policies

Creates, updates, deletes, gets or lists a policies resource.

Overview

Name	policies
Type	Resource
Id	aws.iot.policies

Fields

The following fields are returned by SELECT queries:

get_policy

Name	Datatype	Description
creation_date	string (date-time)	The date the policy was created.
default_version_id	string	The default policy version ID. (pattern: <code>[0-9]+</code>)
generation_id	string	The generation ID of the policy.
last_modified_date	string (date-time)	The date the policy was last modified.
policy_arn	string	The policy ARN.
policy_document	string	The JSON document that describes the policy. (pattern: <code>[\s\S]*</code>)
policy_name	string	The policy name. (pattern: <code>[\w+=,.@-]+</code>)

list_policies

Name	Datatype	Description
policy_arn	string	The policy ARN.
policy_name	string	The policy name. (pattern: <code>[\w+=,.@-]+</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_policy	select	policy_name, region		Gets information about the specified policy with the policy document of the default version. Requires permission to access the GetPolicy action.
list_policies	select	region	marker, pageSize, isAscendingOrder	Lists your policies. Requires permission to access the ListPolicies action.
create_policy	insert	policy_name, region, policyDocument		Creates an IoT policy. The created policy is the default version for the policy. This operation creates a policy version with a version identifier of 1 and sets 1 as the policy's default version. Requires permission to access the CreatePolicy action.
attach_policy	update	policy_name, region, target		Attaches the specified policy to the specified principal (certificate or other credential). Requires permission to access the AttachPolicy action.
delete_policy	delete	policy_name, region		Deletes the specified policy. A policy cannot be deleted if it has non-default versions or it is attached to any certificate. To delete a policy, use the DeletePolicyVersion action to delete all non-default versions of the policy; use the DetachPolicy action to detach the policy from any certificate; and then use the DeletePolicy action to delete the policy. When a policy is deleted using DeletePolicy, its default version is deleted with it. Because of the distributed nature of Amazon Web Services, it can take up to five minutes after a policy is detached before it's ready to be deleted. Requires permission to access the DeletePolicy action.
detach_policy	exec	policy_name, region, target		Detaches a policy from the specified target. Because of the distributed nature of Amazon Web Services, it can take up to five minutes after a policy is detached before it's ready to be deleted. Requires permission to access the DetachPolicy action.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
policy_name	string	The policy to detach.
region	string	AWS region (default: us-east-1)
isAscendingOrder	boolean	Specifies the order for results. If true, the results are returned in ascending creation order.
marker	string	The marker for the next set of results.
pageSize	integer	The result page size.

SELECT examples

get_policy

Gets information about the specified policy with the policy document of the default version. Requires permission to access the GetPolicy action.

SELECT
creation_date,
default_version_id,
generation_id,
last_modified_date,
policy_arn,
policy_document,
policy_name
FROM aws.iot.policies
WHERE policy_name = '{{ policy_name }}' -- required
AND region = '{{ region }}' -- required
;

list_policies

Lists your policies. Requires permission to access the ListPolicies action.

SELECT
policy_arn,
policy_name
FROM aws.iot.policies
WHERE region = '{{ region }}' -- required
AND marker = '{{ marker }}'
AND pageSize = '{{ pageSize }}'
AND isAscendingOrder = '{{ isAscendingOrder }}'
;

INSERT examples

create_policy

Creates an IoT policy. The created policy is the default version for the policy. This operation creates a policy version with a version identifier of 1 and sets 1 as the policy's default version. Requires permission to access the CreatePolicy action.

INSERT INTO aws.iot.policies (
policyDocument,
tags,
policy_name,
region
)
SELECT 
'{{ policyDocument }}' /* required */,
'{{ tags }}',
'{{ policy_name }}',
'{{ region }}'
RETURNING
policy_arn,
policy_document,
policy_name,
policy_version_id
;

Manifest

# Description fields are for documentation purposes
- name: policies
props:
  - name: policy_name
    value: "{{ policy_name }}"
    description: Required parameter for the policies resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the policies resource.
  - name: policyDocument
    value: "{{ policyDocument }}"
  - name: tags
    value:
      - Key: "{{ Key }}"
        Value: "{{ Value }}"

UPDATE examples

attach_policy

Attaches the specified policy to the specified principal (certificate or other credential). Requires permission to access the AttachPolicy action.

UPDATE aws.iot.policies
SET 
target = '{{ target }}'
WHERE 
policy_name = '{{ policy_name }}' --required
AND region = '{{ region }}' --required
AND target = '{{ target }}' --required;

DELETE examples

delete_policy

Deletes the specified policy. A policy cannot be deleted if it has non-default versions or it is attached to any certificate. To delete a policy, use the DeletePolicyVersion action to delete all non-default versions of the policy; use the DetachPolicy action to detach the policy from any certificate; and then use the DeletePolicy action to delete the policy. When a policy is deleted using DeletePolicy, its default version is deleted with it. Because of the distributed nature of Amazon Web Services, it can take up to five minutes after a policy is detached before it's ready to be deleted. Requires permission to access the DeletePolicy action.

DELETE FROM aws.iot.policies
WHERE policy_name = '{{ policy_name }}' --required
AND region = '{{ region }}' --required
;

Lifecycle Methods

detach_policy

Detaches a policy from the specified target. Because of the distributed nature of Amazon Web Services, it can take up to five minutes after a policy is detached before it's ready to be deleted. Requires permission to access the DetachPolicy action.

EXEC aws.iot.policies.detach_policy 
@policy_name='{{ policy_name }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"target": "{{ target }}"
}'
;