolicyCheckResult holds a structured check result returned to callers.

func CheckAccessNotGranted 

func CheckAccessNotGranted(policyDoc string, accesses []AccessSpec) PolicyCheckResult

CheckAccessNotGranted returns PASS if the policy does NOT grant any of the specified accesses.

func CheckNoNewAccess 

func CheckNoNewAccess(existingDoc, newDoc string) PolicyCheckResult

CheckNoNewAccess returns PASS if newPolicyDoc does not grant access beyond existingPolicyDoc.

func CheckNoPublicAccess 

func CheckNoPublicAccess(policyDoc string) PolicyCheckResult

CheckNoPublicAccess returns PASS if the policy has no public-access Allow statements.

type PolicyGeneration 

type PolicyGeneration struct {
	CompletedOn  *time.Time
	StartedOn    time.Time
	JobID        string
	PrincipalArn string
	Status       PolicyGenerationStatus
}

PolicyGeneration represents a policy generation job.

type PolicyGenerationStatus 

type PolicyGenerationStatus string

PolicyGenerationStatus represents the status of a policy generation job. 

const (
	PolicyGenerationStatusRunning   PolicyGenerationStatus = "RUNNING"
	PolicyGenerationStatusSucceeded PolicyGenerationStatus = "SUCCEEDED"
	PolicyGenerationStatusFailed    PolicyGenerationStatus = "FAILED"
	PolicyGenerationStatusCanceled  PolicyGenerationStatus = "CANCELED"
)

type Provider 

type Provider struct{}

Provider implements service.Provider for IAM Access Analyzer.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Access Analyzer service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type StorageBackend 

type StorageBackend interface {
	// Analyzer operations
	CreateAnalyzer(name string, analyzerType AnalyzerType, tags map[string]string) (*Analyzer, error)
	GetAnalyzer(name string) (*Analyzer, error)
	ListAnalyzers(analyzerType string) ([]*Analyzer, error)
	DeleteAnalyzer(name string) error
	UpdateAnalyzer(name string) (*Analyzer, error)
	CreateServiceLinkedAnalyzer(analyzerType AnalyzerType) (*Analyzer, error)

	// Archive rule operations
	CreateArchiveRule(analyzerName, ruleName string, filter map[string]FilterCriterion) (*ArchiveRule, error)
	GetArchiveRule(analyzerName, ruleName string) (*ArchiveRule, error)
	ListArchiveRules(analyzerName string) ([]*ArchiveRule, error)
	DeleteArchiveRule(analyzerName, ruleName string) error
	UpdateArchiveRule(analyzerName, ruleName string, filter map[string]FilterCriterion) (*ArchiveRule, error)
	ApplyArchiveRule(analyzerArn, ruleName string) error

	// Finding operations
	AddFinding(
		analyzerName, resourceType, resourceArn string,
		action []string,
		principal map[string]string,
		isPublic *bool,
	) (*Finding, error)
	GetFinding(analyzerName, findingID string) (*Finding, error)
	ListFindings(
		analyzerName string,
		filter map[string]FilterCriterion,
		status string,
		maxResults int,
		nextToken string,
	) ([]*Finding, string, error)
	UpdateFindings(analyzerName string, findingIDs []string, status FindingStatus) error
	GetFindingV2(analyzerArn, findingID string) (*Finding, error)
	ListFindingsV2(analyzerArn, status string, maxResults int, nextToken string) ([]*Finding, string, error)
	GetFindingsStatistics(analyzerArn string) (map[string]int, error)

	// Finding recommendations
	GenerateFindingRecommendation(analyzerArn, findingID string) error
	GetFindingRecommendation(analyzerArn, findingID string) (*FindingRecommendation, error)

	// Analyzed resources
	AddAnalyzedResource(analyzerArn, resourceArn, resourceType string, isPublic bool) (*AnalyzedResource, error)
	GetAnalyzedResource(analyzerArn, resourceArn string) (*AnalyzedResource, error)
	ListAnalyzedResources(
		analyzerArn, resourceType string,
		maxResults int,
		nextToken string,
	) ([]*AnalyzedResource, string, error)

	// Scan
	StartResourceScan(analyzerARN, resourceARN string) error

	// Policy generation
	StartPolicyGeneration(principalArn string) (*PolicyGeneration, error)
	GetPolicyGeneration(jobID string) (*PolicyGeneration, error)
	CancelPolicyGeneration(jobID string) error
	ListPolicyGenerations(principalArn string) ([]*PolicyGeneration, error)

	// Access previews
	CreateAccessPreview(analyzerArn string) (*AccessPreview, error)
	GetAccessPreview(accessPreviewID string) (*AccessPreview, error)
	ListAccessPreviews(analyzerArn string) ([]*AccessPreview, error)
	ListAccessPreviewFindings(accessPreviewID string, maxResults int, nextToken string) ([]*Finding, string, error)

	// Tag operations
	TagResource(resourceARN string, kv map[string]string) error
	UntagResource(resourceARN string, tagKeys []string) error
	ListTagsForResource(resourceARN string) (map[string]string, error)

	// Lifecycle
	Reset()
	Region() string
	AccountID() string
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend defines the interface for Access Analyzer backend implementations. All mutating methods must be safe for concurrent use.

type ValidatePolicyFinding 

type ValidatePolicyFinding struct {
	FindingType   string           `json:"findingType"`
	IssueCode     string           `json:"issueCode"`
	LearnMoreLink string           `json:"learnMoreLink"`
	Locations     []map[string]any `json:"locations"`
}

ValidatePolicyFinding is a single finding from policy validation.

func ValidatePolicy 

func ValidatePolicy(policyDoc, policyType string) []ValidatePolicyFinding

ValidatePolicy checks a policy document for structural and semantic errors.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.