amazonka-iam 1.3.5 → 1.3.6

raw patch · 9 files changed

+276/−53 lines, 9 filesdep ~amazonka-coredep ~amazonka-iamdep ~amazonka-testPVP: major bump suggested

API removals or changes: PVP suggests a major version bump

Dependency ranges changed: amazonka-core, amazonka-iam, amazonka-test

API changes (from Hackage documentation)

Files

• README.md +1/−1
• amazonka-iam.cabal +5/−5
• gen/Network/AWS/IAM.hs +11/−1
• gen/Network/AWS/IAM/GetContextKeysForCustomPolicy.hs +2/−1
• gen/Network/AWS/IAM/ListAccountAliases.hs +4/−6
• gen/Network/AWS/IAM/SimulateCustomPolicy.hs +61/−9
• gen/Network/AWS/IAM/SimulatePrincipalPolicy.hs +62/−10
• gen/Network/AWS/IAM/Types.hs +11/−1
• gen/Network/AWS/IAM/Types/Product.hs +119/−19

@@ -8,7 +8,7 @@  ## Version -`1.3.5`+`1.3.6`   ## Description

@@ -1,5 +1,5 @@ name:                  amazonka-iam-version:               1.3.5+version:               1.3.6 synopsis:              Amazon Identity and Access Management SDK. homepage:              https://github.com/brendanhay/amazonka bug-reports:           https://github.com/brendanhay/amazonka/issues@@ -219,7 +219,7 @@         , Network.AWS.IAM.Types.Sum      build-depends:-          amazonka-core == 1.3.5.*+          amazonka-core == 1.3.6.*         , base          >= 4.7     && < 5  test-suite amazonka-iam-test@@ -239,9 +239,9 @@         , Test.AWS.IAM.Internal      build-depends:-          amazonka-core == 1.3.5.*-        , amazonka-test == 1.3.5.*-        , amazonka-iam == 1.3.5.*+          amazonka-core == 1.3.6.*+        , amazonka-test == 1.3.6.*+        , amazonka-iam == 1.3.6.*         , base         , bytestring         , lens

@@ -573,9 +573,10 @@     , evaluationResult     , erMatchedStatements     , erEvalDecisionDetails+    , erResourceSpecificResults+    , erEvalResourceName     , erMissingContextValues     , erEvalActionName-    , erEvalResourceName     , erEvalDecision      -- ** GetContextKeysForPolicyResponse@@ -709,6 +710,15 @@     , position     , pLine     , pColumn++    -- ** ResourceSpecificResult+    , ResourceSpecificResult+    , resourceSpecificResult+    , rsrMatchedStatements+    , rsrEvalDecisionDetails+    , rsrMissingContextValues+    , rsrEvalResourceName+    , rsrEvalResourceDecision      -- ** Role     , Role

@@ -71,7 +71,8 @@     }  -- | A list of policies for which you want list of context keys used in--- 'Condition' elements.+-- 'Condition' elements. Each document is specified as a string containing+-- the complete, valid JSON text of an IAM policy. gckfcpPolicyInputList :: Lens' GetContextKeysForCustomPolicy [Text] gckfcpPolicyInputList = lens _gckfcpPolicyInputList (\ s a -> s{_gckfcpPolicyInputList = a}) . _Coerce; 

@@ -18,14 +18,11 @@ -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Lists the account aliases associated with the account. For information--- about using an AWS account alias, see+-- Lists the account alias associated with the account (Note: you can have+-- only one). For information about using an AWS account alias, see -- <http://docs.aws.amazon.com/IAM/latest/UserGuide/AccountAlias.html Using an Alias for Your AWS Account ID> -- in the /IAM User Guide/. ----- You can paginate the results using the 'MaxItems' and 'Marker'--- parameters.--- -- /See:/ <http://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccountAliases.html AWS API Reference> for ListAccountAliases. -- -- This operation returns paginated results.@@ -181,6 +178,7 @@ laarsResponseStatus :: Lens' ListAccountAliasesResponse Int laarsResponseStatus = lens _laarsResponseStatus (\ s a -> s{_laarsResponseStatus = a}); --- | A list of aliases associated with the account.+-- | A list of aliases associated with the account. AWS supports only one+-- alias per account. laarsAccountAliases :: Lens' ListAccountAliasesResponse [Text] laarsAccountAliases = lens _laarsAccountAliases (\ s a -> s{_laarsAccountAliases = a}) . _Coerce;

@@ -48,6 +48,7 @@     -- * Request Lenses     , scpResourcePolicy     , scpCallerARN+    , scpResourceHandlingOption     , scpResourceARNs     , scpMarker     , scpMaxItems@@ -73,15 +74,16 @@  -- | /See:/ 'simulateCustomPolicy' smart constructor. data SimulateCustomPolicy = SimulateCustomPolicy'-    { _scpResourcePolicy  :: !(Maybe Text)-    , _scpCallerARN       :: !(Maybe Text)-    , _scpResourceARNs    :: !(Maybe [Text])-    , _scpMarker          :: !(Maybe Text)-    , _scpMaxItems        :: !(Maybe Nat)-    , _scpContextEntries  :: !(Maybe [ContextEntry])-    , _scpResourceOwner   :: !(Maybe Text)-    , _scpPolicyInputList :: ![Text]-    , _scpActionNames     :: ![Text]+    { _scpResourcePolicy         :: !(Maybe Text)+    , _scpCallerARN              :: !(Maybe Text)+    , _scpResourceHandlingOption :: !(Maybe Text)+    , _scpResourceARNs           :: !(Maybe [Text])+    , _scpMarker                 :: !(Maybe Text)+    , _scpMaxItems               :: !(Maybe Nat)+    , _scpContextEntries         :: !(Maybe [ContextEntry])+    , _scpResourceOwner          :: !(Maybe Text)+    , _scpPolicyInputList        :: ![Text]+    , _scpActionNames            :: ![Text]     } deriving (Eq,Read,Show,Data,Typeable,Generic)  -- | Creates a value of 'SimulateCustomPolicy' with the minimum fields required to make a request.@@ -92,6 +94,8 @@ -- -- * 'scpCallerARN' --+-- * 'scpResourceHandlingOption'+-- -- * 'scpResourceARNs' -- -- * 'scpMarker'@@ -111,6 +115,7 @@     SimulateCustomPolicy'     { _scpResourcePolicy = Nothing     , _scpCallerARN = Nothing+    , _scpResourceHandlingOption = Nothing     , _scpResourceARNs = Nothing     , _scpMarker = Nothing     , _scpMaxItems = Nothing@@ -137,6 +142,51 @@ scpCallerARN :: Lens' SimulateCustomPolicy (Maybe Text) scpCallerARN = lens _scpCallerARN (\ s a -> s{_scpCallerARN = a}); +-- | Specifies the type of simulation to run. Different APIs that support+-- resource-based policies require different combinations of resources. By+-- specifying the type of simulation to run, you enable the policy+-- simulator to enforce the presence of the required resources to ensure+-- reliable simulation results. If your simulation does not match one of+-- the following scenarios, then you can omit this parameter. The following+-- list shows each of the supported scenario values and the resources that+-- you must define to run the simulation.+--+-- Each of the EC2 scenarios requires that you specify instance, image, and+-- security-group resources. If your scenario includes an EBS volume, then+-- you must specify that volume as a resource. If the EC2 scenario includes+-- VPC, then you must supply the network-interface resource. If it includes+-- an IP subnet, then you must specify the subnet resource. For more+-- information on the EC2 scenario options, see+-- <http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-supported-platforms.html Supported Platforms>+-- in the /AWS EC2 User Guide/.+--+-- -   __EC2-Classic-InstanceStore__+--+--     instance, image, security-group+--+-- -   __EC2-Classic-EBS__+--+--     instance, image, security-group, volume+--+-- -   __EC2-VPC-InstanceStore__+--+--     instance, image, security-group, network-interface+--+-- -   __EC2-VPC-InstanceStore-Subnet__+--+--     instance, image, security-group, network-interface, subnet+--+-- -   __EC2-VPC-EBS__+--+--     instance, image, security-group, network-interface, volume+--+-- -   __EC2-VPC-EBS-Subnet__+--+--     instance, image, security-group, network-interface, subnet, volume+--+scpResourceHandlingOption :: Lens' SimulateCustomPolicy (Maybe Text)+scpResourceHandlingOption = lens _scpResourceHandlingOption (\ s a -> s{_scpResourceHandlingOption = a});+ -- | A list of ARNs of AWS resources to include in the simulation. If this -- parameter is not provided then the value defaults to '*' (all -- resources). Each API in the 'ActionNames' parameter is evaluated for@@ -233,6 +283,8 @@                "Version" =: ("2010-05-08" :: ByteString),                "ResourcePolicy" =: _scpResourcePolicy,                "CallerArn" =: _scpCallerARN,+               "ResourceHandlingOption" =:+                 _scpResourceHandlingOption,                "ResourceArns" =:                  toQuery (toQueryList "member" <$> _scpResourceARNs),                "Marker" =: _scpMarker, "MaxItems" =: _scpMaxItems,

@@ -60,6 +60,7 @@     , sppPolicyInputList     , sppResourcePolicy     , sppCallerARN+    , sppResourceHandlingOption     , sppResourceARNs     , sppMarker     , sppMaxItems@@ -85,16 +86,17 @@  -- | /See:/ 'simulatePrincipalPolicy' smart constructor. data SimulatePrincipalPolicy = SimulatePrincipalPolicy'-    { _sppPolicyInputList :: !(Maybe [Text])-    , _sppResourcePolicy  :: !(Maybe Text)-    , _sppCallerARN       :: !(Maybe Text)-    , _sppResourceARNs    :: !(Maybe [Text])-    , _sppMarker          :: !(Maybe Text)-    , _sppMaxItems        :: !(Maybe Nat)-    , _sppContextEntries  :: !(Maybe [ContextEntry])-    , _sppResourceOwner   :: !(Maybe Text)-    , _sppPolicySourceARN :: !Text-    , _sppActionNames     :: ![Text]+    { _sppPolicyInputList        :: !(Maybe [Text])+    , _sppResourcePolicy         :: !(Maybe Text)+    , _sppCallerARN              :: !(Maybe Text)+    , _sppResourceHandlingOption :: !(Maybe Text)+    , _sppResourceARNs           :: !(Maybe [Text])+    , _sppMarker                 :: !(Maybe Text)+    , _sppMaxItems               :: !(Maybe Nat)+    , _sppContextEntries         :: !(Maybe [ContextEntry])+    , _sppResourceOwner          :: !(Maybe Text)+    , _sppPolicySourceARN        :: !Text+    , _sppActionNames            :: ![Text]     } deriving (Eq,Read,Show,Data,Typeable,Generic)  -- | Creates a value of 'SimulatePrincipalPolicy' with the minimum fields required to make a request.@@ -107,6 +109,8 @@ -- -- * 'sppCallerARN' --+-- * 'sppResourceHandlingOption'+-- -- * 'sppResourceARNs' -- -- * 'sppMarker'@@ -128,6 +132,7 @@     { _sppPolicyInputList = Nothing     , _sppResourcePolicy = Nothing     , _sppCallerARN = Nothing+    , _sppResourceHandlingOption = Nothing     , _sppResourceARNs = Nothing     , _sppMarker = Nothing     , _sppMaxItems = Nothing@@ -168,6 +173,51 @@ sppCallerARN :: Lens' SimulatePrincipalPolicy (Maybe Text) sppCallerARN = lens _sppCallerARN (\ s a -> s{_sppCallerARN = a}); +-- | Specifies the type of simulation to run. Different APIs that support+-- resource-based policies require different combinations of resources. By+-- specifying the type of simulation to run, you enable the policy+-- simulator to enforce the presence of the required resources to ensure+-- reliable simulation results. If your simulation does not match one of+-- the following scenarios, then you can omit this parameter. The following+-- list shows each of the supported scenario values and the resources that+-- you must define to run the simulation.+--+-- Each of the EC2 scenarios requires that you specify instance, image, and+-- security-group resources. If your scenario includes an EBS volume, then+-- you must specify that volume as a resource. If the EC2 scenario includes+-- VPC, then you must supply the network-interface resource. If it includes+-- an IP subnet, then you must specify the subnet resource. For more+-- information on the EC2 scenario options, see+-- <http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-supported-platforms.html Supported Platforms>+-- in the /AWS EC2 User Guide/.+--+-- -   __EC2-Classic-InstanceStore__+--+--     instance, image, security-group+--+-- -   __EC2-Classic-EBS__+--+--     instance, image, security-group, volume+--+-- -   __EC2-VPC-InstanceStore__+--+--     instance, image, security-group, network-interface+--+-- -   __EC2-VPC-InstanceStore-Subnet__+--+--     instance, image, security-group, network-interface, subnet+--+-- -   __EC2-VPC-EBS__+--+--     instance, image, security-group, network-interface, volume+--+-- -   __EC2-VPC-EBS-Subnet__+--+--     instance, image, security-group, network-interface, subnet, volume+--+sppResourceHandlingOption :: Lens' SimulatePrincipalPolicy (Maybe Text)+sppResourceHandlingOption = lens _sppResourceHandlingOption (\ s a -> s{_sppResourceHandlingOption = a});+ -- | A list of ARNs of AWS resources to include in the simulation. If this -- parameter is not provided then the value defaults to '*' (all -- resources). Each API in the 'ActionNames' parameter is evaluated for@@ -258,6 +308,8 @@                    (toQueryList "member" <$> _sppPolicyInputList),                "ResourcePolicy" =: _sppResourcePolicy,                "CallerArn" =: _sppCallerARN,+               "ResourceHandlingOption" =:+                 _sppResourceHandlingOption,                "ResourceArns" =:                  toQuery (toQueryList "member" <$> _sppResourceARNs),                "Marker" =: _sppMarker, "MaxItems" =: _sppMaxItems,

@@ -114,9 +114,10 @@     , evaluationResult     , erMatchedStatements     , erEvalDecisionDetails+    , erResourceSpecificResults+    , erEvalResourceName     , erMissingContextValues     , erEvalActionName-    , erEvalResourceName     , erEvalDecision      -- * GetContextKeysForPolicyResponse@@ -250,6 +251,15 @@     , position     , pLine     , pColumn++    -- * ResourceSpecificResult+    , ResourceSpecificResult+    , resourceSpecificResult+    , rsrMatchedStatements+    , rsrEvalDecisionDetails+    , rsrMissingContextValues+    , rsrEvalResourceName+    , rsrEvalResourceDecision      -- * Role     , Role

@@ -344,12 +344,13 @@ -- -- /See:/ 'evaluationResult' smart constructor. data EvaluationResult = EvaluationResult'-    { _erMatchedStatements    :: !(Maybe [Statement])-    , _erEvalDecisionDetails  :: !(Maybe (Map Text PolicyEvaluationDecisionType))-    , _erMissingContextValues :: !(Maybe [Text])-    , _erEvalActionName       :: !Text-    , _erEvalResourceName     :: !Text-    , _erEvalDecision         :: !PolicyEvaluationDecisionType+    { _erMatchedStatements       :: !(Maybe [Statement])+    , _erEvalDecisionDetails     :: !(Maybe (Map Text PolicyEvaluationDecisionType))+    , _erResourceSpecificResults :: !(Maybe [ResourceSpecificResult])+    , _erEvalResourceName        :: !(Maybe Text)+    , _erMissingContextValues    :: !(Maybe [Text])+    , _erEvalActionName          :: !Text+    , _erEvalDecision            :: !PolicyEvaluationDecisionType     } deriving (Eq,Read,Show,Data,Typeable,Generic)  -- | Creates a value of 'EvaluationResult' with the minimum fields required to make a request.@@ -360,25 +361,27 @@ -- -- * 'erEvalDecisionDetails' --+-- * 'erResourceSpecificResults'+--+-- * 'erEvalResourceName'+-- -- * 'erMissingContextValues' -- -- * 'erEvalActionName' ----- * 'erEvalResourceName'--- -- * 'erEvalDecision' evaluationResult     :: Text -- ^ 'erEvalActionName'-    -> Text -- ^ 'erEvalResourceName'     -> PolicyEvaluationDecisionType -- ^ 'erEvalDecision'     -> EvaluationResult-evaluationResult pEvalActionName_ pEvalResourceName_ pEvalDecision_ =+evaluationResult pEvalActionName_ pEvalDecision_ =     EvaluationResult'     { _erMatchedStatements = Nothing     , _erEvalDecisionDetails = Nothing+    , _erResourceSpecificResults = Nothing+    , _erEvalResourceName = Nothing     , _erMissingContextValues = Nothing     , _erEvalActionName = pEvalActionName_-    , _erEvalResourceName = pEvalResourceName_     , _erEvalDecision = pEvalDecision_     } @@ -395,10 +398,20 @@ -- explains how each set of policies contributes to the final evaluation -- decision. When simulating cross-account access to a resource, both the -- resource-based policy and the caller\'s IAM policy must grant access.--- See How IAM Roles Differ from Resource-based Policies+-- See+-- <http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_compare-resource-policies.html How IAM Roles Differ from Resource-based Policies> erEvalDecisionDetails :: Lens' EvaluationResult (HashMap Text PolicyEvaluationDecisionType) erEvalDecisionDetails = lens _erEvalDecisionDetails (\ s a -> s{_erEvalDecisionDetails = a}) . _Default . _Map; +-- | The individual results of the simulation of the API action specified in+-- EvalActionName on each resource.+erResourceSpecificResults :: Lens' EvaluationResult [ResourceSpecificResult]+erResourceSpecificResults = lens _erResourceSpecificResults (\ s a -> s{_erResourceSpecificResults = a}) . _Default . _Coerce;++-- | The ARN of the resource that the indicated API action was tested on.+erEvalResourceName :: Lens' EvaluationResult (Maybe Text)+erEvalResourceName = lens _erEvalResourceName (\ s a -> s{_erEvalResourceName = a});+ -- | A list of context keys that are required by the included input policies -- but that were not provided by one of the input parameters. To discover -- the context keys used by a set of policies, you can call@@ -415,10 +428,6 @@ erEvalActionName :: Lens' EvaluationResult Text erEvalActionName = lens _erEvalActionName (\ s a -> s{_erEvalActionName = a}); --- | The ARN of the resource that the indicated API action was tested on.-erEvalResourceName :: Lens' EvaluationResult Text-erEvalResourceName = lens _erEvalResourceName (\ s a -> s{_erEvalResourceName = a});- -- | The result of the simulation. erEvalDecision :: Lens' EvaluationResult PolicyEvaluationDecisionType erEvalDecision = lens _erEvalDecision (\ s a -> s{_erEvalDecision = a});@@ -432,10 +441,13 @@                 (x .@? "EvalDecisionDetails" .!@ mempty >>=                    may (parseXMLMap "entry" "key" "value"))                 <*>+                (x .@? "ResourceSpecificResults" .!@ mempty >>=+                   may (parseXMLList "member"))+                <*> (x .@? "EvalResourceName")+                <*>                 (x .@? "MissingContextValues" .!@ mempty >>=                    may (parseXMLList "member"))                 <*> (x .@ "EvalActionName")-                <*> (x .@ "EvalResourceName")                 <*> (x .@ "EvalDecision")  -- | Contains the response to a successful GetContextKeysForPrincipalPolicy@@ -1089,8 +1101,9 @@     , _ppAllowUsersToChangePassword = Nothing     } --- | Specifies whether IAM users are required to change their password after--- a specified number of days.+-- | Indicates whether passwords in the account expire. Returns true if+-- MaxPasswordAge is contains a value greater than 0. Returns false if+-- MaxPasswordAge is 0 or not present. ppExpirePasswords :: Lens' PasswordPolicy (Maybe Bool) ppExpirePasswords = lens _ppExpirePasswords (\ s a -> s{_ppExpirePasswords = a}); @@ -1534,6 +1547,93 @@ instance FromXML Position where         parseXML x           = Position' <$> (x .@? "Line") <*> (x .@? "Column")++-- | Contains the result of the simulation of a single API action call on a+-- single resource.+--+-- This data type is used by a member of the EvaluationResult data type.+--+-- /See:/ 'resourceSpecificResult' smart constructor.+data ResourceSpecificResult = ResourceSpecificResult'+    { _rsrMatchedStatements    :: !(Maybe [Statement])+    , _rsrEvalDecisionDetails  :: !(Maybe (Map Text PolicyEvaluationDecisionType))+    , _rsrMissingContextValues :: !(Maybe [Text])+    , _rsrEvalResourceName     :: !Text+    , _rsrEvalResourceDecision :: !PolicyEvaluationDecisionType+    } deriving (Eq,Read,Show,Data,Typeable,Generic)++-- | Creates a value of 'ResourceSpecificResult' with the minimum fields required to make a request.+--+-- Use one of the following lenses to modify other fields as desired:+--+-- * 'rsrMatchedStatements'+--+-- * 'rsrEvalDecisionDetails'+--+-- * 'rsrMissingContextValues'+--+-- * 'rsrEvalResourceName'+--+-- * 'rsrEvalResourceDecision'+resourceSpecificResult+    :: Text -- ^ 'rsrEvalResourceName'+    -> PolicyEvaluationDecisionType -- ^ 'rsrEvalResourceDecision'+    -> ResourceSpecificResult+resourceSpecificResult pEvalResourceName_ pEvalResourceDecision_ =+    ResourceSpecificResult'+    { _rsrMatchedStatements = Nothing+    , _rsrEvalDecisionDetails = Nothing+    , _rsrMissingContextValues = Nothing+    , _rsrEvalResourceName = pEvalResourceName_+    , _rsrEvalResourceDecision = pEvalResourceDecision_+    }++-- | A list of the statements in the input policies that determine the result+-- for this part of the simulation. Remember that even if multiple+-- statements allow the action on the resource, if /any/ statement denies+-- that action, then the explicit deny overrides any allow, and the deny+-- statement is the only entry included in the result.+rsrMatchedStatements :: Lens' ResourceSpecificResult [Statement]+rsrMatchedStatements = lens _rsrMatchedStatements (\ s a -> s{_rsrMatchedStatements = a}) . _Default . _Coerce;++-- | Additional details about the results of the evaluation decision. When+-- there are both IAM policies and resource policies, this parameter+-- explains how each set of policies contributes to the final evaluation+-- decision. When simulating cross-account access to a resource, both the+-- resource-based policy and the caller\'s IAM policy must grant access.+rsrEvalDecisionDetails :: Lens' ResourceSpecificResult (HashMap Text PolicyEvaluationDecisionType)+rsrEvalDecisionDetails = lens _rsrEvalDecisionDetails (\ s a -> s{_rsrEvalDecisionDetails = a}) . _Default . _Map;++-- | A list of context keys that are required by the included input policies+-- but that were not provided by one of the input parameters. To discover+-- the context keys used by a set of policies, you can call+-- GetContextKeysForCustomPolicy or GetContextKeysForPrincipalPolicy.+rsrMissingContextValues :: Lens' ResourceSpecificResult [Text]+rsrMissingContextValues = lens _rsrMissingContextValues (\ s a -> s{_rsrMissingContextValues = a}) . _Default . _Coerce;++-- | The name of the simulated resource, in Amazon Resource Name (ARN)+-- format.+rsrEvalResourceName :: Lens' ResourceSpecificResult Text+rsrEvalResourceName = lens _rsrEvalResourceName (\ s a -> s{_rsrEvalResourceName = a});++-- | The result of the simulation of the simulated API action on the resource+-- specified in 'EvalResourceName'.+rsrEvalResourceDecision :: Lens' ResourceSpecificResult PolicyEvaluationDecisionType+rsrEvalResourceDecision = lens _rsrEvalResourceDecision (\ s a -> s{_rsrEvalResourceDecision = a});++instance FromXML ResourceSpecificResult where+        parseXML x+          = ResourceSpecificResult' <$>+              (x .@? "MatchedStatements" .!@ mempty >>=+                 may (parseXMLList "member"))+                <*>+                (x .@? "EvalDecisionDetails" .!@ mempty >>=+                   may (parseXMLMap "entry" "key" "value"))+                <*>+                (x .@? "MissingContextValues" .!@ mempty >>=+                   may (parseXMLList "member"))+                <*> (x .@ "EvalResourceName")+                <*> (x .@ "EvalResourceDecision")  -- | Contains information about an IAM role. --