Amazon Aurora DSQL

Deletes the resource-based policy attached to a cluster. This removes all access permissions defined by the policy, reverting to default access controls.

See also: AWS API Documentation

Request Syntax

client.delete_cluster_policy(
    identifier='string',
    expectedPolicyVersion='string',
    clientToken='string'
)

type identifier:

string

param identifier:

[REQUIRED]

The ID of the cluster.

type expectedPolicyVersion:

string

param expectedPolicyVersion:

The expected version of the policy to delete. This parameter ensures that you're deleting the correct version of the policy and helps prevent accidental deletions.

type clientToken:

string

param clientToken:

Idempotency token so a request is only processed once.

This field is autopopulated if not provided.

rtype:

dict

returns:

Response Syntax

{
    'policyVersion': 'string'
}

Response Structure

• (dict) --

  • policyVersion (string) --

    The version of the policy that was deleted.

Attaches a resource-based policy to a cluster. This policy defines access permissions and conditions for the cluster, allowing you to control which principals can perform actions on the cluster.

See also: AWS API Documentation

Request Syntax

client.put_cluster_policy(
    identifier='string',
    policy='string',
    bypassPolicyLockoutSafetyCheck=True|False,
    expectedPolicyVersion='string',
    clientToken='string'
)

type identifier:

string

param identifier:

[REQUIRED]

The ID of the cluster.

type policy:

string

param policy:

[REQUIRED]

The resource-based policy document to attach to the cluster. This should be a valid JSON policy document that defines permissions and conditions.

type bypassPolicyLockoutSafetyCheck:

boolean

param bypassPolicyLockoutSafetyCheck:

A flag that allows you to bypass the policy lockout safety check. When set to true, this parameter allows you to apply a policy that might lock you out of the cluster. Use with caution.

type expectedPolicyVersion:

string

param expectedPolicyVersion:

The expected version of the current policy. This parameter ensures that you're updating the correct version of the policy and helps prevent concurrent modification conflicts.

type clientToken:

string

param clientToken:

Idempotency token so a request is only processed once.

This field is autopopulated if not provided.

rtype:

dict

returns:

Response Syntax

{
    'policyVersion': 'string'
}

Response Structure

• (dict) --

  • policyVersion (string) --

    The version of the policy after it has been updated or created.

Retrieves the resource-based policy document attached to a cluster. This policy defines the access permissions and conditions for the cluster.

See also: AWS API Documentation

Request Syntax

client.get_cluster_policy(
    identifier='string'
)

type identifier:

string

param identifier:

[REQUIRED]

The ID of the cluster to retrieve the policy from.

rtype:

dict

returns:

Response Syntax

{
    'policy': 'string',
    'policyVersion': 'string'
}

Response Structure

• (dict) --

  • policy (string) --

    The resource-based policy document attached to the cluster, returned as a JSON string.

  • policyVersion (string) --

    The version of the policy document. This version number is incremented each time the policy is updated.

{'bypassPolicyLockoutSafetyCheck': 'boolean', 'policy': 'string'}

The CreateCluster API allows you to create both single-Region clusters and multi-Region clusters. With the addition of the multiRegionProperties parameter, you can create a cluster with witness Region support and establish peer relationships with clusters in other Regions during creation.

Required permissions

dsql:CreateCluster

Required to create a cluster.

Resources: arn:aws:dsql:region:account-id:cluster/*

dsql:TagResource

Permission to add tags to a resource.

Resources: arn:aws:dsql:region:account-id:cluster/*

dsql:PutMultiRegionProperties

Permission to configure multi-Region properties for a cluster.

Resources: arn:aws:dsql:region:account-id:cluster/*

dsql:AddPeerCluster

When specifying multiRegionProperties.clusters, permission to add peer clusters.

Resources:

• Local cluster: arn:aws:dsql:region:account-id:cluster/*

• Each peer cluster: exact ARN of each specified peer cluster

  dsql:PutWitnessRegion

When specifying multiRegionProperties.witnessRegion, permission to set a witness Region. This permission is checked both in the cluster Region and in the witness Region.

Resources: arn:aws:dsql:region:account-id:cluster/*

Condition Keys: dsql:WitnessRegion (matching the specified witness region)

See also: AWS API Documentation

Request Syntax

client.create_cluster(
    deletionProtectionEnabled=True|False,
    kmsEncryptionKey='string',
    tags={
        'string': 'string'
    },
    clientToken='string',
    multiRegionProperties={
        'witnessRegion': 'string',
        'clusters': [
            'string',
        ]
    },
    policy='string',
    bypassPolicyLockoutSafetyCheck=True|False
)

type deletionProtectionEnabled:

boolean

param deletionProtectionEnabled:

If enabled, you can't delete your cluster. You must first disable this property before you can delete your cluster.

type kmsEncryptionKey:

string

param kmsEncryptionKey:

The KMS key that encrypts and protects the data on your cluster. You can specify the ARN, ID, or alias of an existing key or have Amazon Web Services create a default key for you.

type tags:

dict

param tags:

A map of key and value pairs to use to tag your cluster.

• (string) --

  Unique tag key, maximum 128 Unicode characters in UTF-8.

  • (string) --

    Tag value, maximum 256 Unicode characters in UTF-8.

type clientToken:

string

param clientToken:

A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. Idempotency ensures that an API request completes only once. With an idempotent request, if the original request completes successfully, the subsequent retries with the same client token return the result from the original successful request and they have no additional effect.

If you don't specify a client token, the Amazon Web Services SDK automatically generates one.

This field is autopopulated if not provided.

type multiRegionProperties:

dict

param multiRegionProperties:

The configuration settings when creating a multi-Region cluster, including the witness region and linked cluster properties.

• witnessRegion (string) --

  The Region that serves as the witness region for a multi-Region cluster. The witness Region helps maintain cluster consistency and quorum.

• clusters (list) --

  The set of peered clusters that form the multi-Region cluster configuration. Each peered cluster represents a database instance in a different Region.

  • (string) --

    The Amazon Resource Name of the cluster.

type policy:

string

param policy:

An optional resource-based policy document in JSON format that defines access permissions for the cluster.

type bypassPolicyLockoutSafetyCheck:

boolean

param bypassPolicyLockoutSafetyCheck:

An optional field that controls whether to bypass the lockout prevention check. When set to true, this parameter allows you to apply a policy that might lock you out of the cluster. Use with caution.

rtype:

dict

returns:

Response Syntax

{
    'identifier': 'string',
    'arn': 'string',
    'status': 'CREATING'|'ACTIVE'|'IDLE'|'INACTIVE'|'UPDATING'|'DELETING'|'DELETED'|'FAILED'|'PENDING_SETUP'|'PENDING_DELETE',
    'creationTime': datetime(2015, 1, 1),
    'multiRegionProperties': {
        'witnessRegion': 'string',
        'clusters': [
            'string',
        ]
    },
    'encryptionDetails': {
        'encryptionType': 'AWS_OWNED_KMS_KEY'|'CUSTOMER_MANAGED_KMS_KEY',
        'kmsKeyArn': 'string',
        'encryptionStatus': 'ENABLED'|'UPDATING'|'KMS_KEY_INACCESSIBLE'|'ENABLING'
    },
    'deletionProtectionEnabled': True|False
}

Response Structure

• (dict) --

  The output of a created cluster.

  • identifier (string) --

    The ID of the created cluster.

  • arn (string) --

    The ARN of the created cluster.

  • status (string) --

    The status of the created cluster.

  • creationTime (datetime) --

    The time of when created the cluster.

  • multiRegionProperties (dict) --

    The multi-Region cluster configuration details that were set during cluster creation

    • witnessRegion (string) --

      The Region that serves as the witness region for a multi-Region cluster. The witness Region helps maintain cluster consistency and quorum.

    • clusters (list) --

      The set of peered clusters that form the multi-Region cluster configuration. Each peered cluster represents a database instance in a different Region.

      • (string) --

        The Amazon Resource Name of the cluster.

  • encryptionDetails (dict) --

    The encryption configuration for the cluster that was specified during the creation process, including the KMS key identifier and encryption state.

    • encryptionType (string) --

      The type of encryption that protects the data on your cluster.

    • kmsKeyArn (string) --

      The ARN of the KMS key that encrypts data in the cluster.

    • encryptionStatus (string) --

      The status of encryption for the cluster.

  • deletionProtectionEnabled (boolean) --

    Whether deletion protection is enabled on this cluster.