IAM Roles Anywhere

2022/07/05 - IAM Roles Anywhere - 26 new api methods

Changes  IAM Roles Anywhere allows your workloads such as servers, containers, and applications to obtain temporary AWS credentials and use the same IAM roles and policies that you have configured for your AWS workloads to access AWS resources.

DeleteProfile (new) Link ¶

Deletes a profile.

Required permissions: rolesanywhere:DeleteProfile.

See also: AWS API Documentation

Request Syntax

client.delete_profile(
    profileId='string'
)
type profileId:

string

param profileId:

[REQUIRED]

The unique identifier of the profile.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'createdAt': datetime(2015, 1, 1),
        'createdBy': 'string',
        'durationSeconds': 123,
        'enabled': True|False,
        'managedPolicyArns': [
            'string',
        ],
        'name': 'string',
        'profileArn': 'string',
        'profileId': 'string',
        'requireInstanceProperties': True|False,
        'roleArns': [
            'string',
        ],
        'sessionPolicy': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • profile (dict) --

      The state of the profile after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the profile was created.

      • createdBy (string) --

        The Amazon Web Services account that created the profile.

      • durationSeconds (integer) --

        The number of seconds the vended session credentials are valid for.

      • enabled (boolean) --

        Indicates whether the profile is enabled.

      • managedPolicyArns (list) --

        A list of managed policy ARNs that apply to the vended session credentials.

        • (string) --

      • name (string) --

        The name of the profile.

      • profileArn (string) --

        The ARN of the profile.

      • profileId (string) --

        The unique identifier of the profile.

      • requireInstanceProperties (boolean) --

        Specifies whether instance properties are required in CreateSession requests with this profile.

      • roleArns (list) --

        A list of IAM roles that this profile can assume in a CreateSession operation.

        • (string) --

      • sessionPolicy (string) --

        A session policy that applies to the trust boundary of the vended session credentials.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the profile was last updated.

CreateTrustAnchor (new) Link ¶

Creates a trust anchor. You establish trust between IAM Roles Anywhere and your certificate authority (CA) by configuring a trust anchor. A Trust Anchor is defined either as a reference to a AWS Certificate Manager Private Certificate Authority (ACM PCA), or by uploading a Certificate Authority (CA) certificate. Your AWS workloads can authenticate with the trust anchor using certificates issued by the trusted Certificate Authority (CA) in exchange for temporary AWS credentials.

Required permissions: rolesanywhere:CreateTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.create_trust_anchor(
    enabled=True|False,
    name='string',
    source={
        'sourceData': {
            'acmPcaArn': 'string',
            'x509CertificateData': 'string'
        },
        'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
    },
    tags=[
        {
            'key': 'string',
            'value': 'string'
        },
    ]
)
type enabled:

boolean

param enabled:

Specifies whether the trust anchor is enabled.

type name:

string

param name:

[REQUIRED]

The name of the trust anchor.

type source:

dict

param source:

[REQUIRED]

The trust anchor type and its related certificate data.

  • sourceData (dict) --

    The data field of the trust anchor depending on its type.

    • acmPcaArn (string) --

      The root certificate of the Certificate Manager Private Certificate Authority specified by this ARN is used in trust validation for CreateSession operations. Included for trust anchors of type AWS_ACM_PCA.

    • x509CertificateData (string) --

      The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

  • sourceType (string) --

    The type of the trust anchor.

type tags:

list

param tags:

The tags to attach to the trust anchor.

  • (dict) --

    A label that consists of a key and value you define.

    • key (string) -- [REQUIRED]

      The tag key.

    • value (string) -- [REQUIRED]

      The tag value.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Certificate Manager Private Certificate Authority specified by this ARN is used in trust validation for CreateSession operations. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

GetSubject (new) Link ¶

Gets a Subject. A Subject associates a certificate identity with authentication attempts by CreateSession. The Subject resources stores audit information such as status of the last authentication attempt, the certificate data used in the attempt, and the last time the associated identity attempted authentication.

Required permissions: rolesanywhere:GetSubject.

See also: AWS API Documentation

Request Syntax

client.get_subject(
    subjectId='string'
)
type subjectId:

string

param subjectId:

[REQUIRED]

The unique identifier of the subject.

rtype:

dict

returns:

Response Syntax

{
    'subject': {
        'createdAt': datetime(2015, 1, 1),
        'credentials': [
            {
                'enabled': True|False,
                'failed': True|False,
                'issuer': 'string',
                'seenAt': datetime(2015, 1, 1),
                'serialNumber': 'string',
                'x509CertificateData': 'string'
            },
        ],
        'enabled': True|False,
        'instanceProperties': [
            {
                'failed': True|False,
                'properties': {
                    'string': 'string'
                },
                'seenAt': datetime(2015, 1, 1)
            },
        ],
        'lastSeenAt': datetime(2015, 1, 1),
        'subjectArn': 'string',
        'subjectId': 'string',
        'updatedAt': datetime(2015, 1, 1),
        'x509Subject': 'string'
    }
}

Response Structure

  • (dict) --

    • subject (dict) --

      The state of the subject after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the subject was created.

      • credentials (list) --

        The temporary session credentials vended at the last authenticating call with this Subject.

        • (dict) --

          A record of a presented X509 credential to CreateSession.

          • enabled (boolean) --

            Indicates whether the credential is enabled.

          • failed (boolean) --

            Indicates whether the CreateSession operation was successful.

          • issuer (string) --

            The fully qualified domain name of the issuing certificate for the presented end-entity certificate.

          • seenAt (datetime) --

            The ISO-8601 time stamp of when the certificate was last used in a CreateSession operation.

          • serialNumber (string) --

            The serial number of the certificate.

          • x509CertificateData (string) --

            The PEM-encoded data of the certificate.

      • enabled (boolean) --

        The enabled status of the subject.

      • instanceProperties (list) --

        The specified instance properties associated with the request.

        • (dict) --

          A key-value pair you set that identifies a property of the authenticating instance.

          • failed (boolean) --

            Indicates whether the CreateSession operation was successful.

          • properties (dict) --

            A list of instanceProperty objects.

            • (string) --

              • (string) --

          • seenAt (datetime) --

            The ISO-8601 time stamp of when the certificate was last used in a CreateSession operation.

      • lastSeenAt (datetime) --

        The ISO-8601 timestamp of the last time this Subject requested temporary session credentials.

      • subjectArn (string) --

        The ARN of the resource.

      • subjectId (string) --

        The id of the resource

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the subject was last updated.

      • x509Subject (string) --

        The x509 principal identifier of the authenticating certificate.

ListProfiles (new) Link ¶

Lists all profiles in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListProfiles.

See also: AWS API Documentation

Request Syntax

client.list_profiles(
    nextToken='string',
    pageSize=123
)
type nextToken:

string

param nextToken:

A token that indicates where the output should continue from, if a previous operation did not show all results. To get the next results, call the operation again with this value.

type pageSize:

integer

param pageSize:

The number of resources in the paginated list.

rtype:

dict

returns:

Response Syntax

{
    'nextToken': 'string',
    'profiles': [
        {
            'createdAt': datetime(2015, 1, 1),
            'createdBy': 'string',
            'durationSeconds': 123,
            'enabled': True|False,
            'managedPolicyArns': [
                'string',
            ],
            'name': 'string',
            'profileArn': 'string',
            'profileId': 'string',
            'requireInstanceProperties': True|False,
            'roleArns': [
                'string',
            ],
            'sessionPolicy': 'string',
            'updatedAt': datetime(2015, 1, 1)
        },
    ]
}

Response Structure

  • (dict) --

    • nextToken (string) --

      A token that indicates where the output should continue from, if a previous operation did not show all results. To get the next results, call the operation again with this value.

    • profiles (list) --

      A list of profiles.

      • (dict) --

        The state of the profile after a read or write operation.

        • createdAt (datetime) --

          The ISO-8601 timestamp when the profile was created.

        • createdBy (string) --

          The Amazon Web Services account that created the profile.

        • durationSeconds (integer) --

          The number of seconds the vended session credentials are valid for.

        • enabled (boolean) --

          Indicates whether the profile is enabled.

        • managedPolicyArns (list) --

          A list of managed policy ARNs that apply to the vended session credentials.

          • (string) --

        • name (string) --

          The name of the profile.

        • profileArn (string) --

          The ARN of the profile.

        • profileId (string) --

          The unique identifier of the profile.

        • requireInstanceProperties (boolean) --

          Specifies whether instance properties are required in CreateSession requests with this profile.

        • roleArns (list) --

          A list of IAM roles that this profile can assume in a CreateSession operation.

          • (string) --

        • sessionPolicy (string) --

          A session policy that applies to the trust boundary of the vended session credentials.

        • updatedAt (datetime) --

          The ISO-8601 timestamp when the profile was last updated.

DisableCrl (new) Link ¶

Disables a certificate revocation list (CRL).

Required permissions: rolesanywhere:DisableCrl.

See also: AWS API Documentation

Request Syntax

client.disable_crl(
    crlId='string'
)
type crlId:

string

param crlId:

[REQUIRED]

The unique identifier of the certificate revocation list (CRL).

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'createdAt': datetime(2015, 1, 1),
        'crlArn': 'string',
        'crlData': b'bytes',
        'crlId': 'string',
        'enabled': True|False,
        'name': 'string',
        'trustAnchorArn': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • crl (dict) --

      The state of the certificate revocation list (CRL) after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was created.

      • crlArn (string) --

        The ARN of the certificate revocation list (CRL).

      • crlData (bytes) --

        The state of the certificate revocation list (CRL) after a read or write operation.

      • crlId (string) --

        The unique identifier of the certificate revocation list (CRL).

      • enabled (boolean) --

        Indicates whether the certificate revocation list (CRL) is enabled.

      • name (string) --

        The name of the certificate revocation list (CRL).

      • trustAnchorArn (string) --

        The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.

GetTrustAnchor (new) Link ¶

Gets a trust anchor.

Required permissions: rolesanywhere:GetTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.get_trust_anchor(
    trustAnchorId='string'
)
type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Certificate Manager Private Certificate Authority specified by this ARN is used in trust validation for CreateSession operations. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

ImportCrl (new) Link ¶

Imports the certificate revocation list (CRL). CRl is a list of certificates that have been revoked by the issuing certificate Authority (CA). IAM Roles Anywhere validates against the crl list before issuing credentials.

Required permissions: rolesanywhere:ImportCrl.

See also: AWS API Documentation

Request Syntax

client.import_crl(
    crlData=b'bytes',
    enabled=True|False,
    name='string',
    tags=[
        {
            'key': 'string',
            'value': 'string'
        },
    ],
    trustAnchorArn='string'
)
type crlData:

bytes

param crlData:

[REQUIRED]

The x509 v3 specified certificate revocation list

type enabled:

boolean

param enabled:

Specifies whether the certificate revocation list (CRL) is enabled.

type name:

string

param name:

[REQUIRED]

The name of the certificate revocation list (CRL).

type tags:

list

param tags:

A list of tags to attach to the certificate revocation list (CRL).

  • (dict) --

    A label that consists of a key and value you define.

    • key (string) -- [REQUIRED]

      The tag key.

    • value (string) -- [REQUIRED]

      The tag value.

type trustAnchorArn:

string

param trustAnchorArn:

[REQUIRED]

The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'createdAt': datetime(2015, 1, 1),
        'crlArn': 'string',
        'crlData': b'bytes',
        'crlId': 'string',
        'enabled': True|False,
        'name': 'string',
        'trustAnchorArn': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • crl (dict) --

      The state of the certificate revocation list (CRL) after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was created.

      • crlArn (string) --

        The ARN of the certificate revocation list (CRL).

      • crlData (bytes) --

        The state of the certificate revocation list (CRL) after a read or write operation.

      • crlId (string) --

        The unique identifier of the certificate revocation list (CRL).

      • enabled (boolean) --

        Indicates whether the certificate revocation list (CRL) is enabled.

      • name (string) --

        The name of the certificate revocation list (CRL).

      • trustAnchorArn (string) --

        The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.

ListCrls (new) Link ¶

Lists all Crls in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListCrls.

See also: AWS API Documentation

Request Syntax

client.list_crls(
    nextToken='string',
    pageSize=123
)
type nextToken:

string

param nextToken:

A token that indicates where the output should continue from, if a previous operation did not show all results. To get the next results, call the operation again with this value.

type pageSize:

integer

param pageSize:

The number of resources in the paginated list.

rtype:

dict

returns:

Response Syntax

{
    'crls': [
        {
            'createdAt': datetime(2015, 1, 1),
            'crlArn': 'string',
            'crlData': b'bytes',
            'crlId': 'string',
            'enabled': True|False,
            'name': 'string',
            'trustAnchorArn': 'string',
            'updatedAt': datetime(2015, 1, 1)
        },
    ],
    'nextToken': 'string'
}

Response Structure

  • (dict) --

    • crls (list) --

      A list of certificate revocation lists (CRL).

      • (dict) --

        The state of the certificate revocation list (CRL) after a read or write operation.

        • createdAt (datetime) --

          The ISO-8601 timestamp when the certificate revocation list (CRL) was created.

        • crlArn (string) --

          The ARN of the certificate revocation list (CRL).

        • crlData (bytes) --

          The state of the certificate revocation list (CRL) after a read or write operation.

        • crlId (string) --

          The unique identifier of the certificate revocation list (CRL).

        • enabled (boolean) --

          Indicates whether the certificate revocation list (CRL) is enabled.

        • name (string) --

          The name of the certificate revocation list (CRL).

        • trustAnchorArn (string) --

          The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.

        • updatedAt (datetime) --

          The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.

    • nextToken (string) --

      A token that indicates where the output should continue from, if a previous operation did not show all results. To get the next results, call the operation again with this value.

GetCrl (new) Link ¶

Gets a certificate revocation list (CRL).

Required permissions: rolesanywhere:GetCrl.

See also: AWS API Documentation

Request Syntax

client.get_crl(
    crlId='string'
)
type crlId:

string

param crlId:

[REQUIRED]

The unique identifier of the certificate revocation list (CRL).

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'createdAt': datetime(2015, 1, 1),
        'crlArn': 'string',
        'crlData': b'bytes',
        'crlId': 'string',
        'enabled': True|False,
        'name': 'string',
        'trustAnchorArn': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • crl (dict) --

      The state of the certificate revocation list (CRL) after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was created.

      • crlArn (string) --

        The ARN of the certificate revocation list (CRL).

      • crlData (bytes) --

        The state of the certificate revocation list (CRL) after a read or write operation.

      • crlId (string) --

        The unique identifier of the certificate revocation list (CRL).

      • enabled (boolean) --

        Indicates whether the certificate revocation list (CRL) is enabled.

      • name (string) --

        The name of the certificate revocation list (CRL).

      • trustAnchorArn (string) --

        The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.

UpdateTrustAnchor (new) Link ¶

Updates the trust anchor.You establish trust between IAM Roles Anywhere and your certificate authority (CA) by configuring a trust anchor. A Trust Anchor is defined either as a reference to a AWS Certificate Manager Private Certificate Authority (ACM PCA), or by uploading a Certificate Authority (CA) certificate. Your AWS workloads can authenticate with the trust anchor using certificates issued by the trusted Certificate Authority (CA) in exchange for temporary AWS credentials.

Required permissions: rolesanywhere:UpdateTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.update_trust_anchor(
    name='string',
    source={
        'sourceData': {
            'acmPcaArn': 'string',
            'x509CertificateData': 'string'
        },
        'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
    },
    trustAnchorId='string'
)
type name:

string

param name:

The name of the trust anchor.

type source:

dict

param source:

The trust anchor type and its related certificate data.

  • sourceData (dict) --

    The data field of the trust anchor depending on its type.

    • acmPcaArn (string) --

      The root certificate of the Certificate Manager Private Certificate Authority specified by this ARN is used in trust validation for CreateSession operations. Included for trust anchors of type AWS_ACM_PCA.

    • x509CertificateData (string) --

      The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

  • sourceType (string) --

    The type of the trust anchor.

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Certificate Manager Private Certificate Authority specified by this ARN is used in trust validation for CreateSession operations. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

GetProfile (new) Link ¶

Gets a profile.

Required permissions: rolesanywhere:GetProfile.

See also: AWS API Documentation

Request Syntax

client.get_profile(
    profileId='string'
)
type profileId:

string

param profileId:

[REQUIRED]

The unique identifier of the profile.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'createdAt': datetime(2015, 1, 1),
        'createdBy': 'string',
        'durationSeconds': 123,
        'enabled': True|False,
        'managedPolicyArns': [
            'string',
        ],
        'name': 'string',
        'profileArn': 'string',
        'profileId': 'string',
        'requireInstanceProperties': True|False,
        'roleArns': [
            'string',
        ],
        'sessionPolicy': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • profile (dict) --

      The state of the profile after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the profile was created.

      • createdBy (string) --

        The Amazon Web Services account that created the profile.

      • durationSeconds (integer) --

        The number of seconds the vended session credentials are valid for.

      • enabled (boolean) --

        Indicates whether the profile is enabled.

      • managedPolicyArns (list) --

        A list of managed policy ARNs that apply to the vended session credentials.

        • (string) --

      • name (string) --

        The name of the profile.

      • profileArn (string) --

        The ARN of the profile.

      • profileId (string) --

        The unique identifier of the profile.

      • requireInstanceProperties (boolean) --

        Specifies whether instance properties are required in CreateSession requests with this profile.

      • roleArns (list) --

        A list of IAM roles that this profile can assume in a CreateSession operation.

        • (string) --

      • sessionPolicy (string) --

        A session policy that applies to the trust boundary of the vended session credentials.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the profile was last updated.

EnableProfile (new) Link ¶

Enables the roles in a profile to receive session credentials in CreateSession.

Required permissions: rolesanywhere:EnableProfile.

See also: AWS API Documentation

Request Syntax

client.enable_profile(
    profileId='string'
)
type profileId:

string

param profileId:

[REQUIRED]

The unique identifier of the profile.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'createdAt': datetime(2015, 1, 1),
        'createdBy': 'string',
        'durationSeconds': 123,
        'enabled': True|False,
        'managedPolicyArns': [
            'string',
        ],
        'name': 'string',
        'profileArn': 'string',
        'profileId': 'string',
        'requireInstanceProperties': True|False,
        'roleArns': [
            'string',
        ],
        'sessionPolicy': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • profile (dict) --

      The state of the profile after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the profile was created.

      • createdBy (string) --

        The Amazon Web Services account that created the profile.

      • durationSeconds (integer) --

        The number of seconds the vended session credentials are valid for.

      • enabled (boolean) --

        Indicates whether the profile is enabled.

      • managedPolicyArns (list) --

        A list of managed policy ARNs that apply to the vended session credentials.

        • (string) --

      • name (string) --

        The name of the profile.

      • profileArn (string) --

        The ARN of the profile.

      • profileId (string) --

        The unique identifier of the profile.

      • requireInstanceProperties (boolean) --

        Specifies whether instance properties are required in CreateSession requests with this profile.

      • roleArns (list) --

        A list of IAM roles that this profile can assume in a CreateSession operation.

        • (string) --

      • sessionPolicy (string) --

        A session policy that applies to the trust boundary of the vended session credentials.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the profile was last updated.

TagResource (new) Link ¶

Attaches tags to a resource.

Required permissions: rolesanywhere:TagResource.

See also: AWS API Documentation

Request Syntax

client.tag_resource(
    resourceArn='string',
    tags=[
        {
            'key': 'string',
            'value': 'string'
        },
    ]
)
type resourceArn:

string

param resourceArn:

[REQUIRED]

The ARN of the resource.

type tags:

list

param tags:

[REQUIRED]

The tags to attach to the resource.

  • (dict) --

    A label that consists of a key and value you define.

    • key (string) -- [REQUIRED]

      The tag key.

    • value (string) -- [REQUIRED]

      The tag value.

rtype:

dict

returns:

Response Syntax

{}

Response Structure

  • (dict) --

DisableTrustAnchor (new) Link ¶

Disables a trust anchor. When disabled, CreateSession requests specifying this trust anchor are unauthorized.

Required permissions: rolesanywhere:DisableTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.disable_trust_anchor(
    trustAnchorId='string'
)
type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Certificate Manager Private Certificate Authority specified by this ARN is used in trust validation for CreateSession operations. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

ListTagsForResource (new) Link ¶

Lists the tags attached to the resource.

Required permissions: rolesanywhere:ListTagsForResource.

See also: AWS API Documentation

Request Syntax

client.list_tags_for_resource(
    resourceArn='string'
)
type resourceArn:

string

param resourceArn:

[REQUIRED]

The ARN of the resource.

rtype:

dict

returns:

Response Syntax

{
    'tags': [
        {
            'key': 'string',
            'value': 'string'
        },
    ]
}

Response Structure

  • (dict) --

    • tags (list) --

      A list of tags attached to the resource.

      • (dict) --

        A label that consists of a key and value you define.

        • key (string) --

          The tag key.

        • value (string) --

          The tag value.

ListTrustAnchors (new) Link ¶

Lists the trust anchors in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListTrustAnchors.

See also: AWS API Documentation

Request Syntax

client.list_trust_anchors(
    nextToken='string',
    pageSize=123
)
type nextToken:

string

param nextToken:

A token that indicates where the output should continue from, if a previous operation did not show all results. To get the next results, call the operation again with this value.

type pageSize:

integer

param pageSize:

The number of resources in the paginated list.

rtype:

dict

returns:

Response Syntax

{
    'nextToken': 'string',
    'trustAnchors': [
        {
            'createdAt': datetime(2015, 1, 1),
            'enabled': True|False,
            'name': 'string',
            'source': {
                'sourceData': {
                    'acmPcaArn': 'string',
                    'x509CertificateData': 'string'
                },
                'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
            },
            'trustAnchorArn': 'string',
            'trustAnchorId': 'string',
            'updatedAt': datetime(2015, 1, 1)
        },
    ]
}

Response Structure

  • (dict) --

    • nextToken (string) --

      A token that indicates where the output should continue from, if a previous operation did not show all results. To get the next results, call the operation again with this value.

    • trustAnchors (list) --

      A list of trust anchors.

      • (dict) --

        The state of the trust anchor after a read or write operation.

        • createdAt (datetime) --

          The ISO-8601 timestamp when the trust anchor was created.

        • enabled (boolean) --

          Indicates whether the trust anchor is enabled.

        • name (string) --

          The name of the trust anchor.

        • source (dict) --

          The trust anchor type and its related certificate data.

          • sourceData (dict) --

            The data field of the trust anchor depending on its type.

            • acmPcaArn (string) --

              The root certificate of the Certificate Manager Private Certificate Authority specified by this ARN is used in trust validation for CreateSession operations. Included for trust anchors of type AWS_ACM_PCA.

            • x509CertificateData (string) --

              The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

          • sourceType (string) --

            The type of the trust anchor.

        • trustAnchorArn (string) --

          The ARN of the trust anchor.

        • trustAnchorId (string) --

          The unique identifier of the trust anchor.

        • updatedAt (datetime) --

          The ISO-8601 timestamp when the trust anchor was last updated.

EnableCrl (new) Link ¶

Enables a certificate revocation list (CRL). When enabled, certificates stored in the CRL are unauthorized to receive session credentials.

Required permissions: rolesanywhere:EnableCrl.

See also: AWS API Documentation

Request Syntax

client.enable_crl(
    crlId='string'
)
type crlId:

string

param crlId:

[REQUIRED]

The unique identifier of the certificate revocation list (CRL).

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'createdAt': datetime(2015, 1, 1),
        'crlArn': 'string',
        'crlData': b'bytes',
        'crlId': 'string',
        'enabled': True|False,
        'name': 'string',
        'trustAnchorArn': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • crl (dict) --

      The state of the certificate revocation list (CRL) after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was created.

      • crlArn (string) --

        The ARN of the certificate revocation list (CRL).

      • crlData (bytes) --

        The state of the certificate revocation list (CRL) after a read or write operation.

      • crlId (string) --

        The unique identifier of the certificate revocation list (CRL).

      • enabled (boolean) --

        Indicates whether the certificate revocation list (CRL) is enabled.

      • name (string) --

        The name of the certificate revocation list (CRL).

      • trustAnchorArn (string) --

        The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.

CreateProfile (new) Link ¶

Creates a profile. A profile is configuration resource to list the roles that RolesAnywhere service is trusted to assume. In addition, by applying a profile you can intersect permissions with IAM managed policies.

Required permissions: rolesanywhere:CreateProfile.

See also: AWS API Documentation

Request Syntax

client.create_profile(
    durationSeconds=123,
    enabled=True|False,
    managedPolicyArns=[
        'string',
    ],
    name='string',
    requireInstanceProperties=True|False,
    roleArns=[
        'string',
    ],
    sessionPolicy='string',
    tags=[
        {
            'key': 'string',
            'value': 'string'
        },
    ]
)
type durationSeconds:

integer

param durationSeconds:

The number of seconds the vended session credentials are valid for.

type enabled:

boolean

param enabled:

Specifies whether the profile is enabled.

type managedPolicyArns:

list

param managedPolicyArns:

A list of managed policy ARNs that apply to the vended session credentials.

  • (string) --

type name:

string

param name:

[REQUIRED]

The name of the profile.

type requireInstanceProperties:

boolean

param requireInstanceProperties:

Specifies whether instance properties are required in CreateSession requests with this profile.

type roleArns:

list

param roleArns:

[REQUIRED]

A list of IAM roles that this profile can assume in a CreateSession operation.

  • (string) --

type sessionPolicy:

string

param sessionPolicy:

A session policy that applies to the trust boundary of the vended session credentials.

type tags:

list

param tags:

The tags to attach to the profile.

  • (dict) --

    A label that consists of a key and value you define.

    • key (string) -- [REQUIRED]

      The tag key.

    • value (string) -- [REQUIRED]

      The tag value.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'createdAt': datetime(2015, 1, 1),
        'createdBy': 'string',
        'durationSeconds': 123,
        'enabled': True|False,
        'managedPolicyArns': [
            'string',
        ],
        'name': 'string',
        'profileArn': 'string',
        'profileId': 'string',
        'requireInstanceProperties': True|False,
        'roleArns': [
            'string',
        ],
        'sessionPolicy': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • profile (dict) --

      The state of the profile after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the profile was created.

      • createdBy (string) --

        The Amazon Web Services account that created the profile.

      • durationSeconds (integer) --

        The number of seconds the vended session credentials are valid for.

      • enabled (boolean) --

        Indicates whether the profile is enabled.

      • managedPolicyArns (list) --

        A list of managed policy ARNs that apply to the vended session credentials.

        • (string) --

      • name (string) --

        The name of the profile.

      • profileArn (string) --

        The ARN of the profile.

      • profileId (string) --

        The unique identifier of the profile.

      • requireInstanceProperties (boolean) --

        Specifies whether instance properties are required in CreateSession requests with this profile.

      • roleArns (list) --

        A list of IAM roles that this profile can assume in a CreateSession operation.

        • (string) --

      • sessionPolicy (string) --

        A session policy that applies to the trust boundary of the vended session credentials.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the profile was last updated.

DisableProfile (new) Link ¶

Disables a profile. When disabled, CreateSession requests with this profile fail.

Required permissions: rolesanywhere:DisableProfile.

See also: AWS API Documentation

Request Syntax

client.disable_profile(
    profileId='string'
)
type profileId:

string

param profileId:

[REQUIRED]

The unique identifier of the profile.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'createdAt': datetime(2015, 1, 1),
        'createdBy': 'string',
        'durationSeconds': 123,
        'enabled': True|False,
        'managedPolicyArns': [
            'string',
        ],
        'name': 'string',
        'profileArn': 'string',
        'profileId': 'string',
        'requireInstanceProperties': True|False,
        'roleArns': [
            'string',
        ],
        'sessionPolicy': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • profile (dict) --

      The state of the profile after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the profile was created.

      • createdBy (string) --

        The Amazon Web Services account that created the profile.

      • durationSeconds (integer) --

        The number of seconds the vended session credentials are valid for.

      • enabled (boolean) --

        Indicates whether the profile is enabled.

      • managedPolicyArns (list) --

        A list of managed policy ARNs that apply to the vended session credentials.

        • (string) --

      • name (string) --

        The name of the profile.

      • profileArn (string) --

        The ARN of the profile.

      • profileId (string) --

        The unique identifier of the profile.

      • requireInstanceProperties (boolean) --

        Specifies whether instance properties are required in CreateSession requests with this profile.

      • roleArns (list) --

        A list of IAM roles that this profile can assume in a CreateSession operation.

        • (string) --

      • sessionPolicy (string) --

        A session policy that applies to the trust boundary of the vended session credentials.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the profile was last updated.

UpdateCrl (new) Link ¶

Updates the certificate revocation list (CRL). CRl is a list of certificates that have been revoked by the issuing certificate Authority (CA). IAM Roles Anywhere validates against the crl list before issuing credentials.

Required permissions: rolesanywhere:UpdateCrl.

See also: AWS API Documentation

Request Syntax

client.update_crl(
    crlData=b'bytes',
    crlId='string',
    name='string'
)
type crlData:

bytes

param crlData:

The x509 v3 specified certificate revocation list

type crlId:

string

param crlId:

[REQUIRED]

The unique identifier of the certificate revocation list (CRL).

type name:

string

param name:

The name of the Crl.

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'createdAt': datetime(2015, 1, 1),
        'crlArn': 'string',
        'crlData': b'bytes',
        'crlId': 'string',
        'enabled': True|False,
        'name': 'string',
        'trustAnchorArn': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • crl (dict) --

      The state of the certificate revocation list (CRL) after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was created.

      • crlArn (string) --

        The ARN of the certificate revocation list (CRL).

      • crlData (bytes) --

        The state of the certificate revocation list (CRL) after a read or write operation.

      • crlId (string) --

        The unique identifier of the certificate revocation list (CRL).

      • enabled (boolean) --

        Indicates whether the certificate revocation list (CRL) is enabled.

      • name (string) --

        The name of the certificate revocation list (CRL).

      • trustAnchorArn (string) --

        The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.

DeleteTrustAnchor (new) Link ¶

Deletes a trust anchor.

Required permissions: rolesanywhere:DeleteTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.delete_trust_anchor(
    trustAnchorId='string'
)
type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Certificate Manager Private Certificate Authority specified by this ARN is used in trust validation for CreateSession operations. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

UpdateProfile (new) Link ¶

Updates the profile. A profile is configuration resource to list the roles that RolesAnywhere service is trusted to assume. In addition, by applying a profile you can scope-down permissions with IAM managed policies.

Required permissions: rolesanywhere:UpdateProfile.

See also: AWS API Documentation

Request Syntax

client.update_profile(
    durationSeconds=123,
    managedPolicyArns=[
        'string',
    ],
    name='string',
    profileId='string',
    roleArns=[
        'string',
    ],
    sessionPolicy='string'
)
type durationSeconds:

integer

param durationSeconds:

The number of seconds the vended session credentials are valid for.

type managedPolicyArns:

list

param managedPolicyArns:

A list of managed policy ARNs that apply to the vended session credentials.

  • (string) --

type name:

string

param name:

The name of the profile.

type profileId:

string

param profileId:

[REQUIRED]

The unique identifier of the profile.

type roleArns:

list

param roleArns:

A list of IAM roles that this profile can assume in a CreateSession operation.

  • (string) --

type sessionPolicy:

string

param sessionPolicy:

A session policy that applies to the trust boundary of the vended session credentials.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'createdAt': datetime(2015, 1, 1),
        'createdBy': 'string',
        'durationSeconds': 123,
        'enabled': True|False,
        'managedPolicyArns': [
            'string',
        ],
        'name': 'string',
        'profileArn': 'string',
        'profileId': 'string',
        'requireInstanceProperties': True|False,
        'roleArns': [
            'string',
        ],
        'sessionPolicy': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • profile (dict) --

      The state of the profile after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the profile was created.

      • createdBy (string) --

        The Amazon Web Services account that created the profile.

      • durationSeconds (integer) --

        The number of seconds the vended session credentials are valid for.

      • enabled (boolean) --

        Indicates whether the profile is enabled.

      • managedPolicyArns (list) --

        A list of managed policy ARNs that apply to the vended session credentials.

        • (string) --

      • name (string) --

        The name of the profile.

      • profileArn (string) --

        The ARN of the profile.

      • profileId (string) --

        The unique identifier of the profile.

      • requireInstanceProperties (boolean) --

        Specifies whether instance properties are required in CreateSession requests with this profile.

      • roleArns (list) --

        A list of IAM roles that this profile can assume in a CreateSession operation.

        • (string) --

      • sessionPolicy (string) --

        A session policy that applies to the trust boundary of the vended session credentials.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the profile was last updated.

UntagResource (new) Link ¶

Removes tags from the resource.

Required permissions: rolesanywhere:UntagResource.

See also: AWS API Documentation

Request Syntax

client.untag_resource(
    resourceArn='string',
    tagKeys=[
        'string',
    ]
)
type resourceArn:

string

param resourceArn:

[REQUIRED]

The ARN of the resource.

type tagKeys:

list

param tagKeys:

[REQUIRED]

A list of keys. Tag keys are the unique identifiers of tags.

  • (string) --

rtype:

dict

returns:

Response Syntax

{}

Response Structure

  • (dict) --

DeleteCrl (new) Link ¶

Deletes a certificate revocation list (CRL).

Required permissions: rolesanywhere:DeleteCrl.

See also: AWS API Documentation

Request Syntax

client.delete_crl(
    crlId='string'
)
type crlId:

string

param crlId:

[REQUIRED]

The unique identifier of the certificate revocation list (CRL).

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'createdAt': datetime(2015, 1, 1),
        'crlArn': 'string',
        'crlData': b'bytes',
        'crlId': 'string',
        'enabled': True|False,
        'name': 'string',
        'trustAnchorArn': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • crl (dict) --

      The state of the certificate revocation list (CRL) after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was created.

      • crlArn (string) --

        The ARN of the certificate revocation list (CRL).

      • crlData (bytes) --

        The state of the certificate revocation list (CRL) after a read or write operation.

      • crlId (string) --

        The unique identifier of the certificate revocation list (CRL).

      • enabled (boolean) --

        Indicates whether the certificate revocation list (CRL) is enabled.

      • name (string) --

        The name of the certificate revocation list (CRL).

      • trustAnchorArn (string) --

        The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.

EnableTrustAnchor (new) Link ¶

Enables a trust anchor. When enabled, certificates in the trust anchor chain are authorized for trust validation.

Required permissions: rolesanywhere:EnableTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.enable_trust_anchor(
    trustAnchorId='string'
)
type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'createdAt': datetime(2015, 1, 1),
        'enabled': True|False,
        'name': 'string',
        'source': {
            'sourceData': {
                'acmPcaArn': 'string',
                'x509CertificateData': 'string'
            },
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY'
        },
        'trustAnchorArn': 'string',
        'trustAnchorId': 'string',
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) --

    • trustAnchor (dict) --

      The state of the trust anchor after a read or write operation.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • name (string) --

        The name of the trust anchor.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • acmPcaArn (string) --

            The root certificate of the Certificate Manager Private Certificate Authority specified by this ARN is used in trust validation for CreateSession operations. Included for trust anchors of type AWS_ACM_PCA.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • sourceType (string) --

          The type of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

ListSubjects (new) Link ¶

Lists the subjects in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListSubjects.

See also: AWS API Documentation

Request Syntax

client.list_subjects(
    nextToken='string',
    pageSize=123
)
type nextToken:

string

param nextToken:

A token that indicates where the output should continue from, if a previous operation did not show all results. To get the next results, call the operation again with this value.

type pageSize:

integer

param pageSize:

The number of resources in the paginated list.

rtype:

dict

returns:

Response Syntax

{
    'nextToken': 'string',
    'subjects': [
        {
            'createdAt': datetime(2015, 1, 1),
            'enabled': True|False,
            'lastSeenAt': datetime(2015, 1, 1),
            'subjectArn': 'string',
            'subjectId': 'string',
            'updatedAt': datetime(2015, 1, 1),
            'x509Subject': 'string'
        },
    ]
}

Response Structure

  • (dict) --

    • nextToken (string) --

      A token that indicates where the output should continue from, if a previous operation did not show all results. To get the next results, call the operation again with this value.

    • subjects (list) --

      A list of subjects.

      • (dict) --

        A summary representation of Subject resources returned in read operations; primarily ListSubjects.

        • createdAt (datetime) --

          The ISO-8601 time stamp of when the certificate was first used in a CreateSession operation.

        • enabled (boolean) --

          The enabled status of the Subject.

        • lastSeenAt (datetime) --

          The ISO-8601 time stamp of when the certificate was last used in a CreateSession operation.

        • subjectArn (string) --

          The ARN of the resource.

        • subjectId (string) --

          The id of the resource.

        • updatedAt (datetime) --

          The ISO-8601 timestamp when the subject was last updated.

        • x509Subject (string) --

          The x509 principal identifier of the authenticating certificate.