* By default, all requests to use your resource coming from anyone but you are * denied. Access control polices can override that by allowing different types * of access to your resources, or by explicitly denying different types of * access. *
* Each statement in an AWS access control policy takes the form: * "A has permission to do B to C where D applies". *
* For more information, see The IAM User Guide * *
* Download the policy uploaded in the previous example and create a new policy with "read" access added to it.
* {@snippet :
* // IamClient requires a dependency on software.amazon.awssdk:iam
* try (IamClient iam = IamClient.builder().region(Region.AWS_GLOBAL).build()) {
* String policyArn = "arn:aws:iam::123456789012:policy/AllowWriteBookMetadata";
* GetPolicyResponse getPolicyResponse = iam.getPolicy(r -> r.policyArn(policyArn));
*
* String policyVersion = getPolicyResponse.defaultVersionId();
* GetPolicyVersionResponse getPolicyVersionResponse =
* iam.getPolicyVersion(r -> r.policyArn(policyArn).versionId(policyVersion));
*
* String decodedPolicy = URLDecoder.decode(getPolicyVersionResponse.policyVersion().document(), StandardCharsets.UTF_8);
* IamPolicy policy = IamPolicy.fromJson(decodedPolicy);
*
* IamStatement newStatement = policy.statements().get(0).copy(s -> s.addAction("dynamodb:GetItem"));
* IamPolicy newPolicy = policy.copy(p -> p.statements(Arrays.asList(newStatement)));
*
* iam.createPolicy(r -> r.policyName("AllowReadWriteBookMetadata")
* .policyDocument(newPolicy.toJson()));
* }
* }
*
* @see IamPolicyReader
* @see IamPolicyWriter
* @see IamStatement
* @see IAM User Guide
*/
@SdkPublicApi
@ThreadSafe
public interface IamPolicy extends ToCopyableBuilder
* This will raise an exception if the provided JSON is invalid or does not appear to represent a valid policy document.
*
* This is equivalent to {@code IamPolicyReader.create().read(json)}.
*/
static IamPolicy fromJson(String json) {
return IamPolicyReader.create().read(json);
}
/**
* Create an {@code IamPolicy} containing the provided statements.
*
* At least one statement is required.
*
* This is equivalent to {@code IamPolicy.builder().statements(statements).build()}
*/
static IamPolicy create(Collection
* This is equivalent to {@code IamPolicyWriter.create().writeToString(policy)}
*
* {@snippet :
* IamPolicy policy =
* IamPolicy.builder()
* .addStatement(IamStatement.builder()
* .effect(IamEffect.ALLOW)
* .addAction("dynamodb:PutItem")
* .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
* .build())
* .build();
* System.out.println("Policy:\n" + policy.toJson());
* }
*/
String toJson();
/**
* Convert this policy to the JSON format that is accepted by AWS services, using the provided writer.
*
* This is equivalent to {@code writer.writeToString(policy)}
*
* {@snippet :
* IamPolicyWriter prettyWriter =
* IamPolicyWriter.builder()
* .prettyPrint(true)
* .build();
* IamPolicy policy =
* IamPolicy.builder()
* .addStatement(IamStatement.builder()
* .effect(IamEffect.ALLOW)
* .addAction("dynamodb:PutItem")
* .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
* .build())
* .build();
* System.out.println("Policy:\n" + policy.toJson(prettyWriter));
* }
*/
String toJson(IamPolicyWriter writer);
/**
* @see #builder()
*/
interface Builder extends CopyableBuilder
* The ID is used differently in different services. ID is allowed in resource-based policies, but not in
* identity-based policies.
*
* For services that let you set an ID element, we recommend you use a UUID (GUID) for the value, or incorporate a UUID
* as part of the ID to ensure uniqueness.
*
* This value is optional.
*
* {@snippet :
* IamPolicy policy =
* IamPolicy.builder()
* .id("cd3ad3d9-2776-4ef1-a904-4c229d1642ee") // An identifier for the policy
* .addStatement(IamStatement.builder()
* .effect(IamEffect.DENY)
* .addAction(IamAction.ALL)
* .build())
* .build();
*}
*
* @see ID user guide
*/
Builder id(String id);
/**
* Configure the
* {@code Version}
* element of the policy, specifying the language syntax rules that are to be used to
* process the policy.
*
* By default, this value is {@code 2012-10-17}.
*
* {@snippet :
* IamPolicy policy =
* IamPolicy.builder()
* .version("2012-10-17") // The IAM policy language syntax version to use
* .addStatement(IamStatement.builder()
* .effect(IamEffect.DENY)
* .addAction(IamAction.ALL)
* .build())
* .build();
* }
*
* @see Version
* user guide
*/
Builder version(String version);
/**
* Configure the
* {@code
* Statement} element of the policy, specifying the access rules for this policy.
*
* This will replace any other statements already added to the policy. At least one statement is required to
* create a policy.
*
* {@snippet :
* IamPolicy policy =
* IamPolicy.builder()
* // Add a statement to this policy that denies all actions:
* .statements(Arrays.asList(IamStatement.builder()
* .effect(IamEffect.DENY)
* .addAction(IamAction.ALL)
* .build()))
* .build();
* }
* @see
* Statement user guide
*/
Builder statements(Collection
* At least one statement is required to create a policy.
*
* {@snippet :
* IamPolicy policy =
* IamPolicy.builder()
* // Add a statement to this policy that denies all actions:
* .addStatement(IamStatement.builder()
* .effect(IamEffect.DENY)
* .addAction(IamAction.ALL)
* .build())
* .build();
* }
* @see
* Statement user guide
*/
Builder addStatement(IamStatement statement);
/**
* Append a
* {@code
* Statement} element to this policy to specify additional access rules.
*
* This works the same as {@link #addStatement(IamStatement)}, except you do not need to specify {@code IamStatement
* .builder()} or {@code build()}. At least one statement is required to create a policy.
*
* {@snippet :
* IamPolicy policy =
* IamPolicy.builder()
* // Add a statement to this policy that denies all actions:
* .addStatement(s -> s.effect(IamEffect.DENY)
* .addAction(IamAction.ALL))
* .build();
* }
* @see
* Statement user guide
*/
Builder addStatement(Consumer