AWS API Changes

2026/02/05 - AWS Resource Access Manager - 1 new7 updated api methods

Changes Added ListSourceAssociations API. Allows RAM resource share owners to list source associations that determine which sources can access resources through service principal associations. Supports filtering by resource share ARN, source ID, source type, or status, with pagination.

ListSourceAssociations (new)

Link ¶

Lists source associations for resource shares. Source associations control which sources can be used with service principals in resource shares. This operation provides visibility into source associations for resource share owners.

You can filter the results by resource share Amazon Resource Name (ARN), source ID, source type, or association status. We recommend using pagination to ensure that the operation returns quickly and successfully.

See also: AWS API Documentation

Request Syntax

client.list_source_associations(
    resourceShareArns=[
        'string',
    ],
    sourceId='string',
    sourceType='string',
    associationStatus='ASSOCIATING'|'ASSOCIATED'|'FAILED'|'DISASSOCIATING'|'DISASSOCIATED'|'SUSPENDED'|'SUSPENDING'|'RESTORING',
    nextToken='string',
    maxResults=123
)

type resourceShareArns:

list

param resourceShareArns:

The Amazon Resource Names (ARNs) of the resource shares for which you want to retrieve source associations.

(string) --

type sourceId:

string

param sourceId:

The identifier of the source for which you want to retrieve associations. This can be an account ID, Amazon Resource Name (ARN), organization ID, or organization path.

type sourceType:

string

param sourceType:

The type of source for which you want to retrieve associations.

type associationStatus:

string

param associationStatus:

The status of the source associations that you want to retrieve.

type nextToken:

string

param nextToken:

The pagination token that indicates the next set of results to retrieve.

type maxResults:

integer

param maxResults:

The maximum number of results to return in a single call. To retrieve the remaining results, make another call with the returned nextToken value.

rtype:

dict

returns:

Response Syntax

{
    'sourceAssociations': [
        {
            'resourceShareArn': 'string',
            'sourceId': 'string',
            'sourceType': 'string',
            'status': 'string',
            'lastUpdatedTime': datetime(2015, 1, 1),
            'creationTime': datetime(2015, 1, 1),
            'statusMessage': 'string'
        },
    ],
    'nextToken': 'string'
}

Response Structure

(dict) --
- sourceAssociations (list) --
  
  Information about the source associations.
  - (dict) --
    
    Information about a source association in a resource share. Source associations control which sources can be used with service principals.
    - resourceShareArn (string) --
      
      The Amazon Resource Name (ARN) of the resource share that contains the source association.
    - sourceId (string) --
      
      The identifier of the source. This can be an account ID, Amazon Resource Name (ARN), organization ID, or organization path.
    - sourceType (string) --
      
      The type of source.
    - status (string) --
      
      The current status of the source association.
    - lastUpdatedTime (datetime) --
      
      The date and time when the source association was last updated.
    - creationTime (datetime) --
      
      The date and time when the source association was created.
    - statusMessage (string) --
      
      A message about the status of the source association.
- nextToken (string) --
  
  The pagination token to use to retrieve the next page of results. This value is null when there are no more results to return.

AcceptResourceShareInvitation (updated)

Link ¶
Changes (response)

{'resourceShareInvitation': {'resourceShareAssociations': {'associationType': {'SOURCE'},
                                                           'status': {'RESTORING',
                                                                      'SUSPENDED',
                                                                      'SUSPENDING'}}}}

Accepts an invitation to a resource share from another Amazon Web Services account. After you accept the invitation, the resources included in the resource share are available to interact with in the relevant Amazon Web Services Management Consoles and tools.

See also: AWS API Documentation

Request Syntax

client.accept_resource_share_invitation(
    resourceShareInvitationArn='string',
    clientToken='string'
)

type resourceShareInvitationArn:

string

param resourceShareInvitationArn:

[REQUIRED]

The Amazon Resource Name (ARN) of the invitation that you want to accept.

type clientToken:

string

param clientToken:

Specifies a unique, case-sensitive identifier that you provide to ensure the idempotency of the request. This lets you safely retry the request without accidentally performing the same operation a second time. Passing the same value to a later call to an operation requires that you also pass the same value for all other parameters. We recommend that you use a UUID type of value..

If you don't provide this value, then Amazon Web Services generates a random one for you.

If you retry the operation with the same ClientToken, but with different parameters, the retry fails with an IdempotentParameterMismatch error.

rtype:

dict

returns:

Response Syntax

{
    'resourceShareInvitation': {
        'resourceShareInvitationArn': 'string',
        'resourceShareName': 'string',
        'resourceShareArn': 'string',
        'senderAccountId': 'string',
        'receiverAccountId': 'string',
        'invitationTimestamp': datetime(2015, 1, 1),
        'status': 'PENDING'|'ACCEPTED'|'REJECTED'|'EXPIRED',
        'resourceShareAssociations': [
            {
                'resourceShareArn': 'string',
                'resourceShareName': 'string',
                'associatedEntity': 'string',
                'associationType': 'PRINCIPAL'|'RESOURCE'|'SOURCE',
                'status': 'ASSOCIATING'|'ASSOCIATED'|'FAILED'|'DISASSOCIATING'|'DISASSOCIATED'|'SUSPENDED'|'SUSPENDING'|'RESTORING',
                'statusMessage': 'string',
                'creationTime': datetime(2015, 1, 1),
                'lastUpdatedTime': datetime(2015, 1, 1),
                'external': True|False
            },
        ],
        'receiverArn': 'string'
    },
    'clientToken': 'string'
}

Response Structure

(dict) --
- resourceShareInvitation (dict) --
  
  An object that contains information about the specified invitation.
  - resourceShareInvitationArn (string) --
    
    The Amazon Resource Name (ARN) of the invitation.
  - resourceShareName (string) --
    
    The name of the resource share.
  - resourceShareArn (string) --
    
    The Amazon Resource Name (ARN) of the resource share
  - senderAccountId (string) --
    
    The ID of the Amazon Web Services account that sent the invitation.
  - receiverAccountId (string) --
    
    The ID of the Amazon Web Services account that received the invitation.
  - invitationTimestamp (datetime) --
    
    The date and time when the invitation was sent.
  - status (string) --
    
    The current status of the invitation.
  - resourceShareAssociations (list) --
    
    To view the resources associated with a pending resource share invitation, use ListPendingInvitationResources.
    - (dict) --
      
      Describes an association between a resource share and either a principal or a resource.
      - resourceShareArn (string) --
        
        The Amazon Resource Name (ARN) of the resource share.
      - resourceShareName (string) --
        
        The name of the resource share.
      - associatedEntity (string) --
        
        The associated entity. This can be either of the following:
        
        For a resource association, this is the Amazon Resource Name (ARN) of the resource.
        
        For principal associations, this is one of the following:
        
        The ID of an Amazon Web Services account
        
        The Amazon Resource Name (ARN) of an organization in Organizations
        
        The ARN of an organizational unit (OU) in Organizations
        
        The ARN of an IAM role
        
        The ARN of an IAM user
      - associationType (string) --
        
        The type of entity included in this association.
      - status (string) --
        
        The current status of the association.
      - statusMessage (string) --
        
        A message about the status of the association.
      - creationTime (datetime) --
        
        The date and time when the association was created.
      - lastUpdatedTime (datetime) --
        
        The date and time when the association was last updated.
      - external (boolean) --
        
        Indicates whether the principal belongs to the same organization in Organizations as the Amazon Web Services account that owns the resource share.
  - receiverArn (string) --
    
    The Amazon Resource Name (ARN) of the IAM user or role that received the invitation.
- clientToken (string) --
  
  The idempotency identifier associated with this request. If you want to repeat the same operation in an idempotent manner then you must include this value in the clientToken request parameter of that later call. All other parameters must also have the same values that you used in the first call.

AssociateResourceShare (updated)

Link ¶
Changes (response)

{'resourceShareAssociations': {'associationType': {'SOURCE'},
                               'status': {'RESTORING',
                                          'SUSPENDED',
                                          'SUSPENDING'}}}

Adds the specified list of principals, resources, and source constraints to a resource share. Principals that already have access to this resource share immediately receive access to the added resources. Newly added principals immediately receive access to the resources shared in this resource share.

See also: AWS API Documentation

Request Syntax

client.associate_resource_share(
    resourceShareArn='string',
    resourceArns=[
        'string',
    ],
    principals=[
        'string',
    ],
    clientToken='string',
    sources=[
        'string',
    ]
)

type resourceShareArn:

string

param resourceShareArn:

[REQUIRED]

Specifies the Amazon Resource Name (ARN) of the resource share that you want to add principals or resources to.

type resourceArns:

list

param resourceArns:

Specifies a list of Amazon Resource Names (ARNs) of the resources that you want to share. This can be null if you want to add only principals.

(string) --

type principals:

list

param principals:

Specifies a list of principals to whom you want to the resource share. This can be null if you want to add only resources.

What the principals can do with the resources in the share is determined by the RAM permissions that you associate with the resource share. See AssociateResourceSharePermission.

You can include the following values:

An Amazon Web Services account ID, for example: 123456789012
An Amazon Resource Name (ARN) of an organization in Organizations, for example: organizations::123456789012:organization/o-exampleorgid
An ARN of an organizational unit (OU) in Organizations, for example: organizations::123456789012:ou/o-exampleorgid/ou-examplerootid-exampleouid123
An ARN of an IAM role, for example: iam::123456789012:role/rolename
An ARN of an IAM user, for example: iam::123456789012user/username
A service principal name, for example: service-id.amazonaws.com

(string) --

type clientToken:

string

param clientToken:

If you don't provide this value, then Amazon Web Services generates a random one for you.

If you retry the operation with the same ClientToken, but with different parameters, the retry fails with an IdempotentParameterMismatch error.

type sources:

list

param sources:

Specifies source constraints (accounts, ARNs, organization IDs, or organization paths) that limit when service principals can access resources in this resource share. When a service principal attempts to access a shared resource, validation is performed to ensure the request originates from one of the specified sources. This helps prevent confused deputy attacks by applying constraints on where service principals can access resources from.

(string) --

rtype:

dict

returns:

Response Syntax

{
    'resourceShareAssociations': [
        {
            'resourceShareArn': 'string',
            'resourceShareName': 'string',
            'associatedEntity': 'string',
            'associationType': 'PRINCIPAL'|'RESOURCE'|'SOURCE',
            'status': 'ASSOCIATING'|'ASSOCIATED'|'FAILED'|'DISASSOCIATING'|'DISASSOCIATED'|'SUSPENDED'|'SUSPENDING'|'RESTORING',
            'statusMessage': 'string',
            'creationTime': datetime(2015, 1, 1),
            'lastUpdatedTime': datetime(2015, 1, 1),
            'external': True|False
        },
    ],
    'clientToken': 'string'
}

Response Structure

(dict) --
- resourceShareAssociations (list) --
  
  An array of objects that contain information about the associations.
  - (dict) --
    
    Describes an association between a resource share and either a principal or a resource.
    - resourceShareArn (string) --
      
      The Amazon Resource Name (ARN) of the resource share.
    - resourceShareName (string) --
      
      The name of the resource share.
    - associatedEntity (string) --
      
      The associated entity. This can be either of the following:
      - For a resource association, this is the Amazon Resource Name (ARN) of the resource.
      - For principal associations, this is one of the following:
        
        The ID of an Amazon Web Services account
        
        The Amazon Resource Name (ARN) of an organization in Organizations
        
        The ARN of an organizational unit (OU) in Organizations
        
        The ARN of an IAM role
        
        The ARN of an IAM user
    - associationType (string) --
      
      The type of entity included in this association.
    - status (string) --
      
      The current status of the association.
    - statusMessage (string) --
      
      A message about the status of the association.
    - creationTime (datetime) --
      
      The date and time when the association was created.
    - lastUpdatedTime (datetime) --
      
      The date and time when the association was last updated.
    - external (boolean) --
      
      Indicates whether the principal belongs to the same organization in Organizations as the Amazon Web Services account that owns the resource share.
- clientToken (string) --
  
  The idempotency identifier associated with this request. If you want to repeat the same operation in an idempotent manner then you must include this value in the clientToken request parameter of that later call. All other parameters must also have the same values that you used in the first call.

DisassociateResourceShare (updated)

Link ¶
Changes (response)

{'resourceShareAssociations': {'associationType': {'SOURCE'},
                               'status': {'RESTORING',
                                          'SUSPENDED',
                                          'SUSPENDING'}}}

Removes the specified principals, resources, or source constraints from participating in the specified resource share.

See also: AWS API Documentation

Request Syntax

client.disassociate_resource_share(
    resourceShareArn='string',
    resourceArns=[
        'string',
    ],
    principals=[
        'string',
    ],
    clientToken='string',
    sources=[
        'string',
    ]
)

type resourceShareArn:

string

param resourceShareArn:

[REQUIRED]

Specifies Amazon Resource Name (ARN) of the resource share that you want to remove resources or principals from.

type resourceArns:

list

param resourceArns:

Specifies a list of Amazon Resource Names (ARNs) for one or more resources that you want to remove from the resource share. After the operation runs, these resources are no longer shared with principals associated with the resource share.

(string) --

type principals:

list

param principals:

Specifies a list of one or more principals that no longer are to have access to the resources in this resource share.

You can include the following values:

An Amazon Web Services account ID, for example: 123456789012
An Amazon Resource Name (ARN) of an organization in Organizations, for example: organizations::123456789012:organization/o-exampleorgid
An ARN of an organizational unit (OU) in Organizations, for example: organizations::123456789012:ou/o-exampleorgid/ou-examplerootid-exampleouid123
An ARN of an IAM role, for example: iam::123456789012:role/rolename
An ARN of an IAM user, for example: iam::123456789012user/username
A service principal name, for example: service-id.amazonaws.com

(string) --

type clientToken:

string

param clientToken:

If you don't provide this value, then Amazon Web Services generates a random one for you.

If you retry the operation with the same ClientToken, but with different parameters, the retry fails with an IdempotentParameterMismatch error.

type sources:

list

param sources:

Specifies source constraints (accounts, ARNs, organization IDs, or organization paths) to remove from the resource share. This enables granular management of source constraints while maintaining service principal associations. At least one source must remain when service principals are present.

(string) --

rtype:

dict

returns:

Response Syntax

{
    'resourceShareAssociations': [
        {
            'resourceShareArn': 'string',
            'resourceShareName': 'string',
            'associatedEntity': 'string',
            'associationType': 'PRINCIPAL'|'RESOURCE'|'SOURCE',
            'status': 'ASSOCIATING'|'ASSOCIATED'|'FAILED'|'DISASSOCIATING'|'DISASSOCIATED'|'SUSPENDED'|'SUSPENDING'|'RESTORING',
            'statusMessage': 'string',
            'creationTime': datetime(2015, 1, 1),
            'lastUpdatedTime': datetime(2015, 1, 1),
            'external': True|False
        },
    ],
    'clientToken': 'string'
}

Response Structure

(dict) --
- resourceShareAssociations (list) --
  
  An array of objects with information about the updated associations for this resource share.
  - (dict) --
    
    Describes an association between a resource share and either a principal or a resource.
    - resourceShareArn (string) --
      
      The Amazon Resource Name (ARN) of the resource share.
    - resourceShareName (string) --
      
      The name of the resource share.
    - associatedEntity (string) --
      
      The associated entity. This can be either of the following:
      - For a resource association, this is the Amazon Resource Name (ARN) of the resource.
      - For principal associations, this is one of the following:
        
        The ID of an Amazon Web Services account
        
        The Amazon Resource Name (ARN) of an organization in Organizations
        
        The ARN of an organizational unit (OU) in Organizations
        
        The ARN of an IAM role
        
        The ARN of an IAM user
    - associationType (string) --
      
      The type of entity included in this association.
    - status (string) --
      
      The current status of the association.
    - statusMessage (string) --
      
      A message about the status of the association.
    - creationTime (datetime) --
      
      The date and time when the association was created.
    - lastUpdatedTime (datetime) --
      
      The date and time when the association was last updated.
    - external (boolean) --
      
      Indicates whether the principal belongs to the same organization in Organizations as the Amazon Web Services account that owns the resource share.
- clientToken (string) --
  
  The idempotency identifier associated with this request. If you want to repeat the same operation in an idempotent manner then you must include this value in the clientToken request parameter of that later call. All other parameters must also have the same values that you used in the first call.

GetResourceShareAssociations (updated)

Link ¶
Changes (request, response)
Request

{'associationStatus': {'RESTORING', 'SUSPENDED', 'SUSPENDING'},
 'associationType': {'SOURCE'}}

Response

{'resourceShareAssociations': {'associationType': {'SOURCE'},
                               'status': {'RESTORING',
                                          'SUSPENDED',
                                          'SUSPENDING'}}}

Retrieves the lists of resources and principals that associated for resource shares that you own.

See also: AWS API Documentation

Request Syntax

client.get_resource_share_associations(
    associationType='PRINCIPAL'|'RESOURCE'|'SOURCE',
    resourceShareArns=[
        'string',
    ],
    resourceArn='string',
    principal='string',
    associationStatus='ASSOCIATING'|'ASSOCIATED'|'FAILED'|'DISASSOCIATING'|'DISASSOCIATED'|'SUSPENDED'|'SUSPENDING'|'RESTORING',
    nextToken='string',
    maxResults=123
)

type associationType:

string

param associationType:

[REQUIRED]

Specifies whether you want to retrieve the associations that involve a specified resource or principal.

PRINCIPAL – list the principals whose associations you want to see.
RESOURCE – list the resources whose associations you want to see.

type resourceShareArns:

list

param resourceShareArns:

Specifies a list of Amazon Resource Names (ARNs) of the resource share whose associations you want to retrieve.

(string) --

type resourceArn:

string

param resourceArn:

Specifies the Amazon Resource Name (ARN) of a resource whose resource shares you want to retrieve.

You cannot specify this parameter if the association type is PRINCIPAL.

type principal:

string

param principal:

Specifies the ID of the principal whose resource shares you want to retrieve. This can be an Amazon Web Services account ID, an organization ID, an organizational unit ID, or the Amazon Resource Name (ARN) of an individual IAM role or user.

You cannot specify this parameter if the association type is RESOURCE.

type associationStatus:

string

param associationStatus:

Specifies that you want to retrieve only associations that have this status.

type nextToken:

string

param nextToken:

Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.

type maxResults:

integer

param maxResults:

Specifies the total number of results that you want included on each page of the response. If you do not include this parameter, it defaults to a value that is specific to the operation. If additional items exist beyond the number you specify, the NextToken response element is returned with a value (not null). Include the specified value as the NextToken request parameter in the next call to the operation to get the next part of the results. Note that the service might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.

rtype:

dict

returns:

Response Syntax

{
    'resourceShareAssociations': [
        {
            'resourceShareArn': 'string',
            'resourceShareName': 'string',
            'associatedEntity': 'string',
            'associationType': 'PRINCIPAL'|'RESOURCE'|'SOURCE',
            'status': 'ASSOCIATING'|'ASSOCIATED'|'FAILED'|'DISASSOCIATING'|'DISASSOCIATED'|'SUSPENDED'|'SUSPENDING'|'RESTORING',
            'statusMessage': 'string',
            'creationTime': datetime(2015, 1, 1),
            'lastUpdatedTime': datetime(2015, 1, 1),
            'external': True|False
        },
    ],
    'nextToken': 'string'
}

Response Structure

(dict) --
- resourceShareAssociations (list) --
  
  An array of objects that contain the details about the associations.
  - (dict) --
    
    Describes an association between a resource share and either a principal or a resource.
    - resourceShareArn (string) --
      
      The Amazon Resource Name (ARN) of the resource share.
    - resourceShareName (string) --
      
      The name of the resource share.
    - associatedEntity (string) --
      
      The associated entity. This can be either of the following:
      - For a resource association, this is the Amazon Resource Name (ARN) of the resource.
      - For principal associations, this is one of the following:
        
        The ID of an Amazon Web Services account
        
        The Amazon Resource Name (ARN) of an organization in Organizations
        
        The ARN of an organizational unit (OU) in Organizations
        
        The ARN of an IAM role
        
        The ARN of an IAM user
    - associationType (string) --
      
      The type of entity included in this association.
    - status (string) --
      
      The current status of the association.
    - statusMessage (string) --
      
      A message about the status of the association.
    - creationTime (datetime) --
      
      The date and time when the association was created.
    - lastUpdatedTime (datetime) --
      
      The date and time when the association was last updated.
    - external (boolean) --
      
      Indicates whether the principal belongs to the same organization in Organizations as the Amazon Web Services account that owns the resource share.
- nextToken (string) --
  
  If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

GetResourceShareInvitations (updated)

Link ¶
Changes (response)

{'resourceShareInvitations': {'resourceShareAssociations': {'associationType': {'SOURCE'},
                                                            'status': {'RESTORING',
                                                                       'SUSPENDED',
                                                                       'SUSPENDING'}}}}

Retrieves details about invitations that you have received for resource shares.

See also: AWS API Documentation

Request Syntax

client.get_resource_share_invitations(
    resourceShareInvitationArns=[
        'string',
    ],
    resourceShareArns=[
        'string',
    ],
    nextToken='string',
    maxResults=123
)

type resourceShareInvitationArns:

list

param resourceShareInvitationArns:

Specifies the Amazon Resource Names (ARNs) of the resource share invitations you want information about.

(string) --

type resourceShareArns:

list

param resourceShareArns:

Specifies that you want details about invitations only for the resource shares described by this list of Amazon Resource Names (ARNs)

(string) --

type nextToken:

string

param nextToken:

type maxResults:

integer

param maxResults:

rtype:

dict

returns:

Response Syntax

{
    'resourceShareInvitations': [
        {
            'resourceShareInvitationArn': 'string',
            'resourceShareName': 'string',
            'resourceShareArn': 'string',
            'senderAccountId': 'string',
            'receiverAccountId': 'string',
            'invitationTimestamp': datetime(2015, 1, 1),
            'status': 'PENDING'|'ACCEPTED'|'REJECTED'|'EXPIRED',
            'resourceShareAssociations': [
                {
                    'resourceShareArn': 'string',
                    'resourceShareName': 'string',
                    'associatedEntity': 'string',
                    'associationType': 'PRINCIPAL'|'RESOURCE'|'SOURCE',
                    'status': 'ASSOCIATING'|'ASSOCIATED'|'FAILED'|'DISASSOCIATING'|'DISASSOCIATED'|'SUSPENDED'|'SUSPENDING'|'RESTORING',
                    'statusMessage': 'string',
                    'creationTime': datetime(2015, 1, 1),
                    'lastUpdatedTime': datetime(2015, 1, 1),
                    'external': True|False
                },
            ],
            'receiverArn': 'string'
        },
    ],
    'nextToken': 'string'
}

Response Structure

(dict) --
- resourceShareInvitations (list) --
  
  An array of objects that contain the details about the invitations.
  - (dict) --
    
    Describes an invitation for an Amazon Web Services account to join a resource share.
    - resourceShareInvitationArn (string) --
      
      The Amazon Resource Name (ARN) of the invitation.
    - resourceShareName (string) --
      
      The name of the resource share.
    - resourceShareArn (string) --
      
      The Amazon Resource Name (ARN) of the resource share
    - senderAccountId (string) --
      
      The ID of the Amazon Web Services account that sent the invitation.
    - receiverAccountId (string) --
      
      The ID of the Amazon Web Services account that received the invitation.
    - invitationTimestamp (datetime) --
      
      The date and time when the invitation was sent.
    - status (string) --
      
      The current status of the invitation.
    - resourceShareAssociations (list) --
      
      To view the resources associated with a pending resource share invitation, use ListPendingInvitationResources.
      - (dict) --
        
        Describes an association between a resource share and either a principal or a resource.
        
        resourceShareArn (string) --
        
        The Amazon Resource Name (ARN) of the resource share.
        
        resourceShareName (string) --
        
        The name of the resource share.
        
        associatedEntity (string) --
        
        The associated entity. This can be either of the following:
        
        For a resource association, this is the Amazon Resource Name (ARN) of the resource.
        
        For principal associations, this is one of the following:
        
        The ID of an Amazon Web Services account
        
        The Amazon Resource Name (ARN) of an organization in Organizations
        
        The ARN of an organizational unit (OU) in Organizations
        
        The ARN of an IAM role
        
        The ARN of an IAM user
        
        associationType (string) --
        
        The type of entity included in this association.
        
        status (string) --
        
        The current status of the association.
        
        statusMessage (string) --
        
        A message about the status of the association.
        
        creationTime (datetime) --
        
        The date and time when the association was created.
        
        lastUpdatedTime (datetime) --
        
        The date and time when the association was last updated.
        
        external (boolean) --
        
        Indicates whether the principal belongs to the same organization in Organizations as the Amazon Web Services account that owns the resource share.
    - receiverArn (string) --
      
      The Amazon Resource Name (ARN) of the IAM user or role that received the invitation.
- nextToken (string) --
  
  If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

ListPermissionAssociations (updated)

Link ¶
Changes (request)

{'associationStatus': {'RESTORING', 'SUSPENDED', 'SUSPENDING'}}

Lists information about the managed permission and its associations to any resource shares that use this managed permission. This lets you see which resource shares use which versions of the specified managed permission.

See also: AWS API Documentation

Request Syntax

client.list_permission_associations(
    permissionArn='string',
    permissionVersion=123,
    associationStatus='ASSOCIATING'|'ASSOCIATED'|'FAILED'|'DISASSOCIATING'|'DISASSOCIATED'|'SUSPENDED'|'SUSPENDING'|'RESTORING',
    resourceType='string',
    featureSet='CREATED_FROM_POLICY'|'PROMOTING_TO_STANDARD'|'STANDARD',
    defaultVersion=True|False,
    nextToken='string',
    maxResults=123
)

type permissionArn:

string

param permissionArn:

Specifies the Amazon Resource Name (ARN) of the managed permission.

type permissionVersion:

integer

param permissionVersion:

Specifies that you want to list only those associations with resource shares that use this version of the managed permission. If you don't provide a value for this parameter, then the operation returns information about associations with resource shares that use any version of the managed permission.

type associationStatus:

string

param associationStatus:

Specifies that you want to list only those associations with resource shares that match this status.

type resourceType:

string

param resourceType:

Specifies that you want to list only those associations with resource shares that include at least one resource of this resource type.

type featureSet:

string

param featureSet:

Specifies that you want to list only those associations with resource shares that have a featureSet with this value.

type defaultVersion:

boolean

param defaultVersion:

When true, specifies that you want to list only those associations with resource shares that use the default version of the specified managed permission.

When false (the default value), lists associations with resource shares that use any version of the specified managed permission.

type nextToken:

string

param nextToken:

type maxResults:

integer

param maxResults:

rtype:

dict

returns:

Response Syntax

{
    'permissions': [
        {
            'arn': 'string',
            'permissionVersion': 'string',
            'defaultVersion': True|False,
            'resourceType': 'string',
            'status': 'string',
            'featureSet': 'CREATED_FROM_POLICY'|'PROMOTING_TO_STANDARD'|'STANDARD',
            'lastUpdatedTime': datetime(2015, 1, 1),
            'resourceShareArn': 'string'
        },
    ],
    'nextToken': 'string'
}

Response Structure

(dict) --
- permissions (list) --
  
  A structure with information about this customer managed permission.
  - (dict) --
    
    An object that describes a managed permission associated with a resource share.
    - arn (string) --
      
      The Amazon Resource Name (ARN) of the associated managed permission.
    - permissionVersion (string) --
      
      The version of the permission currently associated with the resource share.
    - defaultVersion (boolean) --
      
      Indicates whether the associated resource share is using the default version of the permission.
    - resourceType (string) --
      
      The resource type to which this permission applies.
    - status (string) --
      
      The current status of the association between the permission and the resource share. The following are the possible values:
      - ATTACHABLE – This permission or version can be associated with resource shares.
      - UNATTACHABLE – This permission or version can't currently be associated with resource shares.
      - DELETING – This permission or version is in the process of being deleted.
      - DELETED – This permission or version is deleted.
    - featureSet (string) --
      
      Indicates what features are available for this resource share. This parameter can have one of the following values:
      - STANDARD – A resource share that supports all functionality. These resource shares are visible to all principals you share the resource share with. You can modify these resource shares in RAM using the console or APIs. This resource share might have been created by RAM, or it might have been CREATED_FROM_POLICY and then promoted.
      - CREATED_FROM_POLICY – The customer manually shared a resource by attaching a resource-based policy. That policy did not match any existing managed permissions, so RAM created this customer managed permission automatically on the customer's behalf based on the attached policy document. This type of resource share is visible only to the Amazon Web Services account that created it. You can't modify it in RAM unless you promote it. For more information, see PromoteResourceShareCreatedFromPolicy.
      - PROMOTING_TO_STANDARD – This resource share was originally CREATED_FROM_POLICY, but the customer ran the PromoteResourceShareCreatedFromPolicy and that operation is still in progress. This value changes to STANDARD when complete.
    - lastUpdatedTime (datetime) --
      
      The date and time when the association between the permission and the resource share was last updated.
    - resourceShareArn (string) --
      
      The Amazon Resource Name (ARN) of a resource share associated with this permission.
- nextToken (string) --
  
  If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

RejectResourceShareInvitation (updated)

Link ¶
Changes (response)

{'resourceShareInvitation': {'resourceShareAssociations': {'associationType': {'SOURCE'},
                                                           'status': {'RESTORING',
                                                                      'SUSPENDED',
                                                                      'SUSPENDING'}}}}

Rejects an invitation to a resource share from another Amazon Web Services account.

See also: AWS API Documentation

Request Syntax

client.reject_resource_share_invitation(
    resourceShareInvitationArn='string',
    clientToken='string'
)

type resourceShareInvitationArn:

string

param resourceShareInvitationArn:

[REQUIRED]

Specifies the Amazon Resource Name (ARN) of the invitation that you want to reject.

type clientToken:

string

param clientToken:

If you don't provide this value, then Amazon Web Services generates a random one for you.

If you retry the operation with the same ClientToken, but with different parameters, the retry fails with an IdempotentParameterMismatch error.

rtype:

dict

returns:

Response Syntax

{
    'resourceShareInvitation': {
        'resourceShareInvitationArn': 'string',
        'resourceShareName': 'string',
        'resourceShareArn': 'string',
        'senderAccountId': 'string',
        'receiverAccountId': 'string',
        'invitationTimestamp': datetime(2015, 1, 1),
        'status': 'PENDING'|'ACCEPTED'|'REJECTED'|'EXPIRED',
        'resourceShareAssociations': [
            {
                'resourceShareArn': 'string',
                'resourceShareName': 'string',
                'associatedEntity': 'string',
                'associationType': 'PRINCIPAL'|'RESOURCE'|'SOURCE',
                'status': 'ASSOCIATING'|'ASSOCIATED'|'FAILED'|'DISASSOCIATING'|'DISASSOCIATED'|'SUSPENDED'|'SUSPENDING'|'RESTORING',
                'statusMessage': 'string',
                'creationTime': datetime(2015, 1, 1),
                'lastUpdatedTime': datetime(2015, 1, 1),
                'external': True|False
            },
        ],
        'receiverArn': 'string'
    },
    'clientToken': 'string'
}

Response Structure

(dict) --
- resourceShareInvitation (dict) --
  
  An object that contains the details about the rejected invitation.
  - resourceShareInvitationArn (string) --
    
    The Amazon Resource Name (ARN) of the invitation.
  - resourceShareName (string) --
    
    The name of the resource share.
  - resourceShareArn (string) --
    
    The Amazon Resource Name (ARN) of the resource share
  - senderAccountId (string) --
    
    The ID of the Amazon Web Services account that sent the invitation.
  - receiverAccountId (string) --
    
    The ID of the Amazon Web Services account that received the invitation.
  - invitationTimestamp (datetime) --
    
    The date and time when the invitation was sent.
  - status (string) --
    
    The current status of the invitation.
  - resourceShareAssociations (list) --
    
    To view the resources associated with a pending resource share invitation, use ListPendingInvitationResources.
    - (dict) --
      
      Describes an association between a resource share and either a principal or a resource.
      - resourceShareArn (string) --
        
        The Amazon Resource Name (ARN) of the resource share.
      - resourceShareName (string) --
        
        The name of the resource share.
      - associatedEntity (string) --
        
        The associated entity. This can be either of the following:
        
        For a resource association, this is the Amazon Resource Name (ARN) of the resource.
        
        For principal associations, this is one of the following:
        
        The ID of an Amazon Web Services account
        
        The Amazon Resource Name (ARN) of an organization in Organizations
        
        The ARN of an organizational unit (OU) in Organizations
        
        The ARN of an IAM role
        
        The ARN of an IAM user
      - associationType (string) --
        
        The type of entity included in this association.
      - status (string) --
        
        The current status of the association.
      - statusMessage (string) --
        
        A message about the status of the association.
      - creationTime (datetime) --
        
        The date and time when the association was created.
      - lastUpdatedTime (datetime) --
        
        The date and time when the association was last updated.
      - external (boolean) --
        
        Indicates whether the principal belongs to the same organization in Organizations as the Amazon Web Services account that owns the resource share.
  - receiverArn (string) --
    
    The Amazon Resource Name (ARN) of the IAM user or role that received the invitation.
- clientToken (string) --
  
  The idempotency identifier associated with this request. If you want to repeat the same operation in an idempotent manner then you must include this value in the clientToken request parameter of that later call. All other parameters must also have the same values that you used in the first call.