Checking Whether a Policy Has New Access

Function

This API is used to check whether a policy has new access.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
AccessAnalyzer::checkNoNewAccess	Read	-	-	-	-

URI

POST /v5/policies/check-no-new-access

Request Parameters

**Table 1** Request body parameters
Parameter	Mandatory	Type	Description
existing_policy_document	Yes	String	Definition: JSON policy document. Constraints: N/A Range: The value contains 0 to 131,072 characters. Default Value: N/A
new_policy_document	Yes	String	Definition: JSON policy document. Constraints: N/A Range: The value contains 0 to 131,072 characters. Default Value: N/A
policy_type	Yes	String	Definition: Type of the policy to be validated. Constraints: N/A Range: identity_policy: identity policy agency_trust_policy: agency trust policy bucket_policy: bucket policy Default Value: N/A

Response Parameters

Status code: 200

**Table 2** Response body parameters
Parameter	Type	Description
message	String	Definition: Message indicating whether the updated policy allows new access permissions. Range: N/A
check_result	String	Definition: Findings generated for the new access. Range: pass: There are no new access permissions. fail: New access permissions are added.
reasons	Array of CheckNoNewAccessReason objects	Definition: Statement description of the new action. Range: N/A

**Table 3** CheckNoNewAccessReason
Parameter	Type	Description
description	String	Definition: Description of the inference on the check findings. Range: N/A
statement_id	String	Definition: SID of the new permission statement. Range: N/A
statement_index	Integer	Definition: Index of the new permission statement, starting from 0. Range: Minimum: 0

Example Requests

Checking whether a policy has new access

POST https://{hostname}/v5/policies/check-no-new-access

{
  "existing_policy_document" : "{\\\"Version\\\":\\\"5.0\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":[\\\"iam:users:createUserV5\\\"]}]}",
  "new_policy_document" : "{\\\"Version\\\":\\\"5.0\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":[\\\"iam:users:createUserV5\\\",\\\"obs:bucket:createBucket\\\"]}]}",
  "policy_type" : "identity_policy"
}

Example Responses

Status code: 200

{
  "check_result" : "fail",
  "message" : "The modified permissions grant new access compared to your existing policy.",
  "reasons" : [ {
    "description" : "New access in the statement with sid: {statement_sid}.",
    "statement_index" : 0,
    "statement_id" : "{statement_sid}"
  } ]
}