Skip to content
AWS for Query.Farm

aws.accessanalyzer.validate_policy

Example SQL Queries

SELECT * FROM
aws.accessanalyzer.validate_policy
WHERE
"policy_document" = 'VALUE'
AND "policy_type" = 'VALUE';

Description

Requests the validation of a policy and returns a list of findings. The findings help you identify issues and provide actionable recommendations to resolve the issue and enable you to author functional policies that meet security best practices.

Table Definition

Column NameColumn Data Type
policy_document Required Input Column

The JSON policy document to use as the content for the policy.

VARCHAR
policy_type Required Input Column

The type of policy to validate. Identity policies grant permissions to IAM principals. Identity policies include managed and inline policies for IAM roles, users, and groups.

Resource policies grant permissions on Amazon Web Services resources. Resource policies include trust policies for IAM roles and bucket policies for Amazon S3 buckets. You can provide a generic input such as identity policy or resource policy or a specific input such as managed policy or Amazon S3 bucket policy.

Service control policies (SCPs) are a type of organization policy attached to an Amazon Web Services organization, organizational unit (OU), or an account.

VARCHAR
locale Input Column

The locale to use for localizing the findings.

VARCHAR
validate_policy_resource_type Input Column

The type of resource to attach to your resource policy. Specify a value for the policy validation resource type only if the policy type is RESOURCE_POLICY. For example, to validate a resource policy to attach to an Amazon S3 bucket, you can choose AWS::S3::Bucket for the policy validation resource type.

For resource types not supported as valid values, IAM Access Analyzer runs policy checks that apply to all resource policies. For example, to validate a resource policy to attach to a KMS key, do not specify a value for the policy validation resource type and IAM Access Analyzer will run policy checks that apply to all resource policies.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

finding_details

A localized message that explains the finding and provides guidance on how to address it.

VARCHAR
finding_type

The impact of the finding.

Security warnings report when the policy allows access that we consider overly permissive.

Errors report when a part of the policy is not functional.

Warnings report non-security issues when a policy does not conform to policy writing best practices.

Suggestions recommend stylistic improvements in the policy that do not impact access.

VARCHAR
issue_code

The issue code provides an identifier of the issue associated with this finding.

VARCHAR
learn_more_link

A link to additional documentation about the type of finding.

VARCHAR
locations

The list of locations in the policy document that are related to the finding. The issue code provides a summary of an issue identified by the finding.

STRUCT(
    "path" STRUCT(
        "index" BIGINT,
        "key" VARCHAR,
        "substring" STRUCT(
            "start" BIGINT,
            "length" BIGINT
        ),
        "value" VARCHAR
    )[],
    "span" STRUCT(
        "start" STRUCT(
            "line" BIGINT,
            "column" BIGINT,
            "offset" BIGINT
        ),
        "end" STRUCT(
            "line" BIGINT,
            "column" BIGINT,
            "offset" BIGINT
        )
    )
)[]
Show child fields
locations[]
Show child fields
locations[].path[]
Show child fields
locations[].path[].index

Refers to an index in a JSON array.

locations[].path[].key

Refers to a key in a JSON object.

locations[].path[].substring

Refers to a substring of a literal string in a JSON object.

Show child fields
locations[].path[].substring.length

The length of the substring.

locations[].path[].substring.start

The start index of the substring, starting from 0.

locations[].path[].value

Refers to the value associated with a given key in a JSON object.

locations[].span

A span in a policy.

Show child fields
locations[].span.end

The end position of the span (exclusive).

Show child fields
locations[].span.end.column

The column of the position, starting from 0.

locations[].span.end.line

The line of the position, starting from 1.

locations[].span.end.offset

The offset within the policy that corresponds to the position, starting from 0.

locations[].span.start

The start position of the span (inclusive).

Show child fields
locations[].span.start.column

The column of the position, starting from 0.

locations[].span.start.line

The line of the position, starting from 1.

locations[].span.start.offset

The offset within the policy that corresponds to the position, starting from 0.