emfirge_policy_checks
Ask AWS IAM Access Analyzer whether the S3 bucket policies and role trust policies a branch changed are public, only after you approve the shown cost.
Parameters
branch_id: string · required; approve: true · optional; accept_estimate_id: string · optional; role_arn: string · optional
{ "branch_id": "branch_456" }
Returns
The response is JSON shaped for the operation. The fields and semantics are described below.
{
"estimate_id": "a17f…3c90", "branch_revision": "3f9a…c21e",
"policies": [ /* changed policies that would be sent */ ], "call_count": 1, "approximate_cost_usd": 0.002
}
Validation, behavior, and limits
Opt-in. Without approve it returns an estimate: exactly which policies would be sent (only ones that differ from the base), the number of calls, and an approximate cost. No AWS call is made.
After the user agrees, call it again with approve, accept_estimate_id and the same role_arn used for emfirge_scan. Each CheckNoPublicAccess call is billed to your AWS account, about $0.002 per policy (https://aws.amazon.com/iam/access-analyzer/pricing/). The role needs access-analyzer:CheckNoPublicAccess; redeploy the CloudFormation template if your role predates it.
AWS evidence can only make a verdict stricter. If AWS says public where Emfirge's local logic said not public, the policy is treated as public; if AWS says not public where local logic says public, the local answer is kept. Both disagreements are shown in coverage_warnings. Without the check, or with a demo role, Emfirge uses local logic and says so in coverage_warnings. Role trust policies are checked on the branch side only. Results apply only to the branch revision they were run on.