2015/12/04 - AWS Directory Service - 5 new2 updated api methods
AWS Directory Service for Microsoft Active Directory allows you to configure trust relationships. For example, you can establish a trust between your Microsoft AD in the AWS cloud, and your existing on-premises Microsoft Active Directory. This would allow you to provide users and groups access to resources in either domain, with a single set of credentials.
This action initiates the creation of the AWS side of a trust relationship between a Microsoft AD in the AWS cloud and an external domain.
Request Syntax
client.create_trust(
DirectoryId='string',
RemoteDomainName='string',
TrustPassword='string',
TrustDirection='One-Way: Outgoing'|'One-Way: Incoming'|'Two-Way',
TrustType='Forest'
)
string
[REQUIRED] The Directory ID of the Microsoft AD in the AWS cloud for which to establish the trust relationship.
string
[REQUIRED] The Fully Qualified Domain Name (FQDN) of the external domain for which to create the trust relationship.
string
[REQUIRED] The trust password. The must be the same password that was used when creating the trust relationship on the external domain.
string
[REQUIRED] The direction of the trust relationship.
string
The trust relationship type.
dict
Response Syntax
{
'TrustId': 'string'
}
Response Structure
(dict) --
TrustId (string) -- A unique identifier for the trust relationship that was created.
Creates a Microsoft AD in the AWS cloud.
Request Syntax
client.create_microsoft_ad(
Name='string',
ShortName='string',
Password='string',
Description='string',
VpcSettings={
'VpcId': 'string',
'SubnetIds': [
'string',
]
}
)
string
[REQUIRED]
The fully qualified domain name for the directory, such as corp.example.com. This name will resolve inside your VPC only. It does not need to be publicly resolvable.
string
The NetBIOS name for your domain. A short identifier for your domain, such as CORP. If you don't specify a NetBIOS name, it will default to the first part of your directory DNS. For example, CORP for the directory DNS corp.example.com.
string
[REQUIRED]
The password for the default administrative user named Admin.
string
A textual description for the directory. This label will appear on the AWS console Directory Details page after the directory is created.
dict
[REQUIRED]
Contains VPC information for the CreateDirectory or CreateMicrosoftAD operation.
VpcId (string) -- [REQUIRED]
The identifier of the VPC in which to create the directory.
SubnetIds (list) -- [REQUIRED]
The identifiers of the subnets for the directory servers. The two subnets must be in different Availability Zones. AWS Directory Service creates a directory server and a DNS server in each of these subnets.
(string) --
dict
Response Syntax
{
'DirectoryId': 'string'
}
Response Structure
(dict) --
DirectoryId (string) -- The identifier of the directory that was created.
Deletes an existing trust relationship between your Microsoft AD in the AWS cloud and an external domain.
Request Syntax
client.delete_trust(
TrustId='string'
)
string
[REQUIRED] The Trust ID of the trust relationship to be deleted.
dict
Response Syntax
{
'TrustId': 'string'
}
Response Structure
(dict) --
TrustId (string) -- The Trust ID of the trust relationship that was deleted.
AWS Directory Service for Microsoft Active Directory allows you to configure and verify trust relationships.
This action verifies a trust relationship between your Microsoft AD in the AWS cloud and an external domain.
Request Syntax
client.verify_trust(
TrustId='string'
)
string
[REQUIRED] The unique Trust ID of the trust relationship to verify.
dict
Response Syntax
{
'TrustId': 'string'
}
Response Structure
(dict) --
TrustId (string) -- The unique Trust ID of the trust relationship that was verified.
Obtains information about the trust relationships for this account.
If no input parameters are provided, such as DirectoryId or TrustIds, this request describes all the trust relationships belonging to the account.
Request Syntax
client.describe_trusts(
DirectoryId='string',
TrustIds=[
'string',
],
NextToken='string',
Limit=123
)
string
The Directory ID of the AWS directory that is a part of the requested trust relationship.
list
A list of identifiers of the trust relationships for which to obtain the information. If this member is null, all trust relationships that belong to the current account are returned.
An empty list results in an InvalidParameterException being thrown.
(string) --
string
The DescribeTrustsResult.NextToken value from a previous call to DescribeTrusts. Pass null if this is the first call.
integer
The maximum number of objects to return.
dict
Response Syntax
{
'Trusts': [
{
'DirectoryId': 'string',
'TrustId': 'string',
'RemoteDomainName': 'string',
'TrustType': 'Forest',
'TrustDirection': 'One-Way: Outgoing'|'One-Way: Incoming'|'Two-Way',
'TrustState': 'Creating'|'Created'|'Verifying'|'VerifyFailed'|'Verified'|'Deleting'|'Deleted'|'Failed',
'CreatedDateTime': datetime(2015, 1, 1),
'LastUpdatedDateTime': datetime(2015, 1, 1),
'StateLastUpdatedDateTime': datetime(2015, 1, 1)
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
Trusts (list) --
The list of Trust objects that were retrieved.
It is possible that this list contains less than the number of items specified in the Limit member of the request. This occurs if there are less than the requested number of items left to retrieve, or if the limitations of the operation have been exceeded.
(dict) -- Describes a trust relationship between an Microsoft AD in the AWS cloud and an external domain.
DirectoryId (string) -- The Directory ID of the AWS directory involved in the trust relationship.
TrustId (string) -- The unique ID of the trust relationship.
RemoteDomainName (string) -- The Fully Qualified Domain Name (FQDN) of the external domain involved in the trust relationship.
TrustType (string) -- The trust relationship type.
TrustDirection (string) -- The trust relationship direction.
TrustState (string) -- The trust relationship state.
CreatedDateTime (datetime) -- The date and time that the trust relationship was created.
LastUpdatedDateTime (datetime) -- The date and time that the trust relationship was last updated.
StateLastUpdatedDateTime (datetime) -- The date and time that the TrustState was last updated.
NextToken (string) --
If not null, more results are available. Pass this value for the NextToken parameter in a subsequent call to DescribeTrusts to retrieve the next set of items.
{'DirectoryDescriptions': {'Type': {'MicrosoftAD'}}}
Obtains information about the directories that belong to this account.
You can retrieve information about specific directories by passing the directory identifiers in the DirectoryIds parameter. Otherwise, all directories that belong to the current account are returned.
This operation supports pagination with the use of the NextToken request and response parameters. If more results are available, the DescribeDirectoriesResult.NextToken member contains a token that you pass in the next call to DescribeDirectories to retrieve the next set of items.
You can also specify a maximum number of return results with the Limit parameter.
Request Syntax
client.describe_directories(
DirectoryIds=[
'string',
],
NextToken='string',
Limit=123
)
list
A list of identifiers of the directories for which to obtain the information. If this member is null, all directories that belong to the current account are returned.
An empty list results in an InvalidParameterException being thrown.
(string) --
string
The DescribeDirectoriesResult.NextToken value from a previous call to DescribeDirectories. Pass null if this is the first call.
integer
The maximum number of items to return. If this value is zero, the maximum number of items is specified by the limitations of the operation.
dict
Response Syntax
{
'DirectoryDescriptions': [
{
'DirectoryId': 'string',
'Name': 'string',
'ShortName': 'string',
'Size': 'Small'|'Large',
'Alias': 'string',
'AccessUrl': 'string',
'Description': 'string',
'DnsIpAddrs': [
'string',
],
'Stage': 'Requested'|'Creating'|'Created'|'Active'|'Inoperable'|'Impaired'|'Restoring'|'RestoreFailed'|'Deleting'|'Deleted'|'Failed',
'LaunchTime': datetime(2015, 1, 1),
'StageLastUpdatedDateTime': datetime(2015, 1, 1),
'Type': 'SimpleAD'|'ADConnector'|'MicrosoftAD',
'VpcSettings': {
'VpcId': 'string',
'SubnetIds': [
'string',
],
'SecurityGroupId': 'string',
'AvailabilityZones': [
'string',
]
},
'ConnectSettings': {
'VpcId': 'string',
'SubnetIds': [
'string',
],
'CustomerUserName': 'string',
'SecurityGroupId': 'string',
'AvailabilityZones': [
'string',
],
'ConnectIps': [
'string',
]
},
'RadiusSettings': {
'RadiusServers': [
'string',
],
'RadiusPort': 123,
'RadiusTimeout': 123,
'RadiusRetries': 123,
'SharedSecret': 'string',
'AuthenticationProtocol': 'PAP'|'CHAP'|'MS-CHAPv1'|'MS-CHAPv2',
'DisplayLabel': 'string',
'UseSameUsername': True|False
},
'RadiusStatus': 'Creating'|'Completed'|'Failed',
'StageReason': 'string',
'SsoEnabled': True|False
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
Contains the results of the DescribeDirectories operation.
DirectoryDescriptions (list) --
The list of DirectoryDescription objects that were retrieved.
It is possible that this list contains less than the number of items specified in the Limit member of the request. This occurs if there are less than the requested number of items left to retrieve, or if the limitations of the operation have been exceeded.
(dict) --
Contains information about an AWS Directory Service directory.
DirectoryId (string) --
The directory identifier.
Name (string) --
The fully-qualified name of the directory.
ShortName (string) --
The short name of the directory.
Size (string) --
The directory size.
Alias (string) --
The alias for the directory. If no alias has been created for the directory, the alias is the directory identifier, such as d-XXXXXXXXXX.
AccessUrl (string) --
The access URL for the directory, such as http://alias.awsapps.com. If no alias has been created for the directory, alias is the directory identifier, such as d-XXXXXXXXXX.
Description (string) --
The textual description for the directory.
DnsIpAddrs (list) --
The IP addresses of the DNS servers for the directory. For a Simple AD or Microsoft AD directory, these are the IP addresses of the Simple AD or Microsoft AD directory servers. For an AD Connector directory, these are the IP addresses of the DNS servers or domain controllers in the on-premises directory to which the AD Connector is connected.
(string) --
Stage (string) --
The current stage of the directory.
LaunchTime (datetime) --
Specifies when the directory was created.
StageLastUpdatedDateTime (datetime) --
The date and time that the stage was last updated.
Type (string) --
The directory size.
VpcSettings (dict) --
A DirectoryVpcSettingsDescription object that contains additional information about a directory. This member is only present if the directory is a Simple AD or Managed AD directory.
VpcId (string) --
The identifier of the VPC that the directory is in.
SubnetIds (list) --
The identifiers of the subnets for the directory servers.
(string) --
SecurityGroupId (string) --
The security group identifier for the directory. If the directory was created before 8/1/2014, this is the identifier of the directory members security group that was created when the directory was created. If the directory was created after this date, this value is null.
AvailabilityZones (list) --
The list of Availability Zones that the directory is in.
(string) --
ConnectSettings (dict) --
A DirectoryConnectSettingsDescription object that contains additional information about an AD Connector directory. This member is only present if the directory is an AD Connector directory.
VpcId (string) --
The identifier of the VPC that the AD Connector is in.
SubnetIds (list) --
A list of subnet identifiers in the VPC that the AD connector is in.
(string) --
CustomerUserName (string) --
The username of the service account in the on-premises directory.
SecurityGroupId (string) --
The security group identifier for the AD Connector directory.
AvailabilityZones (list) --
A list of the Availability Zones that the directory is in.
(string) --
ConnectIps (list) --
The IP addresses of the AD Connector servers.
(string) --
RadiusSettings (dict) --
A RadiusSettings object that contains information about the RADIUS server configured for this directory.
RadiusServers (list) --
An array of strings that contains the IP addresses of the RADIUS server endpoints, or the IP addresses of your RADIUS server load balancer.
(string) --
RadiusPort (integer) --
The port that your RADIUS server is using for communications. Your on-premises network must allow inbound traffic over this port from the AWS Directory Service servers.
RadiusTimeout (integer) --
The amount of time, in seconds, to wait for the RADIUS server to respond.
RadiusRetries (integer) --
The maximum number of times that communication with the RADIUS server is attempted.
SharedSecret (string) --
The shared secret code that was specified when your RADIUS endpoints were created.
AuthenticationProtocol (string) --
The protocol specified for your RADIUS endpoints.
DisplayLabel (string) --
Not currently used.
UseSameUsername (boolean) --
Not currently used.
RadiusStatus (string) --
The status of the RADIUS MFA server connection.
StageReason (string) --
Additional information about the directory stage.
SsoEnabled (boolean) --
Indicates if single-sign on is enabled for the directory. For more information, see EnableSso and DisableSso.
NextToken (string) --
If not null, more results are available. Pass this value for the NextToken parameter in a subsequent call to DescribeDirectories to retrieve the next set of items.
{'DirectoryLimits': {'CloudOnlyMicrosoftADCurrentCount': 'integer',
'CloudOnlyMicrosoftADLimit': 'integer',
'CloudOnlyMicrosoftADLimitReached': 'boolean'}}
Obtains directory limit information for the current region.
Request Syntax
client.get_directory_limits()
dict
Response Syntax
{
'DirectoryLimits': {
'CloudOnlyDirectoriesLimit': 123,
'CloudOnlyDirectoriesCurrentCount': 123,
'CloudOnlyDirectoriesLimitReached': True|False,
'CloudOnlyMicrosoftADLimit': 123,
'CloudOnlyMicrosoftADCurrentCount': 123,
'CloudOnlyMicrosoftADLimitReached': True|False,
'ConnectedDirectoriesLimit': 123,
'ConnectedDirectoriesCurrentCount': 123,
'ConnectedDirectoriesLimitReached': True|False
}
}
Response Structure
(dict) --
Contains the results of the GetDirectoryLimits operation.
DirectoryLimits (dict) --
A DirectoryLimits object that contains the directory limits for the current region.
CloudOnlyDirectoriesLimit (integer) --
The maximum number of cloud directories allowed in the region.
CloudOnlyDirectoriesCurrentCount (integer) --
The current number of cloud directories in the region.
CloudOnlyDirectoriesLimitReached (boolean) --
Indicates if the cloud directory limit has been reached.
CloudOnlyMicrosoftADLimit (integer) -- The maximum number of Microsoft AD directories allowed in the region.
CloudOnlyMicrosoftADCurrentCount (integer) -- The current number of Microsoft AD directories in the region.
CloudOnlyMicrosoftADLimitReached (boolean) -- Indicates if the Microsoft AD directory limit has been reached.
ConnectedDirectoriesLimit (integer) --
The maximum number of connected directories allowed in the region.
ConnectedDirectoriesCurrentCount (integer) --
The current number of connected directories in the region.
ConnectedDirectoriesLimitReached (boolean) --
Indicates if the connected directory limit has been reached.