IAM Roles Anywhere

2023/05/15 - IAM Roles Anywhere - 2 new7 updated api methods

Changes  Adds support for custom notification settings in a trust anchor. Introduces PutNotificationSettings and ResetNotificationSettings API's. Updates DurationSeconds max value to 3600.

PutNotificationSettings (new) Link ¶

Attaches a list of notification settings to a trust anchor.

A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

Required permissions: rolesanywhere:PutNotificationSettings.

See also: AWS API Documentation

Request Syntax

client.put_notification_settings(
    notificationSettings=[
        {
            'channel': 'ALL',
            'enabled': True|False,
            'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
            'threshold': 123
        },
    ],
    trustAnchorId='string'
)
type notificationSettings:

list

param notificationSettings:

[REQUIRED]

A list of notification settings to be associated to the trust anchor.

  • (dict) --

    Customizable notification settings that will be applied to notification events. IAM Roles Anywhere consumes these settings while notifying across multiple channels - CloudWatch metrics, EventBridge, and Health Dashboard.

    • channel (string) --

      The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

    • enabled (boolean) -- [REQUIRED]

      Indicates whether the notification setting is enabled.

    • event (string) -- [REQUIRED]

      The event to which this notification setting is applied.

    • threshold (integer) --

      The number of days before a notification event. This value is required for a notification setting that is enabled.

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'notificationSettings': [
            {
                'channel': 'ALL',
                'configuredBy': 'string',
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123
            },
        ],
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • notificationSettings (list) --

        A list of notification settings to be associated to the trust anchor.

        • (dict) --

          The state of a notification setting.

          A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

          • channel (string) --

            The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

          • configuredBy (string) --

            The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

          • enabled (boolean) --

            Indicates whether the notification setting is enabled.

          • event (string) --

            The event to which this notification setting is applied.

          • threshold (integer) --

            The number of days before a notification event.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

ResetNotificationSettings (new) Link ¶

Resets the custom notification setting to IAM Roles Anywhere default setting.

Required permissions: rolesanywhere:ResetNotificationSettings.

See also: AWS API Documentation

Request Syntax

client.reset_notification_settings(
    notificationSettingKeys=[
        {
            'channel': 'ALL',
            'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY'
        },
    ],
    trustAnchorId='string'
)
type notificationSettingKeys:

list

param notificationSettingKeys:

[REQUIRED]

A list of notification setting keys to reset. A notification setting key includes the event and the channel.

  • (dict) --

    A notification setting key to reset. A notification setting key includes the event and the channel.

    • channel (string) --

      The specified channel of notification.

    • event (string) -- [REQUIRED]

      The notification setting event to reset.

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'notificationSettings': [
            {
                'channel': 'ALL',
                'configuredBy': 'string',
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123
            },
        ],
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • notificationSettings (list) --

        A list of notification settings to be associated to the trust anchor.

        • (dict) --

          The state of a notification setting.

          A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

          • channel (string) --

            The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

          • configuredBy (string) --

            The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

          • enabled (boolean) --

            Indicates whether the notification setting is enabled.

          • event (string) --

            The event to which this notification setting is applied.

          • threshold (integer) --

            The number of days before a notification event.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

CreateTrustAnchor (updated) Link ¶
Changes (request, response)
Request 
{'notificationSettings': [{'channel': 'ALL',
                           'enabled': 'boolean',
                           'event': 'CA_CERTIFICATE_EXPIRY | '
                                    'END_ENTITY_CERTIFICATE_EXPIRY',
                           'threshold': 'integer'}]}
Response 
{'trustAnchor': {'notificationSettings': [{'channel': 'ALL',
                                           'configuredBy': 'string',
                                           'enabled': 'boolean',
                                           'event': 'CA_CERTIFICATE_EXPIRY | '
                                                    'END_ENTITY_CERTIFICATE_EXPIRY',
                                           'threshold': 'integer'}]}}

Creates a trust anchor to establish trust between IAM Roles Anywhere and your certificate authority (CA). You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials.

Required permissions: rolesanywhere:CreateTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.create_trust_anchor(
    enabled=True|False,
    name='string',
    notificationSettings=[
        {
            'channel': 'ALL',
            'enabled': True|False,
            'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
            'threshold': 123
        },
    ],
    source={
        'sourceData': {
            'acmPcaArn': 'string',
            'x509CertificateData': 'string'
        },
        'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
    },
    tags=[
        {
            'key': 'string',
            'value': 'string'
        },
    ]
)
type enabled:

boolean

param enabled:

Specifies whether the trust anchor is enabled.

type name:

string

param name:

[REQUIRED]

The name of the trust anchor.

type notificationSettings:

list

param notificationSettings:

A list of notification settings to be associated to the trust anchor.

  • (dict) --

    Customizable notification settings that will be applied to notification events. IAM Roles Anywhere consumes these settings while notifying across multiple channels - CloudWatch metrics, EventBridge, and Health Dashboard.

    • channel (string) --

      The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

    • enabled (boolean) -- [REQUIRED]

      Indicates whether the notification setting is enabled.

    • event (string) -- [REQUIRED]

      The event to which this notification setting is applied.

    • threshold (integer) --

      The number of days before a notification event. This value is required for a notification setting that is enabled.

type source:

dict

param source:

[REQUIRED]

The trust anchor type and its related certificate data.

  • sourceData (dict) --

    The data field of the trust anchor depending on its type.

    • acmPcaArn (string) --

      The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

    • x509CertificateData (string) --

      The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

  • sourceType (string) --

    The type of the trust anchor.

type tags:

list

param tags:

The tags to attach to the trust anchor.

  • (dict) --

    A label that consists of a key and value you define.

    • key (string) -- [REQUIRED]

      The tag key.

    • value (string) -- [REQUIRED]

      The tag value.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'notificationSettings': [
            {
                'channel': 'ALL',
                'configuredBy': 'string',
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123
            },
        ],
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • notificationSettings (list) --

        A list of notification settings to be associated to the trust anchor.

        • (dict) --

          The state of a notification setting.

          A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

          • channel (string) --

            The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

          • configuredBy (string) --

            The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

          • enabled (boolean) --

            Indicates whether the notification setting is enabled.

          • event (string) --

            The event to which this notification setting is applied.

          • threshold (integer) --

            The number of days before a notification event.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

DeleteTrustAnchor (updated) Link ¶
Changes (response) 
{'trustAnchor': {'notificationSettings': [{'channel': 'ALL',
                                           'configuredBy': 'string',
                                           'enabled': 'boolean',
                                           'event': 'CA_CERTIFICATE_EXPIRY | '
                                                    'END_ENTITY_CERTIFICATE_EXPIRY',
                                           'threshold': 'integer'}]}}

Deletes a trust anchor.

Required permissions: rolesanywhere:DeleteTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.delete_trust_anchor(
    trustAnchorId='string'
)
type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'notificationSettings': [
            {
                'channel': 'ALL',
                'configuredBy': 'string',
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123
            },
        ],
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • notificationSettings (list) --

        A list of notification settings to be associated to the trust anchor.

        • (dict) --

          The state of a notification setting.

          A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

          • channel (string) --

            The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

          • configuredBy (string) --

            The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

          • enabled (boolean) --

            Indicates whether the notification setting is enabled.

          • event (string) --

            The event to which this notification setting is applied.

          • threshold (integer) --

            The number of days before a notification event.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

DisableTrustAnchor (updated) Link ¶
Changes (response) 
{'trustAnchor': {'notificationSettings': [{'channel': 'ALL',
                                           'configuredBy': 'string',
                                           'enabled': 'boolean',
                                           'event': 'CA_CERTIFICATE_EXPIRY | '
                                                    'END_ENTITY_CERTIFICATE_EXPIRY',
                                           'threshold': 'integer'}]}}

Disables a trust anchor. When disabled, temporary credential requests specifying this trust anchor are unauthorized.

Required permissions: rolesanywhere:DisableTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.disable_trust_anchor(
    trustAnchorId='string'
)
type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'notificationSettings': [
            {
                'channel': 'ALL',
                'configuredBy': 'string',
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123
            },
        ],
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • notificationSettings (list) --

        A list of notification settings to be associated to the trust anchor.

        • (dict) --

          The state of a notification setting.

          A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

          • channel (string) --

            The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

          • configuredBy (string) --

            The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

          • enabled (boolean) --

            Indicates whether the notification setting is enabled.

          • event (string) --

            The event to which this notification setting is applied.

          • threshold (integer) --

            The number of days before a notification event.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

EnableTrustAnchor (updated) Link ¶
Changes (response) 
{'trustAnchor': {'notificationSettings': [{'channel': 'ALL',
                                           'configuredBy': 'string',
                                           'enabled': 'boolean',
                                           'event': 'CA_CERTIFICATE_EXPIRY | '
                                                    'END_ENTITY_CERTIFICATE_EXPIRY',
                                           'threshold': 'integer'}]}}

Enables a trust anchor. When enabled, certificates in the trust anchor chain are authorized for trust validation.

Required permissions: rolesanywhere:EnableTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.enable_trust_anchor(
    trustAnchorId='string'
)
type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'notificationSettings': [
            {
                'channel': 'ALL',
                'configuredBy': 'string',
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123
            },
        ],
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • notificationSettings (list) --

        A list of notification settings to be associated to the trust anchor.

        • (dict) --

          The state of a notification setting.

          A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

          • channel (string) --

            The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

          • configuredBy (string) --

            The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

          • enabled (boolean) --

            Indicates whether the notification setting is enabled.

          • event (string) --

            The event to which this notification setting is applied.

          • threshold (integer) --

            The number of days before a notification event.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

GetTrustAnchor (updated) Link ¶
Changes (response) 
{'trustAnchor': {'notificationSettings': [{'channel': 'ALL',
                                           'configuredBy': 'string',
                                           'enabled': 'boolean',
                                           'event': 'CA_CERTIFICATE_EXPIRY | '
                                                    'END_ENTITY_CERTIFICATE_EXPIRY',
                                           'threshold': 'integer'}]}}

Gets a trust anchor.

Required permissions: rolesanywhere:GetTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.get_trust_anchor(
    trustAnchorId='string'
)
type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'notificationSettings': [
            {
                'channel': 'ALL',
                'configuredBy': 'string',
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123
            },
        ],
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • notificationSettings (list) --

        A list of notification settings to be associated to the trust anchor.

        • (dict) --

          The state of a notification setting.

          A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

          • channel (string) --

            The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

          • configuredBy (string) --

            The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

          • enabled (boolean) --

            Indicates whether the notification setting is enabled.

          • event (string) --

            The event to which this notification setting is applied.

          • threshold (integer) --

            The number of days before a notification event.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

ListTrustAnchors (updated) Link ¶
Changes (response) 
{'trustAnchors': {'notificationSettings': [{'channel': 'ALL',
                                            'configuredBy': 'string',
                                            'enabled': 'boolean',
                                            'event': 'CA_CERTIFICATE_EXPIRY | '
                                                     'END_ENTITY_CERTIFICATE_EXPIRY',
                                            'threshold': 'integer'}]}}

Lists the trust anchors in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListTrustAnchors.

See also: AWS API Documentation

Request Syntax

client.list_trust_anchors(
    nextToken='string',
    pageSize=123
)
type nextToken:

string

param nextToken:

A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.

type pageSize:

integer

param pageSize:

The number of resources in the paginated list.

rtype:

dict

returns:

Response Syntax

{
    'nextToken': 'string',
    'trustAnchors': [
        {
            'createdAt': datetime(2015, 1, 1),
            'enabled': True|False,
            'name': 'string',
            'notificationSettings': [
                {
                    'channel': 'ALL',
                    'configuredBy': 'string',
                    'enabled': True|False,
                    'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                    'threshold': 123
                },
            ],
            'source': {
                'sourceData': {
                    'acmPcaArn': 'string',
                    'x509CertificateData': 'string'
                },
                'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
            },
            'trustAnchorArn': 'string',
            'trustAnchorId': 'string',
            'updatedAt': datetime(2015, 1, 1)
        },
    ]
}

Response Structure

  • (dict) --

    • nextToken (string) --

      A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.

    • trustAnchors (list) --

      A list of trust anchors.

      • (dict) --

        The state of the trust anchor after a read or write operation.

        • createdAt (datetime) --

          The ISO-8601 timestamp when the trust anchor was created.

        • enabled (boolean) --

          Indicates whether the trust anchor is enabled.

        • name (string) --

          The name of the trust anchor.

        • notificationSettings (list) --

          A list of notification settings to be associated to the trust anchor.

          • (dict) --

            The state of a notification setting.

            A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

            • channel (string) --

              The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

            • configuredBy (string) --

              The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

            • enabled (boolean) --

              Indicates whether the notification setting is enabled.

            • event (string) --

              The event to which this notification setting is applied.

            • threshold (integer) --

              The number of days before a notification event.

        • source (dict) --

          The trust anchor type and its related certificate data.

          • sourceData (dict) --

            The data field of the trust anchor depending on its type.

            • acmPcaArn (string) --

              The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

            • x509CertificateData (string) --

              The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

          • sourceType (string) --

            The type of the trust anchor.

        • trustAnchorArn (string) --

          The ARN of the trust anchor.

        • trustAnchorId (string) --

          The unique identifier of the trust anchor.

        • updatedAt (datetime) --

          The ISO-8601 timestamp when the trust anchor was last updated.

UpdateTrustAnchor (updated) Link ¶
Changes (response) 
{'trustAnchor': {'notificationSettings': [{'channel': 'ALL',
                                           'configuredBy': 'string',
                                           'enabled': 'boolean',
                                           'event': 'CA_CERTIFICATE_EXPIRY | '
                                                    'END_ENTITY_CERTIFICATE_EXPIRY',
                                           'threshold': 'integer'}]}}

Updates a trust anchor. You establish trust between IAM Roles Anywhere and your certificate authority (CA) by configuring a trust anchor. You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials.

Required permissions: rolesanywhere:UpdateTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.update_trust_anchor(
    name='string',
    source={
        'sourceData': {
            'acmPcaArn': 'string',
            'x509CertificateData': 'string'
        },
        'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
    },
    trustAnchorId='string'
)
type name:

string

param name:

The name of the trust anchor.

type source:

dict

param source:

The trust anchor type and its related certificate data.

  • sourceData (dict) --

    The data field of the trust anchor depending on its type.

    • acmPcaArn (string) --

      The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

    • x509CertificateData (string) --

      The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

  • sourceType (string) --

    The type of the trust anchor.

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'notificationSettings': [
            {
                'channel': 'ALL',
                'configuredBy': 'string',
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123
            },
        ],
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • notificationSettings (list) --

        A list of notification settings to be associated to the trust anchor.

        • (dict) --

          The state of a notification setting.

          A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

          • channel (string) --

            The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

          • configuredBy (string) --

            The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

          • enabled (boolean) --

            Indicates whether the notification setting is enabled.

          • event (string) --

            The event to which this notification setting is applied.

          • threshold (integer) --

            The number of days before a notification event.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.