GETREQUESTAUTHDETAILS()`¶

About GetRequestAuthorizationDetails¶

Retrieves the authorization details for a specific access denied request. The details include the request context, the evaluations performed, and the policies that were evaluated.

Use this operation to understand why a request was denied. Supported services include an authorization ID in the access denied error message. Pass that ID to this operation to retrieve the details.

Authorization details are available for at least 24 hours after the denial.

To use this operation, you must have the iam:GetRequestAuthorizationDetails permission.

Method Signature¶

METHODS /AWS1/IF_IAB~GETREQUESTAUTHDETAILS
  IMPORTING
    !IV_AUTHORIZATIONID TYPE /AWS1/IABSTRING OPTIONAL
    !IV_NEXTTOKEN TYPE /AWS1/IABSTRING OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_iabgetreqauthdetsout
  RAISING
    /AWS1/CX_IABACCESSDENIEDEX
    /AWS1/CX_IABINTERNALSERVEREX
    /AWS1/CX_IABRESOURCENOTFOUNDEX
    /AWS1/CX_IABVLDTNEXCEPTION
    /AWS1/CX_IABCLIENTEXC
    /AWS1/CX_IABSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING¶

Required arguments:¶

`iv_authorizationid` `TYPE /AWS1/IABSTRING` `/AWS1/IABSTRING`¶

The authorization ID received in the access denied error message. This ID identifies the specific request to retrieve details for.

Optional arguments:¶

`iv_nexttoken` `TYPE /AWS1/IABSTRING` `/AWS1/IABSTRING`¶

The pagination token from a previous call, used to retrieve the next page of evaluations. Omit this value on the first call.

RETURNING¶

`oo_output` `TYPE REF TO /aws1/cl_iabgetreqauthdetsout` `/AWS1/CL_IABGETREQAUTHDETSOUT`¶

Examples¶

Syntax Example¶

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->getrequestauthdetails(
  iv_authorizationid = |string|
  iv_nexttoken = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  LOOP AT lo_result->get_requestcontext( ) into ls_row.
    lv_key = ls_row-key.
    lo_value = ls_row-value.
    IF lo_value IS NOT INITIAL.
    ENDIF.
  ENDLOOP.
  LOOP AT lo_result->get_evaluations( ) into lo_row_1.
    lo_row_2 = lo_row_1.
    IF lo_row_2 IS NOT INITIAL.
      lv_string = lo_row_2->get_action( ).
      lv_string = lo_row_2->get_resource( ).
      LOOP AT lo_row_2->get_context( ) into ls_row.
        lv_key = ls_row-key.
        lo_value = ls_row-value.
        IF lo_value IS NOT INITIAL.
        ENDIF.
      ENDLOOP.
      lv_evaluatedeffect = lo_row_2->get_evaluatedeffect( ).
      LOOP AT lo_row_2->get_matchedpolicies( ) into lo_row_3.
        lo_row_4 = lo_row_3.
        IF lo_row_4 IS NOT INITIAL.
          lv_string = lo_row_4->get_uri( ).
          LOOP AT lo_row_4->get_matchedstatements( ) into lo_row_5.
            lo_row_6 = lo_row_5.
            IF lo_row_6 IS NOT INITIAL.
              lv_string = lo_row_6->get_sid( ).
              lv_statementeffect = lo_row_6->get_evaluatedeffect( ).
            ENDIF.
          ENDLOOP.
        ENDIF.
      ENDLOOP.
    ENDIF.
  ENDLOOP.
  LOOP AT lo_result->get_policies( ) into lo_row_7.
    lo_row_8 = lo_row_7.
    IF lo_row_8 IS NOT INITIAL.
      lv_policytype = lo_row_8->get_type( ).
      lv_boolean = lo_row_8->get_inline( ).
      lv_string = lo_row_8->get_uri( ).
      LOOP AT lo_row_8->get_attachedto( ) into lo_row_9.
        lo_row_10 = lo_row_9.
        IF lo_row_10 IS NOT INITIAL.
          lv_string = lo_row_10->get_arn( ).
        ENDIF.
      ENDLOOP.
    ENDIF.
  ENDLOOP.
  lv_string = lo_result->get_nexttoken( ).
ENDIF.

/AWS1/IF_IAB=>GETREQUESTAUTHDETAILS()¶