/test-authorization - AWS IoT Wireless

Tests if a specified principal is authorized to perform an IoT action on a specified resource. Use this to test and debug the authorization behavior of devices that connect to the IoT device gateway.

Requires permission to access the TestAuthorization action.

curl --location -g --request POST 'https://api.iotwireless.{region}.amazonaws.com/test-authorization' \ --header 'Content-Type: application/json' \ --data-raw '{ "principal": "string", "cognitoIdentityPoolId": "string", "authInfos": [ { "actionType": "PUBLISH", "resources": [] } ], "policyNamesToAdd": [ "string" ], "policyNamesToSkip": [ "string" ] }'

Request

Query Params

clientId

string

optional

The MQTT client ID.

Body Params application/json

principal

string

optional

The principal. Valid principals are CertificateArn (arn:aws:iot:region:accountId:cert/certificateId), thingGroupArn (arn:aws:iot:region:accountId:thinggroup/groupName) and CognitoId (region:id).

cognitoIdentityPoolId

string

optional

The Cognito identity pool ID.

authInfos

array[object (AuthInfo) {2}]

required

A list of authorization info objects. Simulating authorization will create a response for each authInfo object in the list.

>= 1 items<= 10 items

actionType

enum<string>

optional

The type of action for which the principal is being authorized.

Allowed values:

PUBLISHSUBSCRIBERECEIVECONNECT

resources

array[string]

required

The resources for which the principal is being authorized to perform the specified action.

policyNamesToAdd

array[string]

optional

When testing custom authorization, the policies specified here are treated as if they are attached to the principal being authorized.

policyNamesToSkip

array[string]

optional

When testing custom authorization, the policies specified here are treated as if they are not attached to the principal being authorized.

Examples

Responses

🟢200Success

application/json

Body

authResults

array[object (AuthResult) {5}]

optional

The authentication results.

authInfo

object

optional

Authorization information.

allowed

object

optional

The policies and statements that allowed the specified action.

denied

object

optional

The policies and statements that denied the specified action.

authDecision

enum<string>

optional

The final authorization decision of this scenario. Multiple statements are taken into account when determining the authorization decision. An explicit deny statement can override multiple allow statements.

Allowed values:

ALLOWEDEXPLICIT_DENYIMPLICIT_DENY

missingContextValues

array[string]

optional

Contains any missing context values found while evaluating policy.

🟠480ResourceNotFoundException

🟠481InvalidRequestException

🟠482ThrottlingException

🟠483UnauthorizedException

🟠484ServiceUnavailableException

🟠485InternalFailureException

🟠486LimitExceededException