Starting Policy Scan for Specified Resources

Function

This API is used to immediately start a scan of the policies applied to the specified resource.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
AccessAnalyzer:analyzer:scan	Write	analyzer *	g:ResourceTag/<tag-key>	-	-

URI

POST /v5/analyzers/{analyzer_id}/scan

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
analyzer_id	Yes	String	Definition: Unique identifier of an analyzer. You can call the ListAnalyzers API to obtain the analyzer ID. The response parameters of this API return an analyzer list. The id field of each analyzer object is the analyzer ID. Range: 1 to 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.

Request Parameters

**Table 2** Request body parameters
Parameter	Mandatory	Type	Description
resource_id	No	String	Definition: Unique identifier of a resource. Constraints: N/A Range: 1 to 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed. Default Value: N/A
resource_owner_account	Yes	String	Definition: ID of the account whose resources need to be scanned. You can call the ListFindings API to retrieve the analysis finding list generated by a specified analyzer. The response of this API contains an analysis finding list. The resource_owner_account field in the list is the ID of the account whose resources need to be scanned. Constraints: N/A Range: 1 to 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed. Default Value: N/A
resource_project_id	No	String	Definition: Project ID of a resource. Constraints: N/A Range: A maximum of 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed. Default Value: N/A
resource_urn	Yes	String	Definition: Unique identifier of a resource. Constraints: N/A Range: The value can contain up to 1,500 characters. Default Value: N/A
finding_type	No	String	Definition: Finding type. Constraints: N/A Range: external_access: external access privilege_escalation: privilege escalation unused_iam_user_access_key: unused access key unused_iam_user_password: unused password unused_permission: unused permission unused_iam_agency: unused agency iam_bp_root_user_has_access_key: an AK/SK pair is bound to the root user iam_bp_access_api_with_password: APIs access using passwords iam_bp_login_protection_disabled: login protection disabled iam_bp_mfa_unconfigured: MFA not added iam_bp_assign_high_risk_sys_policy_or_role_to_user: high-risk system-defined policies or roles attached to users iam_bp_attach_high_risk_sys_identity_policy_to_user: high-risk system-defined identity policies attached to users iam_bp_assign_high_risk_sys_policy_or_role_to_agency: high-risk system-defined policies or roles attached to agencies iam_bp_attach_high_risk_sys_identity_policy_to_agency: high-risk system-defined identity policies attached to agencies Default Value: N/A

Response Parameters

Status code: 200

None

Example Requests

Immediately starting a scan of the policies applied to the specified resource

POST https://{hostname}/v5/analyzers/{analyzer_id}/scan

{
  "resource_owner_account" : "{analyzer_id}",
  "resource_urn" : "iam::{domain_id}:agency:{agency_name}",
  "resource_id" : "{agency_id}"
}