aws.iam.getPrincipalPolicySimulation

func LookupPrincipalPolicySimulation(ctx *Context, args *LookupPrincipalPolicySimulationArgs, opts ...InvokeOption) (*LookupPrincipalPolicySimulationResult, error)
func LookupPrincipalPolicySimulationOutput(ctx *Context, args *LookupPrincipalPolicySimulationOutputArgs, opts ...InvokeOption) LookupPrincipalPolicySimulationResultOutput

> Note: This function is named LookupPrincipalPolicySimulation in the Go SDK.

ActionNames List<string>

A set of IAM action names to run simulations for. Each entry in this set adds an additional hypothetical request to the simulation.

Action names consist of a service prefix and an action verb separated by a colon, such as s3:GetObject. Refer to Actions, resources, and condition keys for AWS services to see the full set of possible IAM action names across all AWS services.

PolicySourceArn string

The ARN of the IAM user, group, or role whose policies will be included in the simulation.

You must closely match the form of the real service request you are simulating in order to achieve a realistic result. You can use the following additional arguments to specify other characteristics of the simulated requests:

AdditionalPoliciesJsons List<string>

A set of additional principal policy documents to include in the simulation. The simulator will behave as if each of these policies were associated with the object specified in policy_source_arn, allowing you to test the effect of hypothetical policies not yet created.

CallerArn string

The ARN of an user that will appear as the "caller" of the simulated requests. If you do not specify caller_arn then the simulation will use the policy_source_arn instead, if it contains a user ARN.

Contexts List<GetPrincipalPolicySimulationContext>

Each context block defines an entry in the table of additional context keys in the simulated request.

IAM uses context keys for both custom conditions and for interpolating dynamic request-specific values into policy values. If you use policies that include those features then you will need to provide suitable example values for those keys to achieve a realistic simulation.

PermissionsBoundaryPoliciesJsons List<string>

A set of permissions boundary policy documents to include in the simulation.

ResourceArns List<string>

A set of ARNs of resources to include in the simulation.

This argument is important for actions that have either required or optional resource types listed in Actions, resources, and condition keys for AWS services, and you must provide ARNs that identify AWS objects of the appropriate types for the chosen actions.

The policy simulator only automatically loads policies associated with the policy_source_arn, so if your given resources have their own resource-level policy then you'll also need to provide that explicitly using the resource_policy_json argument to achieve a realistic simulation.

ResourceHandlingOption string

Specifies a special simulation type to run. Some EC2 actions require special simulation behaviors and a particular set of resource ARNs to achieve a realistic result.

For more details, see the ResourceHandlingOption request parameter for the underlying iam:SimulatePrincipalPolicy action.

ResourceOwnerAccountId string

An AWS account ID to use for any resource ARN in resource_arns that doesn't include its own AWS account ID. If unspecified, the simulator will use the account ID from the caller_arn argument as a placeholder.

ResourcePolicyJson string

An IAM policy document representing the resource-level policy of all of the resources specified in resource_arns.

The policy simulator cannot automatically load policies that are associated with individual resources, as described in the documentation for resource_arns above.

ActionNames []string

A set of IAM action names to run simulations for. Each entry in this set adds an additional hypothetical request to the simulation.

Action names consist of a service prefix and an action verb separated by a colon, such as s3:GetObject. Refer to Actions, resources, and condition keys for AWS services to see the full set of possible IAM action names across all AWS services.

PolicySourceArn string

The ARN of the IAM user, group, or role whose policies will be included in the simulation.

You must closely match the form of the real service request you are simulating in order to achieve a realistic result. You can use the following additional arguments to specify other characteristics of the simulated requests:

AdditionalPoliciesJsons []string

A set of additional principal policy documents to include in the simulation. The simulator will behave as if each of these policies were associated with the object specified in policy_source_arn, allowing you to test the effect of hypothetical policies not yet created.

CallerArn string

The ARN of an user that will appear as the "caller" of the simulated requests. If you do not specify caller_arn then the simulation will use the policy_source_arn instead, if it contains a user ARN.

Contexts []GetPrincipalPolicySimulationContext

Each context block defines an entry in the table of additional context keys in the simulated request.

IAM uses context keys for both custom conditions and for interpolating dynamic request-specific values into policy values. If you use policies that include those features then you will need to provide suitable example values for those keys to achieve a realistic simulation.

PermissionsBoundaryPoliciesJsons []string

A set of permissions boundary policy documents to include in the simulation.

ResourceArns []string

A set of ARNs of resources to include in the simulation.

This argument is important for actions that have either required or optional resource types listed in Actions, resources, and condition keys for AWS services, and you must provide ARNs that identify AWS objects of the appropriate types for the chosen actions.

The policy simulator only automatically loads policies associated with the policy_source_arn, so if your given resources have their own resource-level policy then you'll also need to provide that explicitly using the resource_policy_json argument to achieve a realistic simulation.

ResourceHandlingOption string

Specifies a special simulation type to run. Some EC2 actions require special simulation behaviors and a particular set of resource ARNs to achieve a realistic result.

For more details, see the ResourceHandlingOption request parameter for the underlying iam:SimulatePrincipalPolicy action.

ResourceOwnerAccountId string

An AWS account ID to use for any resource ARN in resource_arns that doesn't include its own AWS account ID. If unspecified, the simulator will use the account ID from the caller_arn argument as a placeholder.

ResourcePolicyJson string

An IAM policy document representing the resource-level policy of all of the resources specified in resource_arns.

The policy simulator cannot automatically load policies that are associated with individual resources, as described in the documentation for resource_arns above.

actionNames List<String>

A set of IAM action names to run simulations for. Each entry in this set adds an additional hypothetical request to the simulation.

Action names consist of a service prefix and an action verb separated by a colon, such as s3:GetObject. Refer to Actions, resources, and condition keys for AWS services to see the full set of possible IAM action names across all AWS services.

policySourceArn String

The ARN of the IAM user, group, or role whose policies will be included in the simulation.

You must closely match the form of the real service request you are simulating in order to achieve a realistic result. You can use the following additional arguments to specify other characteristics of the simulated requests:

additionalPoliciesJsons List<String>

A set of additional principal policy documents to include in the simulation. The simulator will behave as if each of these policies were associated with the object specified in policy_source_arn, allowing you to test the effect of hypothetical policies not yet created.

callerArn String

The ARN of an user that will appear as the "caller" of the simulated requests. If you do not specify caller_arn then the simulation will use the policy_source_arn instead, if it contains a user ARN.

contexts List<GetPrincipalPolicySimulationContext>

Each context block defines an entry in the table of additional context keys in the simulated request.

IAM uses context keys for both custom conditions and for interpolating dynamic request-specific values into policy values. If you use policies that include those features then you will need to provide suitable example values for those keys to achieve a realistic simulation.

permissionsBoundaryPoliciesJsons List<String>

A set of permissions boundary policy documents to include in the simulation.

resourceArns List<String>

A set of ARNs of resources to include in the simulation.

This argument is important for actions that have either required or optional resource types listed in Actions, resources, and condition keys for AWS services, and you must provide ARNs that identify AWS objects of the appropriate types for the chosen actions.

The policy simulator only automatically loads policies associated with the policy_source_arn, so if your given resources have their own resource-level policy then you'll also need to provide that explicitly using the resource_policy_json argument to achieve a realistic simulation.

resourceHandlingOption String

Specifies a special simulation type to run. Some EC2 actions require special simulation behaviors and a particular set of resource ARNs to achieve a realistic result.

For more details, see the ResourceHandlingOption request parameter for the underlying iam:SimulatePrincipalPolicy action.

resourceOwnerAccountId String

An AWS account ID to use for any resource ARN in resource_arns that doesn't include its own AWS account ID. If unspecified, the simulator will use the account ID from the caller_arn argument as a placeholder.

resourcePolicyJson String

An IAM policy document representing the resource-level policy of all of the resources specified in resource_arns.

The policy simulator cannot automatically load policies that are associated with individual resources, as described in the documentation for resource_arns above.

actionNames string[]

A set of IAM action names to run simulations for. Each entry in this set adds an additional hypothetical request to the simulation.

Action names consist of a service prefix and an action verb separated by a colon, such as s3:GetObject. Refer to Actions, resources, and condition keys for AWS services to see the full set of possible IAM action names across all AWS services.

policySourceArn string

The ARN of the IAM user, group, or role whose policies will be included in the simulation.

You must closely match the form of the real service request you are simulating in order to achieve a realistic result. You can use the following additional arguments to specify other characteristics of the simulated requests:

additionalPoliciesJsons string[]

A set of additional principal policy documents to include in the simulation. The simulator will behave as if each of these policies were associated with the object specified in policy_source_arn, allowing you to test the effect of hypothetical policies not yet created.

callerArn string

The ARN of an user that will appear as the "caller" of the simulated requests. If you do not specify caller_arn then the simulation will use the policy_source_arn instead, if it contains a user ARN.

contexts GetPrincipalPolicySimulationContext[]

Each context block defines an entry in the table of additional context keys in the simulated request.

IAM uses context keys for both custom conditions and for interpolating dynamic request-specific values into policy values. If you use policies that include those features then you will need to provide suitable example values for those keys to achieve a realistic simulation.

permissionsBoundaryPoliciesJsons string[]

A set of permissions boundary policy documents to include in the simulation.

resourceArns string[]

A set of ARNs of resources to include in the simulation.

This argument is important for actions that have either required or optional resource types listed in Actions, resources, and condition keys for AWS services, and you must provide ARNs that identify AWS objects of the appropriate types for the chosen actions.

The policy simulator only automatically loads policies associated with the policy_source_arn, so if your given resources have their own resource-level policy then you'll also need to provide that explicitly using the resource_policy_json argument to achieve a realistic simulation.

resourceHandlingOption string

Specifies a special simulation type to run. Some EC2 actions require special simulation behaviors and a particular set of resource ARNs to achieve a realistic result.

For more details, see the ResourceHandlingOption request parameter for the underlying iam:SimulatePrincipalPolicy action.

resourceOwnerAccountId string

An AWS account ID to use for any resource ARN in resource_arns that doesn't include its own AWS account ID. If unspecified, the simulator will use the account ID from the caller_arn argument as a placeholder.

resourcePolicyJson string

An IAM policy document representing the resource-level policy of all of the resources specified in resource_arns.

The policy simulator cannot automatically load policies that are associated with individual resources, as described in the documentation for resource_arns above.

action_names Sequence[str]

A set of IAM action names to run simulations for. Each entry in this set adds an additional hypothetical request to the simulation.

Action names consist of a service prefix and an action verb separated by a colon, such as s3:GetObject. Refer to Actions, resources, and condition keys for AWS services to see the full set of possible IAM action names across all AWS services.

policy_source_arn str

The ARN of the IAM user, group, or role whose policies will be included in the simulation.

You must closely match the form of the real service request you are simulating in order to achieve a realistic result. You can use the following additional arguments to specify other characteristics of the simulated requests:

additional_policies_jsons Sequence[str]

A set of additional principal policy documents to include in the simulation. The simulator will behave as if each of these policies were associated with the object specified in policy_source_arn, allowing you to test the effect of hypothetical policies not yet created.

caller_arn str

The ARN of an user that will appear as the "caller" of the simulated requests. If you do not specify caller_arn then the simulation will use the policy_source_arn instead, if it contains a user ARN.

contexts Sequence[GetPrincipalPolicySimulationContext]

Each context block defines an entry in the table of additional context keys in the simulated request.

IAM uses context keys for both custom conditions and for interpolating dynamic request-specific values into policy values. If you use policies that include those features then you will need to provide suitable example values for those keys to achieve a realistic simulation.

permissions_boundary_policies_jsons Sequence[str]

A set of permissions boundary policy documents to include in the simulation.

resource_arns Sequence[str]

A set of ARNs of resources to include in the simulation.

This argument is important for actions that have either required or optional resource types listed in Actions, resources, and condition keys for AWS services, and you must provide ARNs that identify AWS objects of the appropriate types for the chosen actions.

The policy simulator only automatically loads policies associated with the policy_source_arn, so if your given resources have their own resource-level policy then you'll also need to provide that explicitly using the resource_policy_json argument to achieve a realistic simulation.

resource_handling_option str

Specifies a special simulation type to run. Some EC2 actions require special simulation behaviors and a particular set of resource ARNs to achieve a realistic result.

For more details, see the ResourceHandlingOption request parameter for the underlying iam:SimulatePrincipalPolicy action.

resource_owner_account_id str

An AWS account ID to use for any resource ARN in resource_arns that doesn't include its own AWS account ID. If unspecified, the simulator will use the account ID from the caller_arn argument as a placeholder.

resource_policy_json str

An IAM policy document representing the resource-level policy of all of the resources specified in resource_arns.

The policy simulator cannot automatically load policies that are associated with individual resources, as described in the documentation for resource_arns above.

actionNames List<String>

A set of IAM action names to run simulations for. Each entry in this set adds an additional hypothetical request to the simulation.

Action names consist of a service prefix and an action verb separated by a colon, such as s3:GetObject. Refer to Actions, resources, and condition keys for AWS services to see the full set of possible IAM action names across all AWS services.

policySourceArn String

The ARN of the IAM user, group, or role whose policies will be included in the simulation.

You must closely match the form of the real service request you are simulating in order to achieve a realistic result. You can use the following additional arguments to specify other characteristics of the simulated requests:

additionalPoliciesJsons List<String>

A set of additional principal policy documents to include in the simulation. The simulator will behave as if each of these policies were associated with the object specified in policy_source_arn, allowing you to test the effect of hypothetical policies not yet created.

callerArn String

The ARN of an user that will appear as the "caller" of the simulated requests. If you do not specify caller_arn then the simulation will use the policy_source_arn instead, if it contains a user ARN.

contexts List<Property Map>

Each context block defines an entry in the table of additional context keys in the simulated request.

IAM uses context keys for both custom conditions and for interpolating dynamic request-specific values into policy values. If you use policies that include those features then you will need to provide suitable example values for those keys to achieve a realistic simulation.

permissionsBoundaryPoliciesJsons List<String>

A set of permissions boundary policy documents to include in the simulation.

resourceArns List<String>

A set of ARNs of resources to include in the simulation.

This argument is important for actions that have either required or optional resource types listed in Actions, resources, and condition keys for AWS services, and you must provide ARNs that identify AWS objects of the appropriate types for the chosen actions.

The policy simulator only automatically loads policies associated with the policy_source_arn, so if your given resources have their own resource-level policy then you'll also need to provide that explicitly using the resource_policy_json argument to achieve a realistic simulation.

resourceHandlingOption String

Specifies a special simulation type to run. Some EC2 actions require special simulation behaviors and a particular set of resource ARNs to achieve a realistic result.

For more details, see the ResourceHandlingOption request parameter for the underlying iam:SimulatePrincipalPolicy action.

resourceOwnerAccountId String

An AWS account ID to use for any resource ARN in resource_arns that doesn't include its own AWS account ID. If unspecified, the simulator will use the account ID from the caller_arn argument as a placeholder.

resourcePolicyJson String

An IAM policy document representing the resource-level policy of all of the resources specified in resource_arns.

The policy simulator cannot automatically load policies that are associated with individual resources, as described in the documentation for resource_arns above.

ActionNames List<string>

AllAllowed bool

true if all of the simulation results have decision "allowed", or false otherwise.

Id string

PolicySourceArn string

Results List<GetPrincipalPolicySimulationResult>

A set of result objects, one for each of the simulated requests, with the following nested attributes:

AdditionalPoliciesJsons List<string>

CallerArn string

Contexts List<GetPrincipalPolicySimulationContext>

PermissionsBoundaryPoliciesJsons List<string>

ResourceArns List<string>

ResourceHandlingOption string

ResourceOwnerAccountId string

ResourcePolicyJson string

ActionNames []string

AllAllowed bool

true if all of the simulation results have decision "allowed", or false otherwise.

Id string

PolicySourceArn string

Results []GetPrincipalPolicySimulationResult

A set of result objects, one for each of the simulated requests, with the following nested attributes:

AdditionalPoliciesJsons []string

CallerArn string

Contexts []GetPrincipalPolicySimulationContext

PermissionsBoundaryPoliciesJsons []string

ResourceArns []string

ResourceHandlingOption string

ResourceOwnerAccountId string

ResourcePolicyJson string

actionNames List<String>

allAllowed Boolean

true if all of the simulation results have decision "allowed", or false otherwise.

id String

policySourceArn String

results List<GetPrincipalPolicySimulationResult>

A set of result objects, one for each of the simulated requests, with the following nested attributes:

additionalPoliciesJsons List<String>

callerArn String

contexts List<GetPrincipalPolicySimulationContext>

permissionsBoundaryPoliciesJsons List<String>

resourceArns List<String>

resourceHandlingOption String

resourceOwnerAccountId String

resourcePolicyJson String

actionNames string[]

allAllowed boolean

true if all of the simulation results have decision "allowed", or false otherwise.

id string

policySourceArn string

results GetPrincipalPolicySimulationResult[]

A set of result objects, one for each of the simulated requests, with the following nested attributes:

additionalPoliciesJsons string[]

callerArn string

contexts GetPrincipalPolicySimulationContext[]

permissionsBoundaryPoliciesJsons string[]

resourceArns string[]

resourceHandlingOption string

resourceOwnerAccountId string

resourcePolicyJson string

action_names Sequence[str]

all_allowed bool

true if all of the simulation results have decision "allowed", or false otherwise.

id str

policy_source_arn str

results Sequence[GetPrincipalPolicySimulationResult]

A set of result objects, one for each of the simulated requests, with the following nested attributes:

additional_policies_jsons Sequence[str]

caller_arn str

contexts Sequence[GetPrincipalPolicySimulationContext]

permissions_boundary_policies_jsons Sequence[str]

resource_arns Sequence[str]

resource_handling_option str

resource_owner_account_id str

resource_policy_json str

actionNames List<String>

allAllowed Boolean

true if all of the simulation results have decision "allowed", or false otherwise.

id String

policySourceArn String

results List<Property Map>

A set of result objects, one for each of the simulated requests, with the following nested attributes:

additionalPoliciesJsons List<String>

callerArn String

contexts List<Property Map>

permissionsBoundaryPoliciesJsons List<String>

resourceArns List<String>

resourceHandlingOption String

resourceOwnerAccountId String

resourcePolicyJson String

Key string

The context condition key to set.

If you have policies containing Condition elements or using dynamic interpolations then you will need to provide suitable values for each condition key your policies use. See Actions, resources, and condition keys for AWS services to find the various condition keys that are normally provided for real requests to each action of each AWS service.

Type string

An IAM value type that determines how the policy simulator will interpret the strings given in values.

For more information, see the ContextKeyType field of iam.ContextEntry in the underlying API.

Values List<string>

A set of one or more values for this context entry.

Key string

The context condition key to set.

If you have policies containing Condition elements or using dynamic interpolations then you will need to provide suitable values for each condition key your policies use. See Actions, resources, and condition keys for AWS services to find the various condition keys that are normally provided for real requests to each action of each AWS service.

Type string

An IAM value type that determines how the policy simulator will interpret the strings given in values.

For more information, see the ContextKeyType field of iam.ContextEntry in the underlying API.

Values []string

A set of one or more values for this context entry.

key String

The context condition key to set.

If you have policies containing Condition elements or using dynamic interpolations then you will need to provide suitable values for each condition key your policies use. See Actions, resources, and condition keys for AWS services to find the various condition keys that are normally provided for real requests to each action of each AWS service.

type String

An IAM value type that determines how the policy simulator will interpret the strings given in values.

For more information, see the ContextKeyType field of iam.ContextEntry in the underlying API.

values List<String>

A set of one or more values for this context entry.

key string

The context condition key to set.

If you have policies containing Condition elements or using dynamic interpolations then you will need to provide suitable values for each condition key your policies use. See Actions, resources, and condition keys for AWS services to find the various condition keys that are normally provided for real requests to each action of each AWS service.

type string

An IAM value type that determines how the policy simulator will interpret the strings given in values.

For more information, see the ContextKeyType field of iam.ContextEntry in the underlying API.

values string[]

A set of one or more values for this context entry.

key str

The context condition key to set.

If you have policies containing Condition elements or using dynamic interpolations then you will need to provide suitable values for each condition key your policies use. See Actions, resources, and condition keys for AWS services to find the various condition keys that are normally provided for real requests to each action of each AWS service.

type str

An IAM value type that determines how the policy simulator will interpret the strings given in values.

For more information, see the ContextKeyType field of iam.ContextEntry in the underlying API.

values Sequence[str]

A set of one or more values for this context entry.

key String

The context condition key to set.

If you have policies containing Condition elements or using dynamic interpolations then you will need to provide suitable values for each condition key your policies use. See Actions, resources, and condition keys for AWS services to find the various condition keys that are normally provided for real requests to each action of each AWS service.

type String

An IAM value type that determines how the policy simulator will interpret the strings given in values.

For more information, see the ContextKeyType field of iam.ContextEntry in the underlying API.

values List<String>

A set of one or more values for this context entry.

ActionName string

The name of the single IAM action used for this particular request.

Allowed bool

true if decision is "allowed", and false otherwise.

Decision string

The raw decision determined from all of the policies in scope; either "allowed", "explicitDeny", or "implicitDeny".

DecisionDetails Dictionary<string, string>

A map of arbitrary metadata entries returned by the policy simulator for this request.

MatchedStatements List<GetPrincipalPolicySimulationResultMatchedStatement>

A nested set of objects describing which policies contained statements that were relevant to this simulation request. Each object has attributes source_policy_id and source_policy_type to identify one of the policies.

MissingContextKeys List<string>

A set of context keys (or condition keys) that were needed by some of the policies contributing to this result but not specified using a context block in the configuration. Missing or incorrect context keys will typically cause a simulated request to be disallowed.

ResourceArn string

ARN of the resource that was used for this particular request. When you specify multiple actions and multiple resource ARNs, that causes a separate policy request for each combination of unique action and resource.

ActionName string

The name of the single IAM action used for this particular request.

Allowed bool

true if decision is "allowed", and false otherwise.

Decision string

The raw decision determined from all of the policies in scope; either "allowed", "explicitDeny", or "implicitDeny".

DecisionDetails map[string]string

A map of arbitrary metadata entries returned by the policy simulator for this request.

MatchedStatements []GetPrincipalPolicySimulationResultMatchedStatement

A nested set of objects describing which policies contained statements that were relevant to this simulation request. Each object has attributes source_policy_id and source_policy_type to identify one of the policies.

MissingContextKeys []string

A set of context keys (or condition keys) that were needed by some of the policies contributing to this result but not specified using a context block in the configuration. Missing or incorrect context keys will typically cause a simulated request to be disallowed.

ResourceArn string

ARN of the resource that was used for this particular request. When you specify multiple actions and multiple resource ARNs, that causes a separate policy request for each combination of unique action and resource.

actionName String

The name of the single IAM action used for this particular request.

allowed Boolean

true if decision is "allowed", and false otherwise.

decision String

The raw decision determined from all of the policies in scope; either "allowed", "explicitDeny", or "implicitDeny".

decisionDetails Map<String,String>

A map of arbitrary metadata entries returned by the policy simulator for this request.

matchedStatements List<GetPrincipalPolicySimulationResultMatchedStatement>

A nested set of objects describing which policies contained statements that were relevant to this simulation request. Each object has attributes source_policy_id and source_policy_type to identify one of the policies.

missingContextKeys List<String>

A set of context keys (or condition keys) that were needed by some of the policies contributing to this result but not specified using a context block in the configuration. Missing or incorrect context keys will typically cause a simulated request to be disallowed.

resourceArn String

ARN of the resource that was used for this particular request. When you specify multiple actions and multiple resource ARNs, that causes a separate policy request for each combination of unique action and resource.

actionName string

The name of the single IAM action used for this particular request.

allowed boolean

true if decision is "allowed", and false otherwise.

decision string

The raw decision determined from all of the policies in scope; either "allowed", "explicitDeny", or "implicitDeny".

decisionDetails {[key: string]: string}

A map of arbitrary metadata entries returned by the policy simulator for this request.

matchedStatements GetPrincipalPolicySimulationResultMatchedStatement[]

A nested set of objects describing which policies contained statements that were relevant to this simulation request. Each object has attributes source_policy_id and source_policy_type to identify one of the policies.

missingContextKeys string[]

A set of context keys (or condition keys) that were needed by some of the policies contributing to this result but not specified using a context block in the configuration. Missing or incorrect context keys will typically cause a simulated request to be disallowed.

resourceArn string

ARN of the resource that was used for this particular request. When you specify multiple actions and multiple resource ARNs, that causes a separate policy request for each combination of unique action and resource.

action_name str

The name of the single IAM action used for this particular request.

allowed bool

true if decision is "allowed", and false otherwise.

decision str

The raw decision determined from all of the policies in scope; either "allowed", "explicitDeny", or "implicitDeny".

decision_details Mapping[str, str]

A map of arbitrary metadata entries returned by the policy simulator for this request.

matched_statements Sequence[GetPrincipalPolicySimulationResultMatchedStatement]

A nested set of objects describing which policies contained statements that were relevant to this simulation request. Each object has attributes source_policy_id and source_policy_type to identify one of the policies.

missing_context_keys Sequence[str]

A set of context keys (or condition keys) that were needed by some of the policies contributing to this result but not specified using a context block in the configuration. Missing or incorrect context keys will typically cause a simulated request to be disallowed.

resource_arn str

ARN of the resource that was used for this particular request. When you specify multiple actions and multiple resource ARNs, that causes a separate policy request for each combination of unique action and resource.

actionName String

The name of the single IAM action used for this particular request.

allowed Boolean

true if decision is "allowed", and false otherwise.

decision String

The raw decision determined from all of the policies in scope; either "allowed", "explicitDeny", or "implicitDeny".

decisionDetails Map<String>

A map of arbitrary metadata entries returned by the policy simulator for this request.

matchedStatements List<Property Map>

A nested set of objects describing which policies contained statements that were relevant to this simulation request. Each object has attributes source_policy_id and source_policy_type to identify one of the policies.

missingContextKeys List<String>

A set of context keys (or condition keys) that were needed by some of the policies contributing to this result but not specified using a context block in the configuration. Missing or incorrect context keys will typically cause a simulated request to be disallowed.

resourceArn String

ARN of the resource that was used for this particular request. When you specify multiple actions and multiple resource ARNs, that causes a separate policy request for each combination of unique action and resource.

SourcePolicyId string

Identifier of one of the policies used as input to the simulation.

SourcePolicyType string

The type of the policy identified in source_policy_id.

SourcePolicyId string

Identifier of one of the policies used as input to the simulation.

SourcePolicyType string

The type of the policy identified in source_policy_id.

sourcePolicyId String

Identifier of one of the policies used as input to the simulation.

sourcePolicyType String

The type of the policy identified in source_policy_id.

sourcePolicyId string

Identifier of one of the policies used as input to the simulation.

sourcePolicyType string

The type of the policy identified in source_policy_id.

source_policy_id str

Identifier of one of the policies used as input to the simulation.

source_policy_type str

The type of the policy identified in source_policy_id.

sourcePolicyId String

Identifier of one of the policies used as input to the simulation.

sourcePolicyType String

The type of the policy identified in source_policy_id.