Querying Effective Policies

Function

This API is used to query the effective policy of a specific type for the specified account. This API cannot be used to query the information about service control policies. This API can be called only from the organization's management account or a delegated administrator account.

Debugging

You can debug this API through automatic authentication in API Explorer or use the SDK sample code generated by API Explorer.

Authorization Information

Each account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions.

If you are using role/policy-based authorization, see Permissions Policies and Supported Actions for details on the required permissions.
If you are using identity policy-based authorization, the following identity policy-based permissions are required.

Action

Access Level

Resource Type (*: required)

Condition Key

Alias

Dependencies

organizations:effectivePolicies:get

Read

-

-

-

-

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
organizations:effectivePolicies:get	Read	-	-	-	-

URI

GET /v1/organizations/entities/effective-policies

**Table 1** Query Parameters
Parameter	Mandatory	Type	Description
entity_id	Yes	String	Definition Unique ID of an account. Currently, the effective policy of the root and organizational units cannot be queried. Constraints Mandatory Range The value must comply with the regular expression ^(?:r-[0-9a-z]{4,32}\|[\w-]+\|ou-[0-9a-z]{8,32})$. The value contains a maximum of 100 characters. Default Value No default value
policy_type	Yes	String	Definition Name of a policy type. Currently, the value tag_policy is available. Range Mandatory Constraints Enumerated value: tag_policy. Default Value No default value

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Security-Token	No	String	Definition Security token (session token) of your temporary security credentials. If a temporary security credential is used, this header is required. Constraints N/A Range The value contains 0 to 32,768 characters. Default Value No default value

Response Parameters

Status code: 200

**Table 3** Response body parameters
Parameter	Type	Description
last_updated_at	String	Definition Time when the effective policy was last updated. Constraints None Range None Default Value None
policy_content	String	Definition Content of the effective policy. Constraints None Range The value must comply with the regular expression ^[\s\S]$. The value contains 0 to 20,000 characters. Default Value* None
policy_type	String	Definition Name of a policy type. Currently, only the value tag_policy is available. Constraints Mandatory Range Enumerated value: tag_policy. Default Value None
entity_id	String	Definition Unique ID of the root, OU, or account. Constraints Mandatory Range The value must comply with the regular expression ^(?:r-[0-9a-z]{4,32}\|[\w-]+\|ou-[0-9a-z]{8,32})$. The value contains a maximum of 100 characters. Default Value None

Example Requests

Querying effective policies

GET https://{endpoint}/v1/organizations/entities/effective-policies?entity_id=0a6d25d23900d45c0faac010e0fb4de0&policy_type=tag_policy

Example Responses

Status code: 200

Successful.

{
  "last_updated_at" : "2023-01-11T11:00:00Z",
  "policy_content" : "{\"tags\":{\"color\":{\"tag_value\":[],\"tag_key\":\"Color\",\"enforced_for\":[\"iam:policy\"]},\"key_string\":{\"tag_value\":[\"AA\",\"BB\",\"cc\"],\"tag_key\":\"key_String\",\"enforced_for\":[\"iam:policy\"]},\"project\":{\"tag_value\":[\"Maintenance\",\"Escalations\"],\"tag_key\":\"Project\"}}}",
  "policy_type" : "tag_policy",
  "entity_id" : "c2acfcdf5fc7461a88f20094963e56c8"
}