ValidatePolicy-Resource Access Management(RAM)-阿里云帮助中心

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request syntax

POST  HTTP/1.1

Request parameters

Parameter	Type	Required	Description	Example
PolicyDocument	string	Yes	The content of the access policy to validate. The maximum length is 61,440 characters.	{ "Version": "1", "Statement": [{ "Effect": "Allow", "Action": "ecs:", "Resources": "" }] }
PolicyType	string	Yes	The policy type.	IdentityBasedPolicy
ValidatePolicyResourceType	string	No	The resource type. This parameter can be specified only when PolicyType is set to ResourceBasedPolicy. This enables more precise validation of resource-based policies. Valid values: ACS::RAM::Role : ACS::RAM::Role ACS::OSS::Bucket : ACS::OSS::Bucket	ACS::OSS::Bucket
MaxResults	integer	No	The maximum number of validation results to return in a single request.	10
NextToken	string	No	The pagination token. Leave this parameter empty for the first request. For subsequent requests, use the NextToken value returned in the previous response.	eyJpbmRleCI6IjIifQ==

Response elements

Element	Type	Description	Example
	object	Schema of Response
Findings	array<object>	The list of issues identified during policy validation.
	object	The issue identified during policy validation.
FindingType	string	The type of the analysis result. Valid values: Suggestion : Suggestion Warning : Warning Error : Error SecurityWarning : SecurityWarning	Error
IssueCode	string	The unique code of the issue that identifies the specific validation rule.	INVALID_EFFECT
Paths	array	The list of path locations of the issue in the policy document.
	string	The path location of the issue in the policy document.	$.Statement[0].Effect
NextToken	string	The pagination token.	eyJpbmRleCI6IjIifQ==
RequestId	string	The request ID.	A1B2C3D4-E5F6-7890-ABCD-EF1234567890

Examples

Success response

JSON format

{
  "Findings": [
    {
      "FindingType": "Error",
      "IssueCode": "INVALID_EFFECT",
      "Paths": [
        "$.Statement[0].Effect"
      ]
    }
  ],
  "NextToken": "eyJpbmRleCI6IjIifQ==",
  "RequestId": "A1B2C3D4-E5F6-7890-ABCD-EF1234567890"
}

Error codes

HTTP status code	Error code	Error message	Description
400	InvalidParameter.%s	The specified parameter %s is not valid.	The specified parameter %s is not valid.
400	NotSupportedOperation.UpdateFindingToResolved	The operation is not supported.	You cannot update finding's status to Resolved
400	NotSupportedOperation.UpdateResolvedFinding	The operation is not supported.	The operation is not supported because the status is resolved.
400	ValidationException	%s.	Parameter check error
400	MissingParameter.%s	The specified parameter %s is missing.	The parameter %s is required.
500	InternalError	The request processing has failed due to some unknown error.	An internal error occurred.
404	EntityNotExist.%s	The %s does not exist.	%s does not exist

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.