Validating a Policy

Function

This API is used to validate a policy and return a list of findings.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
AccessAnalyzer::validatePolicy	Read	-	-	-	-

URI

POST /v5/policies/validate

**Table 1** Query Parameters
Parameter	Mandatory	Type	Description
limit	No	Integer	Definition: Maximum number of results on a page. Constraints: N/A Range: The value ranges from 1 to 200. Default Value: 100
marker	No	String	Definition: Page marker. Constraints: N/A Range: The value contains 4 to 400 characters. Only letters, digits, and special characters (+/=-_) are allowed. Default Value: N/A

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Language	No	String	Definition: Language of the returned message. Constraints: N/A Range: zh-cn: Chinese en-us: English zh-cn: Chinese Default Value:

**Table 3** Request body parameters
Parameter	Mandatory	Type	Description
policy_document	Yes	String	Definition: JSON policy document. Constraints: N/A Range: The value contains 0 to 131,072 characters. Default Value: N/A
policy_type	Yes	String	Definition: Type of the policy to be validated. Constraints: N/A Range: identity_policy: identity policy resource_policy: resource policy service_control_policy: service control policy resource_control_policy: resource control policy network_control_policy: network control policy Default Value: N/A
validate_policy_resource_type	No	String	Definition: The type of resource to attach to your resource policy. Constraints: N/A Range: iam:agency: IAM agency Default Value: N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
findings	Array of ValidatePolicyFinding objects	Definition: Actionable recommendation that can be used to improve the policy. Range: N/A
page_info	PageInfo object	Definition: Page information. Range: N/A

**Table 5** ValidatePolicyFinding
Parameter	Type	Description
finding_details	String	Definition: A message that explains the finding and provides guidance on how to address it. Range: N/A
finding_type	String	Definition: Impact level. Range: security_warning: There are security risks, which may be caused by overly permissive access. error: There are errors that prevent the policy from functioning, such as syntax errors or invalid parameters. If an error occurs, the policy cannot be created. warning: There are warnings that prevent the policy from functioning, such as a mismatch between a parameter type and a value. The policy can still be created even if there is a warning. suggestion: There are suggestions for the policy to achieve expected results. For example, suggestions are given when there are empty arrays or empty objects.
issue_code	String	Definition: Provides an identifier of the issue associated with the validation check findings. Range: N/A
learn_more_link	String	Definition: Links to related documents associated with the validation check findings. Range: N/A
locations	Array of Location objects	Definition: List of locations that are related to the validation check findings in the policy document. Range: N/A

**Table 6** Location
Parameter	Type	Description
path	Array of PathElement objects	Definition: A path in a policy, represented as a sequence of path elements. Range: N/A
span	Span object	Definition: Span of the cursor in a policy, consisting of a start position (inclusive) and end position (exclusive). Range: N/A

**Table 7** PathElement
Parameter	Type	Description
index	Integer	Definition: Index in the array, starting from 0. Range: N/A
key	String	Definition: A key in an object. Range: N/A
substring	Substring object	Definition: Sub-string of a literal string in a JSON object. Range: N/A
value	String	Definition: A value associated with a given key in an object. Range: N/A

**Table 8** Substring
Parameter	Type	Description
start	Integer	Definition: Start index of a substring, starting from 0. The value 0 indicates the first character. Range: N/A
length	Integer	Definition: Length of a substring. Range: N/A

**Table 9** Span
Parameter	Type	Description
start	Position object	Definition: Location in the policy. Range: N/A
end	Position object	Definition: Location in the policy. Range: N/A

**Table 10** Position
Parameter	Type	Description
line	Integer	Definition: Row number of the location, starting from 1. Range: N/A
column	Integer	Definition: Column number of the location, starting from 0. Range: N/A
offset	Integer	Definition: Offset within the policy that corresponds to the position, starting from 0. Range: N/A

**Table 11** PageInfo
Parameter	Type	Description
current_count	Integer	Definition: Number of items on the current page. Range: N/A
next_marker	String	Definition: If present, it indicates that the available output is more than the output contained in the current response. Use this value in the marker request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this operation until the next_marker response returns null. Range: Only letters, digits, plus signs (+), slashes (/), equal signs (=), underscores (_), and hyphens (-) are allowed.

Example Requests

Requesting the validation of a policy and returning a list of findings

POST https://{hostname}/v5/policies/validate

{
  "policy_document" : "",
  "policy_type" : "identity_policy"
}

Example Responses

Status code: 200

{
  "findings" : [ {
    "finding_details" : "Fix the JSON syntax error in row 1 and column 0 of index 0.",
    "finding_type" : "error",
    "issue_code" : "JSON_SYNTAX_ERROR",
    "learn_more_link" : "https://{endpoint}/section0",
    "locations" : [ {
      "path" : [ ],
      "span" : {
        "start" : {
          "line" : 1,
          "column" : 0,
          "offset" : 0
        },
        "end" : {
          "line" : 1,
          "column" : 1,
          "offset" : 1
        }
      }
    } ]
  } ],
  "page_info" : {
    "current_count" : 1,
    "next_marker" : null
  }
}