:doc:`Organizations <../../organizations>` / Client / list_policies_for_target

************************
list_policies_for_target
************************



.. py:method:: Organizations.Client.list_policies_for_target(**kwargs)

  

  Lists the policies that are directly attached to the specified target root, organizational unit (OU), or account. You must specify the policy type that you want included in the returned list.

   

  .. note::

    

    When calling List* operations, always check the ``NextToken`` response parameter value, even if you receive an empty result set. These operations can occasionally return an empty set of results even when more results are available. Continue making requests until ``NextToken`` returns null. A null ``NextToken`` value indicates that you have retrieved all available results.

    

   

  You can only call this operation from the management account or a member account that is a delegated administrator.

  

  See also: `AWS API Documentation <https://docs.aws.amazon.com/goto/WebAPI/organizations-2016-11-28/ListPoliciesForTarget>`_  


  **Request Syntax**
  ::

    response = client.list_policies_for_target(
        TargetId='string',
        Filter='SERVICE_CONTROL_POLICY'|'RESOURCE_CONTROL_POLICY'|'TAG_POLICY'|'BACKUP_POLICY'|'AISERVICES_OPT_OUT_POLICY'|'CHATBOT_POLICY'|'DECLARATIVE_POLICY_EC2'|'SECURITYHUB_POLICY'|'INSPECTOR_POLICY'|'UPGRADE_ROLLOUT_POLICY'|'BEDROCK_POLICY'|'S3_POLICY'|'NETWORK_SECURITY_DIRECTOR_POLICY',
        NextToken='string',
        MaxResults=123
    )
    
  :type TargetId: string
  :param TargetId: **[REQUIRED]** 

    ID for the root, organizational unit, or account whose policies you want to list.

     

    The `regex pattern <http://wikipedia.org/wiki/regex>`__ for a target ID string requires one of the following:

     

    
    * **Root** - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits.
     
    * **Account** - A string that consists of exactly 12 digits.
     
    * **Organizational unit (OU)** - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.
    

    

  
  :type Filter: string
  :param Filter: **[REQUIRED]** 

    The type of policy that you want to include in the returned list. You must specify one of the following values:

     

    
    * `SERVICE_CONTROL_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html>`__
     
    * `RESOURCE_CONTROL_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps.html>`__
     
    * `DECLARATIVE_POLICY_EC2 <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_declarative.html>`__
     
    * `BACKUP_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_backup.html>`__
     
    * `TAG_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html>`__
     
    * `CHATBOT_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_chatbot.html>`__
     
    * `AISERVICES_OPT_OUT_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out.html>`__
     
    * `SECURITYHUB_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_security_hub.html>`__
     
    * `UPGRADE_ROLLOUT_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_upgrade_rollout.html>`__
     
    * `INSPECTOR_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inspector.html>`__
     
    * `BEDROCK_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html>`__
     
    * `S3_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_s3.html>`__
     
    * `NETWORK_SECURITY_DIRECTOR_POLICY <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_network_security_director.html>`__
    

    

  
  :type NextToken: string
  :param NextToken: 

    The parameter for receiving additional results if you receive a ``NextToken`` response in a previous request. A ``NextToken`` response indicates that more output is available. Set this parameter to the value of the previous call's ``NextToken`` response to indicate where the output should continue from.

    

  
  :type MaxResults: integer
  :param MaxResults: 

    The maximum number of items to return in the response. If more results exist than the specified ``MaxResults`` value, a token is included in the response so that you can retrieve the remaining results.

    

  
  
  :rtype: dict
  :returns: 
    
    **Response Syntax**

    
    ::

      {
          'Policies': [
              {
                  'Id': 'string',
                  'Arn': 'string',
                  'Name': 'string',
                  'Description': 'string',
                  'Type': 'SERVICE_CONTROL_POLICY'|'RESOURCE_CONTROL_POLICY'|'TAG_POLICY'|'BACKUP_POLICY'|'AISERVICES_OPT_OUT_POLICY'|'CHATBOT_POLICY'|'DECLARATIVE_POLICY_EC2'|'SECURITYHUB_POLICY'|'INSPECTOR_POLICY'|'UPGRADE_ROLLOUT_POLICY'|'BEDROCK_POLICY'|'S3_POLICY'|'NETWORK_SECURITY_DIRECTOR_POLICY',
                  'AwsManaged': True|False
              },
          ],
          'NextToken': 'string'
      }
      
    **Response Structure**

    

    - *(dict) --* 
      

      - **Policies** *(list) --* 

        The list of policies that match the criteria in the request.

        
        

        - *(dict) --* 

          Contains information about a policy, but does not include the content. To see the content of a policy, see  DescribePolicy.

          
          

          - **Id** *(string) --* 

            The unique identifier (ID) of the policy.

             

            The `regex pattern <http://wikipedia.org/wiki/regex>`__ for a policy ID string requires "p-" followed by from 8 to 128 lowercase or uppercase letters, digits, or the underscore character (_).

            
          

          - **Arn** *(string) --* 

            The Amazon Resource Name (ARN) of the policy.

             

            For more information about ARNs in Organizations, see `ARN Formats Supported by Organizations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsorganizations.html#awsorganizations-resources-for-iam-policies>`__ in the *Amazon Web Services Service Authorization Reference*.

            
          

          - **Name** *(string) --* 

            The friendly name of the policy.

             

            The `regex pattern <http://wikipedia.org/wiki/regex>`__ that is used to validate this parameter is a string of any of the characters in the ASCII character range.

            
          

          - **Description** *(string) --* 

            The description of the policy.

            
          

          - **Type** *(string) --* 

            The type of policy.

            
          

          - **AwsManaged** *(boolean) --* 

            A boolean value that indicates whether the specified policy is an Amazon Web Services managed policy. If true, then you can attach the policy to roots, OUs, or accounts, but you cannot edit it.

            
      
    
      

      - **NextToken** *(string) --* 

        If present, indicates that more output is available than is included in the current response. Use this value in the ``NextToken`` request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the ``NextToken`` response element comes back as ``null``.

        
  
  **Exceptions**
  
  *   :py:class:`Organizations.Client.exceptions.AccessDeniedException`

  
  *   :py:class:`Organizations.Client.exceptions.AWSOrganizationsNotInUseException`

  
  *   :py:class:`Organizations.Client.exceptions.InvalidInputException`

  
  *   :py:class:`Organizations.Client.exceptions.ServiceException`

  
  *   :py:class:`Organizations.Client.exceptions.TargetNotFoundException`

  
  *   :py:class:`Organizations.Client.exceptions.TooManyRequestsException`

  
  *   :py:class:`Organizations.Client.exceptions.UnsupportedAPIEndpointException`

  

  **Examples**

  The following example shows how to get a list of all service control policies (SCPs) of the type specified by the Filter parameter, that are directly attached to an account. The returned list does not include policies that apply to the account because of inheritance from its location in an OU hierarchy:/n/n
  ::

    response = client.list_policies_for_target(
        Filter='SERVICE_CONTROL_POLICY',
        TargetId='444444444444',
    )
    
    print(response)

  
  Expected Output:
  ::

    {
        'Policies': [
            {
                'Arn': 'arn:aws:organizations::111111111111:policy/o-exampleorgid/service_control_policy/p-examplepolicyid222',
                'AwsManaged': False,
                'Description': 'Enables account admins to delegate permissions for any EC2 actions to users and roles in their accounts.',
                'Id': 'p-examplepolicyid222',
                'Name': 'AllowAllEC2Actions',
                'Type': 'SERVICE_CONTROL_POLICY',
            },
        ],
        'ResponseMetadata': {
            '...': '...',
        },
    }

  