---
title: "POST /policy/validation"
method: POST
path: "/policy/validation"
---

# POST /policy/validation

`POST /policy/validation`

Requests the validation of a policy and returns a list of findings. The findings help you identify issues and provide actionable recommendations to resolve the issue and enable you to author functional policies that meet security best practices.

## Query parameters

- `maxResults` integer
- `nextToken` string

## Request body

- object
  - `locale` 'DE' | 'EN' | 'ES' | 'FR' | 'IT' | 'JA' | 'KO' | 'PT_BR' | 'ZH_CN' | 'ZH_TW' — The locale to use for localizing the findings.
  - `policyDocument` string, required — The JSON policy document to use as the content for the policy.
  - `policyType` 'IDENTITY_POLICY' | 'RESOURCE_POLICY' | 'SERVICE_CONTROL_POLICY', required — <p>The type of policy to validate. Identity policies grant permissions to IAM principals. Identity policies include managed and inline policies for IAM roles, users, and groups. They also include service-control policies (SCPs) that are attached to an Amazon Web Services organization, organizational unit (OU), or an account.</p> <p>Resource policies grant permissions on Amazon Web Services resources. Resource policies include trust policies for IAM roles and bucket policies for Amazon S3 buckets. You can provide a generic input such as identity policy or resource policy or a specific input such as managed policy or Amazon S3 bucket policy. </p>
  - `validatePolicyResourceType` 'AWS::S3::Bucket' | 'AWS::S3::AccessPoint' | 'AWS::S3::MultiRegionAccessPoint' | 'AWS::S3ObjectLambda::AccessPoint' | 'AWS::IAM::AssumeRolePolicyDocument' — <p>The type of resource to attach to your resource policy. Specify a value for the policy validation resource type only if the policy type is <code>RESOURCE_POLICY</code>. For example, to validate a resource policy to attach to an Amazon S3 bucket, you can choose <code>AWS::S3::Bucket</code> for the policy validation resource type.</p> <p>For resource types not supported as valid values, IAM Access Analyzer runs policy checks that apply to all resource policies. For example, to validate a resource policy to attach to a KMS key, do not specify a value for the policy validation resource type and IAM Access Analyzer will run policy checks that apply to all resource policies.</p>

## Response `200`

Success

- ValidatePolicyResponse
  - `findings` ValidatePolicyFinding[], required — The list of findings in a policy returned by IAM Access Analyzer based on its suite of policy checks.
    - `findingDetails` string, required — A localized message that explains the finding and provides guidance on how to address it.
    - `findingType` 'ERROR' | 'SECURITY_WARNING' | 'SUGGESTION' | 'WARNING', required — <p>The impact of the finding.</p> <p>Security warnings report when the policy allows access that we consider overly permissive.</p> <p>Errors report when a part of the policy is not functional.</p> <p>Warnings report non-security issues when a policy does not conform to policy writing best practices.</p> <p>Suggestions recommend stylistic improvements in the policy that do not impact access.</p>
    - `issueCode` string, required — The issue code provides an identifier of the issue associated with this finding.
    - `learnMoreLink` string, required — A link to additional documentation about the type of finding.
    - `locations` Location[], required — The list of locations in the policy document that are related to the finding. The issue code provides a summary of an issue identified by the finding.
      - `path` PathElement[], required — A path in a policy, represented as a sequence of path elements.
        - `index` integer — Refers to an index in a JSON array.
        - `key` string — Refers to a key in a JSON object.
        - `substring` object — Refers to a substring of a literal string in a JSON object.
          - `start` integer, required — The start index of the substring, starting from 0.
          - `length` integer, required — The length of the substring.
        - `value` string — Refers to the value associated with a given key in a JSON object.
      - `span` object, required — A span in a policy.
        - `start` object, required — The start position of the span (inclusive).
          - `line` integer, required — The line of the position, starting from 1.
          - `column` integer, required — The column of the position, starting from 0.
          - `offset` integer, required — The offset within the policy that corresponds to the position, starting from 0.
        - `end` object, required — The end position of the span (exclusive).
          - `line` integer, required — The line of the position, starting from 1.
          - `column` integer, required — The column of the position, starting from 0.
          - `offset` integer, required — The offset within the policy that corresponds to the position, starting from 0.
  - `nextToken` string — A token used for pagination of results returned.

## Other responses

- `480` — ValidationException
- `481` — InternalServerException
- `482` — ThrottlingException
- `483` — AccessDeniedException

---

[API](https://skmtc.net/aws/apis/accessanalyzer.md) · [All operations](https://skmtc.net/aws/apis/accessanalyzer/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/accessanalyzer/versions/d729b5bbb9cd/schema)