policies

Creates, updates, deletes, gets or lists a policies resource.

Overview

Name	policies
Type	Resource
Id	aws.verifiedpermissions.policies

Fields

The following fields are returned by SELECT queries:

get_policy

Name	Datatype	Description
name	string	The name of the policy, if one was assigned when the policy was created or last updated. (pattern: <code>[a-zA-Z0-9-/_]*</code>)
actions	array	The action that a policy permits or forbids. For example, {"actions": [{"actionId": "ViewPhoto", "actionType": "PhotoFlash::Action"}, {"entityID": "SharePhoto", "entityType": "PhotoFlash::Action"}]}.
created_date	string (date-time)	The date and time that the policy was originally created.
definition	object	The definition of the requested policy.
effect	string	The effect of the decision that a policy returns to an authorization request. For example, "effect": "Permit". (Permit, Forbid)
last_updated_date	string (date-time)	The date and time that the policy was last updated.
policy_id	string	The unique ID of the policy that you want information about. (pattern: <code>[a-zA-Z0-9-/_]*</code>)
policy_store_id	string	The ID of the policy store that contains the policy that you want information about. (pattern: <code>[a-zA-Z0-9-/_]*</code>)
policy_type	string	The type of the policy. (STATIC, TEMPLATE_LINKED)
principal	object	Contains the identifier of an entity, including its ID and type. This data type is used as a request parameter for IsAuthorized operation, and as a response parameter for the CreatePolicy, GetPolicy, and UpdatePolicy operations. Example: {"entityId":"string","entityType":"string"}
resource	object	Contains the identifier of an entity, including its ID and type. This data type is used as a request parameter for IsAuthorized operation, and as a response parameter for the CreatePolicy, GetPolicy, and UpdatePolicy operations. Example: {"entityId":"string","entityType":"string"}

batch_get_policy

Name	Datatype	Description
errors	array	Information about the policies from the request that resulted in an error. These results are returned in the order they were requested.
results	array	Information about the policies listed in the request that were successfully returned. These results are returned in the order they were requested.

list_policies

Name	Datatype	Description
name	string	The name of the policy, if one was assigned when the policy was created or last updated. (pattern: <code>[a-zA-Z0-9-/_]*</code>)
actions	array	The action that a policy permits or forbids. For example, {"actions": [{"actionId": "ViewPhoto", "actionType": "PhotoFlash::Action"}, {"entityID": "SharePhoto", "entityType": "PhotoFlash::Action"}]}.
created_date	string (date-time)	The date and time the policy was created.
definition	object	The policy definition of an item in the list of policies returned.
effect	string	The effect of the decision that a policy returns to an authorization request. For example, "effect": "Permit". (Permit, Forbid)
last_updated_date	string (date-time)	The date and time the policy was most recently updated.
policy_id	string	The identifier of the policy you want information about. (pattern: <code>[a-zA-Z0-9-/_]*</code>)
policy_store_id	string	The identifier of the policy store where the policy you want information about is stored. (pattern: <code>[a-zA-Z0-9-/_]*</code>)
policy_type	string	The type of the policy. This is one of the following values: STATIC TEMPLATE_LINKED (STATIC, TEMPLATE_LINKED)
principal	object	Contains the identifier of an entity, including its ID and type. This data type is used as a request parameter for IsAuthorized operation, and as a response parameter for the CreatePolicy, GetPolicy, and UpdatePolicy operations. Example: {"entityId":"string","entityType":"string"}
resource	object	Contains the identifier of an entity, including its ID and type. This data type is used as a request parameter for IsAuthorized operation, and as a response parameter for the CreatePolicy, GetPolicy, and UpdatePolicy operations. Example: {"entityId":"string","entityType":"string"}

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_policy	select	region		Retrieves information about the specified policy.
batch_get_policy	select	region		Retrieves information about a group (batch) of policies. The BatchGetPolicy operation doesn't have its own IAM permission. To authorize this operation for Amazon Web Services principals, include the permission verifiedpermissions:GetPolicy in their IAM policies.
list_policies	select	region		Returns a paginated list of all policies stored in the specified policy store.
create_policy	insert	region, policyStoreId, definition		Creates a Cedar policy and saves it in the specified policy store. You can create either a static policy or a policy linked to a policy template. To create a static policy, provide the Cedar policy text in the StaticPolicy section of the PolicyDefinition. To create a policy that is dynamically linked to a policy template, specify the policy template ID and the principal and resource to associate with this policy in the templateLinked section of the PolicyDefinition. If the policy template is ever updated, any policies linked to the policy template automatically use the updated template. Creating a policy causes it to be validated against the schema in the policy store. If the policy doesn't pass validation, the operation fails and the policy isn't stored. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.
update_policy	update	region, policyStoreId, policyId		Modifies a Cedar static policy in the specified policy store. You can change only certain elements of the UpdatePolicyDefinition parameter. You can directly update only static policies. To change a template-linked policy, you must update the template instead, using UpdatePolicyTemplate. If policy validation is enabled in the policy store, then updating a static policy causes Verified Permissions to validate the policy against the schema in the policy store. If the updated static policy doesn't pass validation, the operation fails and the update isn't stored. When you edit a static policy, you can change only certain elements of a static policy: The action referenced by the policy. A condition clause, such as when and unless. You can't change these elements of a static policy: Changing a policy from a static policy to a template-linked policy. Changing the effect of a static policy from permit or forbid. The principal referenced by a static policy. The resource referenced by a static policy. To update a template-linked policy, you must update the template instead. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.
delete_policy	delete	region		Deletes the specified policy from the policy store. This operation is idempotent; if you specify a policy that doesn't exist, the request response returns a successful HTTP 200 status code.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_policy

Retrieves information about the specified policy.

SELECT
name,
actions,
created_date,
definition,
effect,
last_updated_date,
policy_id,
policy_store_id,
policy_type,
principal,
resource
FROM aws.verifiedpermissions.policies
WHERE region = '{{ region }}' -- required
;

batch_get_policy

Retrieves information about a group (batch) of policies. The BatchGetPolicy operation doesn't have its own IAM permission. To authorize this operation for Amazon Web Services principals, include the permission verifiedpermissions:GetPolicy in their IAM policies.

SELECT
errors,
results
FROM aws.verifiedpermissions.policies
WHERE region = '{{ region }}' -- required
;

list_policies

Returns a paginated list of all policies stored in the specified policy store.

SELECT
name,
actions,
created_date,
definition,
effect,
last_updated_date,
policy_id,
policy_store_id,
policy_type,
principal,
resource
FROM aws.verifiedpermissions.policies
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_policy

Creates a Cedar policy and saves it in the specified policy store. You can create either a static policy or a policy linked to a policy template. To create a static policy, provide the Cedar policy text in the StaticPolicy section of the PolicyDefinition. To create a policy that is dynamically linked to a policy template, specify the policy template ID and the principal and resource to associate with this policy in the templateLinked section of the PolicyDefinition. If the policy template is ever updated, any policies linked to the policy template automatically use the updated template. Creating a policy causes it to be validated against the schema in the policy store. If the policy doesn't pass validation, the operation fails and the policy isn't stored. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.

INSERT INTO aws.verifiedpermissions.policies (
clientToken,
policyStoreId,
definition,
name,
region
)
SELECT 
'{{ clientToken }}',
'{{ policyStoreId }}' /* required */,
'{{ definition }}' /* required */,
'{{ name }}',
'{{ region }}'
RETURNING
actions,
created_date,
effect,
last_updated_date,
policy_id,
policy_store_id,
policy_type,
principal,
resource
;

Manifest

# Description fields are for documentation purposes
- name: policies
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the policies resource.
  - name: clientToken
    value: "{{ clientToken }}"
    description: |
      Specifies a unique, case-sensitive ID that you provide to ensure the idempotency of the request. This lets you safely retry the request without accidentally performing the same operation a second time. Passing the same value to a later call to an operation requires that you also pass the same value for all other parameters. We recommend that you use a UUID type of value.. If you don't provide this value, then Amazon Web Services generates a random one for you. If you retry the operation with the same ClientToken, but with different parameters, the retry fails with an ConflictException error. Verified Permissions recognizes a ClientToken for eight hours. After eight hours, the next request with the same parameters performs the operation again regardless of the value of ClientToken.
  - name: policyStoreId
    value: "{{ policyStoreId }}"
    description: |
      Specifies the PolicyStoreId of the policy store you want to store the policy in. To specify a policy store, use its ID or alias name. When using an alias name, prefix it with policy-store-alias/. For example: ID: PSEXAMPLEabcdefg111111 Alias name: policy-store-alias/example-policy-store To view aliases, use ListPolicyStoreAliases.
  - name: definition
    description: |
      A structure that specifies the policy type and content to use for the new policy. You must include either a static or a templateLinked element. The policy content must be written in the Cedar policy language.
    value:
      static:
        description: "{{ description }}"
        statement: "{{ statement }}"
      templateLinked:
        policyTemplateId: "{{ policyTemplateId }}"
        principal:
          entityType: "{{ entityType }}"
          entityId: "{{ entityId }}"
        resource:
          entityType: "{{ entityType }}"
          entityId: "{{ entityId }}"
  - name: name
    value: "{{ name }}"
    description: |
      Specifies a name for the policy that is unique among all policies within the policy store. You can use the name in place of the policy ID in API operations that reference the policy. The name must be prefixed with name/. If you specify a name that is already associated with another policy in the policy store, you receive a ConflictException error.

UPDATE examples

update_policy

Modifies a Cedar static policy in the specified policy store. You can change only certain elements of the UpdatePolicyDefinition parameter. You can directly update only static policies. To change a template-linked policy, you must update the template instead, using UpdatePolicyTemplate. If policy validation is enabled in the policy store, then updating a static policy causes Verified Permissions to validate the policy against the schema in the policy store. If the updated static policy doesn't pass validation, the operation fails and the update isn't stored. When you edit a static policy, you can change only certain elements of a static policy: The action referenced by the policy. A condition clause, such as when and unless. You can't change these elements of a static policy: Changing a policy from a static policy to a template-linked policy. Changing the effect of a static policy from permit or forbid. The principal referenced by a static policy. The resource referenced by a static policy. To update a template-linked policy, you must update the template instead. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.

UPDATE aws.verifiedpermissions.policies
SET 
policyStoreId = '{{ policyStoreId }}',
policyId = '{{ policyId }}',
definition = '{{ definition }}',
name = '{{ name }}'
WHERE 
region = '{{ region }}' --required
AND policyStoreId = '{{ policyStoreId }}' --required
AND policyId = '{{ policyId }}' --required
RETURNING
actions,
created_date,
effect,
last_updated_date,
policy_id,
policy_store_id,
policy_type,
principal,
resource;

DELETE examples

delete_policy

Deletes the specified policy from the policy store. This operation is idempotent; if you specify a policy that doesn't exist, the request response returns a successful HTTP 200 status code.

DELETE FROM aws.verifiedpermissions.policies
WHERE region = '{{ region }}' --required
;