Class | AWS::Policy::Statement |
In: |
lib/aws/policy.rb
|
Parent: | Object |
Represents a statement in a policy.
@see Policy#allow @see Policy#deny
actions | [RW] |
@return [Array] Returns an array of statement actions included
by this policy statement. |
conditions | [RW] | @return [Array] Returns an array of conditions for this policy. |
effect | [RW] |
@return [String] Returns the statement effect, either "Allow" or
"Deny" |
excluded_actions | [RW] |
@return [Array] Returns an array of actions excluded by this
policy statement. |
principals | [RW] | @return [Array] Returns an array of principals. |
resources | [RW] |
@return [Array] Returns an array of resources affected by this
policy statement. |
sid | [RW] | @return [String] Returns the statement id |
Constructs a new statement.
@option opts [String] :sid The statement ID. This is optional; if
omitted, a UUID will be generated for the statement.
@option opts [String] :effect The statement effect, which must be either
"Allow" or "Deny". @see Policy#allow @see Policy#deny
@option opts [String or array of strings] :principals The account(s)
affected by the statement. These should be AWS account IDs.
@option opts :actions The action or actions affected by
the statement. These can be symbols or strings. If they are strings, you can use wildcard character "*" to match zero or more characters in the action name. Symbols are expected to match methods of S3::Client.
@option opts :excluded_actions Action or actions which are
explicitly not affected by this statement. As with +:actions+, these may be symbols or strings.
@option opts [String or array of strings] :resources The
resource(s) affected by the statement. These can be expressed as ARNs (e.g. +arn:aws:s3:::mybucket/mykey+) or you may omit the +arn:aws:s3:::+ prefix and just give the path as +bucket_name/key+. You may use the wildcard character "*" to match zero or more characters in the resource name.
@option opts [ConditionBlock or Hash] :conditions
Additional conditions that narrow the effect of the statement. It's typically more convenient to use the ConditionBuilder instance returned from Policy#allow or Policy#deny to add conditions to a statement.
@see S3::Client