AWS API Changes

2026/11/13 - IAM Roles Anywhere - 25 updated api methods

Changes This release adds resource aliases for IAM Roles Anywhere trust anchors, profiles, and certificate revocation lists (CRLs). Assign an optional, unique alias name to a resource and use its alias ARN wherever an identifier is accepted, including CreateSession.

CreateProfile (updated)

Link ¶
Changes (request, response)
Request

{'aliasName': 'string'}

Response

{'profile': {'aliasArn': 'string',
             'aliasName': 'string',
             'previousAliasName': 'string'}}

Creates a profile, a list of the roles that Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies.

Required permissions: rolesanywhere:CreateProfile.

See also: AWS API Documentation

Request Syntax

client.create_profile(
    name='string',
    requireInstanceProperties=True|False,
    sessionPolicy='string',
    roleArns=[
        'string',
    ],
    managedPolicyArns=[
        'string',
    ],
    durationSeconds=123,
    enabled=True|False,
    tags=[
        {
            'key': 'string',
            'value': 'string'
        },
    ],
    acceptRoleSessionName=True|False,
    aliasName='string'
)

type name:

string

param name:

[REQUIRED]

The name of the profile.

type requireInstanceProperties:

boolean

param requireInstanceProperties:

Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.

type sessionPolicy:

string

param sessionPolicy:

A session policy that applies to the trust boundary of the vended session credentials.

type roleArns:

list

param roleArns:

[REQUIRED]

A list of IAM roles that this profile can assume in a temporary credential request.

(string) --

type managedPolicyArns:

list

param managedPolicyArns:

A list of managed policy ARNs that apply to the vended session credentials.

(string) --

type durationSeconds:

integer

param durationSeconds:

Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.

type enabled:

boolean

param enabled:

Specifies whether the profile is enabled.

type tags:

list

param tags:

The tags to attach to the profile.

(dict) --

A label that consists of a key and value you define.
- key (string) -- [REQUIRED]
  
  The tag key.
- value (string) -- [REQUIRED]
  
  The tag value.

type acceptRoleSessionName:

boolean

param acceptRoleSessionName:

Used to determine if a custom role session name will be accepted in a temporary credential request.

type aliasName:

string

param aliasName:

An alias for the profile. When you set an alias, the response includes the alias ARN of the profile in aliasArn.

An alias name contains 1 to 256 characters. It must begin with a letter (A-Z or a-z). It can contain only letters (A-Z and a-z), numbers (0-9), underscores (_), hyphens (-), and forward slashes (/). A forward slash can appear only between two other characters, so an alias name can't end with a forward slash or contain two in a row. Alias names that begin with aws/, in any combination of uppercase and lowercase letters, are reserved. Alias names are case sensitive.

The alias name must be unique among resources of the same type in your account and Region. If another resource of the same type already has the alias, the request fails with a ValidationException. An invalid or reserved alias name also causes a ValidationException.

If you omit this parameter or specify an empty string, the resource is created without an alias.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'profileId': 'string',
        'profileArn': 'string',
        'name': 'string',
        'requireInstanceProperties': True|False,
        'enabled': True|False,
        'createdBy': 'string',
        'sessionPolicy': 'string',
        'roleArns': [
            'string',
        ],
        'managedPolicyArns': [
            'string',
        ],
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'durationSeconds': 123,
        'acceptRoleSessionName': True|False,
        'attributeMappings': [
            {
                'certificateField': 'x509Subject'|'x509Issuer'|'x509SAN',
                'mappingRules': [
                    {
                        'specifier': 'string'
                    },
                ]
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- profile (dict) --
  
  The state of the profile after a read or write operation.
  - profileId (string) --
    
    The unique identifier of the profile.
  - profileArn (string) --
    
    The ARN of the profile.
  - name (string) --
    
    The name of the profile.
  - requireInstanceProperties (boolean) --
    
    Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.
  - enabled (boolean) --
    
    Indicates whether the profile is enabled.
  - createdBy (string) --
    
    The Amazon Web Services account that created the profile.
  - sessionPolicy (string) --
    
    A session policy that applies to the trust boundary of the vended session credentials.
  - roleArns (list) --
    
    A list of IAM roles that this profile can assume in a temporary credential request.
    - (string) --
  - managedPolicyArns (list) --
    
    A list of managed policy ARNs that apply to the vended session credentials.
    - (string) --
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the profile was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the profile was last updated.
  - durationSeconds (integer) --
    
    Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.
  - acceptRoleSessionName (boolean) --
    
    Used to determine if a custom role session name will be accepted in a temporary credential request.
  - attributeMappings (list) --
    
    A mapping applied to the authenticating end-entity certificate.
    - (dict) --
      
      A mapping applied to the authenticating end-entity certificate.
      - certificateField (string) --
        
        Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.
      - mappingRules (list) --
        
        A list of mapping entries for every supported specifier or sub-field.
        
        (dict) --
        
        A single mapping entry for each supported specifier or sub-field.
        
        specifier (string) --
        
        Specifier within a certificate field, such as CN, OU, or UID from the Subject field.
  - aliasName (string) --
    
    The alias of the profile. Present only if the profile has an alias.
  - aliasArn (string) --
    
    The alias ARN of the profile, in the form ``arn:partition:rolesanywhere:region:account:alias/profile/alias-name ``. Present only if the profile has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

CreateTrustAnchor (updated)

Link ¶
Changes (request, response)
Request

{'aliasName': 'string'}

Response

{'trustAnchor': {'aliasArn': 'string',
                 'aliasName': 'string',
                 'previousAliasName': 'string'}}

Creates a trust anchor to establish trust between IAM Roles Anywhere and your certificate authority (CA). You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials.

Required permissions: rolesanywhere:CreateTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.create_trust_anchor(
    name='string',
    source={
        'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
        'sourceData': {
            'x509CertificateData': 'string',
            'acmPcaArn': 'string'
        }
    },
    enabled=True|False,
    crlDpRevocationEnabled=True|False,
    tags=[
        {
            'key': 'string',
            'value': 'string'
        },
    ],
    notificationSettings=[
        {
            'enabled': True|False,
            'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
            'threshold': 123,
            'channel': 'ALL'
        },
    ],
    aliasName='string'
)

type name:

string

param name:

[REQUIRED]

The name of the trust anchor.

type source:

dict

param source:

[REQUIRED]

The trust anchor type and its related certificate data.

sourceType (string) --

The type of the trust anchor.
sourceData (dict) --

The data field of the trust anchor depending on its type.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: x509CertificateData, acmPcaArn.
- x509CertificateData (string) --
  
  The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.
- acmPcaArn (string) --
  
  The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

type enabled:

boolean

param enabled:

Specifies whether the trust anchor is enabled.

type crlDpRevocationEnabled:

boolean

param crlDpRevocationEnabled:

Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

type tags:

list

param tags:

The tags to attach to the trust anchor.

(dict) --

A label that consists of a key and value you define.
- key (string) -- [REQUIRED]
  
  The tag key.
- value (string) -- [REQUIRED]
  
  The tag value.

type notificationSettings:

list

param notificationSettings:

A list of notification settings to be associated to the trust anchor.

(dict) --

Customizable notification settings that will be applied to notification events. IAM Roles Anywhere consumes these settings while notifying across multiple channels - CloudWatch metrics, EventBridge, and Health Dashboard.
- enabled (boolean) -- [REQUIRED]
  
  Indicates whether the notification setting is enabled.
- event (string) -- [REQUIRED]
  
  The event to which this notification setting is applied.
- threshold (integer) --
  
  The number of days before a notification event. This value is required for a notification setting that is enabled.
- channel (string) --
  
  The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.
  
  Note
  
  In the absence of a specific channel, IAM Roles Anywhere applies this setting to 'ALL' channels.

type aliasName:

string

param aliasName:

An alias for the trust anchor. When you set an alias, the response includes the alias ARN of the trust anchor in aliasArn.

If you omit this parameter or specify an empty string, the resource is created without an alias.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- trustAnchor (dict) --
  
  The state of the trust anchor after a read or write operation.
  - trustAnchorId (string) --
    
    The unique identifier of the trust anchor.
  - trustAnchorArn (string) --
    
    The ARN of the trust anchor.
  - name (string) --
    
    The name of the trust anchor.
  - source (dict) --
    
    The trust anchor type and its related certificate data.
    - sourceType (string) --
      
      The type of the trust anchor.
    - sourceData (dict) --
      
      The data field of the trust anchor depending on its type.
      Note
      
      This is a Tagged Union structure. Only one of the following top level keys will be set: x509CertificateData, acmPcaArn. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - x509CertificateData (string) --
        
        The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.
      - acmPcaArn (string) --
        
        The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.
  - enabled (boolean) --
    
    Indicates whether the trust anchor is enabled.
  - crlDpRevocationEnabled (boolean) --
    
    Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was last updated.
  - notificationSettings (list) --
    
    A list of notification settings to be associated to the trust anchor.
    - (dict) --
      
      The state of a notification setting.
      
      A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.
      - enabled (boolean) --
        
        Indicates whether the notification setting is enabled.
      - event (string) --
        
        The event to which this notification setting is applied.
      - threshold (integer) --
        
        The number of days before a notification event.
      - channel (string) --
        
        The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.
        
        Note
        
        In the absence of a specific channel, IAM Roles Anywhere applies this setting to 'ALL' channels.
      - configuredBy (string) --
        
        The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.
  - aliasName (string) --
    
    The alias of the trust anchor. Present only if the trust anchor has an alias.
  - aliasArn (string) --
    
    The alias ARN of the trust anchor, in the form ``arn:partition:rolesanywhere:region:account:alias/trust-anchor/alias-name ``. Present only if the trust anchor has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

DeleteAttributeMapping (updated)

Link ¶
Changes (response)

{'profile': {'aliasArn': 'string',
             'aliasName': 'string',
             'previousAliasName': 'string'}}

Delete an entry from the attribute mapping rules enforced by a given profile.

See also: AWS API Documentation

Request Syntax

client.delete_attribute_mapping(
    profileId='string',
    certificateField='x509Subject'|'x509Issuer'|'x509SAN',
    specifiers=[
        'string',
    ]
)

type profileId:

string

param profileId:

[REQUIRED]

The profile to act on. You can specify one of the following:

The profile ID.
The profile ARN.
The alias ARN of the profile.

An ARN must be for a profile in your account and Region.

type certificateField:

string

param certificateField:

[REQUIRED]

Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.

type specifiers:

list

param specifiers:

A list of specifiers of a certificate field; for example, CN, OU, UID from a Subject.

(string) --

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'profileId': 'string',
        'profileArn': 'string',
        'name': 'string',
        'requireInstanceProperties': True|False,
        'enabled': True|False,
        'createdBy': 'string',
        'sessionPolicy': 'string',
        'roleArns': [
            'string',
        ],
        'managedPolicyArns': [
            'string',
        ],
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'durationSeconds': 123,
        'acceptRoleSessionName': True|False,
        'attributeMappings': [
            {
                'certificateField': 'x509Subject'|'x509Issuer'|'x509SAN',
                'mappingRules': [
                    {
                        'specifier': 'string'
                    },
                ]
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- profile (dict) --
  
  The state of the profile after a read or write operation.
  - profileId (string) --
    
    The unique identifier of the profile.
  - profileArn (string) --
    
    The ARN of the profile.
  - name (string) --
    
    The name of the profile.
  - requireInstanceProperties (boolean) --
    
    Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.
  - enabled (boolean) --
    
    Indicates whether the profile is enabled.
  - createdBy (string) --
    
    The Amazon Web Services account that created the profile.
  - sessionPolicy (string) --
    
    A session policy that applies to the trust boundary of the vended session credentials.
  - roleArns (list) --
    
    A list of IAM roles that this profile can assume in a temporary credential request.
    - (string) --
  - managedPolicyArns (list) --
    
    A list of managed policy ARNs that apply to the vended session credentials.
    - (string) --
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the profile was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the profile was last updated.
  - durationSeconds (integer) --
    
    Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.
  - acceptRoleSessionName (boolean) --
    
    Used to determine if a custom role session name will be accepted in a temporary credential request.
  - attributeMappings (list) --
    
    A mapping applied to the authenticating end-entity certificate.
    - (dict) --
      
      A mapping applied to the authenticating end-entity certificate.
      - certificateField (string) --
        
        Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.
      - mappingRules (list) --
        
        A list of mapping entries for every supported specifier or sub-field.
        
        (dict) --
        
        A single mapping entry for each supported specifier or sub-field.
        
        specifier (string) --
        
        Specifier within a certificate field, such as CN, OU, or UID from the Subject field.
  - aliasName (string) --
    
    The alias of the profile. Present only if the profile has an alias.
  - aliasArn (string) --
    
    The alias ARN of the profile, in the form ``arn:partition:rolesanywhere:region:account:alias/profile/alias-name ``. Present only if the profile has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

DeleteCrl (updated)

Link ¶
Changes (response)

{'crl': {'aliasArn': 'string',
         'aliasName': 'string',
         'previousAliasName': 'string'}}

Deletes a certificate revocation list (CRL).

Required permissions: rolesanywhere:DeleteCrl.

See also: AWS API Documentation

Request Syntax

client.delete_crl(
    crlId='string'
)

type crlId:

string

param crlId:

[REQUIRED]

The certificate revocation list (CRL) to act on. You can specify one of the following:

The CRL ID.
The CRL ARN.
The alias ARN of the CRL.

An ARN must be for a CRL in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'crlId': 'string',
        'crlArn': 'string',
        'name': 'string',
        'enabled': True|False,
        'crlData': b'bytes',
        'trustAnchorArn': 'string',
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- crl (dict) --
  
  The state of the certificate revocation list (CRL) after a read or write operation.
  - crlId (string) --
    
    The unique identifier of the certificate revocation list (CRL).
  - crlArn (string) --
    
    The ARN of the certificate revocation list (CRL).
  - name (string) --
    
    The name of the certificate revocation list (CRL).
  - enabled (boolean) --
    
    Indicates whether the certificate revocation list (CRL) is enabled.
  - crlData (bytes) --
    
    The state of the certificate revocation list (CRL) after a read or write operation.
  - trustAnchorArn (string) --
    
    The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.
  - aliasName (string) --
    
    The alias of the certificate revocation list (CRL). Present only if the CRL has an alias.
  - aliasArn (string) --
    
    The alias ARN of the certificate revocation list (CRL), in the form ``arn:partition:rolesanywhere:region:account:alias/crl/alias-name ``. Present only if the CRL has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

DeleteProfile (updated)

Link ¶
Changes (response)

{'profile': {'aliasArn': 'string',
             'aliasName': 'string',
             'previousAliasName': 'string'}}

Deletes a profile.

Required permissions: rolesanywhere:DeleteProfile.

See also: AWS API Documentation

Request Syntax

client.delete_profile(
    profileId='string'
)

type profileId:

string

param profileId:

[REQUIRED]

The profile to act on. You can specify one of the following:

The profile ID.
The profile ARN.
The alias ARN of the profile.

An ARN must be for a profile in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'profileId': 'string',
        'profileArn': 'string',
        'name': 'string',
        'requireInstanceProperties': True|False,
        'enabled': True|False,
        'createdBy': 'string',
        'sessionPolicy': 'string',
        'roleArns': [
            'string',
        ],
        'managedPolicyArns': [
            'string',
        ],
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'durationSeconds': 123,
        'acceptRoleSessionName': True|False,
        'attributeMappings': [
            {
                'certificateField': 'x509Subject'|'x509Issuer'|'x509SAN',
                'mappingRules': [
                    {
                        'specifier': 'string'
                    },
                ]
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- profile (dict) --
  
  The state of the profile after a read or write operation.
  - profileId (string) --
    
    The unique identifier of the profile.
  - profileArn (string) --
    
    The ARN of the profile.
  - name (string) --
    
    The name of the profile.
  - requireInstanceProperties (boolean) --
    
    Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.
  - enabled (boolean) --
    
    Indicates whether the profile is enabled.
  - createdBy (string) --
    
    The Amazon Web Services account that created the profile.
  - sessionPolicy (string) --
    
    A session policy that applies to the trust boundary of the vended session credentials.
  - roleArns (list) --
    
    A list of IAM roles that this profile can assume in a temporary credential request.
    - (string) --
  - managedPolicyArns (list) --
    
    A list of managed policy ARNs that apply to the vended session credentials.
    - (string) --
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the profile was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the profile was last updated.
  - durationSeconds (integer) --
    
    Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.
  - acceptRoleSessionName (boolean) --
    
    Used to determine if a custom role session name will be accepted in a temporary credential request.
  - attributeMappings (list) --
    
    A mapping applied to the authenticating end-entity certificate.
    - (dict) --
      
      A mapping applied to the authenticating end-entity certificate.
      - certificateField (string) --
        
        Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.
      - mappingRules (list) --
        
        A list of mapping entries for every supported specifier or sub-field.
        
        (dict) --
        
        A single mapping entry for each supported specifier or sub-field.
        
        specifier (string) --
        
        Specifier within a certificate field, such as CN, OU, or UID from the Subject field.
  - aliasName (string) --
    
    The alias of the profile. Present only if the profile has an alias.
  - aliasArn (string) --
    
    The alias ARN of the profile, in the form ``arn:partition:rolesanywhere:region:account:alias/profile/alias-name ``. Present only if the profile has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

DeleteTrustAnchor (updated)

Link ¶
Changes (response)

{'trustAnchor': {'aliasArn': 'string',
                 'aliasName': 'string',
                 'previousAliasName': 'string'}}

Deletes a trust anchor.

Required permissions: rolesanywhere:DeleteTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.delete_trust_anchor(
    trustAnchorId='string'
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The trust anchor to act on. You can specify one of the following:

The trust anchor ID.
The trust anchor ARN.
The alias ARN of the trust anchor.

An ARN must be for a trust anchor in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- trustAnchor (dict) --
  
  The state of the trust anchor after a read or write operation.
  - trustAnchorId (string) --
    
    The unique identifier of the trust anchor.
  - trustAnchorArn (string) --
    
    The ARN of the trust anchor.
  - name (string) --
    
    The name of the trust anchor.
  - source (dict) --
    
    The trust anchor type and its related certificate data.
    - sourceType (string) --
      
      The type of the trust anchor.
    - sourceData (dict) --
      
      The data field of the trust anchor depending on its type.
      Note
      
      This is a Tagged Union structure. Only one of the following top level keys will be set: x509CertificateData, acmPcaArn. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - x509CertificateData (string) --
        
        The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.
      - acmPcaArn (string) --
        
        The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.
  - enabled (boolean) --
    
    Indicates whether the trust anchor is enabled.
  - crlDpRevocationEnabled (boolean) --
    
    Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was last updated.
  - notificationSettings (list) --
    
    A list of notification settings to be associated to the trust anchor.
    - (dict) --
      
      The state of a notification setting.
      
      A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.
      - enabled (boolean) --
        
        Indicates whether the notification setting is enabled.
      - event (string) --
        
        The event to which this notification setting is applied.
      - threshold (integer) --
        
        The number of days before a notification event.
      - channel (string) --
        
        The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.
        
        Note
        
        In the absence of a specific channel, IAM Roles Anywhere applies this setting to 'ALL' channels.
      - configuredBy (string) --
        
        The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.
  - aliasName (string) --
    
    The alias of the trust anchor. Present only if the trust anchor has an alias.
  - aliasArn (string) --
    
    The alias ARN of the trust anchor, in the form ``arn:partition:rolesanywhere:region:account:alias/trust-anchor/alias-name ``. Present only if the trust anchor has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

DisableCrl (updated)

Link ¶
Changes (response)

{'crl': {'aliasArn': 'string',
         'aliasName': 'string',
         'previousAliasName': 'string'}}

Disables a certificate revocation list (CRL).

Required permissions: rolesanywhere:DisableCrl.

See also: AWS API Documentation

Request Syntax

client.disable_crl(
    crlId='string'
)

type crlId:

string

param crlId:

[REQUIRED]

The certificate revocation list (CRL) to act on. You can specify one of the following:

The CRL ID.
The CRL ARN.
The alias ARN of the CRL.

An ARN must be for a CRL in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'crlId': 'string',
        'crlArn': 'string',
        'name': 'string',
        'enabled': True|False,
        'crlData': b'bytes',
        'trustAnchorArn': 'string',
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- crl (dict) --
  
  The state of the certificate revocation list (CRL) after a read or write operation.
  - crlId (string) --
    
    The unique identifier of the certificate revocation list (CRL).
  - crlArn (string) --
    
    The ARN of the certificate revocation list (CRL).
  - name (string) --
    
    The name of the certificate revocation list (CRL).
  - enabled (boolean) --
    
    Indicates whether the certificate revocation list (CRL) is enabled.
  - crlData (bytes) --
    
    The state of the certificate revocation list (CRL) after a read or write operation.
  - trustAnchorArn (string) --
    
    The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.
  - aliasName (string) --
    
    The alias of the certificate revocation list (CRL). Present only if the CRL has an alias.
  - aliasArn (string) --
    
    The alias ARN of the certificate revocation list (CRL), in the form ``arn:partition:rolesanywhere:region:account:alias/crl/alias-name ``. Present only if the CRL has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

DisableProfile (updated)

Link ¶
Changes (response)

{'profile': {'aliasArn': 'string',
             'aliasName': 'string',
             'previousAliasName': 'string'}}

Disables a profile. When disabled, temporary credential requests with this profile fail.

Required permissions: rolesanywhere:DisableProfile.

See also: AWS API Documentation

Request Syntax

client.disable_profile(
    profileId='string'
)

type profileId:

string

param profileId:

[REQUIRED]

The profile to act on. You can specify one of the following:

The profile ID.
The profile ARN.
The alias ARN of the profile.

An ARN must be for a profile in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'profileId': 'string',
        'profileArn': 'string',
        'name': 'string',
        'requireInstanceProperties': True|False,
        'enabled': True|False,
        'createdBy': 'string',
        'sessionPolicy': 'string',
        'roleArns': [
            'string',
        ],
        'managedPolicyArns': [
            'string',
        ],
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'durationSeconds': 123,
        'acceptRoleSessionName': True|False,
        'attributeMappings': [
            {
                'certificateField': 'x509Subject'|'x509Issuer'|'x509SAN',
                'mappingRules': [
                    {
                        'specifier': 'string'
                    },
                ]
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- profile (dict) --
  
  The state of the profile after a read or write operation.
  - profileId (string) --
    
    The unique identifier of the profile.
  - profileArn (string) --
    
    The ARN of the profile.
  - name (string) --
    
    The name of the profile.
  - requireInstanceProperties (boolean) --
    
    Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.
  - enabled (boolean) --
    
    Indicates whether the profile is enabled.
  - createdBy (string) --
    
    The Amazon Web Services account that created the profile.
  - sessionPolicy (string) --
    
    A session policy that applies to the trust boundary of the vended session credentials.
  - roleArns (list) --
    
    A list of IAM roles that this profile can assume in a temporary credential request.
    - (string) --
  - managedPolicyArns (list) --
    
    A list of managed policy ARNs that apply to the vended session credentials.
    - (string) --
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the profile was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the profile was last updated.
  - durationSeconds (integer) --
    
    Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.
  - acceptRoleSessionName (boolean) --
    
    Used to determine if a custom role session name will be accepted in a temporary credential request.
  - attributeMappings (list) --
    
    A mapping applied to the authenticating end-entity certificate.
    - (dict) --
      
      A mapping applied to the authenticating end-entity certificate.
      - certificateField (string) --
        
        Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.
      - mappingRules (list) --
        
        A list of mapping entries for every supported specifier or sub-field.
        
        (dict) --
        
        A single mapping entry for each supported specifier or sub-field.
        
        specifier (string) --
        
        Specifier within a certificate field, such as CN, OU, or UID from the Subject field.
  - aliasName (string) --
    
    The alias of the profile. Present only if the profile has an alias.
  - aliasArn (string) --
    
    The alias ARN of the profile, in the form ``arn:partition:rolesanywhere:region:account:alias/profile/alias-name ``. Present only if the profile has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

DisableTrustAnchor (updated)

Link ¶
Changes (response)

{'trustAnchor': {'aliasArn': 'string',
                 'aliasName': 'string',
                 'previousAliasName': 'string'}}

Disables a trust anchor. When disabled, temporary credential requests specifying this trust anchor are unauthorized.

Required permissions: rolesanywhere:DisableTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.disable_trust_anchor(
    trustAnchorId='string'
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The trust anchor to act on. You can specify one of the following:

The trust anchor ID.
The trust anchor ARN.
The alias ARN of the trust anchor.

An ARN must be for a trust anchor in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- trustAnchor (dict) --
  
  The state of the trust anchor after a read or write operation.
  - trustAnchorId (string) --
    
    The unique identifier of the trust anchor.
  - trustAnchorArn (string) --
    
    The ARN of the trust anchor.
  - name (string) --
    
    The name of the trust anchor.
  - source (dict) --
    
    The trust anchor type and its related certificate data.
    - sourceType (string) --
      
      The type of the trust anchor.
    - sourceData (dict) --
      
      The data field of the trust anchor depending on its type.
      Note
      
      This is a Tagged Union structure. Only one of the following top level keys will be set: x509CertificateData, acmPcaArn. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - x509CertificateData (string) --
        
        The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.
      - acmPcaArn (string) --
        
        The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.
  - enabled (boolean) --
    
    Indicates whether the trust anchor is enabled.
  - crlDpRevocationEnabled (boolean) --
    
    Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was last updated.
  - notificationSettings (list) --
    
    A list of notification settings to be associated to the trust anchor.
    - (dict) --
      
      The state of a notification setting.
      
      A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.
      - enabled (boolean) --
        
        Indicates whether the notification setting is enabled.
      - event (string) --
        
        The event to which this notification setting is applied.
      - threshold (integer) --
        
        The number of days before a notification event.
      - channel (string) --
        
        The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.
        
        Note
        
        In the absence of a specific channel, IAM Roles Anywhere applies this setting to 'ALL' channels.
      - configuredBy (string) --
        
        The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.
  - aliasName (string) --
    
    The alias of the trust anchor. Present only if the trust anchor has an alias.
  - aliasArn (string) --
    
    The alias ARN of the trust anchor, in the form ``arn:partition:rolesanywhere:region:account:alias/trust-anchor/alias-name ``. Present only if the trust anchor has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

EnableCrl (updated)

Link ¶
Changes (response)

{'crl': {'aliasArn': 'string',
         'aliasName': 'string',
         'previousAliasName': 'string'}}

Enables a certificate revocation list (CRL). When enabled, certificates stored in the CRL are unauthorized to receive session credentials.

Required permissions: rolesanywhere:EnableCrl.

See also: AWS API Documentation

Request Syntax

client.enable_crl(
    crlId='string'
)

type crlId:

string

param crlId:

[REQUIRED]

The certificate revocation list (CRL) to act on. You can specify one of the following:

The CRL ID.
The CRL ARN.
The alias ARN of the CRL.

An ARN must be for a CRL in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'crlId': 'string',
        'crlArn': 'string',
        'name': 'string',
        'enabled': True|False,
        'crlData': b'bytes',
        'trustAnchorArn': 'string',
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- crl (dict) --
  
  The state of the certificate revocation list (CRL) after a read or write operation.
  - crlId (string) --
    
    The unique identifier of the certificate revocation list (CRL).
  - crlArn (string) --
    
    The ARN of the certificate revocation list (CRL).
  - name (string) --
    
    The name of the certificate revocation list (CRL).
  - enabled (boolean) --
    
    Indicates whether the certificate revocation list (CRL) is enabled.
  - crlData (bytes) --
    
    The state of the certificate revocation list (CRL) after a read or write operation.
  - trustAnchorArn (string) --
    
    The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.
  - aliasName (string) --
    
    The alias of the certificate revocation list (CRL). Present only if the CRL has an alias.
  - aliasArn (string) --
    
    The alias ARN of the certificate revocation list (CRL), in the form ``arn:partition:rolesanywhere:region:account:alias/crl/alias-name ``. Present only if the CRL has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

EnableProfile (updated)

Link ¶
Changes (response)

{'profile': {'aliasArn': 'string',
             'aliasName': 'string',
             'previousAliasName': 'string'}}

Enables temporary credential requests for a profile.

Required permissions: rolesanywhere:EnableProfile.

See also: AWS API Documentation

Request Syntax

client.enable_profile(
    profileId='string'
)

type profileId:

string

param profileId:

[REQUIRED]

The profile to act on. You can specify one of the following:

The profile ID.
The profile ARN.
The alias ARN of the profile.

An ARN must be for a profile in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'profileId': 'string',
        'profileArn': 'string',
        'name': 'string',
        'requireInstanceProperties': True|False,
        'enabled': True|False,
        'createdBy': 'string',
        'sessionPolicy': 'string',
        'roleArns': [
            'string',
        ],
        'managedPolicyArns': [
            'string',
        ],
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'durationSeconds': 123,
        'acceptRoleSessionName': True|False,
        'attributeMappings': [
            {
                'certificateField': 'x509Subject'|'x509Issuer'|'x509SAN',
                'mappingRules': [
                    {
                        'specifier': 'string'
                    },
                ]
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- profile (dict) --
  
  The state of the profile after a read or write operation.
  - profileId (string) --
    
    The unique identifier of the profile.
  - profileArn (string) --
    
    The ARN of the profile.
  - name (string) --
    
    The name of the profile.
  - requireInstanceProperties (boolean) --
    
    Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.
  - enabled (boolean) --
    
    Indicates whether the profile is enabled.
  - createdBy (string) --
    
    The Amazon Web Services account that created the profile.
  - sessionPolicy (string) --
    
    A session policy that applies to the trust boundary of the vended session credentials.
  - roleArns (list) --
    
    A list of IAM roles that this profile can assume in a temporary credential request.
    - (string) --
  - managedPolicyArns (list) --
    
    A list of managed policy ARNs that apply to the vended session credentials.
    - (string) --
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the profile was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the profile was last updated.
  - durationSeconds (integer) --
    
    Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.
  - acceptRoleSessionName (boolean) --
    
    Used to determine if a custom role session name will be accepted in a temporary credential request.
  - attributeMappings (list) --
    
    A mapping applied to the authenticating end-entity certificate.
    - (dict) --
      
      A mapping applied to the authenticating end-entity certificate.
      - certificateField (string) --
        
        Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.
      - mappingRules (list) --
        
        A list of mapping entries for every supported specifier or sub-field.
        
        (dict) --
        
        A single mapping entry for each supported specifier or sub-field.
        
        specifier (string) --
        
        Specifier within a certificate field, such as CN, OU, or UID from the Subject field.
  - aliasName (string) --
    
    The alias of the profile. Present only if the profile has an alias.
  - aliasArn (string) --
    
    The alias ARN of the profile, in the form ``arn:partition:rolesanywhere:region:account:alias/profile/alias-name ``. Present only if the profile has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

EnableTrustAnchor (updated)

Link ¶
Changes (response)

{'trustAnchor': {'aliasArn': 'string',
                 'aliasName': 'string',
                 'previousAliasName': 'string'}}

Enables a trust anchor. When enabled, certificates in the trust anchor chain are authorized for trust validation.

Required permissions: rolesanywhere:EnableTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.enable_trust_anchor(
    trustAnchorId='string'
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The trust anchor to act on. You can specify one of the following:

The trust anchor ID.
The trust anchor ARN.
The alias ARN of the trust anchor.

An ARN must be for a trust anchor in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- trustAnchor (dict) --
  
  The state of the trust anchor after a read or write operation.
  - trustAnchorId (string) --
    
    The unique identifier of the trust anchor.
  - trustAnchorArn (string) --
    
    The ARN of the trust anchor.
  - name (string) --
    
    The name of the trust anchor.
  - source (dict) --
    
    The trust anchor type and its related certificate data.
    - sourceType (string) --
      
      The type of the trust anchor.
    - sourceData (dict) --
      
      The data field of the trust anchor depending on its type.
      Note
      
      This is a Tagged Union structure. Only one of the following top level keys will be set: x509CertificateData, acmPcaArn. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - x509CertificateData (string) --
        
        The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.
      - acmPcaArn (string) --
        
        The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.
  - enabled (boolean) --
    
    Indicates whether the trust anchor is enabled.
  - crlDpRevocationEnabled (boolean) --
    
    Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was last updated.
  - notificationSettings (list) --
    
    A list of notification settings to be associated to the trust anchor.
    - (dict) --
      
      The state of a notification setting.
      
      A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.
      - enabled (boolean) --
        
        Indicates whether the notification setting is enabled.
      - event (string) --
        
        The event to which this notification setting is applied.
      - threshold (integer) --
        
        The number of days before a notification event.
      - channel (string) --
        
        The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.
        
        Note
        
        In the absence of a specific channel, IAM Roles Anywhere applies this setting to 'ALL' channels.
      - configuredBy (string) --
        
        The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.
  - aliasName (string) --
    
    The alias of the trust anchor. Present only if the trust anchor has an alias.
  - aliasArn (string) --
    
    The alias ARN of the trust anchor, in the form ``arn:partition:rolesanywhere:region:account:alias/trust-anchor/alias-name ``. Present only if the trust anchor has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

GetCrl (updated)

Link ¶
Changes (response)

{'crl': {'aliasArn': 'string',
         'aliasName': 'string',
         'previousAliasName': 'string'}}

Gets a certificate revocation list (CRL).

Required permissions: rolesanywhere:GetCrl.

See also: AWS API Documentation

Request Syntax

client.get_crl(
    crlId='string'
)

type crlId:

string

param crlId:

[REQUIRED]

The certificate revocation list (CRL) to act on. You can specify one of the following:

The CRL ID.
The CRL ARN.
The alias ARN of the CRL.

An ARN must be for a CRL in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'crlId': 'string',
        'crlArn': 'string',
        'name': 'string',
        'enabled': True|False,
        'crlData': b'bytes',
        'trustAnchorArn': 'string',
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- crl (dict) --
  
  The state of the certificate revocation list (CRL) after a read or write operation.
  - crlId (string) --
    
    The unique identifier of the certificate revocation list (CRL).
  - crlArn (string) --
    
    The ARN of the certificate revocation list (CRL).
  - name (string) --
    
    The name of the certificate revocation list (CRL).
  - enabled (boolean) --
    
    Indicates whether the certificate revocation list (CRL) is enabled.
  - crlData (bytes) --
    
    The state of the certificate revocation list (CRL) after a read or write operation.
  - trustAnchorArn (string) --
    
    The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.
  - aliasName (string) --
    
    The alias of the certificate revocation list (CRL). Present only if the CRL has an alias.
  - aliasArn (string) --
    
    The alias ARN of the certificate revocation list (CRL), in the form ``arn:partition:rolesanywhere:region:account:alias/crl/alias-name ``. Present only if the CRL has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

GetProfile (updated)

Link ¶
Changes (response)

{'profile': {'aliasArn': 'string',
             'aliasName': 'string',
             'previousAliasName': 'string'}}

Gets a profile.

Required permissions: rolesanywhere:GetProfile.

See also: AWS API Documentation

Request Syntax

client.get_profile(
    profileId='string'
)

type profileId:

string

param profileId:

[REQUIRED]

The profile to act on. You can specify one of the following:

The profile ID.
The profile ARN.
The alias ARN of the profile.

An ARN must be for a profile in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'profileId': 'string',
        'profileArn': 'string',
        'name': 'string',
        'requireInstanceProperties': True|False,
        'enabled': True|False,
        'createdBy': 'string',
        'sessionPolicy': 'string',
        'roleArns': [
            'string',
        ],
        'managedPolicyArns': [
            'string',
        ],
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'durationSeconds': 123,
        'acceptRoleSessionName': True|False,
        'attributeMappings': [
            {
                'certificateField': 'x509Subject'|'x509Issuer'|'x509SAN',
                'mappingRules': [
                    {
                        'specifier': 'string'
                    },
                ]
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- profile (dict) --
  
  The state of the profile after a read or write operation.
  - profileId (string) --
    
    The unique identifier of the profile.
  - profileArn (string) --
    
    The ARN of the profile.
  - name (string) --
    
    The name of the profile.
  - requireInstanceProperties (boolean) --
    
    Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.
  - enabled (boolean) --
    
    Indicates whether the profile is enabled.
  - createdBy (string) --
    
    The Amazon Web Services account that created the profile.
  - sessionPolicy (string) --
    
    A session policy that applies to the trust boundary of the vended session credentials.
  - roleArns (list) --
    
    A list of IAM roles that this profile can assume in a temporary credential request.
    - (string) --
  - managedPolicyArns (list) --
    
    A list of managed policy ARNs that apply to the vended session credentials.
    - (string) --
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the profile was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the profile was last updated.
  - durationSeconds (integer) --
    
    Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.
  - acceptRoleSessionName (boolean) --
    
    Used to determine if a custom role session name will be accepted in a temporary credential request.
  - attributeMappings (list) --
    
    A mapping applied to the authenticating end-entity certificate.
    - (dict) --
      
      A mapping applied to the authenticating end-entity certificate.
      - certificateField (string) --
        
        Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.
      - mappingRules (list) --
        
        A list of mapping entries for every supported specifier or sub-field.
        
        (dict) --
        
        A single mapping entry for each supported specifier or sub-field.
        
        specifier (string) --
        
        Specifier within a certificate field, such as CN, OU, or UID from the Subject field.
  - aliasName (string) --
    
    The alias of the profile. Present only if the profile has an alias.
  - aliasArn (string) --
    
    The alias ARN of the profile, in the form ``arn:partition:rolesanywhere:region:account:alias/profile/alias-name ``. Present only if the profile has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

GetTrustAnchor (updated)

Link ¶
Changes (response)

{'trustAnchor': {'aliasArn': 'string',
                 'aliasName': 'string',
                 'previousAliasName': 'string'}}

Gets a trust anchor.

Required permissions: rolesanywhere:GetTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.get_trust_anchor(
    trustAnchorId='string'
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The trust anchor to act on. You can specify one of the following:

The trust anchor ID.
The trust anchor ARN.
The alias ARN of the trust anchor.

An ARN must be for a trust anchor in your account and Region.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- trustAnchor (dict) --
  
  The state of the trust anchor after a read or write operation.
  - trustAnchorId (string) --
    
    The unique identifier of the trust anchor.
  - trustAnchorArn (string) --
    
    The ARN of the trust anchor.
  - name (string) --
    
    The name of the trust anchor.
  - source (dict) --
    
    The trust anchor type and its related certificate data.
    - sourceType (string) --
      
      The type of the trust anchor.
    - sourceData (dict) --
      
      The data field of the trust anchor depending on its type.
      Note
      
      This is a Tagged Union structure. Only one of the following top level keys will be set: x509CertificateData, acmPcaArn. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - x509CertificateData (string) --
        
        The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.
      - acmPcaArn (string) --
        
        The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.
  - enabled (boolean) --
    
    Indicates whether the trust anchor is enabled.
  - crlDpRevocationEnabled (boolean) --
    
    Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was last updated.
  - notificationSettings (list) --
    
    A list of notification settings to be associated to the trust anchor.
    - (dict) --
      
      The state of a notification setting.
      
      A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.
      - enabled (boolean) --
        
        Indicates whether the notification setting is enabled.
      - event (string) --
        
        The event to which this notification setting is applied.
      - threshold (integer) --
        
        The number of days before a notification event.
      - channel (string) --
        
        The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.
        
        Note
        
        In the absence of a specific channel, IAM Roles Anywhere applies this setting to 'ALL' channels.
      - configuredBy (string) --
        
        The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.
  - aliasName (string) --
    
    The alias of the trust anchor. Present only if the trust anchor has an alias.
  - aliasArn (string) --
    
    The alias ARN of the trust anchor, in the form ``arn:partition:rolesanywhere:region:account:alias/trust-anchor/alias-name ``. Present only if the trust anchor has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

ImportCrl (updated)

Link ¶
Changes (request, response)
Request

{'aliasName': 'string'}

Response

{'crl': {'aliasArn': 'string',
         'aliasName': 'string',
         'previousAliasName': 'string'}}

Imports the certificate revocation list (CRL). A CRL is a list of certificates that have been revoked by the issuing certificate Authority (CA).In order to be properly imported, a CRL must be in PEM format. IAM Roles Anywhere validates against the CRL before issuing credentials.

Required permissions: rolesanywhere:ImportCrl.

See also: AWS API Documentation

Request Syntax

client.import_crl(
    name='string',
    crlData=b'bytes',
    enabled=True|False,
    tags=[
        {
            'key': 'string',
            'value': 'string'
        },
    ],
    trustAnchorArn='string',
    aliasName='string'
)

type name:

string

param name:

[REQUIRED]

The name of the certificate revocation list (CRL).

type crlData:

bytes

param crlData:

[REQUIRED]

The x509 v3 specified certificate revocation list (CRL).

type enabled:

boolean

param enabled:

Specifies whether the certificate revocation list (CRL) is enabled.

type tags:

list

param tags:

A list of tags to attach to the certificate revocation list (CRL).

(dict) --

A label that consists of a key and value you define.
- key (string) -- [REQUIRED]
  
  The tag key.
- value (string) -- [REQUIRED]
  
  The tag value.

type trustAnchorArn:

string

param trustAnchorArn:

[REQUIRED]

The ARN of the trust anchor that the certificate revocation list (CRL) provides revocation for. Specify the trust anchor ARN that contains the trust anchor ID. This parameter doesn't support alias ARNs. If you specify an alias ARN, the request fails with ResourceNotFoundException.

type aliasName:

string

param aliasName:

An alias for the certificate revocation list (CRL). When you set an alias, the response includes the alias ARN of the CRL in aliasArn.

If you omit this parameter or specify an empty string, the resource is created without an alias.

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'crlId': 'string',
        'crlArn': 'string',
        'name': 'string',
        'enabled': True|False,
        'crlData': b'bytes',
        'trustAnchorArn': 'string',
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- crl (dict) --
  
  The state of the certificate revocation list (CRL) after a read or write operation.
  - crlId (string) --
    
    The unique identifier of the certificate revocation list (CRL).
  - crlArn (string) --
    
    The ARN of the certificate revocation list (CRL).
  - name (string) --
    
    The name of the certificate revocation list (CRL).
  - enabled (boolean) --
    
    Indicates whether the certificate revocation list (CRL) is enabled.
  - crlData (bytes) --
    
    The state of the certificate revocation list (CRL) after a read or write operation.
  - trustAnchorArn (string) --
    
    The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.
  - aliasName (string) --
    
    The alias of the certificate revocation list (CRL). Present only if the CRL has an alias.
  - aliasArn (string) --
    
    The alias ARN of the certificate revocation list (CRL), in the form ``arn:partition:rolesanywhere:region:account:alias/crl/alias-name ``. Present only if the CRL has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

ListCrls (updated)

Link ¶
Changes (response)

{'crls': {'aliasArn': 'string',
          'aliasName': 'string',
          'previousAliasName': 'string'}}

Lists all certificate revocation lists (CRL) in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListCrls.

See also: AWS API Documentation

Request Syntax

client.list_crls(
    nextToken='string',
    pageSize=123
)

type nextToken:

string

param nextToken:

A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.

type pageSize:

integer

param pageSize:

The number of resources in the paginated list.

rtype:

dict

returns:

Response Syntax

{
    'nextToken': 'string',
    'crls': [
        {
            'crlId': 'string',
            'crlArn': 'string',
            'name': 'string',
            'enabled': True|False,
            'crlData': b'bytes',
            'trustAnchorArn': 'string',
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1),
            'aliasName': 'string',
            'aliasArn': 'string',
            'previousAliasName': 'string'
        },
    ]
}

Response Structure

(dict) --
- nextToken (string) --
  
  A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.
- crls (list) --
  
  A list of certificate revocation lists (CRL).
  - (dict) --
    
    The state of the certificate revocation list (CRL) after a read or write operation.
    - crlId (string) --
      
      The unique identifier of the certificate revocation list (CRL).
    - crlArn (string) --
      
      The ARN of the certificate revocation list (CRL).
    - name (string) --
      
      The name of the certificate revocation list (CRL).
    - enabled (boolean) --
      
      Indicates whether the certificate revocation list (CRL) is enabled.
    - crlData (bytes) --
      
      The state of the certificate revocation list (CRL) after a read or write operation.
    - trustAnchorArn (string) --
      
      The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.
    - createdAt (datetime) --
      
      The ISO-8601 timestamp when the certificate revocation list (CRL) was created.
    - updatedAt (datetime) --
      
      The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.
    - aliasName (string) --
      
      The alias of the certificate revocation list (CRL). Present only if the CRL has an alias.
    - aliasArn (string) --
      
      The alias ARN of the certificate revocation list (CRL), in the form ``arn:partition:rolesanywhere:region:account:alias/crl/alias-name ``. Present only if the CRL has an alias.
      
      You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
    - previousAliasName (string) --
      
      The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

ListProfiles (updated)

Link ¶
Changes (response)

{'profiles': {'aliasArn': 'string',
              'aliasName': 'string',
              'previousAliasName': 'string'}}

Lists all profiles in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListProfiles.

See also: AWS API Documentation

Request Syntax

client.list_profiles(
    nextToken='string',
    pageSize=123
)

type nextToken:

string

param nextToken:

A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.

type pageSize:

integer

param pageSize:

The number of resources in the paginated list.

rtype:

dict

returns:

Response Syntax

{
    'nextToken': 'string',
    'profiles': [
        {
            'profileId': 'string',
            'profileArn': 'string',
            'name': 'string',
            'requireInstanceProperties': True|False,
            'enabled': True|False,
            'createdBy': 'string',
            'sessionPolicy': 'string',
            'roleArns': [
                'string',
            ],
            'managedPolicyArns': [
                'string',
            ],
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1),
            'durationSeconds': 123,
            'acceptRoleSessionName': True|False,
            'attributeMappings': [
                {
                    'certificateField': 'x509Subject'|'x509Issuer'|'x509SAN',
                    'mappingRules': [
                        {
                            'specifier': 'string'
                        },
                    ]
                },
            ],
            'aliasName': 'string',
            'aliasArn': 'string',
            'previousAliasName': 'string'
        },
    ]
}

Response Structure

(dict) --
- nextToken (string) --
  
  A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.
- profiles (list) --
  
  A list of profiles.
  - (dict) --
    
    The state of the profile after a read or write operation.
    - profileId (string) --
      
      The unique identifier of the profile.
    - profileArn (string) --
      
      The ARN of the profile.
    - name (string) --
      
      The name of the profile.
    - requireInstanceProperties (boolean) --
      
      Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.
    - enabled (boolean) --
      
      Indicates whether the profile is enabled.
    - createdBy (string) --
      
      The Amazon Web Services account that created the profile.
    - sessionPolicy (string) --
      
      A session policy that applies to the trust boundary of the vended session credentials.
    - roleArns (list) --
      
      A list of IAM roles that this profile can assume in a temporary credential request.
      - (string) --
    - managedPolicyArns (list) --
      
      A list of managed policy ARNs that apply to the vended session credentials.
      - (string) --
    - createdAt (datetime) --
      
      The ISO-8601 timestamp when the profile was created.
    - updatedAt (datetime) --
      
      The ISO-8601 timestamp when the profile was last updated.
    - durationSeconds (integer) --
      
      Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.
    - acceptRoleSessionName (boolean) --
      
      Used to determine if a custom role session name will be accepted in a temporary credential request.
    - attributeMappings (list) --
      
      A mapping applied to the authenticating end-entity certificate.
      - (dict) --
        
        A mapping applied to the authenticating end-entity certificate.
        
        certificateField (string) --
        
        Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.
        
        mappingRules (list) --
        
        A list of mapping entries for every supported specifier or sub-field.
        
        (dict) --
        
        A single mapping entry for each supported specifier or sub-field.
        
        specifier (string) --
        
        Specifier within a certificate field, such as CN, OU, or UID from the Subject field.
    - aliasName (string) --
      
      The alias of the profile. Present only if the profile has an alias.
    - aliasArn (string) --
      
      The alias ARN of the profile, in the form ``arn:partition:rolesanywhere:region:account:alias/profile/alias-name ``. Present only if the profile has an alias.
      
      You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
    - previousAliasName (string) --
      
      The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

ListTrustAnchors (updated)

Link ¶
Changes (response)

{'trustAnchors': {'aliasArn': 'string',
                  'aliasName': 'string',
                  'previousAliasName': 'string'}}

Lists the trust anchors in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListTrustAnchors.

See also: AWS API Documentation

Request Syntax

client.list_trust_anchors(
    nextToken='string',
    pageSize=123
)

type nextToken:

string

param nextToken:

A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.

type pageSize:

integer

param pageSize:

The number of resources in the paginated list.

rtype:

dict

returns:

Response Syntax

{
    'nextToken': 'string',
    'trustAnchors': [
        {
            'trustAnchorId': 'string',
            'trustAnchorArn': 'string',
            'name': 'string',
            'source': {
                'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
                'sourceData': {
                    'x509CertificateData': 'string',
                    'acmPcaArn': 'string'
                }
            },
            'enabled': True|False,
            'crlDpRevocationEnabled': True|False,
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1),
            'notificationSettings': [
                {
                    'enabled': True|False,
                    'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                    'threshold': 123,
                    'channel': 'ALL',
                    'configuredBy': 'string'
                },
            ],
            'aliasName': 'string',
            'aliasArn': 'string',
            'previousAliasName': 'string'
        },
    ]
}

Response Structure

(dict) --
- nextToken (string) --
  
  A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.
- trustAnchors (list) --
  
  A list of trust anchors.
  - (dict) --
    
    The state of the trust anchor after a read or write operation.
    - trustAnchorId (string) --
      
      The unique identifier of the trust anchor.
    - trustAnchorArn (string) --
      
      The ARN of the trust anchor.
    - name (string) --
      
      The name of the trust anchor.
    - source (dict) --
      
      The trust anchor type and its related certificate data.
      - sourceType (string) --
        
        The type of the trust anchor.
      - sourceData (dict) --
        
        The data field of the trust anchor depending on its type.
        
        Note
        
        This is a Tagged Union structure. Only one of the following top level keys will be set: x509CertificateData, acmPcaArn. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
        
        'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
        
        x509CertificateData (string) --
        
        The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.
        
        acmPcaArn (string) --
        
        The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.
    - enabled (boolean) --
      
      Indicates whether the trust anchor is enabled.
    - crlDpRevocationEnabled (boolean) --
      
      Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.
    - createdAt (datetime) --
      
      The ISO-8601 timestamp when the trust anchor was created.
    - updatedAt (datetime) --
      
      The ISO-8601 timestamp when the trust anchor was last updated.
    - notificationSettings (list) --
      
      A list of notification settings to be associated to the trust anchor.
      - (dict) --
        
        The state of a notification setting.
        
        A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.
        
        enabled (boolean) --
        
        Indicates whether the notification setting is enabled.
        
        event (string) --
        
        The event to which this notification setting is applied.
        
        threshold (integer) --
        
        The number of days before a notification event.
        
        channel (string) --
        
        The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.
        
        Note
        
        In the absence of a specific channel, IAM Roles Anywhere applies this setting to 'ALL' channels.
        
        configuredBy (string) --
        
        The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.
    - aliasName (string) --
      
      The alias of the trust anchor. Present only if the trust anchor has an alias.
    - aliasArn (string) --
      
      The alias ARN of the trust anchor, in the form ``arn:partition:rolesanywhere:region:account:alias/trust-anchor/alias-name ``. Present only if the trust anchor has an alias.
      
      You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
    - previousAliasName (string) --
      
      The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

PutAttributeMapping (updated)

Link ¶
Changes (response)

{'profile': {'aliasArn': 'string',
             'aliasName': 'string',
             'previousAliasName': 'string'}}

Put an entry in the attribute mapping rules that will be enforced by a given profile. A mapping specifies a certificate field and one or more specifiers that have contextual meanings.

See also: AWS API Documentation

Request Syntax

client.put_attribute_mapping(
    profileId='string',
    certificateField='x509Subject'|'x509Issuer'|'x509SAN',
    mappingRules=[
        {
            'specifier': 'string'
        },
    ]
)

type profileId:

string

param profileId:

[REQUIRED]

The profile to act on. You can specify one of the following:

The profile ID.
The profile ARN.
The alias ARN of the profile.

An ARN must be for a profile in your account and Region.

type certificateField:

string

param certificateField:

[REQUIRED]

Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.

type mappingRules:

list

param mappingRules:

[REQUIRED]

A list of mapping entries for every supported specifier or sub-field.

(dict) --

A single mapping entry for each supported specifier or sub-field.
- specifier (string) -- [REQUIRED]
  
  Specifier within a certificate field, such as CN, OU, or UID from the Subject field.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'profileId': 'string',
        'profileArn': 'string',
        'name': 'string',
        'requireInstanceProperties': True|False,
        'enabled': True|False,
        'createdBy': 'string',
        'sessionPolicy': 'string',
        'roleArns': [
            'string',
        ],
        'managedPolicyArns': [
            'string',
        ],
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'durationSeconds': 123,
        'acceptRoleSessionName': True|False,
        'attributeMappings': [
            {
                'certificateField': 'x509Subject'|'x509Issuer'|'x509SAN',
                'mappingRules': [
                    {
                        'specifier': 'string'
                    },
                ]
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- profile (dict) --
  
  The state of the profile after a read or write operation.
  - profileId (string) --
    
    The unique identifier of the profile.
  - profileArn (string) --
    
    The ARN of the profile.
  - name (string) --
    
    The name of the profile.
  - requireInstanceProperties (boolean) --
    
    Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.
  - enabled (boolean) --
    
    Indicates whether the profile is enabled.
  - createdBy (string) --
    
    The Amazon Web Services account that created the profile.
  - sessionPolicy (string) --
    
    A session policy that applies to the trust boundary of the vended session credentials.
  - roleArns (list) --
    
    A list of IAM roles that this profile can assume in a temporary credential request.
    - (string) --
  - managedPolicyArns (list) --
    
    A list of managed policy ARNs that apply to the vended session credentials.
    - (string) --
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the profile was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the profile was last updated.
  - durationSeconds (integer) --
    
    Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.
  - acceptRoleSessionName (boolean) --
    
    Used to determine if a custom role session name will be accepted in a temporary credential request.
  - attributeMappings (list) --
    
    A mapping applied to the authenticating end-entity certificate.
    - (dict) --
      
      A mapping applied to the authenticating end-entity certificate.
      - certificateField (string) --
        
        Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.
      - mappingRules (list) --
        
        A list of mapping entries for every supported specifier or sub-field.
        
        (dict) --
        
        A single mapping entry for each supported specifier or sub-field.
        
        specifier (string) --
        
        Specifier within a certificate field, such as CN, OU, or UID from the Subject field.
  - aliasName (string) --
    
    The alias of the profile. Present only if the profile has an alias.
  - aliasArn (string) --
    
    The alias ARN of the profile, in the form ``arn:partition:rolesanywhere:region:account:alias/profile/alias-name ``. Present only if the profile has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

PutNotificationSettings (updated)

Link ¶
Changes (response)

{'trustAnchor': {'aliasArn': 'string',
                 'aliasName': 'string',
                 'previousAliasName': 'string'}}

Attaches a list of notification settings to a trust anchor.

A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

Required permissions: rolesanywhere:PutNotificationSettings.

See also: AWS API Documentation

Request Syntax

client.put_notification_settings(
    trustAnchorId='string',
    notificationSettings=[
        {
            'enabled': True|False,
            'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
            'threshold': 123,
            'channel': 'ALL'
        },
    ]
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

type notificationSettings:

list

param notificationSettings:

[REQUIRED]

A list of notification settings to be associated to the trust anchor.

(dict) --

Customizable notification settings that will be applied to notification events. IAM Roles Anywhere consumes these settings while notifying across multiple channels - CloudWatch metrics, EventBridge, and Health Dashboard.
- enabled (boolean) -- [REQUIRED]
  
  Indicates whether the notification setting is enabled.
- event (string) -- [REQUIRED]
  
  The event to which this notification setting is applied.
- threshold (integer) --
  
  The number of days before a notification event. This value is required for a notification setting that is enabled.
- channel (string) --
  
  The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.
  
  Note
  
  In the absence of a specific channel, IAM Roles Anywhere applies this setting to 'ALL' channels.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- trustAnchor (dict) --
  
  The state of the trust anchor after a read or write operation.
  - trustAnchorId (string) --
    
    The unique identifier of the trust anchor.
  - trustAnchorArn (string) --
    
    The ARN of the trust anchor.
  - name (string) --
    
    The name of the trust anchor.
  - source (dict) --
    
    The trust anchor type and its related certificate data.
    - sourceType (string) --
      
      The type of the trust anchor.
    - sourceData (dict) --
      
      The data field of the trust anchor depending on its type.
      Note
      
      This is a Tagged Union structure. Only one of the following top level keys will be set: x509CertificateData, acmPcaArn. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - x509CertificateData (string) --
        
        The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.
      - acmPcaArn (string) --
        
        The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.
  - enabled (boolean) --
    
    Indicates whether the trust anchor is enabled.
  - crlDpRevocationEnabled (boolean) --
    
    Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was last updated.
  - notificationSettings (list) --
    
    A list of notification settings to be associated to the trust anchor.
    - (dict) --
      
      The state of a notification setting.
      
      A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.
      - enabled (boolean) --
        
        Indicates whether the notification setting is enabled.
      - event (string) --
        
        The event to which this notification setting is applied.
      - threshold (integer) --
        
        The number of days before a notification event.
      - channel (string) --
        
        The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.
        
        Note
        
        In the absence of a specific channel, IAM Roles Anywhere applies this setting to 'ALL' channels.
      - configuredBy (string) --
        
        The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.
  - aliasName (string) --
    
    The alias of the trust anchor. Present only if the trust anchor has an alias.
  - aliasArn (string) --
    
    The alias ARN of the trust anchor, in the form ``arn:partition:rolesanywhere:region:account:alias/trust-anchor/alias-name ``. Present only if the trust anchor has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

ResetNotificationSettings (updated)

Link ¶
Changes (response)

{'trustAnchor': {'aliasArn': 'string',
                 'aliasName': 'string',
                 'previousAliasName': 'string'}}

Resets the custom notification setting to IAM Roles Anywhere default setting.

Required permissions: rolesanywhere:ResetNotificationSettings.

See also: AWS API Documentation

Request Syntax

client.reset_notification_settings(
    trustAnchorId='string',
    notificationSettingKeys=[
        {
            'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
            'channel': 'ALL'
        },
    ]
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

type notificationSettingKeys:

list

param notificationSettingKeys:

[REQUIRED]

A list of notification setting keys to reset. A notification setting key includes the event and the channel.

(dict) --

A notification setting key to reset. A notification setting key includes the event and the channel.
- event (string) -- [REQUIRED]
  
  The notification setting event to reset.
- channel (string) --
  
  The specified channel of notification.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- trustAnchor (dict) --
  
  The state of the trust anchor after a read or write operation.
  - trustAnchorId (string) --
    
    The unique identifier of the trust anchor.
  - trustAnchorArn (string) --
    
    The ARN of the trust anchor.
  - name (string) --
    
    The name of the trust anchor.
  - source (dict) --
    
    The trust anchor type and its related certificate data.
    - sourceType (string) --
      
      The type of the trust anchor.
    - sourceData (dict) --
      
      The data field of the trust anchor depending on its type.
      Note
      
      This is a Tagged Union structure. Only one of the following top level keys will be set: x509CertificateData, acmPcaArn. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - x509CertificateData (string) --
        
        The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.
      - acmPcaArn (string) --
        
        The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.
  - enabled (boolean) --
    
    Indicates whether the trust anchor is enabled.
  - crlDpRevocationEnabled (boolean) --
    
    Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was last updated.
  - notificationSettings (list) --
    
    A list of notification settings to be associated to the trust anchor.
    - (dict) --
      
      The state of a notification setting.
      
      A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.
      - enabled (boolean) --
        
        Indicates whether the notification setting is enabled.
      - event (string) --
        
        The event to which this notification setting is applied.
      - threshold (integer) --
        
        The number of days before a notification event.
      - channel (string) --
        
        The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.
        
        Note
        
        In the absence of a specific channel, IAM Roles Anywhere applies this setting to 'ALL' channels.
      - configuredBy (string) --
        
        The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.
  - aliasName (string) --
    
    The alias of the trust anchor. Present only if the trust anchor has an alias.
  - aliasArn (string) --
    
    The alias ARN of the trust anchor, in the form ``arn:partition:rolesanywhere:region:account:alias/trust-anchor/alias-name ``. Present only if the trust anchor has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

UpdateCrl (updated)

Link ¶
Changes (request, response)
Request

{'aliasName': 'string'}

Response

{'crl': {'aliasArn': 'string',
         'aliasName': 'string',
         'previousAliasName': 'string'}}

Updates the certificate revocation list (CRL). A CRL is a list of certificates that have been revoked by the issuing certificate authority (CA). IAM Roles Anywhere validates against the CRL before issuing credentials.

Required permissions: rolesanywhere:UpdateCrl.

See also: AWS API Documentation

Request Syntax

client.update_crl(
    crlId='string',
    name='string',
    crlData=b'bytes',
    aliasName='string'
)

type crlId:

string

param crlId:

[REQUIRED]

The certificate revocation list (CRL) to act on. You can specify one of the following:

The CRL ID.
The CRL ARN.
The alias ARN of the CRL.

An ARN must be for a CRL in your account and Region.

type name:

string

param name:

The name of the Crl.

type crlData:

bytes

param crlData:

The x509 v3 specified certificate revocation list (CRL).

type aliasName:

string

param aliasName:

The alias for the certificate revocation list (CRL).

You can use this parameter in the following ways:

To set or change the alias, specify the new alias name. After the change, the previous alias ARN no longer identifies the resource. You can then assign the previous alias to another resource of the same type. A change can take a short time to take effect for requests that use an alias ARN.
To remove the alias, specify an empty string.
To keep the current alias, omit this parameter.

rtype:

dict

returns:

Response Syntax

{
    'crl': {
        'crlId': 'string',
        'crlArn': 'string',
        'name': 'string',
        'enabled': True|False,
        'crlData': b'bytes',
        'trustAnchorArn': 'string',
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- crl (dict) --
  
  The state of the certificate revocation list (CRL) after a read or write operation.
  - crlId (string) --
    
    The unique identifier of the certificate revocation list (CRL).
  - crlArn (string) --
    
    The ARN of the certificate revocation list (CRL).
  - name (string) --
    
    The name of the certificate revocation list (CRL).
  - enabled (boolean) --
    
    Indicates whether the certificate revocation list (CRL) is enabled.
  - crlData (bytes) --
    
    The state of the certificate revocation list (CRL) after a read or write operation.
  - trustAnchorArn (string) --
    
    The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the certificate revocation list (CRL) was last updated.
  - aliasName (string) --
    
    The alias of the certificate revocation list (CRL). Present only if the CRL has an alias.
  - aliasArn (string) --
    
    The alias ARN of the certificate revocation list (CRL), in the form ``arn:partition:rolesanywhere:region:account:alias/crl/alias-name ``. Present only if the CRL has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

UpdateProfile (updated)

Link ¶
Changes (request, response)
Request

{'aliasName': 'string'}

Response

{'profile': {'aliasArn': 'string',
             'aliasName': 'string',
             'previousAliasName': 'string'}}

Updates a profile, a list of the roles that IAM Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies.

Required permissions: rolesanywhere:UpdateProfile.

See also: AWS API Documentation

Request Syntax

client.update_profile(
    profileId='string',
    name='string',
    sessionPolicy='string',
    roleArns=[
        'string',
    ],
    managedPolicyArns=[
        'string',
    ],
    durationSeconds=123,
    acceptRoleSessionName=True|False,
    aliasName='string'
)

type profileId:

string

param profileId:

[REQUIRED]

The profile to act on. You can specify one of the following:

The profile ID.
The profile ARN.
The alias ARN of the profile.

An ARN must be for a profile in your account and Region.

type name:

string

param name:

The name of the profile.

type sessionPolicy:

string

param sessionPolicy:

A session policy that applies to the trust boundary of the vended session credentials.

type roleArns:

list

param roleArns:

A list of IAM roles that this profile can assume in a temporary credential request.

(string) --

type managedPolicyArns:

list

param managedPolicyArns:

A list of managed policy ARNs that apply to the vended session credentials.

(string) --

type durationSeconds:

integer

param durationSeconds:

type acceptRoleSessionName:

boolean

param acceptRoleSessionName:

Used to determine if a custom role session name will be accepted in a temporary credential request.

type aliasName:

string

param aliasName:

The alias for the profile.

You can use this parameter in the following ways:

To set or change the alias, specify the new alias name. After the change, the previous alias ARN no longer identifies the resource. You can then assign the previous alias to another resource of the same type. A change can take a short time to take effect for requests that use an alias ARN.
To remove the alias, specify an empty string.
To keep the current alias, omit this parameter.

rtype:

dict

returns:

Response Syntax

{
    'profile': {
        'profileId': 'string',
        'profileArn': 'string',
        'name': 'string',
        'requireInstanceProperties': True|False,
        'enabled': True|False,
        'createdBy': 'string',
        'sessionPolicy': 'string',
        'roleArns': [
            'string',
        ],
        'managedPolicyArns': [
            'string',
        ],
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'durationSeconds': 123,
        'acceptRoleSessionName': True|False,
        'attributeMappings': [
            {
                'certificateField': 'x509Subject'|'x509Issuer'|'x509SAN',
                'mappingRules': [
                    {
                        'specifier': 'string'
                    },
                ]
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- profile (dict) --
  
  The state of the profile after a read or write operation.
  - profileId (string) --
    
    The unique identifier of the profile.
  - profileArn (string) --
    
    The ARN of the profile.
  - name (string) --
    
    The name of the profile.
  - requireInstanceProperties (boolean) --
    
    Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.
  - enabled (boolean) --
    
    Indicates whether the profile is enabled.
  - createdBy (string) --
    
    The Amazon Web Services account that created the profile.
  - sessionPolicy (string) --
    
    A session policy that applies to the trust boundary of the vended session credentials.
  - roleArns (list) --
    
    A list of IAM roles that this profile can assume in a temporary credential request.
    - (string) --
  - managedPolicyArns (list) --
    
    A list of managed policy ARNs that apply to the vended session credentials.
    - (string) --
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the profile was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the profile was last updated.
  - durationSeconds (integer) --
    
    Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.
  - acceptRoleSessionName (boolean) --
    
    Used to determine if a custom role session name will be accepted in a temporary credential request.
  - attributeMappings (list) --
    
    A mapping applied to the authenticating end-entity certificate.
    - (dict) --
      
      A mapping applied to the authenticating end-entity certificate.
      - certificateField (string) --
        
        Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.
      - mappingRules (list) --
        
        A list of mapping entries for every supported specifier or sub-field.
        
        (dict) --
        
        A single mapping entry for each supported specifier or sub-field.
        
        specifier (string) --
        
        Specifier within a certificate field, such as CN, OU, or UID from the Subject field.
  - aliasName (string) --
    
    The alias of the profile. Present only if the profile has an alias.
  - aliasArn (string) --
    
    The alias ARN of the profile, in the form ``arn:partition:rolesanywhere:region:account:alias/profile/alias-name ``. Present only if the profile has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.

UpdateTrustAnchor (updated)

Link ¶
Changes (request, response)
Request

{'aliasName': 'string'}

Response

{'trustAnchor': {'aliasArn': 'string',
                 'aliasName': 'string',
                 'previousAliasName': 'string'}}

Updates a trust anchor. You establish trust between IAM Roles Anywhere and your certificate authority (CA) by configuring a trust anchor. You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials.

Required permissions: rolesanywhere:UpdateTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.update_trust_anchor(
    trustAnchorId='string',
    name='string',
    source={
        'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
        'sourceData': {
            'x509CertificateData': 'string',
            'acmPcaArn': 'string'
        }
    },
    crlDpRevocationEnabled=True|False,
    aliasName='string'
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The trust anchor to act on. You can specify one of the following:

The trust anchor ID.
The trust anchor ARN.
The alias ARN of the trust anchor.

An ARN must be for a trust anchor in your account and Region.

type name:

string

param name:

The name of the trust anchor.

type source:

dict

param source:

The trust anchor type and its related certificate data.

sourceType (string) --

The type of the trust anchor.
sourceData (dict) --

The data field of the trust anchor depending on its type.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: x509CertificateData, acmPcaArn.
- x509CertificateData (string) --
  
  The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.
- acmPcaArn (string) --
  
  The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

type crlDpRevocationEnabled:

boolean

param crlDpRevocationEnabled:

Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

type aliasName:

string

param aliasName:

The alias for the trust anchor.

You can use this parameter in the following ways:

To set or change the alias, specify the new alias name. After the change, the previous alias ARN no longer identifies the resource. You can then assign the previous alias to another resource of the same type. A change can take a short time to take effect for requests that use an alias ARN.
To remove the alias, specify an empty string.
To keep the current alias, omit this parameter.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ],
        'aliasName': 'string',
        'aliasArn': 'string',
        'previousAliasName': 'string'
    }
}

Response Structure

(dict) --
- trustAnchor (dict) --
  
  The state of the trust anchor after a read or write operation.
  - trustAnchorId (string) --
    
    The unique identifier of the trust anchor.
  - trustAnchorArn (string) --
    
    The ARN of the trust anchor.
  - name (string) --
    
    The name of the trust anchor.
  - source (dict) --
    
    The trust anchor type and its related certificate data.
    - sourceType (string) --
      
      The type of the trust anchor.
    - sourceData (dict) --
      
      The data field of the trust anchor depending on its type.
      Note
      
      This is a Tagged Union structure. Only one of the following top level keys will be set: x509CertificateData, acmPcaArn. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - x509CertificateData (string) --
        
        The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.
      - acmPcaArn (string) --
        
        The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.
  - enabled (boolean) --
    
    Indicates whether the trust anchor is enabled.
  - crlDpRevocationEnabled (boolean) --
    
    Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.
  - createdAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was created.
  - updatedAt (datetime) --
    
    The ISO-8601 timestamp when the trust anchor was last updated.
  - notificationSettings (list) --
    
    A list of notification settings to be associated to the trust anchor.
    - (dict) --
      
      The state of a notification setting.
      
      A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.
      - enabled (boolean) --
        
        Indicates whether the notification setting is enabled.
      - event (string) --
        
        The event to which this notification setting is applied.
      - threshold (integer) --
        
        The number of days before a notification event.
      - channel (string) --
        
        The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.
        
        Note
        
        In the absence of a specific channel, IAM Roles Anywhere applies this setting to 'ALL' channels.
      - configuredBy (string) --
        
        The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.
  - aliasName (string) --
    
    The alias of the trust anchor. Present only if the trust anchor has an alias.
  - aliasArn (string) --
    
    The alias ARN of the trust anchor, in the form ``arn:partition:rolesanywhere:region:account:alias/trust-anchor/alias-name ``. Present only if the trust anchor has an alias.
    
    You can use the alias ARN in place of the resource ID or ARN in the request parameters whose descriptions say that they accept an alias ARN. Don't use the alias ARN in Identity and Access Management (IAM) policies. A policy statement that names an alias ARN doesn't apply to the resource that holds the alias. Write policies with the ARN that contains the resource ID instead.
  - previousAliasName (string) --
    
    The alias that the resource had before the update request. IAM Roles Anywhere returns this value only in the response to an update request that changed or removed an existing alias. It isn't returned when the alias was unchanged, when the resource had no alias before the request, or by other operations.