IAM Roles Anywhere

{'crlDpRevocationEnabled': 'boolean'}

{'trustAnchor': {'crlDpRevocationEnabled': 'boolean'}}

Creates a trust anchor to establish trust between IAM Roles Anywhere and your certificate authority (CA). You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials.

Required permissions: rolesanywhere:CreateTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.create_trust_anchor(
    name='string',
    source={
        'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
        'sourceData': {
            'x509CertificateData': 'string',
            'acmPcaArn': 'string'
        }
    },
    enabled=True|False,
    crlDpRevocationEnabled=True|False,
    tags=[
        {
            'key': 'string',
            'value': 'string'
        },
    ],
    notificationSettings=[
        {
            'enabled': True|False,
            'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
            'threshold': 123,
            'channel': 'ALL'
        },
    ]
)

type name:

string

param name:

[REQUIRED]

The name of the trust anchor.

type source:

dict

param source:

[REQUIRED]

The trust anchor type and its related certificate data.

• sourceType (string) --

  The type of the trust anchor.

• sourceData (dict) --

  The data field of the trust anchor depending on its type.

  • x509CertificateData (string) --

    The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

  • acmPcaArn (string) --

    The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

type enabled:

boolean

param enabled:

Specifies whether the trust anchor is enabled.

type crlDpRevocationEnabled:

boolean

param crlDpRevocationEnabled:

Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

type tags:

list

param tags:

The tags to attach to the trust anchor.

• (dict) --

  A label that consists of a key and value you define.

  • key (string) -- [REQUIRED]

    The tag key.

  • value (string) -- [REQUIRED]

    The tag value.

type notificationSettings:

list

param notificationSettings:

A list of notification settings to be associated to the trust anchor.

• (dict) --

  Customizable notification settings that will be applied to notification events. IAM Roles Anywhere consumes these settings while notifying across multiple channels - CloudWatch metrics, EventBridge, and Health Dashboard.

  • enabled (boolean) -- [REQUIRED]

    Indicates whether the notification setting is enabled.

  • event (string) -- [REQUIRED]

    The event to which this notification setting is applied.

  • threshold (integer) --

    The number of days before a notification event. This value is required for a notification setting that is enabled.

  • channel (string) --

    The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ]
    }
}

Response Structure

• (dict) --

  • trustAnchor (dict) --

    The state of the trust anchor after a read or write operation.

    • trustAnchorId (string) --

      The unique identifier of the trust anchor.

    • trustAnchorArn (string) --

      The ARN of the trust anchor.

    • name (string) --

      The name of the trust anchor.

    • source (dict) --

      The trust anchor type and its related certificate data.

      • sourceType (string) --

        The type of the trust anchor.

      • sourceData (dict) --

        The data field of the trust anchor depending on its type.

        • x509CertificateData (string) --

          The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • acmPcaArn (string) --

          The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

    • enabled (boolean) --

      Indicates whether the trust anchor is enabled.

    • crlDpRevocationEnabled (boolean) --

      Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

    • createdAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was created.

    • updatedAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was last updated.

    • notificationSettings (list) --

      A list of notification settings to be associated to the trust anchor.

      • (dict) --

        The state of a notification setting.

        A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

        • enabled (boolean) --

          Indicates whether the notification setting is enabled.

        • event (string) --

          The event to which this notification setting is applied.

        • threshold (integer) --

          The number of days before a notification event.

        • channel (string) --

          The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

        • configuredBy (string) --

          The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

{'trustAnchor': {'crlDpRevocationEnabled': 'boolean'}}

Deletes a trust anchor.

Required permissions: rolesanywhere:DeleteTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.delete_trust_anchor(
    trustAnchorId='string'
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ]
    }
}

Response Structure

• (dict) --

  • trustAnchor (dict) --

    The state of the trust anchor after a read or write operation.

    • trustAnchorId (string) --

      The unique identifier of the trust anchor.

    • trustAnchorArn (string) --

      The ARN of the trust anchor.

    • name (string) --

      The name of the trust anchor.

    • source (dict) --

      The trust anchor type and its related certificate data.

      • sourceType (string) --

        The type of the trust anchor.

      • sourceData (dict) --

        The data field of the trust anchor depending on its type.

        • x509CertificateData (string) --

          The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • acmPcaArn (string) --

          The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

    • enabled (boolean) --

      Indicates whether the trust anchor is enabled.

    • crlDpRevocationEnabled (boolean) --

      Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

    • createdAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was created.

    • updatedAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was last updated.

    • notificationSettings (list) --

      A list of notification settings to be associated to the trust anchor.

      • (dict) --

        The state of a notification setting.

        A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

        • enabled (boolean) --

          Indicates whether the notification setting is enabled.

        • event (string) --

          The event to which this notification setting is applied.

        • threshold (integer) --

          The number of days before a notification event.

        • channel (string) --

          The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

        • configuredBy (string) --

          The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

{'trustAnchor': {'crlDpRevocationEnabled': 'boolean'}}

Disables a trust anchor. When disabled, temporary credential requests specifying this trust anchor are unauthorized.

Required permissions: rolesanywhere:DisableTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.disable_trust_anchor(
    trustAnchorId='string'
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ]
    }
}

Response Structure

• (dict) --

  • trustAnchor (dict) --

    The state of the trust anchor after a read or write operation.

    • trustAnchorId (string) --

      The unique identifier of the trust anchor.

    • trustAnchorArn (string) --

      The ARN of the trust anchor.

    • name (string) --

      The name of the trust anchor.

    • source (dict) --

      The trust anchor type and its related certificate data.

      • sourceType (string) --

        The type of the trust anchor.

      • sourceData (dict) --

        The data field of the trust anchor depending on its type.

        • x509CertificateData (string) --

          The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • acmPcaArn (string) --

          The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

    • enabled (boolean) --

      Indicates whether the trust anchor is enabled.

    • crlDpRevocationEnabled (boolean) --

      Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

    • createdAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was created.

    • updatedAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was last updated.

    • notificationSettings (list) --

      A list of notification settings to be associated to the trust anchor.

      • (dict) --

        The state of a notification setting.

        A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

        • enabled (boolean) --

          Indicates whether the notification setting is enabled.

        • event (string) --

          The event to which this notification setting is applied.

        • threshold (integer) --

          The number of days before a notification event.

        • channel (string) --

          The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

        • configuredBy (string) --

          The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

{'trustAnchor': {'crlDpRevocationEnabled': 'boolean'}}

Enables a trust anchor. When enabled, certificates in the trust anchor chain are authorized for trust validation.

Required permissions: rolesanywhere:EnableTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.enable_trust_anchor(
    trustAnchorId='string'
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ]
    }
}

Response Structure

• (dict) --

  • trustAnchor (dict) --

    The state of the trust anchor after a read or write operation.

    • trustAnchorId (string) --

      The unique identifier of the trust anchor.

    • trustAnchorArn (string) --

      The ARN of the trust anchor.

    • name (string) --

      The name of the trust anchor.

    • source (dict) --

      The trust anchor type and its related certificate data.

      • sourceType (string) --

        The type of the trust anchor.

      • sourceData (dict) --

        The data field of the trust anchor depending on its type.

        • x509CertificateData (string) --

          The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • acmPcaArn (string) --

          The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

    • enabled (boolean) --

      Indicates whether the trust anchor is enabled.

    • crlDpRevocationEnabled (boolean) --

      Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

    • createdAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was created.

    • updatedAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was last updated.

    • notificationSettings (list) --

      A list of notification settings to be associated to the trust anchor.

      • (dict) --

        The state of a notification setting.

        A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

        • enabled (boolean) --

          Indicates whether the notification setting is enabled.

        • event (string) --

          The event to which this notification setting is applied.

        • threshold (integer) --

          The number of days before a notification event.

        • channel (string) --

          The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

        • configuredBy (string) --

          The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

{'trustAnchor': {'crlDpRevocationEnabled': 'boolean'}}

Gets a trust anchor.

Required permissions: rolesanywhere:GetTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.get_trust_anchor(
    trustAnchorId='string'
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ]
    }
}

Response Structure

• (dict) --

  • trustAnchor (dict) --

    The state of the trust anchor after a read or write operation.

    • trustAnchorId (string) --

      The unique identifier of the trust anchor.

    • trustAnchorArn (string) --

      The ARN of the trust anchor.

    • name (string) --

      The name of the trust anchor.

    • source (dict) --

      The trust anchor type and its related certificate data.

      • sourceType (string) --

        The type of the trust anchor.

      • sourceData (dict) --

        The data field of the trust anchor depending on its type.

        • x509CertificateData (string) --

          The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • acmPcaArn (string) --

          The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

    • enabled (boolean) --

      Indicates whether the trust anchor is enabled.

    • crlDpRevocationEnabled (boolean) --

      Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

    • createdAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was created.

    • updatedAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was last updated.

    • notificationSettings (list) --

      A list of notification settings to be associated to the trust anchor.

      • (dict) --

        The state of a notification setting.

        A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

        • enabled (boolean) --

          Indicates whether the notification setting is enabled.

        • event (string) --

          The event to which this notification setting is applied.

        • threshold (integer) --

          The number of days before a notification event.

        • channel (string) --

          The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

        • configuredBy (string) --

          The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

{'trustAnchors': {'crlDpRevocationEnabled': 'boolean'}}

Lists the trust anchors in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListTrustAnchors.

See also: AWS API Documentation

Request Syntax

client.list_trust_anchors(
    nextToken='string',
    pageSize=123
)

type nextToken:

string

param nextToken:

A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.

type pageSize:

integer

param pageSize:

The number of resources in the paginated list.

rtype:

dict

returns:

Response Syntax

{
    'nextToken': 'string',
    'trustAnchors': [
        {
            'trustAnchorId': 'string',
            'trustAnchorArn': 'string',
            'name': 'string',
            'source': {
                'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
                'sourceData': {
                    'x509CertificateData': 'string',
                    'acmPcaArn': 'string'
                }
            },
            'enabled': True|False,
            'crlDpRevocationEnabled': True|False,
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1),
            'notificationSettings': [
                {
                    'enabled': True|False,
                    'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                    'threshold': 123,
                    'channel': 'ALL',
                    'configuredBy': 'string'
                },
            ]
        },
    ]
}

Response Structure

• (dict) --

  • nextToken (string) --

    A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.

  • trustAnchors (list) --

    A list of trust anchors.

    • (dict) --

      The state of the trust anchor after a read or write operation.

      • trustAnchorId (string) --

        The unique identifier of the trust anchor.

      • trustAnchorArn (string) --

        The ARN of the trust anchor.

      • name (string) --

        The name of the trust anchor.

      • source (dict) --

        The trust anchor type and its related certificate data.

        • sourceType (string) --

          The type of the trust anchor.

        • sourceData (dict) --

          The data field of the trust anchor depending on its type.

          • x509CertificateData (string) --

            The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

          • acmPcaArn (string) --

            The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

      • enabled (boolean) --

        Indicates whether the trust anchor is enabled.

      • crlDpRevocationEnabled (boolean) --

        Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

      • createdAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was created.

      • updatedAt (datetime) --

        The ISO-8601 timestamp when the trust anchor was last updated.

      • notificationSettings (list) --

        A list of notification settings to be associated to the trust anchor.

        • (dict) --

          The state of a notification setting.

          A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

          • enabled (boolean) --

            Indicates whether the notification setting is enabled.

          • event (string) --

            The event to which this notification setting is applied.

          • threshold (integer) --

            The number of days before a notification event.

          • channel (string) --

            The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

          • configuredBy (string) --

            The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

{'trustAnchor': {'crlDpRevocationEnabled': 'boolean'}}

Attaches a list of notification settings to a trust anchor.

A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

Required permissions: rolesanywhere:PutNotificationSettings.

See also: AWS API Documentation

Request Syntax

client.put_notification_settings(
    trustAnchorId='string',
    notificationSettings=[
        {
            'enabled': True|False,
            'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
            'threshold': 123,
            'channel': 'ALL'
        },
    ]
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

type notificationSettings:

list

param notificationSettings:

[REQUIRED]

A list of notification settings to be associated to the trust anchor.

• (dict) --

  Customizable notification settings that will be applied to notification events. IAM Roles Anywhere consumes these settings while notifying across multiple channels - CloudWatch metrics, EventBridge, and Health Dashboard.

  • enabled (boolean) -- [REQUIRED]

    Indicates whether the notification setting is enabled.

  • event (string) -- [REQUIRED]

    The event to which this notification setting is applied.

  • threshold (integer) --

    The number of days before a notification event. This value is required for a notification setting that is enabled.

  • channel (string) --

    The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ]
    }
}

Response Structure

• (dict) --

  • trustAnchor (dict) --

    The state of the trust anchor after a read or write operation.

    • trustAnchorId (string) --

      The unique identifier of the trust anchor.

    • trustAnchorArn (string) --

      The ARN of the trust anchor.

    • name (string) --

      The name of the trust anchor.

    • source (dict) --

      The trust anchor type and its related certificate data.

      • sourceType (string) --

        The type of the trust anchor.

      • sourceData (dict) --

        The data field of the trust anchor depending on its type.

        • x509CertificateData (string) --

          The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • acmPcaArn (string) --

          The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

    • enabled (boolean) --

      Indicates whether the trust anchor is enabled.

    • crlDpRevocationEnabled (boolean) --

      Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

    • createdAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was created.

    • updatedAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was last updated.

    • notificationSettings (list) --

      A list of notification settings to be associated to the trust anchor.

      • (dict) --

        The state of a notification setting.

        A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

        • enabled (boolean) --

          Indicates whether the notification setting is enabled.

        • event (string) --

          The event to which this notification setting is applied.

        • threshold (integer) --

          The number of days before a notification event.

        • channel (string) --

          The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

        • configuredBy (string) --

          The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

{'trustAnchor': {'crlDpRevocationEnabled': 'boolean'}}

Resets the custom notification setting to IAM Roles Anywhere default setting.

Required permissions: rolesanywhere:ResetNotificationSettings.

See also: AWS API Documentation

Request Syntax

client.reset_notification_settings(
    trustAnchorId='string',
    notificationSettingKeys=[
        {
            'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
            'channel': 'ALL'
        },
    ]
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

type notificationSettingKeys:

list

param notificationSettingKeys:

[REQUIRED]

A list of notification setting keys to reset. A notification setting key includes the event and the channel.

• (dict) --

  A notification setting key to reset. A notification setting key includes the event and the channel.

  • event (string) -- [REQUIRED]

    The notification setting event to reset.

  • channel (string) --

    The specified channel of notification.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ]
    }
}

Response Structure

• (dict) --

  • trustAnchor (dict) --

    The state of the trust anchor after a read or write operation.

    • trustAnchorId (string) --

      The unique identifier of the trust anchor.

    • trustAnchorArn (string) --

      The ARN of the trust anchor.

    • name (string) --

      The name of the trust anchor.

    • source (dict) --

      The trust anchor type and its related certificate data.

      • sourceType (string) --

        The type of the trust anchor.

      • sourceData (dict) --

        The data field of the trust anchor depending on its type.

        • x509CertificateData (string) --

          The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • acmPcaArn (string) --

          The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

    • enabled (boolean) --

      Indicates whether the trust anchor is enabled.

    • crlDpRevocationEnabled (boolean) --

      Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

    • createdAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was created.

    • updatedAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was last updated.

    • notificationSettings (list) --

      A list of notification settings to be associated to the trust anchor.

      • (dict) --

        The state of a notification setting.

        A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

        • enabled (boolean) --

          Indicates whether the notification setting is enabled.

        • event (string) --

          The event to which this notification setting is applied.

        • threshold (integer) --

          The number of days before a notification event.

        • channel (string) --

          The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

        • configuredBy (string) --

          The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.

{'crlDpRevocationEnabled': 'boolean'}

{'trustAnchor': {'crlDpRevocationEnabled': 'boolean'}}

Updates a trust anchor. You establish trust between IAM Roles Anywhere and your certificate authority (CA) by configuring a trust anchor. You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials.

Required permissions: rolesanywhere:UpdateTrustAnchor.

See also: AWS API Documentation

Request Syntax

client.update_trust_anchor(
    trustAnchorId='string',
    name='string',
    source={
        'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
        'sourceData': {
            'x509CertificateData': 'string',
            'acmPcaArn': 'string'
        }
    },
    crlDpRevocationEnabled=True|False
)

type trustAnchorId:

string

param trustAnchorId:

[REQUIRED]

The unique identifier of the trust anchor.

type name:

string

param name:

The name of the trust anchor.

type source:

dict

param source:

The trust anchor type and its related certificate data.

• sourceType (string) --

  The type of the trust anchor.

• sourceData (dict) --

  The data field of the trust anchor depending on its type.

  • x509CertificateData (string) --

    The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

  • acmPcaArn (string) --

    The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

type crlDpRevocationEnabled:

boolean

param crlDpRevocationEnabled:

Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

rtype:

dict

returns:

Response Syntax

{
    'trustAnchor': {
        'trustAnchorId': 'string',
        'trustAnchorArn': 'string',
        'name': 'string',
        'source': {
            'sourceType': 'AWS_ACM_PCA'|'CERTIFICATE_BUNDLE'|'SELF_SIGNED_REPOSITORY',
            'sourceData': {
                'x509CertificateData': 'string',
                'acmPcaArn': 'string'
            }
        },
        'enabled': True|False,
        'crlDpRevocationEnabled': True|False,
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1),
        'notificationSettings': [
            {
                'enabled': True|False,
                'event': 'CA_CERTIFICATE_EXPIRY'|'END_ENTITY_CERTIFICATE_EXPIRY',
                'threshold': 123,
                'channel': 'ALL',
                'configuredBy': 'string'
            },
        ]
    }
}

Response Structure

• (dict) --

  • trustAnchor (dict) --

    The state of the trust anchor after a read or write operation.

    • trustAnchorId (string) --

      The unique identifier of the trust anchor.

    • trustAnchorArn (string) --

      The ARN of the trust anchor.

    • name (string) --

      The name of the trust anchor.

    • source (dict) --

      The trust anchor type and its related certificate data.

      • sourceType (string) --

        The type of the trust anchor.

      • sourceData (dict) --

        The data field of the trust anchor depending on its type.

        • x509CertificateData (string) --

          The PEM-encoded data for the certificate anchor. Included for trust anchors of type CERTIFICATE_BUNDLE.

        • acmPcaArn (string) --

          The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type AWS_ACM_PCA.

    • enabled (boolean) --

      Indicates whether the trust anchor is enabled.

    • crlDpRevocationEnabled (boolean) --

      Specifies whether the trust anchor checks certificate revocation status against CRL distribution points.

    • createdAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was created.

    • updatedAt (datetime) --

      The ISO-8601 timestamp when the trust anchor was last updated.

    • notificationSettings (list) --

      A list of notification settings to be associated to the trust anchor.

      • (dict) --

        The state of a notification setting.

        A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

        • enabled (boolean) --

          Indicates whether the notification setting is enabled.

        • event (string) --

          The event to which this notification setting is applied.

        • threshold (integer) --

          The number of days before a notification event.

        • channel (string) --

          The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event.

        • configuredBy (string) --

          The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is rolesanywhere.amazonaws.com, and for customized notifications settings, it is the respective account ID.