test_authorization¶

IoT.Client.test_authorization(**kwargs)¶

Tests if a specified principal is authorized to perform an IoT action on a specified resource. Use this to test and debug the authorization behavior of devices that connect to the IoT device gateway.

Requires permission to access the TestAuthorization action.

See also: AWS API Documentation

Request Syntax

response = client.test_authorization(
    principal='string',
    cognitoIdentityPoolId='string',
    authInfos=[
        {
            'actionType': 'PUBLISH'|'SUBSCRIBE'|'RECEIVE'|'CONNECT',
            'resources': [
                'string',
            ]
        },
    ],
    clientId='string',
    policyNamesToAdd=[
        'string',
    ],
    policyNamesToSkip=[
        'string',
    ]
)

Parameters

principal (string) -- The principal. Valid principals are CertificateArn (arn:aws:iot:region :accountId :cert/certificateId ), thingGroupArn (arn:aws:iot:region :accountId :thinggroup/groupName ) and CognitoId (region :id ).
cognitoIdentityPoolId (string) -- The Cognito identity pool ID.
authInfos (list) --
[REQUIRED]

A list of authorization info objects. Simulating authorization will create a response for each authInfo object in the list.
- (dict) --
  A collection of authorization information.
  - actionType (string) --
    The type of action for which the principal is being authorized.
  - resources (list) -- [REQUIRED]
    The resources for which the principal is being authorized to perform the specified action.
    - (string) --
clientId (string) -- The MQTT client ID.
policyNamesToAdd (list) --
When testing custom authorization, the policies specified here are treated as if they are attached to the principal being authorized.
- (string) --
policyNamesToSkip (list) --
When testing custom authorization, the policies specified here are treated as if they are not attached to the principal being authorized.
- (string) --

Return type

dict

Returns

Response Syntax

{
    'authResults': [
        {
            'authInfo': {
                'actionType': 'PUBLISH'|'SUBSCRIBE'|'RECEIVE'|'CONNECT',
                'resources': [
                    'string',
                ]
            },
            'allowed': {
                'policies': [
                    {
                        'policyName': 'string',
                        'policyArn': 'string'
                    },
                ]
            },
            'denied': {
                'implicitDeny': {
                    'policies': [
                        {
                            'policyName': 'string',
                            'policyArn': 'string'
                        },
                    ]
                },
                'explicitDeny': {
                    'policies': [
                        {
                            'policyName': 'string',
                            'policyArn': 'string'
                        },
                    ]
                }
            },
            'authDecision': 'ALLOWED'|'EXPLICIT_DENY'|'IMPLICIT_DENY',
            'missingContextValues': [
                'string',
            ]
        },
    ]
}

Response Structure

(dict) --
- authResults (list) --
  
  The authentication results.
  - (dict) --
    
    The authorizer result.
    - authInfo (dict) --
      
      Authorization information.
      - actionType (string) --
        
        The type of action for which the principal is being authorized.
      - resources (list) --
        
        The resources for which the principal is being authorized to perform the specified action.
        
        (string) --
    - allowed (dict) --
      
      The policies and statements that allowed the specified action.
      - policies (list) --
        
        A list of policies that allowed the authentication.
        
        (dict) --
        
        Describes an IoT policy.
        
        policyName (string) --
        
        The policy name.
        
        policyArn (string) --
        
        The policy ARN.
    - denied (dict) --
      
      The policies and statements that denied the specified action.
      - implicitDeny (dict) --
        
        Information that implicitly denies the authorization. When a policy doesn't explicitly deny or allow an action on a resource it is considered an implicit deny.
        
        policies (list) --
        
        Policies that don't contain a matching allow or deny statement for the specified action on the specified resource.
        
        (dict) --
        
        Describes an IoT policy.
        
        policyName (string) --
        
        The policy name.
        
        policyArn (string) --
        
        The policy ARN.
      - explicitDeny (dict) --
        
        Information that explicitly denies the authorization.
        
        policies (list) --
        
        The policies that denied the authorization.
        
        (dict) --
        
        Describes an IoT policy.
        
        policyName (string) --
        
        The policy name.
        
        policyArn (string) --
        
        The policy ARN.
    - authDecision (string) --
      
      The final authorization decision of this scenario. Multiple statements are taken into account when determining the authorization decision. An explicit deny statement can override multiple allow statements.
    - missingContextValues (list) --
      
      Contains any missing context values found while evaluating policy.
      - (string) --

Exceptions

IoT.Client.exceptions.ResourceNotFoundException
IoT.Client.exceptions.InvalidRequestException
IoT.Client.exceptions.ThrottlingException
IoT.Client.exceptions.UnauthorizedException
IoT.Client.exceptions.ServiceUnavailableException
IoT.Client.exceptions.InternalFailureException
IoT.Client.exceptions.LimitExceededException

Table Of Contents

test_authorization¶