Amazonka.SecretsManager.ValidateResourcePolicy

Validates that a resource policy does not grant a wide range of principals access to your secret. A resource-based policy is optional for secrets.

The API performs three checks when validating the policy:

• Sends a call to Zelkova, an automated reasoning engine, to ensure your resource policy does not allow broad access to your secret, for example policies that use a wildcard for the principal.
• Checks for correct syntax in a policy.
• Verifies the policy does not lock out a caller.

Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail.

Required permissions: secretsmanager:ValidateResourcePolicy. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.

Creating a Request

data ValidateResourcePolicy

See: newValidateResourcePolicy smart constructor.

Constructors

ValidateResourcePolicy'

Fields

• secretId :: Maybe Text

  This field is reserved for internal use.

• resourcePolicy :: Text

  A JSON-formatted string that contains an Amazon Web Services resource-based policy. The policy in the string identifies who can access or manage this secret and its versions. For example policies, see Permissions policy examples.

Instances

ToJSON ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

toJSON :: ValidateResourcePolicy -> Value

toEncoding :: ValidateResourcePolicy -> Encoding

toJSONList :: [ValidateResourcePolicy] -> Value

toEncodingList :: [ValidateResourcePolicy] -> Encoding

ToHeaders ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

toHeaders :: ValidateResourcePolicy -> [Header]

ToPath ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

toPath :: ValidateResourcePolicy -> ByteString

ToQuery ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

toQuery :: ValidateResourcePolicy -> QueryString

AWSRequest ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Associated Types

type AWSResponse ValidateResourcePolicy

Methods

request :: (Service -> Service) -> ValidateResourcePolicy -> Request ValidateResourcePolicy

response :: MonadResource m => (ByteStringLazy -> IO ByteStringLazy) -> Service -> Proxy ValidateResourcePolicy -> ClientResponse ClientBody -> m (Either Error (ClientResponse (AWSResponse ValidateResourcePolicy)))

Generic ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Associated Types

type Rep ValidateResourcePolicy :: Type -> Type

Methods

from :: ValidateResourcePolicy -> Rep ValidateResourcePolicy x

to :: Rep ValidateResourcePolicy x -> ValidateResourcePolicy

Read ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

readsPrec :: Int -> ReadS ValidateResourcePolicy

readList :: ReadS [ValidateResourcePolicy]

readPrec :: ReadPrec ValidateResourcePolicy

readListPrec :: ReadPrec [ValidateResourcePolicy]

Show ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

showsPrec :: Int -> ValidateResourcePolicy -> ShowS

show :: ValidateResourcePolicy -> String

showList :: [ValidateResourcePolicy] -> ShowS

NFData ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

rnf :: ValidateResourcePolicy -> ()

Eq ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

(==) :: ValidateResourcePolicy -> ValidateResourcePolicy -> Bool

(/=) :: ValidateResourcePolicy -> ValidateResourcePolicy -> Bool

Hashable ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

hashWithSalt :: Int -> ValidateResourcePolicy -> Int

hash :: ValidateResourcePolicy -> Int

type AWSResponse ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

type AWSResponse ValidateResourcePolicy = ValidateResourcePolicyResponse

type Rep ValidateResourcePolicy

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

type Rep ValidateResourcePolicy = D1 ('MetaData "ValidateResourcePolicy" "Amazonka.SecretsManager.ValidateResourcePolicy" "amazonka-secretsmanager-2.0-8tljeZ4CwL92E7JavkDb0o" 'False) (C1 ('MetaCons "ValidateResourcePolicy'" 'PrefixI 'True) (S1 ('MetaSel ('Just "secretId") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "resourcePolicy") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text)))

newValidateResourcePolicy

Arguments

:: Text

$sel:resourcePolicy:ValidateResourcePolicy'

-> ValidateResourcePolicy

Create a value of ValidateResourcePolicy with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:secretId:ValidateResourcePolicy', validateResourcePolicy_secretId - This field is reserved for internal use.

$sel:resourcePolicy:ValidateResourcePolicy', validateResourcePolicy_resourcePolicy - A JSON-formatted string that contains an Amazon Web Services resource-based policy. The policy in the string identifies who can access or manage this secret and its versions. For example policies, see Permissions policy examples.

Request Lenses

validateResourcePolicy_secretId :: Lens' ValidateResourcePolicy (Maybe Text)

This field is reserved for internal use.

validateResourcePolicy_resourcePolicy :: Lens' ValidateResourcePolicy Text

A JSON-formatted string that contains an Amazon Web Services resource-based policy. The policy in the string identifies who can access or manage this secret and its versions. For example policies, see Permissions policy examples.

Destructuring the Response

data ValidateResourcePolicyResponse

See: newValidateResourcePolicyResponse smart constructor.

Constructors

ValidateResourcePolicyResponse'

Fields

• policyValidationPassed :: Maybe Bool

  True if your policy passes validation, otherwise false.

• validationErrors :: Maybe [ValidationErrorsEntry]

  Validation errors if your policy didn't pass validation.

• httpStatus :: Int

  The response's http status code.

Instances

Generic ValidateResourcePolicyResponse

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Associated Types

type Rep ValidateResourcePolicyResponse :: Type -> Type

Methods

from :: ValidateResourcePolicyResponse -> Rep ValidateResourcePolicyResponse x

to :: Rep ValidateResourcePolicyResponse x -> ValidateResourcePolicyResponse

Read ValidateResourcePolicyResponse

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

readsPrec :: Int -> ReadS ValidateResourcePolicyResponse

readList :: ReadS [ValidateResourcePolicyResponse]

readPrec :: ReadPrec ValidateResourcePolicyResponse

readListPrec :: ReadPrec [ValidateResourcePolicyResponse]

Show ValidateResourcePolicyResponse

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

showsPrec :: Int -> ValidateResourcePolicyResponse -> ShowS

show :: ValidateResourcePolicyResponse -> String

showList :: [ValidateResourcePolicyResponse] -> ShowS

NFData ValidateResourcePolicyResponse

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

rnf :: ValidateResourcePolicyResponse -> ()

Eq ValidateResourcePolicyResponse

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

Methods

(==) :: ValidateResourcePolicyResponse -> ValidateResourcePolicyResponse -> Bool

(/=) :: ValidateResourcePolicyResponse -> ValidateResourcePolicyResponse -> Bool

type Rep ValidateResourcePolicyResponse

Defined in Amazonka.SecretsManager.ValidateResourcePolicy

type Rep ValidateResourcePolicyResponse = D1 ('MetaData "ValidateResourcePolicyResponse" "Amazonka.SecretsManager.ValidateResourcePolicy" "amazonka-secretsmanager-2.0-8tljeZ4CwL92E7JavkDb0o" 'False) (C1 ('MetaCons "ValidateResourcePolicyResponse'" 'PrefixI 'True) (S1 ('MetaSel ('Just "policyValidationPassed") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Bool)) :*: (S1 ('MetaSel ('Just "validationErrors") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe [ValidationErrorsEntry])) :*: S1 ('MetaSel ('Just "httpStatus") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Int))))

newValidateResourcePolicyResponse

Arguments

:: Int

$sel:httpStatus:ValidateResourcePolicyResponse'

-> ValidateResourcePolicyResponse

Create a value of ValidateResourcePolicyResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:policyValidationPassed:ValidateResourcePolicyResponse', validateResourcePolicyResponse_policyValidationPassed - True if your policy passes validation, otherwise false.

$sel:validationErrors:ValidateResourcePolicyResponse', validateResourcePolicyResponse_validationErrors - Validation errors if your policy didn't pass validation.

$sel:httpStatus:ValidateResourcePolicyResponse', validateResourcePolicyResponse_httpStatus - The response's http status code.

Response Lenses

validateResourcePolicyResponse_policyValidationPassed :: Lens' ValidateResourcePolicyResponse (Maybe Bool)

True if your policy passes validation, otherwise false.

validateResourcePolicyResponse_validationErrors :: Lens' ValidateResourcePolicyResponse (Maybe [ValidationErrorsEntry])

Validation errors if your policy didn't pass validation.

validateResourcePolicyResponse_httpStatus :: Lens' ValidateResourcePolicyResponse Int

The response's http status code.