check-access-not-granted.rst

**To check whether the specified access isn't allowed by a policy**

The following ``check-access-not-granted`` example checks whether the specified access isn't allowed by a policy. ::

    aws accessanalyzer check-access-not-granted \
        --policy-document file://myfile.json \
        --access actions="s3:DeleteBucket","s3:GetBucketLocation" \
        --policy-type IDENTITY_POLICY

Contents of ``myfile.json``::

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "s3:GetObject",
                    "s3:ListBucket"
                ],
                "Resource": [
                    "arn:aws:s3:::amzn-s3-demo-bucket",
                    "arn:aws:s3:::amzn-s3-demo-bucket/*"
                ]
            }
        ]
    }

Output::

    {
        "result": "PASS",
        "message": "The policy document does not grant access to perform one or more of the listed actions."
    }

For more information, see `Previewing access with IAM Access Analyzer APIs <https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-preview-access-apis.html>`__ in the *AWS IAM User Guide*.