AWS Directory Service

Shares a specified directory ( DirectoryId) in your AWS account (directory owner) with another AWS account (directory consumer). With this operation you can use your directory from any AWS account and from any Amazon VPC within an AWS Region.

When you share your AWS Managed Microsoft AD directory, AWS Directory Service creates a shared directory in the directory consumer account. This shared directory contains the metadata to provide access to the directory within the directory owner account. The shared directory is visible in all VPCs in the directory consumer account.

The ShareMethod parameter determines whether the specified directory can be shared between AWS accounts inside the same AWS organization ( ORGANIZATIONS). It also determines whether you can share the directory with any other AWS account either inside or outside of the organization ( HANDSHAKE).

The ShareNotes parameter is only used when HANDSHAKE is called, which sends a directory sharing request to the directory consumer.

See also: AWS API Documentation

Request Syntax

client.share_directory(
    DirectoryId='string',
    ShareNotes='string',
    ShareTarget={
        'Id': 'string',
        'Type': 'ACCOUNT'
    },
    ShareMethod='ORGANIZATIONS'|'HANDSHAKE'
)

type DirectoryId:

string

param DirectoryId:

[REQUIRED]

Identifier of the AWS Managed Microsoft AD directory that you want to share with other AWS accounts.

type ShareNotes:

string

param ShareNotes:

A directory share request that is sent by the directory owner to the directory consumer. The request includes a typed message to help the directory consumer administrator determine whether to approve or reject the share invitation.

type ShareTarget:

dict

param ShareTarget:

[REQUIRED]

Identifier for the directory consumer account with whom the directory is to be shared.

• Id (string) -- [REQUIRED]

  Identifier of the directory consumer account.

• Type (string) -- [REQUIRED]

  Type of identifier to be used in the Id field.

type ShareMethod:

string

param ShareMethod:

[REQUIRED]

The method used when sharing a directory to determine whether the directory should be shared within your AWS organization ( ORGANIZATIONS) or with any AWS account by sending a directory sharing request ( HANDSHAKE).

rtype:

dict

returns:

Response Syntax

{
    'SharedDirectoryId': 'string'
}

Response Structure

• (dict) --

  • SharedDirectoryId (string) --

    Identifier of the directory that is stored in the directory consumer account that is shared from the specified directory ( DirectoryId).

Stops the directory sharing between the directory owner and consumer accounts.

See also: AWS API Documentation

Request Syntax

client.unshare_directory(
    DirectoryId='string',
    UnshareTarget={
        'Id': 'string',
        'Type': 'ACCOUNT'
    }
)

type DirectoryId:

string

param DirectoryId:

[REQUIRED]

The identifier of the AWS Managed Microsoft AD directory that you want to stop sharing.

type UnshareTarget:

dict

param UnshareTarget:

[REQUIRED]

Identifier for the directory consumer account with whom the directory has to be unshared.

• Id (string) -- [REQUIRED]

  Identifier of the directory consumer account.

• Type (string) -- [REQUIRED]

  Type of identifier to be used in the Id field.

rtype:

dict

returns:

Response Syntax

{
    'SharedDirectoryId': 'string'
}

Response Structure

• (dict) --

  • SharedDirectoryId (string) --

    Identifier of the directory stored in the directory consumer account that is to be unshared from the specified directory ( DirectoryId).

Rejects a directory sharing request that was sent from the directory owner account.

See also: AWS API Documentation

Request Syntax

client.reject_shared_directory(
    SharedDirectoryId='string'
)

type SharedDirectoryId:

string

param SharedDirectoryId:

[REQUIRED]

Identifier of the shared directory in the directory consumer account. This identifier is different for each directory owner account.

rtype:

dict

returns:

Response Syntax

{
    'SharedDirectoryId': 'string'
}

Response Structure

• (dict) --

  • SharedDirectoryId (string) --

    Identifier of the shared directory in the directory consumer account.

Returns the shared directories in your account.

See also: AWS API Documentation

Request Syntax

client.describe_shared_directories(
    OwnerDirectoryId='string',
    SharedDirectoryIds=[
        'string',
    ],
    NextToken='string',
    Limit=123
)

type OwnerDirectoryId:

string

param OwnerDirectoryId:

[REQUIRED]

Returns the identifier of the directory in the directory owner account.

type SharedDirectoryIds:

list

param SharedDirectoryIds:

A list of identifiers of all shared directories in your account.

• (string) --

type NextToken:

string

param NextToken:

The DescribeSharedDirectoriesResult.NextToken value from a previous call to DescribeSharedDirectories. Pass null if this is the first call.

type Limit:

integer

param Limit:

The number of shared directories to return in the response object.

rtype:

dict

returns:

Response Syntax

{
    'SharedDirectories': [
        {
            'OwnerAccountId': 'string',
            'OwnerDirectoryId': 'string',
            'ShareMethod': 'ORGANIZATIONS'|'HANDSHAKE',
            'SharedAccountId': 'string',
            'SharedDirectoryId': 'string',
            'ShareStatus': 'Shared'|'PendingAcceptance'|'Rejected'|'Rejecting'|'RejectFailed'|'Sharing'|'ShareFailed'|'Deleted'|'Deleting',
            'ShareNotes': 'string',
            'CreatedDateTime': datetime(2015, 1, 1),
            'LastUpdatedDateTime': datetime(2015, 1, 1)
        },
    ],
    'NextToken': 'string'
}

Response Structure

• (dict) --

  • SharedDirectories (list) --

    A list of all shared directories in your account.

    • (dict) --

      Details about the shared directory in the directory owner account for which the share request in the directory consumer account has been accepted.

      • OwnerAccountId (string) --

        Identifier of the directory owner account, which contains the directory that has been shared to the consumer account.

      • OwnerDirectoryId (string) --

        Identifier of the directory in the directory owner account.

      • ShareMethod (string) --

        The method used when sharing a directory to determine whether the directory should be shared within your AWS organization ( ORGANIZATIONS) or with any AWS account by sending a shared directory request ( HANDSHAKE).

      • SharedAccountId (string) --

        Identifier of the directory consumer account that has access to the shared directory ( OwnerDirectoryId) in the directory owner account.

      • SharedDirectoryId (string) --

        Identifier of the shared directory in the directory consumer account. This identifier is different for each directory owner account.

      • ShareStatus (string) --

        Current directory status of the shared AWS Managed Microsoft AD directory.

      • ShareNotes (string) --

        A directory share request that is sent by the directory owner to the directory consumer. The request includes a typed message to help the directory consumer administrator determine whether to approve or reject the share invitation.

      • CreatedDateTime (datetime) --

        The date and time that the shared directory was created.

      • LastUpdatedDateTime (datetime) --

        The date and time that the shared directory was last updated.

  • NextToken (string) --

    If not null, token that indicates that more results are available. Pass this value for the NextToken parameter in a subsequent call to DescribeSharedDirectories to retrieve the next set of items.

Accepts a directory sharing request that was sent from the directory owner account.

See also: AWS API Documentation

Request Syntax

client.accept_shared_directory(
    SharedDirectoryId='string'
)

type SharedDirectoryId:

string

param SharedDirectoryId:

[REQUIRED]

Identifier of the shared directory in the directory consumer account. This identifier is different for each directory owner account.

rtype:

dict

returns:

Response Syntax

{
    'SharedDirectory': {
        'OwnerAccountId': 'string',
        'OwnerDirectoryId': 'string',
        'ShareMethod': 'ORGANIZATIONS'|'HANDSHAKE',
        'SharedAccountId': 'string',
        'SharedDirectoryId': 'string',
        'ShareStatus': 'Shared'|'PendingAcceptance'|'Rejected'|'Rejecting'|'RejectFailed'|'Sharing'|'ShareFailed'|'Deleted'|'Deleting',
        'ShareNotes': 'string',
        'CreatedDateTime': datetime(2015, 1, 1),
        'LastUpdatedDateTime': datetime(2015, 1, 1)
    }
}

Response Structure

• (dict) --

  • SharedDirectory (dict) --

    The shared directory in the directory consumer account.

    • OwnerAccountId (string) --

      Identifier of the directory owner account, which contains the directory that has been shared to the consumer account.

    • OwnerDirectoryId (string) --

      Identifier of the directory in the directory owner account.

    • ShareMethod (string) --

      The method used when sharing a directory to determine whether the directory should be shared within your AWS organization ( ORGANIZATIONS) or with any AWS account by sending a shared directory request ( HANDSHAKE).

    • SharedAccountId (string) --

      Identifier of the directory consumer account that has access to the shared directory ( OwnerDirectoryId) in the directory owner account.

    • SharedDirectoryId (string) --

      Identifier of the shared directory in the directory consumer account. This identifier is different for each directory owner account.

    • ShareStatus (string) --

      Current directory status of the shared AWS Managed Microsoft AD directory.

    • ShareNotes (string) --

      A directory share request that is sent by the directory owner to the directory consumer. The request includes a typed message to help the directory consumer administrator determine whether to approve or reject the share invitation.

    • CreatedDateTime (datetime) --

      The date and time that the shared directory was created.

    • LastUpdatedDateTime (datetime) --

      The date and time that the shared directory was last updated.

{'DirectoryDescriptions': {'OwnerDirectoryDescription': {'AccountId': 'string',
                                                         'DirectoryId': 'string',
                                                         'DnsIpAddrs': ['string'],
                                                         'RadiusSettings': {'AuthenticationProtocol': 'PAP '
                                                                                                      '| '
                                                                                                      'CHAP '
                                                                                                      '| '
                                                                                                      'MS-CHAPv1 '
                                                                                                      '| '
                                                                                                      'MS-CHAPv2',
                                                                            'DisplayLabel': 'string',
                                                                            'RadiusPort': 'integer',
                                                                            'RadiusRetries': 'integer',
                                                                            'RadiusServers': ['string'],
                                                                            'RadiusTimeout': 'integer',
                                                                            'SharedSecret': 'string',
                                                                            'UseSameUsername': 'boolean'},
                                                         'RadiusStatus': 'Creating '
                                                                         '| '
                                                                         'Completed '
                                                                         '| '
                                                                         'Failed',
                                                         'VpcSettings': {'AvailabilityZones': ['string'],
                                                                         'SecurityGroupId': 'string',
                                                                         'SubnetIds': ['string'],
                                                                         'VpcId': 'string'}},
                           'ShareMethod': 'ORGANIZATIONS | HANDSHAKE',
                           'ShareNotes': 'string',
                           'ShareStatus': 'Shared | PendingAcceptance | '
                                          'Rejected | Rejecting | RejectFailed '
                                          '| Sharing | ShareFailed | Deleted | '
                                          'Deleting',
                           'Type': {'SharedMicrosoftAD'}}}

Obtains information about the directories that belong to this account.

You can retrieve information about specific directories by passing the directory identifiers in the DirectoryIds parameter. Otherwise, all directories that belong to the current account are returned.

This operation supports pagination with the use of the NextToken request and response parameters. If more results are available, the DescribeDirectoriesResult.NextToken member contains a token that you pass in the next call to DescribeDirectories to retrieve the next set of items.

You can also specify a maximum number of return results with the Limit parameter.

See also: AWS API Documentation

Request Syntax

client.describe_directories(
    DirectoryIds=[
        'string',
    ],
    NextToken='string',
    Limit=123
)

type DirectoryIds:

list

param DirectoryIds:

A list of identifiers of the directories for which to obtain the information. If this member is null, all directories that belong to the current account are returned.

An empty list results in an InvalidParameterException being thrown.

• (string) --

type NextToken:

string

param NextToken:

The DescribeDirectoriesResult.NextToken value from a previous call to DescribeDirectories. Pass null if this is the first call.

type Limit:

integer

param Limit:

The maximum number of items to return. If this value is zero, the maximum number of items is specified by the limitations of the operation.

rtype:

dict

returns:

Response Syntax

{
    'DirectoryDescriptions': [
        {
            'DirectoryId': 'string',
            'Name': 'string',
            'ShortName': 'string',
            'Size': 'Small'|'Large',
            'Edition': 'Enterprise'|'Standard',
            'Alias': 'string',
            'AccessUrl': 'string',
            'Description': 'string',
            'DnsIpAddrs': [
                'string',
            ],
            'Stage': 'Requested'|'Creating'|'Created'|'Active'|'Inoperable'|'Impaired'|'Restoring'|'RestoreFailed'|'Deleting'|'Deleted'|'Failed',
            'ShareStatus': 'Shared'|'PendingAcceptance'|'Rejected'|'Rejecting'|'RejectFailed'|'Sharing'|'ShareFailed'|'Deleted'|'Deleting',
            'ShareMethod': 'ORGANIZATIONS'|'HANDSHAKE',
            'ShareNotes': 'string',
            'LaunchTime': datetime(2015, 1, 1),
            'StageLastUpdatedDateTime': datetime(2015, 1, 1),
            'Type': 'SimpleAD'|'ADConnector'|'MicrosoftAD'|'SharedMicrosoftAD',
            'VpcSettings': {
                'VpcId': 'string',
                'SubnetIds': [
                    'string',
                ],
                'SecurityGroupId': 'string',
                'AvailabilityZones': [
                    'string',
                ]
            },
            'ConnectSettings': {
                'VpcId': 'string',
                'SubnetIds': [
                    'string',
                ],
                'CustomerUserName': 'string',
                'SecurityGroupId': 'string',
                'AvailabilityZones': [
                    'string',
                ],
                'ConnectIps': [
                    'string',
                ]
            },
            'RadiusSettings': {
                'RadiusServers': [
                    'string',
                ],
                'RadiusPort': 123,
                'RadiusTimeout': 123,
                'RadiusRetries': 123,
                'SharedSecret': 'string',
                'AuthenticationProtocol': 'PAP'|'CHAP'|'MS-CHAPv1'|'MS-CHAPv2',
                'DisplayLabel': 'string',
                'UseSameUsername': True|False
            },
            'RadiusStatus': 'Creating'|'Completed'|'Failed',
            'StageReason': 'string',
            'SsoEnabled': True|False,
            'DesiredNumberOfDomainControllers': 123,
            'OwnerDirectoryDescription': {
                'DirectoryId': 'string',
                'AccountId': 'string',
                'DnsIpAddrs': [
                    'string',
                ],
                'VpcSettings': {
                    'VpcId': 'string',
                    'SubnetIds': [
                        'string',
                    ],
                    'SecurityGroupId': 'string',
                    'AvailabilityZones': [
                        'string',
                    ]
                },
                'RadiusSettings': {
                    'RadiusServers': [
                        'string',
                    ],
                    'RadiusPort': 123,
                    'RadiusTimeout': 123,
                    'RadiusRetries': 123,
                    'SharedSecret': 'string',
                    'AuthenticationProtocol': 'PAP'|'CHAP'|'MS-CHAPv1'|'MS-CHAPv2',
                    'DisplayLabel': 'string',
                    'UseSameUsername': True|False
                },
                'RadiusStatus': 'Creating'|'Completed'|'Failed'
            }
        },
    ],
    'NextToken': 'string'
}

Response Structure

• (dict) --

  Contains the results of the DescribeDirectories operation.

  • DirectoryDescriptions (list) --

    The list of DirectoryDescription objects that were retrieved.

    It is possible that this list contains less than the number of items specified in the Limit member of the request. This occurs if there are less than the requested number of items left to retrieve, or if the limitations of the operation have been exceeded.

    • (dict) --

      Contains information about an AWS Directory Service directory.

      • DirectoryId (string) --

        The directory identifier.

      • Name (string) --

        The fully qualified name of the directory.

      • ShortName (string) --

        The short name of the directory.

      • Size (string) --

        The directory size.

      • Edition (string) --

        The edition associated with this directory.

      • Alias (string) --

        The alias for the directory. If no alias has been created for the directory, the alias is the directory identifier, such as d-XXXXXXXXXX.

      • AccessUrl (string) --

        The access URL for the directory, such as http://<alias>.awsapps.com. If no alias has been created for the directory, <alias> is the directory identifier, such as d-XXXXXXXXXX.

      • Description (string) --

        The textual description for the directory.

      • DnsIpAddrs (list) --

        The IP addresses of the DNS servers for the directory. For a Simple AD or Microsoft AD directory, these are the IP addresses of the Simple AD or Microsoft AD directory servers. For an AD Connector directory, these are the IP addresses of the DNS servers or domain controllers in the on-premises directory to which the AD Connector is connected.

        • (string) --

      • Stage (string) --

        The current stage of the directory.

      • ShareStatus (string) --

        Current directory status of the shared AWS Managed Microsoft AD directory.

      • ShareMethod (string) --

        The method used when sharing a directory to determine whether the directory should be shared within your AWS organization ( ORGANIZATIONS) or with any AWS account by sending a shared directory request ( HANDSHAKE).

      • ShareNotes (string) --

        A directory share request that is sent by the directory owner to the directory consumer. The request includes a typed message to help the directory consumer administrator determine whether to approve or reject the share invitation.

      • LaunchTime (datetime) --

        Specifies when the directory was created.

      • StageLastUpdatedDateTime (datetime) --

        The date and time that the stage was last updated.

      • Type (string) --

        The directory size.

      • VpcSettings (dict) --

        A DirectoryVpcSettingsDescription object that contains additional information about a directory. This member is only present if the directory is a Simple AD or Managed AD directory.

        • VpcId (string) --

          The identifier of the VPC that the directory is in.

        • SubnetIds (list) --

          The identifiers of the subnets for the directory servers.

          • (string) --

        • SecurityGroupId (string) --

          The domain controller security group identifier for the directory.

        • AvailabilityZones (list) --

          The list of Availability Zones that the directory is in.

          • (string) --

      • ConnectSettings (dict) --

        A DirectoryConnectSettingsDescription object that contains additional information about an AD Connector directory. This member is only present if the directory is an AD Connector directory.

        • VpcId (string) --

          The identifier of the VPC that the AD Connector is in.

        • SubnetIds (list) --

          A list of subnet identifiers in the VPC that the AD connector is in.

          • (string) --

        • CustomerUserName (string) --

          The user name of the service account in the on-premises directory.

        • SecurityGroupId (string) --

          The security group identifier for the AD Connector directory.

        • AvailabilityZones (list) --

          A list of the Availability Zones that the directory is in.

          • (string) --

        • ConnectIps (list) --

          The IP addresses of the AD Connector servers.

          • (string) --

      • RadiusSettings (dict) --

        A RadiusSettings object that contains information about the RADIUS server configured for this directory.

        • RadiusServers (list) --

          An array of strings that contains the IP addresses of the RADIUS server endpoints, or the IP addresses of your RADIUS server load balancer.

          • (string) --

        • RadiusPort (integer) --

          The port that your RADIUS server is using for communications. Your on-premises network must allow inbound traffic over this port from the AWS Directory Service servers.

        • RadiusTimeout (integer) --

          The amount of time, in seconds, to wait for the RADIUS server to respond.

        • RadiusRetries (integer) --

          The maximum number of times that communication with the RADIUS server is attempted.

        • SharedSecret (string) --

          Required for enabling RADIUS on the directory.

        • AuthenticationProtocol (string) --

          The protocol specified for your RADIUS endpoints.

        • DisplayLabel (string) --

          Not currently used.

        • UseSameUsername (boolean) --

          Not currently used.

      • RadiusStatus (string) --

        The status of the RADIUS MFA server connection.

      • StageReason (string) --

        Additional information about the directory stage.

      • SsoEnabled (boolean) --

        Indicates if single sign-on is enabled for the directory. For more information, see EnableSso and DisableSso.

      • DesiredNumberOfDomainControllers (integer) --

        The desired number of domain controllers in the directory if the directory is Microsoft AD.

      • OwnerDirectoryDescription (dict) --

        Describes the AWS Managed Microsoft AD directory in the directory owner account.

        • DirectoryId (string) --

          Identifier of the AWS Managed Microsoft AD directory in the directory owner account.

        • AccountId (string) --

          Identifier of the directory owner account.

        • DnsIpAddrs (list) --

          IP address of the directory’s domain controllers.

          • (string) --

        • VpcSettings (dict) --

          Information about the VPC settings for the directory.

          • VpcId (string) --

            The identifier of the VPC that the directory is in.

          • SubnetIds (list) --

            The identifiers of the subnets for the directory servers.

            • (string) --

          • SecurityGroupId (string) --

            The domain controller security group identifier for the directory.

          • AvailabilityZones (list) --

            The list of Availability Zones that the directory is in.

            • (string) --

        • RadiusSettings (dict) --

          A RadiusSettings object that contains information about the RADIUS server.

          • RadiusServers (list) --

            An array of strings that contains the IP addresses of the RADIUS server endpoints, or the IP addresses of your RADIUS server load balancer.

            • (string) --

          • RadiusPort (integer) --

            The port that your RADIUS server is using for communications. Your on-premises network must allow inbound traffic over this port from the AWS Directory Service servers.

          • RadiusTimeout (integer) --

            The amount of time, in seconds, to wait for the RADIUS server to respond.

          • RadiusRetries (integer) --

            The maximum number of times that communication with the RADIUS server is attempted.

          • SharedSecret (string) --

            Required for enabling RADIUS on the directory.

          • AuthenticationProtocol (string) --

            The protocol specified for your RADIUS endpoints.

          • DisplayLabel (string) --

            Not currently used.

          • UseSameUsername (boolean) --

            Not currently used.

        • RadiusStatus (string) --

          Information about the status of the RADIUS server.

  • NextToken (string) --

    If not null, more results are available. Pass this value for the NextToken parameter in a subsequent call to DescribeDirectories to retrieve the next set of items.