AWS API Changes

2019/11/07 - AWS Single Sign-On - 4 new api methods

Changes This is an initial release of AWS Single Sign-On (SSO) end-user access. This release adds support for accessing AWS accounts assigned in AWS SSO using short term credentials.

GetRoleCredentials (new)

Link ¶

Returns the STS short-term credentials for a given role name that is assigned to the user.

See also: AWS API Documentation

Request Syntax

client.get_role_credentials(
    roleName='string',
    accountId='string',
    accessToken='string'
)

type roleName

string

param roleName

[REQUIRED]

The friendly name of the role that is assigned to the user.

type accountId

string

param accountId

[REQUIRED]

The identifier for the AWS account that is assigned to the user.

type accessToken

string

param accessToken

[REQUIRED]

The token issued by the CreateToken API call. For more information, see CreateToken in the AWS SSO OIDC API Reference Guide .

rtype

dict

returns

Response Syntax

{
    'roleCredentials': {
        'accessKeyId': 'string',
        'secretAccessKey': 'string',
        'sessionToken': 'string',
        'expiration': 123
    }
}

Response Structure

(dict) --
- roleCredentials (dict) --
  
  The credentials for the role that is assigned to the user.
  - accessKeyId (string) --
    
    The identifier used for the temporary security credentials. For more information, see Using Temporary Security Credentials to Request Access to AWS Resources in the AWS IAM User Guide .
  - secretAccessKey (string) --
    
    The key that is used to sign the request. For more information, see Using Temporary Security Credentials to Request Access to AWS Resources in the AWS IAM User Guide .
  - sessionToken (string) --
    
    The token used for temporary credentials. For more information, see Using Temporary Security Credentials to Request Access to AWS Resources in the AWS IAM User Guide .
  - expiration (integer) --
    
    The date on which temporary security credentials expire.

Logout (new)

Link ¶

Removes the client- and server-side session that is associated with the user.

See also: AWS API Documentation

Request Syntax

client.logout(
    accessToken='string'
)

type accessToken

string

param accessToken

[REQUIRED]

The token issued by the CreateToken API call. For more information, see CreateToken in the AWS SSO OIDC API Reference Guide .

returns

None

ListAccountRoles (new)

Link ¶

Lists all roles that are assigned to the user for a given AWS account.

See also: AWS API Documentation

Request Syntax

client.list_account_roles(
    nextToken='string',
    maxResults=123,
    accessToken='string',
    accountId='string'
)

type nextToken

string

param nextToken

The page token from the previous response output when you request subsequent pages.

type maxResults

integer

param maxResults

The number of items that clients can request per page.

type accessToken

string

param accessToken

[REQUIRED]

The token issued by the CreateToken API call. For more information, see CreateToken in the AWS SSO OIDC API Reference Guide .

type accountId

string

param accountId

[REQUIRED]

The identifier for the AWS account that is assigned to the user.

rtype

dict

returns

Response Syntax

{
    'nextToken': 'string',
    'roleList': [
        {
            'roleName': 'string',
            'accountId': 'string'
        },
    ]
}

Response Structure

(dict) --
- nextToken (string) --
  
  The page token client that is used to retrieve the list of accounts.
- roleList (list) --
  
  A paginated response with the list of roles and the next token if more results are available.
  - (dict) --
    
    Provides information about the role that is assigned to the user.
    - roleName (string) --
      
      The friendly name of the role that is assigned to the user.
    - accountId (string) --
      
      The identifier of the AWS account assigned to the user.

ListAccounts (new)

Link ¶

Lists all AWS accounts assigned to the user. These AWS accounts are assigned by the administrator of the account. For more information, see Assign User Access in the AWS SSO User Guide . This operation returns a paginated response.

See also: AWS API Documentation

Request Syntax

client.list_accounts(
    nextToken='string',
    maxResults=123,
    accessToken='string'
)

type nextToken

string

param nextToken

(Optional) When requesting subsequent pages, this is the page token from the previous response output.

type maxResults

integer

param maxResults

This is the number of items clients can request per page.

type accessToken

string

param accessToken

[REQUIRED]

The token issued by the CreateToken API call. For more information, see CreateToken in the AWS SSO OIDC API Reference Guide .

rtype

dict

returns

Response Syntax

{
    'nextToken': 'string',
    'accountList': [
        {
            'accountId': 'string',
            'accountName': 'string',
            'emailAddress': 'string'
        },
    ]
}

Response Structure

(dict) --
- nextToken (string) --
  
  The page token client that is used to retrieve the list of accounts.
- accountList (list) --
  
  A paginated response with the list of account information and the next token if more results are available.
  - (dict) --
    
    Provides information about your AWS account.
    - accountId (string) --
      
      The identifier of the AWS account that is assigned to the user.
    - accountName (string) --
      
      The display name of the AWS account that is assigned to the user.
    - emailAddress (string) --
      
      The email address of the AWS account that is assigned to the user.