%% WARNING: DO NOT EDIT, AUTO-GENERATED CODE! %% See https://github.com/aws-beam/aws-codegen for more details. %% @doc AWS IAM Access Analyzer helps identify potential resource-access %% risks by enabling you to identify any policies that grant access to an %% external principal. %% %% It does this by using logic-based reasoning to analyze resource-based %% policies in your AWS environment. An external principal can be another AWS %% account, a root user, an IAM user or role, a federated user, an AWS %% service, or an anonymous user. This guide describes the AWS IAM Access %% Analyzer operations that you can call programmatically. For general %% information about Access Analyzer, see AWS IAM Access Analyzer in the IAM %% User Guide. %% %% To start using Access Analyzer, you first need to create an analyzer. -module(aws_accessanalyzer). -export([apply_archive_rule/2, apply_archive_rule/3, create_analyzer/2, create_analyzer/3, create_archive_rule/3, create_archive_rule/4, delete_analyzer/3, delete_analyzer/4, delete_archive_rule/4, delete_archive_rule/5, get_analyzed_resource/3, get_analyzed_resource/5, get_analyzed_resource/6, get_analyzer/2, get_analyzer/4, get_analyzer/5, get_archive_rule/3, get_archive_rule/5, get_archive_rule/6, get_finding/3, get_finding/5, get_finding/6, list_analyzed_resources/2, list_analyzed_resources/3, list_analyzers/1, list_analyzers/3, list_analyzers/4, list_archive_rules/2, list_archive_rules/4, list_archive_rules/5, list_findings/2, list_findings/3, list_tags_for_resource/2, list_tags_for_resource/4, list_tags_for_resource/5, start_resource_scan/2, start_resource_scan/3, tag_resource/3, tag_resource/4, untag_resource/3, untag_resource/4, update_archive_rule/4, update_archive_rule/5, update_findings/2, update_findings/3]). -include_lib("hackney/include/hackney_lib.hrl"). %%==================================================================== %% API %%==================================================================== %% @doc Retroactively applies the archive rule to existing findings that meet %% the archive rule criteria. apply_archive_rule(Client, Input) -> apply_archive_rule(Client, Input, []). apply_archive_rule(Client, Input0, Options0) -> Method = put, Path = ["/archive-rule"], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, Query_ = [], Input = Input2, request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %% @doc Creates an analyzer for your account. create_analyzer(Client, Input) -> create_analyzer(Client, Input, []). create_analyzer(Client, Input0, Options0) -> Method = put, Path = ["/analyzer"], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, Query_ = [], Input = Input2, request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %% @doc Creates an archive rule for the specified analyzer. %% %% Archive rules automatically archive new findings that meet the criteria %% you define when you create the rule. create_archive_rule(Client, AnalyzerName, Input) -> create_archive_rule(Client, AnalyzerName, Input, []). create_archive_rule(Client, AnalyzerName, Input0, Options0) -> Method = put, Path = ["/analyzer/", aws_util:encode_uri(AnalyzerName), "/archive-rule"], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, Query_ = [], Input = Input2, request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %% @doc Deletes the specified analyzer. %% %% When you delete an analyzer, Access Analyzer is disabled for the account %% or organization in the current or specific Region. All findings that were %% generated by the analyzer are deleted. You cannot undo this action. delete_analyzer(Client, AnalyzerName, Input) -> delete_analyzer(Client, AnalyzerName, Input, []). delete_analyzer(Client, AnalyzerName, Input0, Options0) -> Method = delete, Path = ["/analyzer/", aws_util:encode_uri(AnalyzerName), ""], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, QueryMapping = [ {<<"clientToken">>, <<"clientToken">>} ], {Query_, Input} = aws_request:build_headers(QueryMapping, Input2), request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %% @doc Deletes the specified archive rule. delete_archive_rule(Client, AnalyzerName, RuleName, Input) -> delete_archive_rule(Client, AnalyzerName, RuleName, Input, []). delete_archive_rule(Client, AnalyzerName, RuleName, Input0, Options0) -> Method = delete, Path = ["/analyzer/", aws_util:encode_uri(AnalyzerName), "/archive-rule/", aws_util:encode_uri(RuleName), ""], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, QueryMapping = [ {<<"clientToken">>, <<"clientToken">>} ], {Query_, Input} = aws_request:build_headers(QueryMapping, Input2), request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %% @doc Retrieves information about a resource that was analyzed. get_analyzed_resource(Client, AnalyzerArn, ResourceArn) when is_map(Client) -> get_analyzed_resource(Client, AnalyzerArn, ResourceArn, #{}, #{}). get_analyzed_resource(Client, AnalyzerArn, ResourceArn, QueryMap, HeadersMap) when is_map(Client), is_map(QueryMap), is_map(HeadersMap) -> get_analyzed_resource(Client, AnalyzerArn, ResourceArn, QueryMap, HeadersMap, []). get_analyzed_resource(Client, AnalyzerArn, ResourceArn, QueryMap, HeadersMap, Options0) when is_map(Client), is_map(QueryMap), is_map(HeadersMap), is_list(Options0) -> Path = ["/analyzed-resource"], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Query0_ = [ {<<"analyzerArn">>, AnalyzerArn}, {<<"resourceArn">>, ResourceArn} ], Query_ = [H || {_, V} = H <- Query0_, V =/= undefined], request(Client, get, Path, Query_, Headers, undefined, Options, SuccessStatusCode). %% @doc Retrieves information about the specified analyzer. get_analyzer(Client, AnalyzerName) when is_map(Client) -> get_analyzer(Client, AnalyzerName, #{}, #{}). get_analyzer(Client, AnalyzerName, QueryMap, HeadersMap) when is_map(Client), is_map(QueryMap), is_map(HeadersMap) -> get_analyzer(Client, AnalyzerName, QueryMap, HeadersMap, []). get_analyzer(Client, AnalyzerName, QueryMap, HeadersMap, Options0) when is_map(Client), is_map(QueryMap), is_map(HeadersMap), is_list(Options0) -> Path = ["/analyzer/", aws_util:encode_uri(AnalyzerName), ""], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Query_ = [], request(Client, get, Path, Query_, Headers, undefined, Options, SuccessStatusCode). %% @doc Retrieves information about an archive rule. %% %% To learn about filter keys that you can use to create an archive rule, see %% Access Analyzer filter keys in the IAM User Guide. get_archive_rule(Client, AnalyzerName, RuleName) when is_map(Client) -> get_archive_rule(Client, AnalyzerName, RuleName, #{}, #{}). get_archive_rule(Client, AnalyzerName, RuleName, QueryMap, HeadersMap) when is_map(Client), is_map(QueryMap), is_map(HeadersMap) -> get_archive_rule(Client, AnalyzerName, RuleName, QueryMap, HeadersMap, []). get_archive_rule(Client, AnalyzerName, RuleName, QueryMap, HeadersMap, Options0) when is_map(Client), is_map(QueryMap), is_map(HeadersMap), is_list(Options0) -> Path = ["/analyzer/", aws_util:encode_uri(AnalyzerName), "/archive-rule/", aws_util:encode_uri(RuleName), ""], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Query_ = [], request(Client, get, Path, Query_, Headers, undefined, Options, SuccessStatusCode). %% @doc Retrieves information about the specified finding. get_finding(Client, Id, AnalyzerArn) when is_map(Client) -> get_finding(Client, Id, AnalyzerArn, #{}, #{}). get_finding(Client, Id, AnalyzerArn, QueryMap, HeadersMap) when is_map(Client), is_map(QueryMap), is_map(HeadersMap) -> get_finding(Client, Id, AnalyzerArn, QueryMap, HeadersMap, []). get_finding(Client, Id, AnalyzerArn, QueryMap, HeadersMap, Options0) when is_map(Client), is_map(QueryMap), is_map(HeadersMap), is_list(Options0) -> Path = ["/finding/", aws_util:encode_uri(Id), ""], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Query0_ = [ {<<"analyzerArn">>, AnalyzerArn} ], Query_ = [H || {_, V} = H <- Query0_, V =/= undefined], request(Client, get, Path, Query_, Headers, undefined, Options, SuccessStatusCode). %% @doc Retrieves a list of resources of the specified type that have been %% analyzed by the specified analyzer.. list_analyzed_resources(Client, Input) -> list_analyzed_resources(Client, Input, []). list_analyzed_resources(Client, Input0, Options0) -> Method = post, Path = ["/analyzed-resource"], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, Query_ = [], Input = Input2, request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %% @doc Retrieves a list of analyzers. list_analyzers(Client) when is_map(Client) -> list_analyzers(Client, #{}, #{}). list_analyzers(Client, QueryMap, HeadersMap) when is_map(Client), is_map(QueryMap), is_map(HeadersMap) -> list_analyzers(Client, QueryMap, HeadersMap, []). list_analyzers(Client, QueryMap, HeadersMap, Options0) when is_map(Client), is_map(QueryMap), is_map(HeadersMap), is_list(Options0) -> Path = ["/analyzer"], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Query0_ = [ {<<"maxResults">>, maps:get(<<"maxResults">>, QueryMap, undefined)}, {<<"nextToken">>, maps:get(<<"nextToken">>, QueryMap, undefined)}, {<<"type">>, maps:get(<<"type">>, QueryMap, undefined)} ], Query_ = [H || {_, V} = H <- Query0_, V =/= undefined], request(Client, get, Path, Query_, Headers, undefined, Options, SuccessStatusCode). %% @doc Retrieves a list of archive rules created for the specified analyzer. list_archive_rules(Client, AnalyzerName) when is_map(Client) -> list_archive_rules(Client, AnalyzerName, #{}, #{}). list_archive_rules(Client, AnalyzerName, QueryMap, HeadersMap) when is_map(Client), is_map(QueryMap), is_map(HeadersMap) -> list_archive_rules(Client, AnalyzerName, QueryMap, HeadersMap, []). list_archive_rules(Client, AnalyzerName, QueryMap, HeadersMap, Options0) when is_map(Client), is_map(QueryMap), is_map(HeadersMap), is_list(Options0) -> Path = ["/analyzer/", aws_util:encode_uri(AnalyzerName), "/archive-rule"], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Query0_ = [ {<<"maxResults">>, maps:get(<<"maxResults">>, QueryMap, undefined)}, {<<"nextToken">>, maps:get(<<"nextToken">>, QueryMap, undefined)} ], Query_ = [H || {_, V} = H <- Query0_, V =/= undefined], request(Client, get, Path, Query_, Headers, undefined, Options, SuccessStatusCode). %% @doc Retrieves a list of findings generated by the specified analyzer. %% %% To learn about filter keys that you can use to create an archive rule, see %% Access Analyzer filter keys in the IAM User Guide. list_findings(Client, Input) -> list_findings(Client, Input, []). list_findings(Client, Input0, Options0) -> Method = post, Path = ["/finding"], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, Query_ = [], Input = Input2, request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %% @doc Retrieves a list of tags applied to the specified resource. list_tags_for_resource(Client, ResourceArn) when is_map(Client) -> list_tags_for_resource(Client, ResourceArn, #{}, #{}). list_tags_for_resource(Client, ResourceArn, QueryMap, HeadersMap) when is_map(Client), is_map(QueryMap), is_map(HeadersMap) -> list_tags_for_resource(Client, ResourceArn, QueryMap, HeadersMap, []). list_tags_for_resource(Client, ResourceArn, QueryMap, HeadersMap, Options0) when is_map(Client), is_map(QueryMap), is_map(HeadersMap), is_list(Options0) -> Path = ["/tags/", aws_util:encode_uri(ResourceArn), ""], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Query_ = [], request(Client, get, Path, Query_, Headers, undefined, Options, SuccessStatusCode). %% @doc Immediately starts a scan of the policies applied to the specified %% resource. start_resource_scan(Client, Input) -> start_resource_scan(Client, Input, []). start_resource_scan(Client, Input0, Options0) -> Method = post, Path = ["/resource/scan"], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, Query_ = [], Input = Input2, request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %% @doc Adds a tag to the specified resource. tag_resource(Client, ResourceArn, Input) -> tag_resource(Client, ResourceArn, Input, []). tag_resource(Client, ResourceArn, Input0, Options0) -> Method = post, Path = ["/tags/", aws_util:encode_uri(ResourceArn), ""], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, Query_ = [], Input = Input2, request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %% @doc Removes a tag from the specified resource. untag_resource(Client, ResourceArn, Input) -> untag_resource(Client, ResourceArn, Input, []). untag_resource(Client, ResourceArn, Input0, Options0) -> Method = delete, Path = ["/tags/", aws_util:encode_uri(ResourceArn), ""], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, QueryMapping = [ {<<"tagKeys">>, <<"tagKeys">>} ], {Query_, Input} = aws_request:build_headers(QueryMapping, Input2), request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %% @doc Updates the criteria and values for the specified archive rule. update_archive_rule(Client, AnalyzerName, RuleName, Input) -> update_archive_rule(Client, AnalyzerName, RuleName, Input, []). update_archive_rule(Client, AnalyzerName, RuleName, Input0, Options0) -> Method = put, Path = ["/analyzer/", aws_util:encode_uri(AnalyzerName), "/archive-rule/", aws_util:encode_uri(RuleName), ""], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, Query_ = [], Input = Input2, request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %% @doc Updates the status for the specified findings. update_findings(Client, Input) -> update_findings(Client, Input, []). update_findings(Client, Input0, Options0) -> Method = put, Path = ["/finding"], SuccessStatusCode = 200, Options = [{send_body_as_binary, false}, {receive_body_as_binary, false} | Options0], Headers = [], Input1 = Input0, CustomHeaders = [], Input2 = Input1, Query_ = [], Input = Input2, request(Client, Method, Path, Query_, CustomHeaders ++ Headers, Input, Options, SuccessStatusCode). %%==================================================================== %% Internal functions %%==================================================================== -spec request(aws_client:aws_client(), atom(), iolist(), list(), list(), map() | undefined, list(), pos_integer() | undefined) -> {ok, Result, {integer(), list(), hackney:client()}} | {error, Error, {integer(), list(), hackney:client()}} | {error, term()} when Result :: map(), Error :: map(). request(Client, Method, Path, Query, Headers0, Input, Options, SuccessStatusCode) -> Client1 = Client#{service => <<"access-analyzer">>}, Host = build_host(<<"access-analyzer">>, Client1), URL0 = build_url(Host, Path, Client1), URL = aws_request:add_query(URL0, Query), AdditionalHeaders = [ {<<"Host">>, Host} , {<<"Content-Type">>, <<"application/x-amz-json-1.1">>} ], Headers1 = aws_request:add_headers(AdditionalHeaders, Headers0), Payload = case proplists:get_value(send_body_as_binary, Options) of true -> maps:get(<<"Body">>, Input, <<"">>); false -> encode_payload(Input) end, MethodBin = aws_request:method_to_binary(Method), SignedHeaders = aws_request:sign_request(Client1, MethodBin, URL, Headers1, Payload), Response = hackney:request(Method, URL, SignedHeaders, Payload, Options), DecodeBody = not proplists:get_value(receive_body_as_binary, Options), handle_response(Response, SuccessStatusCode, DecodeBody). handle_response({ok, StatusCode, ResponseHeaders, Client}, SuccessStatusCode, DecodeBody) when StatusCode =:= 200; StatusCode =:= 202; StatusCode =:= 204; StatusCode =:= SuccessStatusCode -> case hackney:body(Client) of {ok, <<>>} when StatusCode =:= 200; StatusCode =:= SuccessStatusCode -> {ok, #{}, {StatusCode, ResponseHeaders, Client}}; {ok, Body} -> Result = case DecodeBody of true -> jsx:decode(Body); false -> #{<<"Body">> => Body} end, {ok, Result, {StatusCode, ResponseHeaders, Client}} end; handle_response({ok, StatusCode, ResponseHeaders, Client}, _, _DecodeBody) -> {ok, Body} = hackney:body(Client), Error = jsx:decode(Body), {error, Error, {StatusCode, ResponseHeaders, Client}}; handle_response({error, Reason}, _, _DecodeBody) -> {error, Reason}. build_host(_EndpointPrefix, #{region := <<"local">>, endpoint := Endpoint}) -> Endpoint; build_host(_EndpointPrefix, #{region := <<"local">>}) -> <<"localhost">>; build_host(EndpointPrefix, #{region := Region, endpoint := Endpoint}) -> aws_util:binary_join([EndpointPrefix, Region, Endpoint], <<".">>). build_url(Host, Path0, Client) -> Proto = maps:get(proto, Client), Path = erlang:iolist_to_binary(Path0), Port = maps:get(port, Client), aws_util:binary_join([Proto, <<"://">>, Host, <<":">>, Port, Path], <<"">>). -spec encode_payload(undefined | map()) -> binary(). encode_payload(undefined) -> <<>>; encode_payload(Input) -> jsx:encode(Input).