CloudWatch Omni

Returns temporary credentials for working with data in a space, limited to the actions you request.

The credentials allow only the requested actions that can be granted in the space and that your access grants allow. Requested actions that cannot be conferred are ignored rather than rejected.

See also: AWS API Documentation

Request Syntax

client.get_space_data_access(
    spaceId='string',
    targetScopes=[
        {
            'actions': [
                'string',
            ]
        },
    ],
    durationSeconds=123,
    auditContext={
        'string': 'string'
    }
)

type spaceId:

string

param spaceId:

[REQUIRED]

The unique ID of the space to return credentials for.

type targetScopes:

list

param targetScopes:

[REQUIRED]

The actions to include in the credentials, grouped by service.

• (dict) --

  One requested scope: an explicit list of actions for one service. All actions in an entry share one service prefix. The same service may appear in more than one entry.

  • actions (list) -- [REQUIRED]

    The actions of one service, each with its service prefix, for example "logs:StartQuery".

    • (string) --

      An action to include in the credentials, with its service prefix, for example "logs:StartQuery". Wildcards are not supported.

type durationSeconds:

integer

param durationSeconds:

The lifetime of the credentials, in seconds. Defaults to 3600.

type auditContext:

dict

param auditContext:

Caller-supplied key-value pairs that are recorded for auditing. They do not affect authorization or the permissions of the credentials.

• (string) --

  • (string) --

rtype:

dict

returns:

Response Syntax

{
    'credentials': {
        'accessKeyId': 'string',
        'secretAccessKey': 'string',
        'sessionToken': 'string',
        'expiration': datetime(2015, 1, 1)
    }
}

Response Structure

• (dict) --

  • credentials (dict) --

    The temporary AWS credentials for the space.

    • accessKeyId (string) --

      The AWS access key ID.

    • secretAccessKey (string) --

      The AWS secret access key.

    • sessionToken (string) --

      The AWS session token.

    • expiration (datetime) --

      The timestamp when the credentials expire.