diff --git a/README.md b/README.md --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ ## Version -`1.3.5` +`1.3.6` ## Description diff --git a/amazonka-iam.cabal b/amazonka-iam.cabal --- a/amazonka-iam.cabal +++ b/amazonka-iam.cabal @@ -1,5 +1,5 @@ name: amazonka-iam -version: 1.3.5 +version: 1.3.6 synopsis: Amazon Identity and Access Management SDK. homepage: https://github.com/brendanhay/amazonka bug-reports: https://github.com/brendanhay/amazonka/issues @@ -219,7 +219,7 @@ , Network.AWS.IAM.Types.Sum build-depends: - amazonka-core == 1.3.5.* + amazonka-core == 1.3.6.* , base >= 4.7 && < 5 test-suite amazonka-iam-test @@ -239,9 +239,9 @@ , Test.AWS.IAM.Internal build-depends: - amazonka-core == 1.3.5.* - , amazonka-test == 1.3.5.* - , amazonka-iam == 1.3.5.* + amazonka-core == 1.3.6.* + , amazonka-test == 1.3.6.* + , amazonka-iam == 1.3.6.* , base , bytestring , lens diff --git a/gen/Network/AWS/IAM.hs b/gen/Network/AWS/IAM.hs --- a/gen/Network/AWS/IAM.hs +++ b/gen/Network/AWS/IAM.hs @@ -573,9 +573,10 @@ , evaluationResult , erMatchedStatements , erEvalDecisionDetails + , erResourceSpecificResults + , erEvalResourceName , erMissingContextValues , erEvalActionName - , erEvalResourceName , erEvalDecision -- ** GetContextKeysForPolicyResponse @@ -709,6 +710,15 @@ , position , pLine , pColumn + + -- ** ResourceSpecificResult + , ResourceSpecificResult + , resourceSpecificResult + , rsrMatchedStatements + , rsrEvalDecisionDetails + , rsrMissingContextValues + , rsrEvalResourceName + , rsrEvalResourceDecision -- ** Role , Role diff --git a/gen/Network/AWS/IAM/GetContextKeysForCustomPolicy.hs b/gen/Network/AWS/IAM/GetContextKeysForCustomPolicy.hs --- a/gen/Network/AWS/IAM/GetContextKeysForCustomPolicy.hs +++ b/gen/Network/AWS/IAM/GetContextKeysForCustomPolicy.hs @@ -71,7 +71,8 @@ } -- | A list of policies for which you want list of context keys used in --- 'Condition' elements. +-- 'Condition' elements. Each document is specified as a string containing +-- the complete, valid JSON text of an IAM policy. gckfcpPolicyInputList :: Lens' GetContextKeysForCustomPolicy [Text] gckfcpPolicyInputList = lens _gckfcpPolicyInputList (\ s a -> s{_gckfcpPolicyInputList = a}) . _Coerce; diff --git a/gen/Network/AWS/IAM/ListAccountAliases.hs b/gen/Network/AWS/IAM/ListAccountAliases.hs --- a/gen/Network/AWS/IAM/ListAccountAliases.hs +++ b/gen/Network/AWS/IAM/ListAccountAliases.hs @@ -18,14 +18,11 @@ -- Stability : auto-generated -- Portability : non-portable (GHC extensions) -- --- Lists the account aliases associated with the account. For information --- about using an AWS account alias, see +-- Lists the account alias associated with the account (Note: you can have +-- only one). For information about using an AWS account alias, see -- -- in the /IAM User Guide/. -- --- You can paginate the results using the 'MaxItems' and 'Marker' --- parameters. --- -- /See:/ for ListAccountAliases. -- -- This operation returns paginated results. @@ -181,6 +178,7 @@ laarsResponseStatus :: Lens' ListAccountAliasesResponse Int laarsResponseStatus = lens _laarsResponseStatus (\ s a -> s{_laarsResponseStatus = a}); --- | A list of aliases associated with the account. +-- | A list of aliases associated with the account. AWS supports only one +-- alias per account. laarsAccountAliases :: Lens' ListAccountAliasesResponse [Text] laarsAccountAliases = lens _laarsAccountAliases (\ s a -> s{_laarsAccountAliases = a}) . _Coerce; diff --git a/gen/Network/AWS/IAM/SimulateCustomPolicy.hs b/gen/Network/AWS/IAM/SimulateCustomPolicy.hs --- a/gen/Network/AWS/IAM/SimulateCustomPolicy.hs +++ b/gen/Network/AWS/IAM/SimulateCustomPolicy.hs @@ -48,6 +48,7 @@ -- * Request Lenses , scpResourcePolicy , scpCallerARN + , scpResourceHandlingOption , scpResourceARNs , scpMarker , scpMaxItems @@ -73,15 +74,16 @@ -- | /See:/ 'simulateCustomPolicy' smart constructor. data SimulateCustomPolicy = SimulateCustomPolicy' - { _scpResourcePolicy :: !(Maybe Text) - , _scpCallerARN :: !(Maybe Text) - , _scpResourceARNs :: !(Maybe [Text]) - , _scpMarker :: !(Maybe Text) - , _scpMaxItems :: !(Maybe Nat) - , _scpContextEntries :: !(Maybe [ContextEntry]) - , _scpResourceOwner :: !(Maybe Text) - , _scpPolicyInputList :: ![Text] - , _scpActionNames :: ![Text] + { _scpResourcePolicy :: !(Maybe Text) + , _scpCallerARN :: !(Maybe Text) + , _scpResourceHandlingOption :: !(Maybe Text) + , _scpResourceARNs :: !(Maybe [Text]) + , _scpMarker :: !(Maybe Text) + , _scpMaxItems :: !(Maybe Nat) + , _scpContextEntries :: !(Maybe [ContextEntry]) + , _scpResourceOwner :: !(Maybe Text) + , _scpPolicyInputList :: ![Text] + , _scpActionNames :: ![Text] } deriving (Eq,Read,Show,Data,Typeable,Generic) -- | Creates a value of 'SimulateCustomPolicy' with the minimum fields required to make a request. @@ -92,6 +94,8 @@ -- -- * 'scpCallerARN' -- +-- * 'scpResourceHandlingOption' +-- -- * 'scpResourceARNs' -- -- * 'scpMarker' @@ -111,6 +115,7 @@ SimulateCustomPolicy' { _scpResourcePolicy = Nothing , _scpCallerARN = Nothing + , _scpResourceHandlingOption = Nothing , _scpResourceARNs = Nothing , _scpMarker = Nothing , _scpMaxItems = Nothing @@ -137,6 +142,51 @@ scpCallerARN :: Lens' SimulateCustomPolicy (Maybe Text) scpCallerARN = lens _scpCallerARN (\ s a -> s{_scpCallerARN = a}); +-- | Specifies the type of simulation to run. Different APIs that support +-- resource-based policies require different combinations of resources. By +-- specifying the type of simulation to run, you enable the policy +-- simulator to enforce the presence of the required resources to ensure +-- reliable simulation results. If your simulation does not match one of +-- the following scenarios, then you can omit this parameter. The following +-- list shows each of the supported scenario values and the resources that +-- you must define to run the simulation. +-- +-- Each of the EC2 scenarios requires that you specify instance, image, and +-- security-group resources. If your scenario includes an EBS volume, then +-- you must specify that volume as a resource. If the EC2 scenario includes +-- VPC, then you must supply the network-interface resource. If it includes +-- an IP subnet, then you must specify the subnet resource. For more +-- information on the EC2 scenario options, see +-- +-- in the /AWS EC2 User Guide/. +-- +-- - __EC2-Classic-InstanceStore__ +-- +-- instance, image, security-group +-- +-- - __EC2-Classic-EBS__ +-- +-- instance, image, security-group, volume +-- +-- - __EC2-VPC-InstanceStore__ +-- +-- instance, image, security-group, network-interface +-- +-- - __EC2-VPC-InstanceStore-Subnet__ +-- +-- instance, image, security-group, network-interface, subnet +-- +-- - __EC2-VPC-EBS__ +-- +-- instance, image, security-group, network-interface, volume +-- +-- - __EC2-VPC-EBS-Subnet__ +-- +-- instance, image, security-group, network-interface, subnet, volume +-- +scpResourceHandlingOption :: Lens' SimulateCustomPolicy (Maybe Text) +scpResourceHandlingOption = lens _scpResourceHandlingOption (\ s a -> s{_scpResourceHandlingOption = a}); + -- | A list of ARNs of AWS resources to include in the simulation. If this -- parameter is not provided then the value defaults to '*' (all -- resources). Each API in the 'ActionNames' parameter is evaluated for @@ -233,6 +283,8 @@ "Version" =: ("2010-05-08" :: ByteString), "ResourcePolicy" =: _scpResourcePolicy, "CallerArn" =: _scpCallerARN, + "ResourceHandlingOption" =: + _scpResourceHandlingOption, "ResourceArns" =: toQuery (toQueryList "member" <$> _scpResourceARNs), "Marker" =: _scpMarker, "MaxItems" =: _scpMaxItems, diff --git a/gen/Network/AWS/IAM/SimulatePrincipalPolicy.hs b/gen/Network/AWS/IAM/SimulatePrincipalPolicy.hs --- a/gen/Network/AWS/IAM/SimulatePrincipalPolicy.hs +++ b/gen/Network/AWS/IAM/SimulatePrincipalPolicy.hs @@ -60,6 +60,7 @@ , sppPolicyInputList , sppResourcePolicy , sppCallerARN + , sppResourceHandlingOption , sppResourceARNs , sppMarker , sppMaxItems @@ -85,16 +86,17 @@ -- | /See:/ 'simulatePrincipalPolicy' smart constructor. data SimulatePrincipalPolicy = SimulatePrincipalPolicy' - { _sppPolicyInputList :: !(Maybe [Text]) - , _sppResourcePolicy :: !(Maybe Text) - , _sppCallerARN :: !(Maybe Text) - , _sppResourceARNs :: !(Maybe [Text]) - , _sppMarker :: !(Maybe Text) - , _sppMaxItems :: !(Maybe Nat) - , _sppContextEntries :: !(Maybe [ContextEntry]) - , _sppResourceOwner :: !(Maybe Text) - , _sppPolicySourceARN :: !Text - , _sppActionNames :: ![Text] + { _sppPolicyInputList :: !(Maybe [Text]) + , _sppResourcePolicy :: !(Maybe Text) + , _sppCallerARN :: !(Maybe Text) + , _sppResourceHandlingOption :: !(Maybe Text) + , _sppResourceARNs :: !(Maybe [Text]) + , _sppMarker :: !(Maybe Text) + , _sppMaxItems :: !(Maybe Nat) + , _sppContextEntries :: !(Maybe [ContextEntry]) + , _sppResourceOwner :: !(Maybe Text) + , _sppPolicySourceARN :: !Text + , _sppActionNames :: ![Text] } deriving (Eq,Read,Show,Data,Typeable,Generic) -- | Creates a value of 'SimulatePrincipalPolicy' with the minimum fields required to make a request. @@ -107,6 +109,8 @@ -- -- * 'sppCallerARN' -- +-- * 'sppResourceHandlingOption' +-- -- * 'sppResourceARNs' -- -- * 'sppMarker' @@ -128,6 +132,7 @@ { _sppPolicyInputList = Nothing , _sppResourcePolicy = Nothing , _sppCallerARN = Nothing + , _sppResourceHandlingOption = Nothing , _sppResourceARNs = Nothing , _sppMarker = Nothing , _sppMaxItems = Nothing @@ -168,6 +173,51 @@ sppCallerARN :: Lens' SimulatePrincipalPolicy (Maybe Text) sppCallerARN = lens _sppCallerARN (\ s a -> s{_sppCallerARN = a}); +-- | Specifies the type of simulation to run. Different APIs that support +-- resource-based policies require different combinations of resources. By +-- specifying the type of simulation to run, you enable the policy +-- simulator to enforce the presence of the required resources to ensure +-- reliable simulation results. If your simulation does not match one of +-- the following scenarios, then you can omit this parameter. The following +-- list shows each of the supported scenario values and the resources that +-- you must define to run the simulation. +-- +-- Each of the EC2 scenarios requires that you specify instance, image, and +-- security-group resources. If your scenario includes an EBS volume, then +-- you must specify that volume as a resource. If the EC2 scenario includes +-- VPC, then you must supply the network-interface resource. If it includes +-- an IP subnet, then you must specify the subnet resource. For more +-- information on the EC2 scenario options, see +-- +-- in the /AWS EC2 User Guide/. +-- +-- - __EC2-Classic-InstanceStore__ +-- +-- instance, image, security-group +-- +-- - __EC2-Classic-EBS__ +-- +-- instance, image, security-group, volume +-- +-- - __EC2-VPC-InstanceStore__ +-- +-- instance, image, security-group, network-interface +-- +-- - __EC2-VPC-InstanceStore-Subnet__ +-- +-- instance, image, security-group, network-interface, subnet +-- +-- - __EC2-VPC-EBS__ +-- +-- instance, image, security-group, network-interface, volume +-- +-- - __EC2-VPC-EBS-Subnet__ +-- +-- instance, image, security-group, network-interface, subnet, volume +-- +sppResourceHandlingOption :: Lens' SimulatePrincipalPolicy (Maybe Text) +sppResourceHandlingOption = lens _sppResourceHandlingOption (\ s a -> s{_sppResourceHandlingOption = a}); + -- | A list of ARNs of AWS resources to include in the simulation. If this -- parameter is not provided then the value defaults to '*' (all -- resources). Each API in the 'ActionNames' parameter is evaluated for @@ -258,6 +308,8 @@ (toQueryList "member" <$> _sppPolicyInputList), "ResourcePolicy" =: _sppResourcePolicy, "CallerArn" =: _sppCallerARN, + "ResourceHandlingOption" =: + _sppResourceHandlingOption, "ResourceArns" =: toQuery (toQueryList "member" <$> _sppResourceARNs), "Marker" =: _sppMarker, "MaxItems" =: _sppMaxItems, diff --git a/gen/Network/AWS/IAM/Types.hs b/gen/Network/AWS/IAM/Types.hs --- a/gen/Network/AWS/IAM/Types.hs +++ b/gen/Network/AWS/IAM/Types.hs @@ -114,9 +114,10 @@ , evaluationResult , erMatchedStatements , erEvalDecisionDetails + , erResourceSpecificResults + , erEvalResourceName , erMissingContextValues , erEvalActionName - , erEvalResourceName , erEvalDecision -- * GetContextKeysForPolicyResponse @@ -250,6 +251,15 @@ , position , pLine , pColumn + + -- * ResourceSpecificResult + , ResourceSpecificResult + , resourceSpecificResult + , rsrMatchedStatements + , rsrEvalDecisionDetails + , rsrMissingContextValues + , rsrEvalResourceName + , rsrEvalResourceDecision -- * Role , Role diff --git a/gen/Network/AWS/IAM/Types/Product.hs b/gen/Network/AWS/IAM/Types/Product.hs --- a/gen/Network/AWS/IAM/Types/Product.hs +++ b/gen/Network/AWS/IAM/Types/Product.hs @@ -344,12 +344,13 @@ -- -- /See:/ 'evaluationResult' smart constructor. data EvaluationResult = EvaluationResult' - { _erMatchedStatements :: !(Maybe [Statement]) - , _erEvalDecisionDetails :: !(Maybe (Map Text PolicyEvaluationDecisionType)) - , _erMissingContextValues :: !(Maybe [Text]) - , _erEvalActionName :: !Text - , _erEvalResourceName :: !Text - , _erEvalDecision :: !PolicyEvaluationDecisionType + { _erMatchedStatements :: !(Maybe [Statement]) + , _erEvalDecisionDetails :: !(Maybe (Map Text PolicyEvaluationDecisionType)) + , _erResourceSpecificResults :: !(Maybe [ResourceSpecificResult]) + , _erEvalResourceName :: !(Maybe Text) + , _erMissingContextValues :: !(Maybe [Text]) + , _erEvalActionName :: !Text + , _erEvalDecision :: !PolicyEvaluationDecisionType } deriving (Eq,Read,Show,Data,Typeable,Generic) -- | Creates a value of 'EvaluationResult' with the minimum fields required to make a request. @@ -360,25 +361,27 @@ -- -- * 'erEvalDecisionDetails' -- +-- * 'erResourceSpecificResults' +-- +-- * 'erEvalResourceName' +-- -- * 'erMissingContextValues' -- -- * 'erEvalActionName' -- --- * 'erEvalResourceName' --- -- * 'erEvalDecision' evaluationResult :: Text -- ^ 'erEvalActionName' - -> Text -- ^ 'erEvalResourceName' -> PolicyEvaluationDecisionType -- ^ 'erEvalDecision' -> EvaluationResult -evaluationResult pEvalActionName_ pEvalResourceName_ pEvalDecision_ = +evaluationResult pEvalActionName_ pEvalDecision_ = EvaluationResult' { _erMatchedStatements = Nothing , _erEvalDecisionDetails = Nothing + , _erResourceSpecificResults = Nothing + , _erEvalResourceName = Nothing , _erMissingContextValues = Nothing , _erEvalActionName = pEvalActionName_ - , _erEvalResourceName = pEvalResourceName_ , _erEvalDecision = pEvalDecision_ } @@ -395,10 +398,20 @@ -- explains how each set of policies contributes to the final evaluation -- decision. When simulating cross-account access to a resource, both the -- resource-based policy and the caller\'s IAM policy must grant access. --- See How IAM Roles Differ from Resource-based Policies +-- See +-- erEvalDecisionDetails :: Lens' EvaluationResult (HashMap Text PolicyEvaluationDecisionType) erEvalDecisionDetails = lens _erEvalDecisionDetails (\ s a -> s{_erEvalDecisionDetails = a}) . _Default . _Map; +-- | The individual results of the simulation of the API action specified in +-- EvalActionName on each resource. +erResourceSpecificResults :: Lens' EvaluationResult [ResourceSpecificResult] +erResourceSpecificResults = lens _erResourceSpecificResults (\ s a -> s{_erResourceSpecificResults = a}) . _Default . _Coerce; + +-- | The ARN of the resource that the indicated API action was tested on. +erEvalResourceName :: Lens' EvaluationResult (Maybe Text) +erEvalResourceName = lens _erEvalResourceName (\ s a -> s{_erEvalResourceName = a}); + -- | A list of context keys that are required by the included input policies -- but that were not provided by one of the input parameters. To discover -- the context keys used by a set of policies, you can call @@ -415,10 +428,6 @@ erEvalActionName :: Lens' EvaluationResult Text erEvalActionName = lens _erEvalActionName (\ s a -> s{_erEvalActionName = a}); --- | The ARN of the resource that the indicated API action was tested on. -erEvalResourceName :: Lens' EvaluationResult Text -erEvalResourceName = lens _erEvalResourceName (\ s a -> s{_erEvalResourceName = a}); - -- | The result of the simulation. erEvalDecision :: Lens' EvaluationResult PolicyEvaluationDecisionType erEvalDecision = lens _erEvalDecision (\ s a -> s{_erEvalDecision = a}); @@ -432,10 +441,13 @@ (x .@? "EvalDecisionDetails" .!@ mempty >>= may (parseXMLMap "entry" "key" "value")) <*> + (x .@? "ResourceSpecificResults" .!@ mempty >>= + may (parseXMLList "member")) + <*> (x .@? "EvalResourceName") + <*> (x .@? "MissingContextValues" .!@ mempty >>= may (parseXMLList "member")) <*> (x .@ "EvalActionName") - <*> (x .@ "EvalResourceName") <*> (x .@ "EvalDecision") -- | Contains the response to a successful GetContextKeysForPrincipalPolicy @@ -1089,8 +1101,9 @@ , _ppAllowUsersToChangePassword = Nothing } --- | Specifies whether IAM users are required to change their password after --- a specified number of days. +-- | Indicates whether passwords in the account expire. Returns true if +-- MaxPasswordAge is contains a value greater than 0. Returns false if +-- MaxPasswordAge is 0 or not present. ppExpirePasswords :: Lens' PasswordPolicy (Maybe Bool) ppExpirePasswords = lens _ppExpirePasswords (\ s a -> s{_ppExpirePasswords = a}); @@ -1534,6 +1547,93 @@ instance FromXML Position where parseXML x = Position' <$> (x .@? "Line") <*> (x .@? "Column") + +-- | Contains the result of the simulation of a single API action call on a +-- single resource. +-- +-- This data type is used by a member of the EvaluationResult data type. +-- +-- /See:/ 'resourceSpecificResult' smart constructor. +data ResourceSpecificResult = ResourceSpecificResult' + { _rsrMatchedStatements :: !(Maybe [Statement]) + , _rsrEvalDecisionDetails :: !(Maybe (Map Text PolicyEvaluationDecisionType)) + , _rsrMissingContextValues :: !(Maybe [Text]) + , _rsrEvalResourceName :: !Text + , _rsrEvalResourceDecision :: !PolicyEvaluationDecisionType + } deriving (Eq,Read,Show,Data,Typeable,Generic) + +-- | Creates a value of 'ResourceSpecificResult' with the minimum fields required to make a request. +-- +-- Use one of the following lenses to modify other fields as desired: +-- +-- * 'rsrMatchedStatements' +-- +-- * 'rsrEvalDecisionDetails' +-- +-- * 'rsrMissingContextValues' +-- +-- * 'rsrEvalResourceName' +-- +-- * 'rsrEvalResourceDecision' +resourceSpecificResult + :: Text -- ^ 'rsrEvalResourceName' + -> PolicyEvaluationDecisionType -- ^ 'rsrEvalResourceDecision' + -> ResourceSpecificResult +resourceSpecificResult pEvalResourceName_ pEvalResourceDecision_ = + ResourceSpecificResult' + { _rsrMatchedStatements = Nothing + , _rsrEvalDecisionDetails = Nothing + , _rsrMissingContextValues = Nothing + , _rsrEvalResourceName = pEvalResourceName_ + , _rsrEvalResourceDecision = pEvalResourceDecision_ + } + +-- | A list of the statements in the input policies that determine the result +-- for this part of the simulation. Remember that even if multiple +-- statements allow the action on the resource, if /any/ statement denies +-- that action, then the explicit deny overrides any allow, and the deny +-- statement is the only entry included in the result. +rsrMatchedStatements :: Lens' ResourceSpecificResult [Statement] +rsrMatchedStatements = lens _rsrMatchedStatements (\ s a -> s{_rsrMatchedStatements = a}) . _Default . _Coerce; + +-- | Additional details about the results of the evaluation decision. When +-- there are both IAM policies and resource policies, this parameter +-- explains how each set of policies contributes to the final evaluation +-- decision. When simulating cross-account access to a resource, both the +-- resource-based policy and the caller\'s IAM policy must grant access. +rsrEvalDecisionDetails :: Lens' ResourceSpecificResult (HashMap Text PolicyEvaluationDecisionType) +rsrEvalDecisionDetails = lens _rsrEvalDecisionDetails (\ s a -> s{_rsrEvalDecisionDetails = a}) . _Default . _Map; + +-- | A list of context keys that are required by the included input policies +-- but that were not provided by one of the input parameters. To discover +-- the context keys used by a set of policies, you can call +-- GetContextKeysForCustomPolicy or GetContextKeysForPrincipalPolicy. +rsrMissingContextValues :: Lens' ResourceSpecificResult [Text] +rsrMissingContextValues = lens _rsrMissingContextValues (\ s a -> s{_rsrMissingContextValues = a}) . _Default . _Coerce; + +-- | The name of the simulated resource, in Amazon Resource Name (ARN) +-- format. +rsrEvalResourceName :: Lens' ResourceSpecificResult Text +rsrEvalResourceName = lens _rsrEvalResourceName (\ s a -> s{_rsrEvalResourceName = a}); + +-- | The result of the simulation of the simulated API action on the resource +-- specified in 'EvalResourceName'. +rsrEvalResourceDecision :: Lens' ResourceSpecificResult PolicyEvaluationDecisionType +rsrEvalResourceDecision = lens _rsrEvalResourceDecision (\ s a -> s{_rsrEvalResourceDecision = a}); + +instance FromXML ResourceSpecificResult where + parseXML x + = ResourceSpecificResult' <$> + (x .@? "MatchedStatements" .!@ mempty >>= + may (parseXMLList "member")) + <*> + (x .@? "EvalDecisionDetails" .!@ mempty >>= + may (parseXMLMap "entry" "key" "value")) + <*> + (x .@? "MissingContextValues" .!@ mempty >>= + may (parseXMLList "member")) + <*> (x .@ "EvalResourceName") + <*> (x .@ "EvalResourceDecision") -- | Contains information about an IAM role. --