2026/09/22 - CloudWatch Omni - 61 new api methods
Changes Amazon CloudWatch Omni is now generally available, an AI-powered unified observability for AI agents, applications, and infrastructure. As part of it, organization centralization rules now support cross-account context graph centralization.
Starts a telemetry query within a session.
Submits the provided query string for execution in the specified session. Use GetTelemetryQueryResults to poll for results and check query status.
See also: AWS API Documentation
Request Syntax
client.start_telemetry_query(
queryString='string',
sessionId='string'
)
string
[REQUIRED]
The query string to execute.
string
[REQUIRED]
The unique ID of the session.
dict
Response Syntax
{
'queryId': 'string',
'sessionId': 'string'
}
Response Structure
(dict) --
queryId (string) --
The unique ID of the query.
sessionId (string) --
The unique ID of the session.
Updates an organization domain's name or identity provider configuration. Call this operation in the Region where the domain was created.
Only the provided fields are changed; omitted fields are left unchanged. Renaming a domain also changes the endpoint URLs derived from its name.
See also: AWS API Documentation
Request Syntax
client.update_domain_for_organization(
domainId='string',
name='string',
identityProviders=[
'IAM'|'IDC',
],
identityProviderConfiguration={
'identityCenterConfiguration': {
'identityCenterInstanceArn': 'string'
}
}
)
string
[REQUIRED]
The ID of the organization domain to update.
string
A new name for the organization domain. Omit to leave unchanged. Must be 3-63 characters: lowercase letters, numbers, and hyphens. It must begin and end with a letter or number and cannot contain consecutive hyphens.
list
The identity providers to configure for the domain. Omit to leave unchanged.
(string) --
Identity provider type for a domain. Determines which identity mechanisms are active for authentication.
dict
Identity provider configuration for the domain. Omit to leave unchanged.
identityCenterConfiguration (dict) --
Identity Center configuration. Required when identityProviders includes IDC.
identityCenterInstanceArn (string) --
Identity Center instance ARN
dict
Response Syntax
{
'organizationDomain': {
'domainId': 'string',
'domainArn': 'string',
'name': 'string',
'domainEndpointUrl': 'string',
'customEndpointUrls': [
'string',
],
'organizationId': 'string',
'ownerAccountId': 'string',
'identityProviders': [
'IAM'|'IDC',
],
'identityProviderConfiguration': {
'identityCenterConfiguration': {
'identityCenterInstanceArn': 'string'
}
},
'identityCenterApplicationArn': 'string',
'region': 'string',
'status': 'ACTIVE',
'domainAccessRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
organizationDomain (dict) --
The details of the updated organization domain.
domainId (string) --
The unique ID of the organization domain.
domainArn (string) --
The Amazon Resource Name (ARN) of the organization domain.
name (string) --
A name that identifies the organization domain.
domainEndpointUrl (string) --
The HTTPS endpoint URL for accessing the organization domain.
customEndpointUrls (list) --
Additional endpoint URLs derived from the domain name.
(string) --
organizationId (string) --
The ID of the AWS Organization that owns the domain.
ownerAccountId (string) --
The AWS account ID that owns the organization domain.
identityProviders (list) --
The identity providers configured for the organization domain.
(string) --
Identity provider type for a domain. Determines which identity mechanisms are active for authentication.
identityProviderConfiguration (dict) --
Identity provider configuration for the organization domain.
identityCenterConfiguration (dict) --
Identity Center configuration. Required when identityProviders includes IDC.
identityCenterInstanceArn (string) --
Identity Center instance ARN
identityCenterApplicationArn (string) --
The ARN of the Identity Center application. Absent for IAM-only domains.
region (string) --
The Region where this organization domain was created.
status (string) --
Current status of the organization domain.
domainAccessRoleArn (string) --
The ARN of the customer-provided IAM role in the management account used for domain access.
createdAt (datetime) --
The timestamp when the organization domain was created.
updatedAt (datetime) --
The timestamp when the organization domain was last updated.
Returns the spaces in the account, optionally filtered by domain.
See also: AWS API Documentation
Request Syntax
client.list_spaces(
domainId='string',
nextToken='string',
maxResults=123
)
string
Filter by domain ID.
string
A token to retrieve the next page of results. Supply the same filters used on the request that returned it. Tokens expire after 24 hours.
integer
The maximum number of spaces to return per page. Defaults to 100. A page can contain fewer results than this value even when more results remain; continue while nextToken is present.
dict
Response Syntax
{
'items': [
{
'spaceId': 'string',
'name': 'string',
'spaceArn': 'string',
'domainArn': 'string',
'region': 'string',
'ownerAccountId': 'string',
'status': 'ACTIVE'|'SUSPENDED'|'MOVING',
'statusReason': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
items (list) --
The list of space summaries.
(dict) --
Summary of a space. Call GetSpace for the full space.
spaceId (string) --
The unique ID of the space.
name (string) --
A name that identifies the space.
spaceArn (string) --
The Amazon Resource Name (ARN) of the space.
domainArn (string) --
The Amazon Resource Name (ARN) of the domain the space belongs to. Absent when the space is not associated with a domain, so callers must tolerate its absence.
region (string) --
The region where this space was created.
ownerAccountId (string) --
AWS account ID that owns this space.
status (string) --
The status of the space.
statusReason (string) --
Reason for the current space status.
createdAt (datetime) --
The timestamp when the space was created.
updatedAt (datetime) --
The timestamp when the space was last updated.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Returns the spaces across all member accounts in the organization.
See also: AWS API Documentation
Request Syntax
client.list_spaces_for_organization(
nextToken='string',
maxResults=123
)
string
A token to retrieve the next page of results. Tokens expire after 24 hours.
integer
The maximum number of spaces to return per page. Defaults to 100.
dict
Response Syntax
{
'items': [
{
'spaceId': 'string',
'name': 'string',
'spaceArn': 'string',
'domainArn': 'string',
'region': 'string',
'ownerAccountId': 'string',
'status': 'ACTIVE'|'SUSPENDED'|'MOVING',
'statusReason': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
items (list) --
The list of space summaries.
(dict) --
Summary of a space. Call GetSpace for the full space.
spaceId (string) --
The unique ID of the space.
name (string) --
A name that identifies the space.
spaceArn (string) --
The Amazon Resource Name (ARN) of the space.
domainArn (string) --
The Amazon Resource Name (ARN) of the domain the space belongs to. Absent when the space is not associated with a domain, so callers must tolerate its absence.
region (string) --
The region where this space was created.
ownerAccountId (string) --
AWS account ID that owns this space.
status (string) --
The status of the space.
statusReason (string) --
Reason for the current space status.
createdAt (datetime) --
The timestamp when the space was created.
updatedAt (datetime) --
The timestamp when the space was last updated.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Creates an AccessGrant that authorizes a principal to perform a set of actions on resources in a space.
Optionally narrow the grant with scoped actions that limit it to specific resources and fields. Use ListAccessGrants and GetAccessGrant to retrieve grants, and DeleteAccessGrant to remove them.
See also: AWS API Documentation
Request Syntax
client.create_access_grant(
domainId='string',
spaceId='string',
name='string',
principal={
'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT'|'ACCESS_PROFILE'|'ALERT'|'AGENT',
'principalId': 'string',
'principalAttributes': [
{
'key': 'string',
'value': 'string'
},
]
},
permission='SPACE_ADMIN'|'READ'|'READ_WRITE_DELETE'|'CUSTOM',
scopedActions=[
{
'actions': [
'string',
],
'resources': [
{
'resourceType': 'string',
'resourceArns': [
'string',
],
'tags': {
'string': 'string'
},
'signalTypes': [
'LOGS'|'TRACES',
],
'rowScopeGroups': [
[
{
'field': 'string',
'operator': 'IN',
'values': [
'string',
]
},
],
]
},
],
'contextConditions': {
'string': [
'string',
]
}
},
],
tags={
'string': 'string'
},
clientToken='string'
)
string
[REQUIRED]
The ID of the domain that contains the space.
string
[REQUIRED]
The ID of the space to scope the grant to.
string
[REQUIRED]
A name that identifies the access grant.
dict
[REQUIRED]
The principal receiving the grant.
principalType (string) -- [REQUIRED]
The type of principal receiving the grant.
principalId (string) --
The ID of the principal receiving the grant.
principalAttributes (list) --
Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.
(dict) --
A single attribute condition used to match principals for attribute-based access.
key (string) -- [REQUIRED]
The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.
value (string) -- [REQUIRED]
The attribute value.
string
[REQUIRED]
The permission to grant. Exactly one permission is granted per request.
list
Groups of actions to allow, each with the resource scopes and conditions that limit those actions.
(dict) --
A group of actions within an access grant, together with the resource scopes and context conditions that apply to exactly those actions.
actions (list) -- [REQUIRED]
The actions this group applies to.
(string) --
A single scoped action in "vendor-code:Action" form (e.g. "bedrock:InvokeModel"). Wildcards are not permitted.
resources (list) --
Optional resource scopes constraining these actions to specific resources.
(dict) --
A single resource scope entry within an AccessGrant. Associates a resource type with optional ARN patterns, tag conditions, and row-level filters.
resourceType (string) -- [REQUIRED]
Resource type name (e.g., "DataSet", "OmniDashboard").
resourceArns (list) --
Specific resource ARNs or ARN patterns. When set, actions are limited to these resources. When absent, defaults to "*".
(string) --
tags (dict) --
Tag-based conditions for dynamic resource scoping. Access applies only to resources carrying all of the specified tag key/value pairs.
(string) --
(string) --
signalTypes (list) --
Signal types this scope's row filtering applies to. Required when rowScopeGroups is set.
(string) --
Telemetry signal type that row-scoped access control applies to.
rowScopeGroups (list) --
Row-level filters for this scope, as an OR of AND-groups: a row is visible when it matches every filter in any one group. Requires signalTypes.
Row filters are additive across a principal's matching grants. A signal type with no matching group is unrestricted, and when rowScopeGroups is omitted all rows are visible for all signal types.
(list) --
A group of row filters that must all match. A row satisfies the group only when it matches every filter in it.
(dict) --
A single additive row-level filter on an AccessGrant. A row is visible when its value for the given field matches the filter's values. Row filters are additive: the visible rows are the union of all row filters across a principal's matching grants.
field (string) -- [REQUIRED]
The field (column) the allowlist applies to (e.g., "serviceName", "accountId").
operator (string) -- [REQUIRED]
Match operator applied to this filter's values.
values (list) -- [REQUIRED]
The values the field is matched against.
(string) --
A single allowlist value for a RowScope field.
contextConditions (dict) --
Optional context conditions for fine-grained access control on these actions.
(string) --
(list) --
Generic list of strings.
(string) --
dict
The tags to associate with the access grant.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
string
Idempotency token for safe retries. Repeated requests with the same token return the original result instead of creating a duplicate.
This field is autopopulated if not provided.
dict
Response Syntax
{
'accessGrant': {
'grantId': 'string',
'grantArn': 'string',
'name': 'string',
'accountId': 'string',
'domainId': 'string',
'principal': {
'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT'|'ACCESS_PROFILE'|'ALERT'|'AGENT',
'principalId': 'string',
'principalAttributes': [
{
'key': 'string',
'value': 'string'
},
]
},
'permission': 'SPACE_ADMIN'|'READ'|'READ_WRITE_DELETE'|'CUSTOM',
'grantType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED',
'createdBy': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'spaceId': 'string',
'scopedActions': [
{
'actions': [
'string',
],
'resources': [
{
'resourceType': 'string',
'resourceArns': [
'string',
],
'tags': {
'string': 'string'
},
'signalTypes': [
'LOGS'|'TRACES',
],
'rowScopeGroups': [
[
{
'field': 'string',
'operator': 'IN',
'values': [
'string',
]
},
],
]
},
],
'contextConditions': {
'string': [
'string',
]
}
},
]
}
}
Response Structure
(dict) --
accessGrant (dict) --
The details of the created access grant.
grantId (string) --
The unique ID of the access grant.
grantArn (string) --
The Amazon Resource Name (ARN) of the access grant.
name (string) --
A name that identifies the access grant.
accountId (string) --
The AWS account ID that owns the grant.
domainId (string) --
The ID of the domain the grant belongs to.
principal (dict) --
The principal receiving the grant.
principalType (string) --
The type of principal receiving the grant.
principalId (string) --
The ID of the principal receiving the grant.
principalAttributes (list) --
Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.
(dict) --
A single attribute condition used to match principals for attribute-based access.
key (string) --
The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.
value (string) --
The attribute value.
permission (string) --
The permission granted.
grantType (string) --
Who manages the grant.
createdBy (string) --
The principal that created the grant.
createdAt (datetime) --
The timestamp when the grant was created.
updatedAt (datetime) --
The timestamp when the grant was last updated.
spaceId (string) --
The space this grant applies to. Domain-scoped grants are returned by ListDomainAccessGrantsForOrganization instead.
scopedActions (list) --
Groups of actions allowed by the grant, each with the resource scopes and conditions that limit those actions.
(dict) --
A group of actions within an access grant, together with the resource scopes and context conditions that apply to exactly those actions.
actions (list) --
The actions this group applies to.
(string) --
A single scoped action in "vendor-code:Action" form (e.g. "bedrock:InvokeModel"). Wildcards are not permitted.
resources (list) --
Optional resource scopes constraining these actions to specific resources.
(dict) --
A single resource scope entry within an AccessGrant. Associates a resource type with optional ARN patterns, tag conditions, and row-level filters.
resourceType (string) --
Resource type name (e.g., "DataSet", "OmniDashboard").
resourceArns (list) --
Specific resource ARNs or ARN patterns. When set, actions are limited to these resources. When absent, defaults to "*".
(string) --
tags (dict) --
Tag-based conditions for dynamic resource scoping. Access applies only to resources carrying all of the specified tag key/value pairs.
(string) --
(string) --
signalTypes (list) --
Signal types this scope's row filtering applies to. Required when rowScopeGroups is set.
(string) --
Telemetry signal type that row-scoped access control applies to.
rowScopeGroups (list) --
Row-level filters for this scope, as an OR of AND-groups: a row is visible when it matches every filter in any one group. Requires signalTypes.
Row filters are additive across a principal's matching grants. A signal type with no matching group is unrestricted, and when rowScopeGroups is omitted all rows are visible for all signal types.
(list) --
A group of row filters that must all match. A row satisfies the group only when it matches every filter in it.
(dict) --
A single additive row-level filter on an AccessGrant. A row is visible when its value for the given field matches the filter's values. Row filters are additive: the visible rows are the union of all row filters across a principal's matching grants.
field (string) --
The field (column) the allowlist applies to (e.g., "serviceName", "accountId").
operator (string) --
Match operator applied to this filter's values.
values (list) --
The values the field is matched against.
(string) --
A single allowlist value for a RowScope field.
contextConditions (dict) --
Optional context conditions for fine-grained access control on these actions.
(string) --
(list) --
Generic list of strings.
(string) --
Returns the access profiles in a space.
See also: AWS API Documentation
Request Syntax
client.list_access_profiles(
spaceId='string',
nextToken='string',
maxResults=123
)
string
[REQUIRED]
The unique ID of the space.
string
A token to retrieve the next page of results.
integer
The maximum number of access profiles to return per page. Defaults to 100.
dict
Response Syntax
{
'items': [
{
'profileId': 'string',
'arn': 'string',
'name': 'string',
'description': 'string',
'profileType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
items (list) --
The list of access profile summaries.
(dict) --
Summary of an access profile. Call GetAccessProfile for the full profile.
profileId (string) --
The unique ID of the access profile.
arn (string) --
The ARN of this access profile.
name (string) --
A name that identifies the access profile.
description (string) --
An optional description of the access profile.
profileType (string) --
Who manages the access profile.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Removes a domain and all of its resources. Call this operation in the Region where the domain was created.
A domain cannot be deleted while it contains spaces.
See also: AWS API Documentation
Request Syntax
client.delete_domain(
domainId='string'
)
string
[REQUIRED]
The unique ID of the domain to delete.
dict
Response Syntax
{}
Response Structure
(dict) --
Creates an access profile in a space.
Use GetAccessProfile and ListAccessProfiles to retrieve profiles, and UpdateAccessProfile to modify one.
See also: AWS API Documentation
Request Syntax
client.create_access_profile(
spaceId='string',
name='string',
description='string',
tags={
'string': 'string'
},
clientToken='string'
)
string
[REQUIRED]
The unique ID of the space to create the profile in.
string
[REQUIRED]
A name that identifies the access profile.
string
An optional description of the access profile.
dict
The tags to associate with the access profile.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
string
Idempotency token for safe retries. Repeated requests with the same token return the original result instead of creating a duplicate.
This field is autopopulated if not provided.
dict
Response Syntax
{
'accessProfile': {
'profileId': 'string',
'spaceId': 'string',
'arn': 'string',
'name': 'string',
'description': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'assumeStatus': 'ALLOWED'|'DENIED',
'profileType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED'
}
}
Response Structure
(dict) --
accessProfile (dict) --
The access profile.
profileId (string) --
The unique ID of the access profile.
spaceId (string) --
The ID of the space the profile belongs to.
arn (string) --
The ARN of this access profile.
name (string) --
A name that identifies the access profile.
description (string) --
An optional description of the access profile.
createdAt (datetime) --
The timestamp when the access profile was created.
updatedAt (datetime) --
The timestamp when the access profile was last updated.
assumeStatus (string) --
The calling principal's authorization to assume this access profile.
profileType (string) --
Who manages the access profile.
Creates an organization-scoped domain for the caller's AWS Organization. Only the organization's management account can call this operation.
See also: AWS API Documentation
Request Syntax
client.create_domain_for_organization(
name='string',
identityProviders=[
'IAM'|'IDC',
],
identityProviderConfiguration={
'identityCenterConfiguration': {
'identityCenterInstanceArn': 'string'
}
},
domainAccessRoleArn='string',
tags={
'string': 'string'
},
clientToken='string'
)
string
[REQUIRED]
A name that identifies the organization domain. Must be 3-63 characters: lowercase letters, numbers, and hyphens. It must begin and end with a letter or number and cannot contain consecutive hyphens.
list
[REQUIRED]
The identity providers to configure for the domain.
(string) --
Identity provider type for a domain. Determines which identity mechanisms are active for authentication.
dict
Identity provider configuration for the domain.
identityCenterConfiguration (dict) --
Identity Center configuration. Required when identityProviders includes IDC.
identityCenterInstanceArn (string) --
Identity Center instance ARN
string
[REQUIRED]
The ARN of an IAM role in the management account used for domain access. You must create this role, and its trust policy must allow the service principal to assume it.
dict
The tags to associate with the domain.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
string
Idempotency token for safe retries. Repeated requests with the same token return the original result instead of creating a duplicate.
This field is autopopulated if not provided.
dict
Response Syntax
{
'organizationDomain': {
'domainId': 'string',
'domainArn': 'string',
'name': 'string',
'domainEndpointUrl': 'string',
'customEndpointUrls': [
'string',
],
'organizationId': 'string',
'ownerAccountId': 'string',
'identityProviders': [
'IAM'|'IDC',
],
'identityProviderConfiguration': {
'identityCenterConfiguration': {
'identityCenterInstanceArn': 'string'
}
},
'identityCenterApplicationArn': 'string',
'region': 'string',
'status': 'ACTIVE',
'domainAccessRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
organizationDomain (dict) --
The details of the created organization domain.
domainId (string) --
The unique ID of the organization domain.
domainArn (string) --
The Amazon Resource Name (ARN) of the organization domain.
name (string) --
A name that identifies the organization domain.
domainEndpointUrl (string) --
The HTTPS endpoint URL for accessing the organization domain.
customEndpointUrls (list) --
Additional endpoint URLs derived from the domain name.
(string) --
organizationId (string) --
The ID of the AWS Organization that owns the domain.
ownerAccountId (string) --
The AWS account ID that owns the organization domain.
identityProviders (list) --
The identity providers configured for the organization domain.
(string) --
Identity provider type for a domain. Determines which identity mechanisms are active for authentication.
identityProviderConfiguration (dict) --
Identity provider configuration for the organization domain.
identityCenterConfiguration (dict) --
Identity Center configuration. Required when identityProviders includes IDC.
identityCenterInstanceArn (string) --
Identity Center instance ARN
identityCenterApplicationArn (string) --
The ARN of the Identity Center application. Absent for IAM-only domains.
region (string) --
The Region where this organization domain was created.
status (string) --
Current status of the organization domain.
domainAccessRoleArn (string) --
The ARN of the customer-provided IAM role in the management account used for domain access.
createdAt (datetime) --
The timestamp when the organization domain was created.
updatedAt (datetime) --
The timestamp when the organization domain was last updated.
Returns the results for the specified query.
See also: AWS API Documentation
Request Syntax
client.get_telemetry_query_results(
queryId='string',
nextToken='string',
maxResults=123
)
string
[REQUIRED]
The unique ID of the query.
string
A token to retrieve the next page of results.
integer
The maximum number of result rows to return per page.
dict
Response Syntax
{
'status': 'Running'|'Failed'|'Complete'|'Cancelled',
'rows': [
{
'string': 'string'
},
],
'nextToken': 'string',
'statistics': {
'bytesScanned': 123.0,
'percentComplete': 123,
'recordsScanned': 123,
'recordsMatched': 123,
'partialResults': {
'partialResultsDetected': True|False
}
}
}
Response Structure
(dict) --
status (string) --
The current execution status of the query.
rows (list) --
The result rows returned by the query.
(dict) --
(string) --
(string) --
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
statistics (dict) --
Statistics about the query execution.
bytesScanned (float) --
The number of bytes scanned by the query.
percentComplete (integer) --
The percentage of the query that has completed.
recordsScanned (integer) --
The total number of records scanned.
recordsMatched (integer) --
The number of records that matched the query criteria.
partialResults (dict) --
Information about whether the query returned partial results.
partialResultsDetected (boolean) --
True when the query returned partial results (some data could not be read).
Creates a space in a domain.
Use GetSpace to retrieve the space, ListSpaces to enumerate spaces, UpdateSpace to modify it, and DeleteSpace to remove it.
See also: AWS API Documentation
Request Syntax
client.create_space(
name='string',
domainId='string',
dataAccessRoleArn='string',
agentCoreEvaluationRoleArn='string',
encryptionConfiguration={
'encryptionStrategy': 'AWS_OWNED'|'CUSTOMER_MANAGED',
'kmsKeyArn': 'string'
},
tags={
'string': 'string'
},
clientToken='string'
)
string
[REQUIRED]
A name that identifies the space. Must be 3-64 characters: lowercase letters, numbers, and hyphens. It must begin and end with a letter or number and cannot contain consecutive hyphens.
string
[REQUIRED]
The ID of the domain to create the space in.
string
[REQUIRED]
The ARN of the IAM role used for data access. The role must be in the caller's account.
string
The ARN of the IAM role used by AgentCore online evaluation. Must be in the caller's account. Omit if the space does not use AgentCore online evaluation.
dict
How to encrypt the space's data at rest. Omit for service owned encryption, which is equivalent to passing encryptionStrategy AWS_OWNED.
encryptionStrategy (string) -- [REQUIRED]
Which kind of key to use. Required.
kmsKeyArn (string) --
Customer managed KMS key ARN. Required when encryptionStrategy is CUSTOMER_MANAGED, and must be omitted when it is AWS_OWNED. Must be a symmetric ENCRYPT_DECRYPT key in the caller's account and region.
dict
The tags to associate with the space.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
string
Idempotency token for safe retries. Repeated requests with the same token return the original result instead of creating a duplicate.
This field is autopopulated if not provided.
dict
Response Syntax
{
'space': {
'spaceId': 'string',
'name': 'string',
'spaceArn': 'string',
'domainArn': 'string',
'region': 'string',
'ownerAccountId': 'string',
'dataAccessRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'agentCoreEvaluationRoleArn': 'string',
'status': 'ACTIVE'|'SUSPENDED'|'MOVING',
'statusReason': 'string',
'encryptionConfiguration': {
'encryptionStrategy': 'AWS_OWNED'|'CUSTOMER_MANAGED',
'kmsKeyArn': 'string'
}
}
}
Response Structure
(dict) --
space (dict) --
The details of the created space.
spaceId (string) --
The unique ID of the space.
name (string) --
A name that identifies the space.
spaceArn (string) --
The Amazon Resource Name (ARN) of the space.
domainArn (string) --
The Amazon Resource Name (ARN) of the domain the space belongs to. Absent when the space is not associated with a domain, so callers must tolerate its absence.
region (string) --
The region where this space was created.
ownerAccountId (string) --
AWS account ID that owns this space.
dataAccessRoleArn (string) --
The ARN of the IAM role used for data access.
createdAt (datetime) --
The timestamp when the space was created.
updatedAt (datetime) --
The timestamp when the space was last updated.
agentCoreEvaluationRoleArn (string) --
The ARN of the IAM role used by AgentCore online evaluation. Absent when the space was created without one.
status (string) --
The status of the space.
statusReason (string) --
Reason for the current space status.
encryptionConfiguration (dict) --
How the space's data at rest is encrypted. Always populated: a space with no customer managed key reports encryptionStrategy AWS_OWNED and no kmsKeyArn.
encryptionStrategy (string) --
Which kind of key to use. Required.
kmsKeyArn (string) --
Customer managed KMS key ARN. Required when encryptionStrategy is CUSTOMER_MANAGED, and must be omitted when it is AWS_OWNED. Must be a symmetric ENCRYPT_DECRYPT key in the caller's account and region.
Creates or updates the intelligence configuration for the calling account. Account is identified via FAS (caller identity).
See also: AWS API Documentation
Request Syntax
client.put_intelligence_configuration(
kmsKeyArn='string',
removeKmsKey=True|False,
clientToken='string'
)
string
Optional KMS key ARN to configure customer-managed encryption for anomaly data.
boolean
Set to true to disassociate the configured KMS key. Mutually exclusive with kmsKeyArn; the service returns ValidationException if both are provided.
string
Idempotency token for safe retries. Repeating a request with the same token applies the update at most once instead of reprocessing it.
This field is autopopulated if not provided.
dict
Response Syntax
{
'accountId': 'string',
'kmsKeyArn': 'string',
'updatedAt': datetime(2015, 1, 1),
'createdAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
The intelligence configuration for the calling account after the update.
accountId (string) --
The AWS account ID this configuration applies to.
kmsKeyArn (string) --
The currently active KMS key ARN for customer-managed encryption, if configured.
updatedAt (datetime) --
ISO-8601 timestamp of the last update.
createdAt (datetime) --
ISO-8601 timestamp of initial creation.
Lists telemetry query sessions.
Returns a list of telemetry query sessions owned by the caller.
See also: AWS API Documentation
Request Syntax
client.list_telemetry_query_sessions(
nextToken='string',
maxResults=123
)
string
A token to retrieve the next page of results.
integer
The maximum number of sessions to return per page.
dict
Response Syntax
{
'sessions': [
{
'sessionId': 'string',
'createdAt': datetime(2015, 1, 1),
'lastActivityAt': datetime(2015, 1, 1),
'sessionName': 'string'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
sessions (list) --
The list of session summaries.
(dict) --
Summary information about a query session, including its identifier, name, and activity timestamps.
sessionId (string) --
The unique ID of the session.
createdAt (datetime) --
The timestamp when the session was created.
lastActivityAt (datetime) --
The timestamp of the most recent activity in the session.
sessionName (string) --
The human-readable name of the session. Names under /aws/ are reserved for service integrations.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Deletes the specified view.
Queries that reference the view fail after it is deleted. Managed views cannot be deleted.
See also: AWS API Documentation
Request Syntax
client.delete_view(
name='string'
)
string
[REQUIRED]
The name of the view to delete.
dict
Response Syntax
{}
Response Structure
(dict) --
Updates a domain's name or identity provider configuration.
Only the provided fields are changed; omitted fields are left unchanged. Renaming a domain also changes the endpoint URLs derived from its name.
See also: AWS API Documentation
Request Syntax
client.update_domain(
domainId='string',
name='string',
identityProviders=[
'IAM'|'IDC',
],
identityProviderConfiguration={
'identityCenterConfiguration': {
'identityCenterInstanceArn': 'string'
}
}
)
string
[REQUIRED]
The unique ID of the domain to update.
string
A new name for the domain. Omit to leave unchanged. Must be 3-63 characters: lowercase letters, numbers, and hyphens. It must begin and end with a letter or number and cannot contain consecutive hyphens.
list
The identity providers to configure for the domain.
(string) --
Identity provider type for a domain. Determines which identity mechanisms are active for authentication.
dict
Identity provider configuration for the domain.
identityCenterConfiguration (dict) --
Identity Center configuration. Required when identityProviders includes IDC.
identityCenterInstanceArn (string) --
Identity Center instance ARN
dict
Response Syntax
{
'domain': {
'domainId': 'string',
'domainArn': 'string',
'name': 'string',
'identityProviders': [
'IAM'|'IDC',
],
'identityProviderConfiguration': {
'identityCenterConfiguration': {
'identityCenterInstanceArn': 'string'
}
},
'domainEndpointUrl': 'string',
'customEndpointUrls': [
'string',
],
'identityCenterApplicationArn': 'string',
'region': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'status': 'ACTIVE'
}
}
Response Structure
(dict) --
domain (dict) --
The details of the updated domain.
domainId (string) --
The unique ID of the domain.
domainArn (string) --
The Amazon Resource Name (ARN) of the domain.
name (string) --
A name that identifies the domain.
identityProviders (list) --
The identity providers configured for the domain.
(string) --
Identity provider type for a domain. Determines which identity mechanisms are active for authentication.
identityProviderConfiguration (dict) --
Identity provider configuration for the domain.
identityCenterConfiguration (dict) --
Identity Center configuration. Required when identityProviders includes IDC.
identityCenterInstanceArn (string) --
Identity Center instance ARN
domainEndpointUrl (string) --
The HTTPS endpoint URL for accessing the domain.
customEndpointUrls (list) --
Additional endpoint URLs derived from the domain name.
(string) --
identityCenterApplicationArn (string) --
The ARN of the Identity Center application. Absent for IAM-only domains.
region (string) --
The Region where this domain was created.
createdAt (datetime) --
The timestamp when the domain was created.
updatedAt (datetime) --
The timestamp when the domain was last updated.
status (string) --
Current status of the domain.
Lists the views in the caller's account and region.
Returns a summary for each view, optionally filtered by view type. View definitions are not included — use GetView to retrieve them.
See also: AWS API Documentation
Request Syntax
client.list_views(
type='USER'|'MANAGED',
maxResults=123,
nextToken='string'
)
string
Return only views of this ownership category.
integer
The maximum number of views to return per page.
string
A token to retrieve the next page of results.
dict
Response Syntax
{
'items': [
{
'name': 'string',
'type': 'USER'|'MANAGED',
'description': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
items (list) --
The list of view summaries.
(dict) --
Summary information about a view. Does not include the view definition.
name (string) --
The name of the view.
type (string) --
The ownership category of the view.
description (string) --
The description of the view.
createdAt (datetime) --
The timestamp when the view was created.
updatedAt (datetime) --
The timestamp when the view was last updated.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Retrieves an access profile by ID.
The response indicates whether the calling principal is currently allowed to assume the profile.
See also: AWS API Documentation
Request Syntax
client.get_access_profile(
spaceId='string',
profileId='string'
)
string
[REQUIRED]
The unique ID of the space.
string
[REQUIRED]
The unique ID of the access profile.
dict
Response Syntax
{
'accessProfile': {
'profileId': 'string',
'spaceId': 'string',
'arn': 'string',
'name': 'string',
'description': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'assumeStatus': 'ALLOWED'|'DENIED',
'profileType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED'
}
}
Response Structure
(dict) --
accessProfile (dict) --
The access profile.
profileId (string) --
The unique ID of the access profile.
spaceId (string) --
The ID of the space the profile belongs to.
arn (string) --
The ARN of this access profile.
name (string) --
A name that identifies the access profile.
description (string) --
An optional description of the access profile.
createdAt (datetime) --
The timestamp when the access profile was created.
updatedAt (datetime) --
The timestamp when the access profile was last updated.
assumeStatus (string) --
The calling principal's authorization to assume this access profile.
profileType (string) --
Who manages the access profile.
Removes an organization domain and all of its resources. Call this operation in the Region where the domain was created.
A domain cannot be deleted while it contains spaces.
See also: AWS API Documentation
Request Syntax
client.delete_domain_for_organization(
domainId='string'
)
string
[REQUIRED]
The ID of the organization domain to delete.
dict
Response Syntax
{}
Response Structure
(dict) --
Queries the context graph with filtering, traversal, and pagination support.
Pagination note: nodes and edges are returned together as a coherent subgraph. Pagination cursors advance over nodes (the primary collection); each page includes all edges connecting nodes within that page. Callers should treat nodes as the paginated collection and edges as supplementary relationship data attached to those nodes.
See also: AWS API Documentation
Request Syntax
client.get_context_graph(
nodeFilters={
'nodeId': 'string',
'nodeType': 'SERVICE'|'RESOURCE'|'REMOTE_SERVICE',
'name': 'string',
'tags': [
{
'key': 'string',
'values': [
'string',
]
},
],
'telemetryAttributes': [
{
'key': 'string',
'values': [
'string',
]
},
],
'region': [
'string',
],
'cloudProvider': [
'string',
],
'sourceAccountId': [
'string',
],
'namespace': [
'string',
],
'category': [
'GEN_AI_AGENT'|'GEN_AI_MODEL'|'DATABASE'|'MESSAGING_QUEUE'|'COMPUTE'|'STORAGE'|'NETWORK',
],
'stage': [
'string',
],
'sources': [
'VPC_FLOW_LOG'|'CLOUDTRAIL'|'IAM_POLICY'|'CODE_SEMANTICS'|'TELEMETRY'|'AZURE_VNET_FLOW_LOG'|'ELB_ACCESS_LOG'|'CLOUDFRONT_ACCESS_LOG'|'S3_ACCESS_LOG'|'WAF_ACCESS_LOG'|'AWS_INTEGRATION'|'CONFIG',
]
},
edgeFilters={
'edgeId': 'string',
'from': 'string',
'to': 'string',
'edgeType': 'CALLS'|'ACCESSES'|'RUNS_ON',
'operations': [
'string',
],
'telemetryAttributes': [
{
'key': 'string',
'values': [
'string',
]
},
],
'sources': [
'VPC_FLOW_LOG'|'CLOUDTRAIL'|'IAM_POLICY'|'CODE_SEMANTICS'|'TELEMETRY'|'AZURE_VNET_FLOW_LOG'|'ELB_ACCESS_LOG'|'CLOUDFRONT_ACCESS_LOG'|'S3_ACCESS_LOG'|'WAF_ACCESS_LOG'|'AWS_INTEGRATION'|'CONFIG',
]
},
startTime=datetime(2015, 1, 1),
endTime=datetime(2015, 1, 1),
depth=123,
maxResults=123,
maxEdgesPerNode=123,
includeMetadata=True|False,
nextToken='string'
)
dict
Criteria restricting which nodes are returned.
nodeId (string) --
Match only the node with this identifier.
nodeType (string) --
Match only nodes of this type.
name (string) --
Match only nodes with this name.
tags (list) --
Match nodes by the tags on the underlying resource.
(dict) --
Key-value filter used for tags and attributes filtering. Multiple KeyFilters are AND'ed. Multiple values within a single KeyFilter are OR'ed. Values support pattern syntax: exact, negation (!value), wildcard (value, value*, *value).
key (string) -- [REQUIRED]
The tag or attribute key to filter on.
values (list) --
The values to match for this key, OR'ed together. Each supports exact, negation (!value), and wildcard (value, value*, *value) syntax.
(string) --
Key filter value string.
telemetryAttributes (list) --
Match nodes by their OpenTelemetry (OTel) telemetry attributes.
(dict) --
Key-value filter used for tags and attributes filtering. Multiple KeyFilters are AND'ed. Multiple values within a single KeyFilter are OR'ed. Values support pattern syntax: exact, negation (!value), wildcard (value, value*, *value).
key (string) -- [REQUIRED]
The tag or attribute key to filter on.
values (list) --
The values to match for this key, OR'ed together. Each supports exact, negation (!value), and wildcard (value, value*, *value) syntax.
(string) --
Key filter value string.
region (list) --
Match nodes in any of these regions.
(string) --
cloudProvider (list) --
Match nodes on any of these cloud providers.
(string) --
sourceAccountId (list) --
Match nodes discovered from telemetry produced by any of these accounts.
(string) --
namespace (list) --
Match nodes in any of these logical service groupings.
(string) --
category (list) --
Match nodes of any of these categories.
(string) --
Coarse classification of what a node is. Orthogonal to NodeType, which says whether the node is a service, a resource, or a remote service. Absent on most nodes today because few producers emit the source attribute.
stage (list) --
Match nodes observed in any of these deployment environments.
(string) --
sources (list) --
Match nodes contributed by any of these discovery sources.
(string) --
Data source enum for context graph queries.
dict
Criteria restricting which edges are returned.
edgeId (string) --
Match only the edge with this identifier.
from (string) --
Match only edges originating from this node identifier.
to (string) --
Match only edges pointing to this node identifier.
edgeType (string) --
Match only edges of this relationship kind.
operations (list) --
Match edges carrying any of these operations.
(string) --
telemetryAttributes (list) --
Match edges by their OpenTelemetry (OTel) telemetry attributes. Not yet enforced: currently accepted but ignored (does not filter), matching nodeFilters.telemetryAttributes.
(dict) --
Key-value filter used for tags and attributes filtering. Multiple KeyFilters are AND'ed. Multiple values within a single KeyFilter are OR'ed. Values support pattern syntax: exact, negation (!value), wildcard (value, value*, *value).
key (string) -- [REQUIRED]
The tag or attribute key to filter on.
values (list) --
The values to match for this key, OR'ed together. Each supports exact, negation (!value), and wildcard (value, value*, *value) syntax.
(string) --
Key filter value string.
sources (list) --
Match edges contributed by any of these discovery sources.
(string) --
Data source enum for context graph queries.
datetime
[REQUIRED]
Start of the time range (UTC), inclusive.
datetime
[REQUIRED]
End of the time range (UTC), inclusive.
integer
How many hops to traverse out from the nodes matched by nodeFilters. 0 returns only the matched nodes themselves.
integer
The maximum number of nodes to return in a single page.
integer
The maximum number of edges to return per node, bounding the fan-out of a densely connected node.
boolean
Whether to return the metadata block, semantics included, on each node and edge. Off by default because it costs an extra lookup per returned node.
string
Pagination token from a previous response, to retrieve the next page.
dict
Response Syntax
{
'nodes': [
{
'nodeId': 'string',
'nodeType': 'SERVICE'|'RESOURCE'|'REMOTE_SERVICE',
'name': 'string',
'alternateNames': [
'string',
],
'tags': {
'string': 'string'
},
'nodeProperties': {
'region': 'string',
'cloudProvider': 'string',
'sourceAccountId': 'string',
'namespace': 'string',
'category': 'GEN_AI_AGENT'|'GEN_AI_MODEL'|'DATABASE'|'MESSAGING_QUEUE'|'COMPUTE'|'STORAGE'|'NETWORK',
'stage': 'string'
},
'telemetryAttributes': {
'string': 'string'
},
'operationDetails': {
'string': [
{
'string': 'string'
},
]
},
'signalTypes': [
'LOGS'|'METRICS'|'TRACES'|'CONFIG'|'UNKNOWN',
],
'sources': [
'VPC_FLOW_LOG'|'CLOUDTRAIL'|'IAM_POLICY'|'CODE_SEMANTICS'|'TELEMETRY'|'AZURE_VNET_FLOW_LOG'|'ELB_ACCESS_LOG'|'CLOUDFRONT_ACCESS_LOG'|'S3_ACCESS_LOG'|'WAF_ACCESS_LOG'|'AWS_INTEGRATION'|'CONFIG',
],
'metadata': {
'metrics': [
{
'name': 'string',
'namespace': 'string',
'preferredStat': 'string',
'metricType': 'string',
'attributes': {
'string': 'string'
},
'semantics': {
'description': 'string',
'unit': 'string'
}
},
],
'semantics': {
'purpose': 'string',
'language': 'string',
'framework': 'string',
'kind': 'string',
'repository': 'string'
},
'logs': [
{
'attributes': {
'string': 'string'
}
},
],
'traces': [
{
'attributes': {
'string': 'string'
}
},
]
},
'firstObservedAt': datetime(2015, 1, 1),
'lastObservedAt': datetime(2015, 1, 1),
'edges': [
{
'edgeId': 'string',
'from': 'string',
'to': 'string',
'edgeType': 'CALLS'|'ACCESSES'|'RUNS_ON',
'operations': [
'string',
],
'edgeProperties': {
'protocol': 'string',
'sourcePort': 'string',
'destinationPort': 'string',
'blocked': True|False,
'errorCode': 'string',
'httpStatusCode': 'string',
'httpMethod': 'string',
'serviceInitiated': True|False,
'trafficStats': {
'bytes': 123,
'packets': 123,
'flows': 123,
'sentBytes': 123,
'receivedBytes': 123
}
},
'telemetryAttributes': {
'string': 'string'
},
'signalTypes': [
'LOGS'|'METRICS'|'TRACES'|'CONFIG'|'UNKNOWN',
],
'sources': [
'VPC_FLOW_LOG'|'CLOUDTRAIL'|'IAM_POLICY'|'CODE_SEMANTICS'|'TELEMETRY'|'AZURE_VNET_FLOW_LOG'|'ELB_ACCESS_LOG'|'CLOUDFRONT_ACCESS_LOG'|'S3_ACCESS_LOG'|'WAF_ACCESS_LOG'|'AWS_INTEGRATION'|'CONFIG',
],
'metadata': {
'metrics': [
{
'name': 'string',
'namespace': 'string',
'preferredStat': 'string',
'metricType': 'string',
'attributes': {
'string': 'string'
},
'semantics': {
'description': 'string',
'unit': 'string'
}
},
],
'semantics': {
'purpose': 'string',
'language': 'string',
'framework': 'string',
'kind': 'string',
'repository': 'string'
},
'logs': [
{
'attributes': {
'string': 'string'
}
},
],
'traces': [
{
'attributes': {
'string': 'string'
}
},
]
},
'firstObservedAt': datetime(2015, 1, 1),
'lastObservedAt': datetime(2015, 1, 1)
},
]
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
The response containing the requested slice of the context graph.
nodes (list) --
The page of nodes matching the request. This is the paginated collection.
(dict) --
A node in the context graph representing a service, resource, or remote service.
nodeId (string) --
The unique identifier of the node within the context graph.
nodeType (string) --
Whether the node is a service, a resource, or a remote service.
name (string) --
The primary display name of the node.
alternateNames (list) --
Other names this node was observed under. A node that merged across sources reports one resolved name, and the names it was merged away from appear here.
(string) --
tags (dict) --
The tags observed on the underlying resource.
(string) --
(string) --
nodeProperties (dict) --
Identity attributes promoted out of the flat attribute map onto typed members.
region (string) --
The region the node runs in. Falls back to the region the telemetry was ingested from when the node does not report one.
cloudProvider (string) --
The cloud provider hosting the node, resolved from the reported provider, platform, or vendor namespace, and defaulting to "aws".
sourceAccountId (string) --
The account that produced the telemetry this node was discovered from.
namespace (string) --
The logical service grouping the node belongs to. This is not a metric namespace.
category (string) --
What kind of thing the node is, coarser than nodeType.
stage (string) --
The node's deployment environment. A node may be observed in several; this is the highest-precedence one. Match any of them with NodeFilters.stage.
telemetryAttributes (dict) --
The node's OpenTelemetry (OTel) attributes, as emitted by telemetry — the raw values, as opposed to the normalized nodeProperties. A key promoted onto a nodeProperties member is removed here, so no value appears twice.
(string) --
(string) --
operationDetails (dict) --
The operations observed on this node, keyed by operation name. Each value lists the dimension sets that identify the metric series for that operation.
(string) --
Operation name on a context graph node (typically OTel span.name).
(list) --
(dict) --
One OTel dimension set identifying a metric series for an operation.
(string) --
OTel dimension key on an operation identifier set (e.g. "http.request.method").
(string) --
OTel dimension value on an operation identifier set.
signalTypes (list) --
The kinds of telemetry signal observed on this node.
(string) --
Signal enum for context graph queries.
sources (list) --
The discovery sources that contributed this node.
(string) --
Data source enum for context graph queries.
metadata (dict) --
Descriptive metadata about the node. Present only when the request sets includeMetadata.
metrics (list) --
The metrics observed on the element.
(dict) --
A single metric observed on a context graph node.
name (string) --
The metric name as emitted, such as "Duration".
namespace (string) --
DEPRECATED: read attributes["service.namespace"] instead. Retained (deprecated) for backward compatibility with existing consumers; will be removed once they migrate. The logical service grouping the metric belongs to.
preferredStat (string) --
The statistic to chart or alarm on, such as "p99" or "Sum". Free-form and frequently absent.
metricType (string) --
OTel metric kind: "gauge", "sum", "histogram", "exponential_histogram", or "summary" (CloudWatch-vended metrics carry the same kinds). Absent when the producer did not report one.
attributes (dict) --
Per-metric qualifying attributes the console uses to query this metric's telemetry. These are the RAW, store-matching values keyed by their OTel names ("service.name", "service.namespace", "cloud.provider", "cloud.account.id", "cloud.region", "instrumentation_scope") — deliberately NOT the node's normalized/merged identity, so the query selectors match the emitted series. A merged node can carry different values per metric, which is why they live here rather than on the node.
(string) --
(string) --
semantics (dict) --
What the metric means and the unit it is reported in.
description (string) --
Human-readable description of what the metric measures.
unit (string) --
The unit the metric is reported in.
semantics (dict) --
Semantic description of the node. Absent on an edge, because semantics describe a service rather than a relationship.
purpose (string) --
What the service does.
language (string) --
The primary programming language the service is written in.
framework (string) --
The application framework the service is built on.
kind (string) --
The kind of workload the service is.
repository (string) --
The source repository the service is built from.
logs (list) --
Per-signal LOGS query selectors: a LIST of blocks the console ORs, each an AND of exact store column -> raw values. Node-level (edges carry only traces). Populated when the request sets includeMetadata; derived labels (logSourceType) are added by the service projection, not stored here.
(dict) --
One LOGS query selector block on a node. The attributes map's keys are AND'd; each selects with col = value. Deliberately RAW/un-normalized so the selector matches the store, not the node's merged identity.
attributes (dict) --
One LOGS query-selector block: EXACT store column -> raw SCALAR value (mirroring the scalar MetadataAttributeMap). Keyed by the store column that carries the value (e.g. resource.attributes['service.name'], attributes['aws.local.service'], @logGroupName) so the selector matches the emitted signal. A dimension seen under several values (a service under two namespaces, several log groups) becomes several blocks with the same columns and different values, which the console ORs. Dedicated to the LOGS selector so its cap evolves independently of the metric attribute map and the TRACES map. Selector caps are deliberately DISTINCT from the metric caps.
(string) --
(string) --
traces (list) --
Per-signal TRACES query selectors (same block shape as logs). Present on both node and edge metadata. serviceName is derived at the service projection, not stored here.
(dict) --
One TRACES query selector block on a node/edge (see LogMetadata).
attributes (dict) --
TRACES counterpart of LogMetadataAttributeMap — a dedicated per-signal map so the two evolve independently (same scalar shape and cap today).
(string) --
(string) --
firstObservedAt (datetime) --
When this node was first observed (UTC), at minute granularity. For a node that merged across sources, this is the earliest value any source reported.
lastObservedAt (datetime) --
When this node was most recently observed (UTC), at minute granularity. For a node that merged across sources, this is the latest value any source reported.
edges (list) --
Outbound edges originating from this node. Each edge carries its from.
(dict) --
A directed edge in the context graph connecting two nodes.
edgeId (string) --
The unique identifier of the edge within the context graph.
from (string) --
The node identifier the edge originates from.
to (string) --
The node identifier the edge points to.
edgeType (string) --
The kind of relationship the edge represents.
operations (list) --
The operations observed on this edge.
(string) --
edgeProperties (dict) --
Attributes promoted out of the flat attribute map onto typed members. Which members are present depends on what produced the edge.
protocol (string) --
The IANA protocol name for the observed network traffic, such as "tcp".
sourcePort (string) --
The source port of the observed traffic. May be a placeholder when the port is unknown.
destinationPort (string) --
The destination port of the observed traffic. May be a placeholder when the port is unknown.
blocked (boolean) --
Whether the observed network flow was denied. Absent means the edge was not derived from network flow data, which is not the same as allowed.
errorCode (string) --
The error code returned when the call was attempted and refused. Its presence means the edge exists but the dependency is failing.
httpStatusCode (string) --
The HTTP status code observed on the request. Distinct from errorCode.
httpMethod (string) --
The HTTP method observed on the request.
serviceInitiated (boolean) --
Whether the caller was an AWS service principal rather than a user or role. Absent means the edge was not derived from a source that reports it.
trafficStats (dict) --
Traffic counters accumulated over the edge's observation window.
bytes (integer) --
Total bytes observed across the edge.
packets (integer) --
Total packets observed across the edge.
flows (integer) --
Total network flows observed across the edge.
sentBytes (integer) --
Total bytes sent to the destination.
receivedBytes (integer) --
Total bytes received from the destination.
telemetryAttributes (dict) --
The edge's OpenTelemetry (OTel) attributes, as emitted by telemetry. A key promoted onto an edgeProperties member is removed here, so no value appears twice.
(string) --
(string) --
signalTypes (list) --
The kinds of telemetry signal observed on this edge.
(string) --
Signal enum for context graph queries.
sources (list) --
The discovery sources that contributed this edge.
(string) --
Data source enum for context graph queries.
metadata (dict) --
Descriptive metadata about the edge. Present only when the request sets includeMetadata.
metrics (list) --
The metrics observed on the element.
(dict) --
A single metric observed on a context graph node.
name (string) --
The metric name as emitted, such as "Duration".
namespace (string) --
DEPRECATED: read attributes["service.namespace"] instead. Retained (deprecated) for backward compatibility with existing consumers; will be removed once they migrate. The logical service grouping the metric belongs to.
preferredStat (string) --
The statistic to chart or alarm on, such as "p99" or "Sum". Free-form and frequently absent.
metricType (string) --
OTel metric kind: "gauge", "sum", "histogram", "exponential_histogram", or "summary" (CloudWatch-vended metrics carry the same kinds). Absent when the producer did not report one.
attributes (dict) --
Per-metric qualifying attributes the console uses to query this metric's telemetry. These are the RAW, store-matching values keyed by their OTel names ("service.name", "service.namespace", "cloud.provider", "cloud.account.id", "cloud.region", "instrumentation_scope") — deliberately NOT the node's normalized/merged identity, so the query selectors match the emitted series. A merged node can carry different values per metric, which is why they live here rather than on the node.
(string) --
(string) --
semantics (dict) --
What the metric means and the unit it is reported in.
description (string) --
Human-readable description of what the metric measures.
unit (string) --
The unit the metric is reported in.
semantics (dict) --
Semantic description of the node. Absent on an edge, because semantics describe a service rather than a relationship.
purpose (string) --
What the service does.
language (string) --
The primary programming language the service is written in.
framework (string) --
The application framework the service is built on.
kind (string) --
The kind of workload the service is.
repository (string) --
The source repository the service is built from.
logs (list) --
Per-signal LOGS query selectors: a LIST of blocks the console ORs, each an AND of exact store column -> raw values. Node-level (edges carry only traces). Populated when the request sets includeMetadata; derived labels (logSourceType) are added by the service projection, not stored here.
(dict) --
One LOGS query selector block on a node. The attributes map's keys are AND'd; each selects with col = value. Deliberately RAW/un-normalized so the selector matches the store, not the node's merged identity.
attributes (dict) --
One LOGS query-selector block: EXACT store column -> raw SCALAR value (mirroring the scalar MetadataAttributeMap). Keyed by the store column that carries the value (e.g. resource.attributes['service.name'], attributes['aws.local.service'], @logGroupName) so the selector matches the emitted signal. A dimension seen under several values (a service under two namespaces, several log groups) becomes several blocks with the same columns and different values, which the console ORs. Dedicated to the LOGS selector so its cap evolves independently of the metric attribute map and the TRACES map. Selector caps are deliberately DISTINCT from the metric caps.
(string) --
(string) --
traces (list) --
Per-signal TRACES query selectors (same block shape as logs). Present on both node and edge metadata. serviceName is derived at the service projection, not stored here.
(dict) --
One TRACES query selector block on a node/edge (see LogMetadata).
attributes (dict) --
TRACES counterpart of LogMetadataAttributeMap — a dedicated per-signal map so the two evolve independently (same scalar shape and cap today).
(string) --
(string) --
firstObservedAt (datetime) --
When this edge was first observed (UTC), at minute granularity. For an edge that merged across sources, this is the earliest value any source reported.
lastObservedAt (datetime) --
When this edge was most recently observed (UTC), at minute granularity. For an edge that merged across sources, this is the latest value any source reported.
nextToken (string) --
Pagination token for the next page; absent when there are no more results.
Returns organization-level domain access grants, with optional filtering by domain, principal, or permission. A grant is returned only when it matches every filter supplied. With no filters, returns the grants for the caller's organization.
See also: AWS API Documentation
Request Syntax
client.list_domain_access_grants_for_organization(
domainId='string',
principalId='string',
principalType='IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT',
permission='ADMIN',
nextToken='string',
maxResults=123
)
string
Filter by domain ID.
string
Filter by principal ID.
string
Filter by principal type.
string
Filter by permission level.
string
A token to retrieve the next page of results. Supply the same filters used on the request that returned it. Tokens expire after 24 hours.
integer
The maximum number of access grants to return per page. Defaults to 100. A page can contain fewer results than this value even when more results remain; continue while nextToken is present.
dict
Response Syntax
{
'items': [
{
'grantId': 'string',
'grantArn': 'string',
'name': 'string',
'domainId': 'string',
'principal': {
'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT',
'principalId': 'string',
'principalAttributes': [
{
'key': 'string',
'value': 'string'
},
]
},
'permission': 'ADMIN',
'grantType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
items (list) --
The list of organization access grant summaries.
(dict) --
Summary of an organization access grant. Call GetDomainAccessGrantForOrganization for the full grant.
grantId (string) --
The unique ID of the access grant.
grantArn (string) --
The Amazon Resource Name (ARN) of the access grant.
name (string) --
A name that identifies the access grant.
domainId (string) --
The ID of the organization domain the grant belongs to.
principal (dict) --
The principal receiving the grant.
principalType (string) --
The type of principal receiving the grant.
principalId (string) --
The ID of the principal receiving the grant.
principalAttributes (list) --
Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.
(dict) --
A single attribute condition used to match principals for attribute-based access.
key (string) --
The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.
value (string) --
The attribute value.
permission (string) --
The permission granted.
grantType (string) --
Who manages the grant.
createdAt (datetime) --
The timestamp when the access grant was created.
updatedAt (datetime) --
The timestamp when the access grant was last updated.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Deletes an integration. Returns the resulting status.
See also: AWS API Documentation
Request Syntax
client.delete_integration(
identifier={
'integrationId': 'string',
'integrationArn': 'string',
'integrationName': 'string'
}
)
dict
[REQUIRED]
Identifies the integration to delete — exactly one of integrationId, integrationArn, or integrationName.
integrationId (string) --
The unique identifier of the integration.
integrationArn (string) --
The Amazon Resource Name of the integration.
integrationName (string) --
The name of the integration; unique within the account.
dict
Response Syntax
{}
Response Structure
(dict) --
The response from deleting an integration. Empty by contract — a successful call indicates the deletion was accepted (DeleteIntegration is idempotent).
Creates a new SQL view.
A view is a named, reusable SQL query that can be referenced from telemetry queries. View names must be unique within the account and region. Only USER views can be created — MANAGED views are provisioned by AWS.
See also: AWS API Documentation
Request Syntax
client.create_view(
name='string',
definition='string',
description='string',
tags={
'string': 'string'
},
clientToken='string'
)
string
[REQUIRED]
The name of the view. Must begin with the "view." prefix. View names must be unique within the account and region.
string
[REQUIRED]
The SQL query that defines the view.
string
A description of the view.
dict
Resource tags.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
string
Idempotency token for safe retries. Retrying with the same token returns the original view instead of creating a duplicate.
This field is autopopulated if not provided.
dict
Response Syntax
{
'name': 'string',
'type': 'USER'|'MANAGED',
'description': 'string',
'definition': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'arn': 'string'
}
Response Structure
(dict) --
name (string) --
The name of the view.
type (string) --
The ownership category of the view.
description (string) --
The description of the view.
definition (string) --
The SQL query that defines the view.
createdAt (datetime) --
The timestamp when the view was created.
updatedAt (datetime) --
The timestamp when the view was last updated.
arn (string) --
The ARN of the view.
Stops a running telemetry query.
See also: AWS API Documentation
Request Syntax
client.stop_telemetry_query(
queryId='string'
)
string
[REQUIRED]
The unique ID of the query.
dict
Response Syntax
{}
Response Structure
(dict) --
Starts a new telemetry query session.
A session provides a logical grouping for one or more telemetry queries. The returned session ID is required when starting queries via StartTelemetryQuery.
See also: AWS API Documentation
Request Syntax
client.start_telemetry_query_session(
sessionName='string'
)
string
A human-readable name for the session. Names under /aws/ are reserved for service integrations.
dict
Response Syntax
{
'sessionId': 'string'
}
Response Structure
(dict) --
sessionId (string) --
The unique ID of the session.
Creates an AccessGrant that authorizes a principal to administer an organization domain.
See also: AWS API Documentation
Request Syntax
client.create_domain_access_grant_for_organization(
domainId='string',
name='string',
principal={
'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT',
'principalId': 'string',
'principalAttributes': [
{
'key': 'string',
'value': 'string'
},
]
},
permission='ADMIN',
tags={
'string': 'string'
},
clientToken='string'
)
string
[REQUIRED]
The ID of the organization domain to create the grant on.
string
[REQUIRED]
A name that identifies the access grant.
dict
[REQUIRED]
The principal receiving the grant.
principalType (string) -- [REQUIRED]
The type of principal receiving the grant.
principalId (string) --
The ID of the principal receiving the grant.
principalAttributes (list) --
Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.
(dict) --
A single attribute condition used to match principals for attribute-based access.
key (string) -- [REQUIRED]
The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.
value (string) -- [REQUIRED]
The attribute value.
string
[REQUIRED]
The permission to grant.
dict
The tags to associate with the access grant.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
string
Idempotency token for safe retries. Repeated requests with the same token return the original result instead of creating a duplicate.
This field is autopopulated if not provided.
dict
Response Syntax
{
'accessGrant': {
'grantId': 'string',
'grantArn': 'string',
'name': 'string',
'domainId': 'string',
'principal': {
'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT',
'principalId': 'string',
'principalAttributes': [
{
'key': 'string',
'value': 'string'
},
]
},
'permission': 'ADMIN',
'grantType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED',
'createdBy': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
accessGrant (dict) --
The details of the created organization access grant.
grantId (string) --
The unique ID of the access grant.
grantArn (string) --
The Amazon Resource Name (ARN) of the access grant.
name (string) --
A name that identifies the access grant.
domainId (string) --
The ID of the organization domain the grant belongs to.
principal (dict) --
The principal receiving the grant.
principalType (string) --
The type of principal receiving the grant.
principalId (string) --
The ID of the principal receiving the grant.
principalAttributes (list) --
Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.
(dict) --
A single attribute condition used to match principals for attribute-based access.
key (string) --
The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.
value (string) --
The attribute value.
permission (string) --
The permission granted.
grantType (string) --
Who manages the grant.
createdBy (string) --
The principal that created the grant.
createdAt (datetime) --
The timestamp when the grant was created.
updatedAt (datetime) --
The timestamp when the grant was last updated.
Removes a space and all of its resources.
See also: AWS API Documentation
Request Syntax
client.delete_space(
spaceId='string'
)
string
[REQUIRED]
The unique ID of the space to delete.
dict
Response Syntax
{}
Response Structure
(dict) --
Returns temporary credentials for a space in an organization member account. The credentials are valid for one hour.
The caller must be the organization's management account or a delegated administrator with access to the target space. The target account must be an active member of the same organization as the domain, and the space must already exist.
See also: AWS API Documentation
Request Syntax
client.get_space_credentials_for_organization(
context={
'spaceId': 'string',
'domainId': 'string',
'targetAccountId': 'string'
},
credentialType='SPACE_OPERATION'
)
dict
[REQUIRED]
Context for credential resolution.
spaceId (string) --
The ID of an existing space to return credentials for.
domainId (string) --
The ID of the domain, when returning credentials for a target account that does not yet have a space.
targetAccountId (string) --
The ID of the target member account. Required when domainId is set.
string
[REQUIRED]
Selects which member-account credential to return. Set this to SPACE_OPERATION.
dict
Response Syntax
{
'credentials': {
'accessKeyId': 'string',
'secretAccessKey': 'string',
'sessionToken': 'string',
'expiration': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
credentials (dict) --
The temporary AWS credentials for the space.
accessKeyId (string) --
The AWS access key ID.
secretAccessKey (string) --
The AWS secret access key.
sessionToken (string) --
The AWS session token.
expiration (datetime) --
The timestamp when the credentials expire.
Returns the definition and metadata of the specified view.
See also: AWS API Documentation
Request Syntax
client.get_view(
name='string'
)
string
[REQUIRED]
The name of the view.
dict
Response Syntax
{
'name': 'string',
'type': 'USER'|'MANAGED',
'description': 'string',
'definition': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'arn': 'string'
}
Response Structure
(dict) --
name (string) --
The name of the view.
type (string) --
The ownership category of the view.
description (string) --
The description of the view.
definition (string) --
The SQL query that defines the view.
createdAt (datetime) --
The timestamp when the view was created.
updatedAt (datetime) --
The timestamp when the view was last updated.
arn (string) --
The ARN of the view.
Creates an integration with a third-party provider. Returns the integration identifier and its initial status; when the provider requires interactive consent, an authorization URL is returned for the user to complete setup.
See also: AWS API Documentation
Request Syntax
client.create_integration(
integrationType='AWS_CONFIG_SLREC'|'SLACK'|'EXTERNAL_AGENT'|'AWS_INTEGRATION',
name='string',
credential={
'oauthCodeCredential': {
'authCode': 'string'
},
'oauthClientCredential': {
'clientId': 'string',
'clientSecret': 'string',
'providerId': 'string'
},
'apiKeyCredential': {
'apiKeyValue': 'string'
}
},
integrationAttributes={
'string': 'string'
},
roleArn='string',
tags={
'string': 'string'
},
clientToken='string'
)
string
[REQUIRED]
The type of third-party provider to integrate with.
string
[REQUIRED]
The name for the new integration; unique within the account.
dict
The credential used to authenticate with the third-party provider.
oauthCodeCredential (dict) --
Credentials for an OAuth 2.0 authorization-code grant.
authCode (string) -- [REQUIRED]
The OAuth 2.0 authorization code returned by the external system's authorization endpoint.
oauthClientCredential (dict) --
Credentials for an OAuth 2.0 client-credentials grant.
clientId (string) -- [REQUIRED]
The OAuth 2.0 client identifier registered with the external system.
clientSecret (string) -- [REQUIRED]
The OAuth 2.0 client secret that pairs with the client identifier.
providerId (string) --
The identifier of the OAuth provider that issued the client credentials.
apiKeyCredential (dict) --
An API key credential.
apiKeyValue (string) -- [REQUIRED]
The API key value used to authenticate with the external system.
dict
Provider-specific attributes to associate with the integration.
(string) --
(string) --
string
The Amazon Resource Name of the IAM role assumed to access the integration.
dict
Tags to apply to the integration at creation time (Tagris tag-on-create).
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
string
Idempotency token for safe retries. Retrying with the same token returns the original integration instead of creating a duplicate.
This field is autopopulated if not provided.
dict
Response Syntax
{
'integration': {
'integrationId': 'string',
'integrationArn': 'string',
'integrationType': 'AWS_CONFIG_SLREC'|'SLACK'|'EXTERNAL_AGENT'|'AWS_INTEGRATION',
'name': 'string',
'status': 'ACTIVE'|'DELETED'|'PENDING'|'PENDING_OAUTH'|'ERROR'|'FAILED',
'authType': 'NONE'|'OAUTH2'|'API_KEY',
'credentialArn': 'string',
'roleArn': 'string',
'integrationAttributes': {
'string': 'string'
},
'authorizationUrl': 'string',
'errorMessage': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'scope': 'ACCOUNT'|'ORGANIZATION'
}
}
Response Structure
(dict) --
The response from creating an integration.
integration (dict) --
The details of the created integration. This is the same object returned by GetIntegration and UpdateIntegration.
integrationId (string) --
The unique identifier of the integration.
integrationArn (string) --
The Amazon Resource Name (ARN) of the integration.
integrationType (string) --
The type of external system that an integration connects to, such as a source of configuration data, a messaging destination, or a model provider.
name (string) --
The customer-provided name of the integration.
status (string) --
The current lifecycle state of an integration.
authType (string) --
The authentication method that an integration uses to connect to its external system.
credentialArn (string) --
The Amazon Resource Name (ARN) of the secret that stores the integration's credentials.
roleArn (string) --
The Amazon Resource Name (ARN) of the IAM role that CloudWatch assumes to access the external system.
integrationAttributes (dict) --
Provider-specific key/value attributes that configure the integration.
(string) --
(string) --
authorizationUrl (string) --
The URL the customer visits to authorize the integration. Present while an OAuth authorization is pending.
errorMessage (string) --
A human-readable description of why the integration is in an ERROR or FAILED state. Present only when the integration has failed.
createdAt (datetime) --
The time at which the integration was created.
updatedAt (datetime) --
The time at which the integration was last updated.
scope (string) --
Whether this integration is account-scoped (ACCOUNT, customer-created) or organization-scoped (ORGANIZATION, created by an org-enablement rule). Absent on legacy records is treated as ACCOUNT.
Returns the details of a single integration, identified by its identifier, Amazon Resource Name, or name.
See also: AWS API Documentation
Request Syntax
client.get_integration(
identifier={
'integrationId': 'string',
'integrationArn': 'string',
'integrationName': 'string'
}
)
dict
[REQUIRED]
Identifies the integration to return — exactly one of integrationId, integrationArn, or integrationName.
integrationId (string) --
The unique identifier of the integration.
integrationArn (string) --
The Amazon Resource Name of the integration.
integrationName (string) --
The name of the integration; unique within the account.
dict
Response Syntax
{
'integration': {
'integrationId': 'string',
'integrationArn': 'string',
'integrationType': 'AWS_CONFIG_SLREC'|'SLACK'|'EXTERNAL_AGENT'|'AWS_INTEGRATION',
'name': 'string',
'status': 'ACTIVE'|'DELETED'|'PENDING'|'PENDING_OAUTH'|'ERROR'|'FAILED',
'authType': 'NONE'|'OAUTH2'|'API_KEY',
'credentialArn': 'string',
'roleArn': 'string',
'integrationAttributes': {
'string': 'string'
},
'authorizationUrl': 'string',
'errorMessage': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'scope': 'ACCOUNT'|'ORGANIZATION'
}
}
Response Structure
(dict) --
The response containing the requested integration.
integration (dict) --
The details of the requested integration.
integrationId (string) --
The unique identifier of the integration.
integrationArn (string) --
The Amazon Resource Name (ARN) of the integration.
integrationType (string) --
The type of external system that an integration connects to, such as a source of configuration data, a messaging destination, or a model provider.
name (string) --
The customer-provided name of the integration.
status (string) --
The current lifecycle state of an integration.
authType (string) --
The authentication method that an integration uses to connect to its external system.
credentialArn (string) --
The Amazon Resource Name (ARN) of the secret that stores the integration's credentials.
roleArn (string) --
The Amazon Resource Name (ARN) of the IAM role that CloudWatch assumes to access the external system.
integrationAttributes (dict) --
Provider-specific key/value attributes that configure the integration.
(string) --
(string) --
authorizationUrl (string) --
The URL the customer visits to authorize the integration. Present while an OAuth authorization is pending.
errorMessage (string) --
A human-readable description of why the integration is in an ERROR or FAILED state. Present only when the integration has failed.
createdAt (datetime) --
The time at which the integration was created.
updatedAt (datetime) --
The time at which the integration was last updated.
scope (string) --
Whether this integration is account-scoped (ACCOUNT, customer-created) or organization-scoped (ORGANIZATION, created by an org-enablement rule). Absent on legacy records is treated as ACCOUNT.
Retrieves a single alert by its identifier.
Use ListAlerts to enumerate alerts in the space.
See also: AWS API Documentation
Request Syntax
client.get_alert(
spaceId='string',
alertId='string'
)
string
[REQUIRED]
The unique ID of the space.
string
[REQUIRED]
The alert to retrieve.
dict
Response Syntax
{
'alert': {
'name': 'string',
'alertId': 'string',
'description': 'string',
'accountId': 'string',
'spaceId': 'string',
'profileId': 'string',
'rule': {
'telemetryRule': {
'query': {
'language': 'SQL'|'PROMQL',
'expression': 'string'
},
'condition': {
'thresholdMode': 'COUNT_OF_RESULTS'|'FIELD_VALUE',
'thresholdField': 'string',
'comparator': 'GT'|'LT'|'GTE'|'LTE',
'warningThreshold': 123.0,
'criticalThreshold': 123.0
},
'evaluation': {
'intervalSeconds': 123,
'pendingDurationSeconds': 123,
'recoveryDurationSeconds': 123
},
'noData': {
'treatAs': 'OK'|'WARNING'|'CRITICAL'|'NODATA'
}
}
},
'notificationStatus': 'ENABLED'|'DISABLED',
'state': {
'value': 'OK'|'WARNING'|'CRITICAL'|'NODATA',
'transitionedAt': datetime(2015, 1, 1),
'contributorSummary': {
'warningCount': 123,
'criticalCount': 123
},
'data': {
'thresholdBreached': 123.0
}
},
'notificationRules': [
{
'trigger': {
'stateValues': [
'OK'|'WARNING'|'CRITICAL'|'NODATA',
]
},
'target': {
'type': 'sns'|'slack'|'pagerduty',
'arn': 'string',
'metadata': {
'string': 'string'
}
}
},
],
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'alertArn': 'string'
}
}
Response Structure
(dict) --
alert (dict) --
The full alert entity.
name (string) --
The name of the alert.
alertId (string) --
The stable alert identifier (see {@link AlertId}), minted on create and immutable across updates. Use it (not {@code name}) to address the alert on GetAlert/UpdateAlert/DeleteAlert; it is also the ARN's resource id.
description (string) --
An optional description of the alert.
accountId (string) --
The AWS account ID that owns the alert.
spaceId (string) --
The ID of the space the alert belongs to.
profileId (string) --
The ID of the access profile associated with the alert.
rule (dict) --
The rule that defines how the alert is evaluated.
telemetryRule (dict) --
The telemetry-based rule definition.
query (dict) --
The query expression to evaluate.
language (string) --
The query language of the expression.
expression (string) --
The query expression to evaluate.
condition (dict) --
The condition that determines when the alert fires.
thresholdMode (string) --
How the threshold is applied to query results.
thresholdField (string) --
The field the threshold is evaluated against.
comparator (string) --
The comparison operator applied to the threshold.
warningThreshold (float) --
The value at which the alert enters the WARNING state.
criticalThreshold (float) --
The value at which the alert enters the CRITICAL state.
evaluation (dict) --
The evaluation cadence and durations.
intervalSeconds (integer) --
The interval between evaluations, in seconds.
pendingDurationSeconds (integer) --
The duration a breach must persist before the alert fires, in seconds.
recoveryDurationSeconds (integer) --
The duration a recovery must persist before the alert clears, in seconds.
noData (dict) --
How the alert behaves when a query produces no data.
treatAs (string) --
The state to report when an evaluation produces no data.
notificationStatus (string) --
Whether notifications are enabled.
state (dict) --
Live evaluation state (read-only, system-managed). Populated by GetAlert. ListAlerts reports state on AlertSummary instead, where it stays required.
Absent on CreateAlert: a newly created alert has never been evaluated, so any state reported there would be a default rather than an observation. Call GetAlert for live state. Not @required for that reason — GetAlert always populates it.
contributorSummary is nested inside this member, so it too is absent on CreateAlert.
value (string) --
Current flat state.
transitionedAt (datetime) --
When the alert transitioned to its current state.
contributorSummary (dict) --
Counts of contributors currently breaching each severity threshold. Present only when contributor-level tracking is active; absent until the first contributor breaches a {@code WARNING} or {@code CRITICAL} threshold.
warningCount (integer) --
Number of contributors currently breaching the warning threshold.
criticalCount (integer) --
Number of contributors currently breaching the critical threshold.
data (dict) --
Structured detail about why the alert is in its current state.
thresholdBreached (float) --
For COUNT_OF_RESULTS alerts, the row count that breached; null for FIELD_VALUE (multi-contributor) alerts.
notificationRules (list) --
The notification rules for the alert.
(dict) --
Single notification rule: which transitions trigger this rule and where the resulting notification should be sent.
trigger (dict) --
The conditions that trigger this notification rule.
stateValues (list) --
Alert state(s) that trigger this rule. Empty / omitted = any state.
(string) --
Flat alert state. Severity is folded in: a WARNING/CRITICAL alert reports that state directly. {@code NODATA} indicates the evaluation produced no data (subject to the rule's noData.treatAs handling).
target (dict) --
The destination for notifications from this rule.
type (string) --
The type of notification target.
arn (string) --
The Amazon Resource Name (ARN) of the notification target. For {@code slack} and {@code pagerduty}, an integration ARN as returned by {@code ListIntegrations}.
metadata (dict) --
Additional target-specific metadata.
(string) --
(string) --
createdAt (datetime) --
The timestamp when the alert was created.
updatedAt (datetime) --
The timestamp when the alert was last updated.
alertArn (string) --
The Amazon Resource Name (ARN) of the alert.
Generates a one-time code for deep-link authentication.
Direct the user's browser to the returned deepLinkUrl before it expires. The code is exchanged for an authenticated, domain-scoped session and can be used only once.
See also: AWS API Documentation
Request Syntax
client.create_one_time_deep_link_code(
domainId='string',
ttlSeconds=123,
redirectUrl='string'
)
string
[REQUIRED]
The ID of the domain to generate the code for.
integer
How long the code remains valid, in seconds. Defaults to 300.
string
The URL to redirect to after the deep-link code is used. Must be an HTTPS URL in the domain with a path of /auth/callback, and cannot include a query string or fragment. If omitted, no redirect is applied.
dict
Response Syntax
{
'code': 'string',
'deepLinkUrl': 'string',
'expiresAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
code (string) --
The one-time deep-link code.
deepLinkUrl (string) --
The deep-link URL containing the one-time code.
expiresAt (datetime) --
The timestamp when the code expires.
Creates a new dashboard within a space.
Use GetOmniDashboard and ListOmniDashboards to retrieve dashboards, UpdateOmniDashboard to modify one, and DeleteOmniDashboard to remove it.
See also: AWS API Documentation
Request Syntax
client.create_omni_dashboard(
spaceId='string',
name='string',
body='string',
description='string',
tags={
'string': 'string'
},
clientToken='string'
)
string
[REQUIRED]
The unique ID of the space to create the dashboard in.
string
[REQUIRED]
A name that identifies the dashboard.
string
[REQUIRED]
The dashboard definition, as a JSON document. Maximum 1 MiB.
string
An optional description of the dashboard.
dict
The tags to associate with the dashboard.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
string
Idempotency token for safe retries. Repeated requests with the same token return the original result instead of creating a duplicate.
This field is autopopulated if not provided.
dict
Response Syntax
{
'omniDashboard': {
'dashboardId': 'string',
'arn': 'string',
'name': 'string',
'body': 'string',
'createdBy': 'string',
'description': 'string',
'tags': {
'string': 'string'
},
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
omniDashboard (dict) --
The dashboard.
dashboardId (string) --
The unique ID of the dashboard.
arn (string) --
The Amazon Resource Name (ARN) of the dashboard.
name (string) --
A name that identifies the dashboard.
body (string) --
The dashboard definition.
createdBy (string) --
The principal that created the dashboard.
description (string) --
An optional description of the dashboard.
tags (dict) --
The tags associated with the dashboard.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
createdAt (datetime) --
The timestamp when the dashboard was created.
updatedAt (datetime) --
The timestamp when the dashboard was last updated.
Removes an access profile.
An access profile cannot be deleted while access grants reference it.
See also: AWS API Documentation
Request Syntax
client.delete_access_profile(
spaceId='string',
profileId='string'
)
string
[REQUIRED]
The unique ID of the space.
string
[REQUIRED]
The unique ID of the access profile to delete.
dict
Response Syntax
{}
Response Structure
(dict) --
Deletes an alert by its identifier.
Idempotent: deleting an alert that has already been removed succeeds without error.
See also: AWS API Documentation
Request Syntax
client.delete_alert(
spaceId='string',
alertId='string'
)
string
[REQUIRED]
The unique ID of the space.
string
[REQUIRED]
The alert to delete.
dict
Response Syntax
{}
Response Structure
(dict) --
Stops a telemetry query session.
Terminates the specified session. After a session is stopped it cannot be reused.
See also: AWS API Documentation
Request Syntax
client.stop_telemetry_query_session(
sessionId='string'
)
string
[REQUIRED]
The unique ID of the session.
dict
Response Syntax
{}
Response Structure
(dict) --
Returns the dashboards in a space, optionally filtered by name prefix.
See also: AWS API Documentation
Request Syntax
client.list_omni_dashboards(
spaceId='string',
namePrefix='string',
nextToken='string',
maxResults=123
)
string
[REQUIRED]
The unique ID of the space.
string
Filter to dashboards whose name starts with this prefix.
string
A token to retrieve the next page of results.
integer
The maximum number of dashboards to return per page. Defaults to 100. A page can contain fewer results than this value even when more results remain; continue while nextToken is present.
dict
Response Syntax
{
'items': [
{
'dashboardId': 'string',
'arn': 'string',
'name': 'string',
'createdBy': 'string',
'description': 'string',
'tags': {
'string': 'string'
},
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
items (list) --
The list of dashboard summaries.
(dict) --
Summary of a dashboard. Call GetOmniDashboard for the full dashboard.
dashboardId (string) --
The unique ID of the dashboard.
arn (string) --
The Amazon Resource Name (ARN) of the dashboard.
name (string) --
A name that identifies the dashboard.
createdBy (string) --
The principal that created the dashboard.
description (string) --
An optional description of the dashboard.
tags (dict) --
The tags associated with the dashboard.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
createdAt (datetime) --
The timestamp when the dashboard was created.
updatedAt (datetime) --
The timestamp when the dashboard was last updated.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Retrieves the details of a domain by ID.
See also: AWS API Documentation
Request Syntax
client.get_domain(
domainId='string'
)
string
[REQUIRED]
The unique ID of the domain.
dict
Response Syntax
{
'domain': {
'domainId': 'string',
'domainArn': 'string',
'name': 'string',
'identityProviders': [
'IAM'|'IDC',
],
'identityProviderConfiguration': {
'identityCenterConfiguration': {
'identityCenterInstanceArn': 'string'
}
},
'domainEndpointUrl': 'string',
'customEndpointUrls': [
'string',
],
'identityCenterApplicationArn': 'string',
'region': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'status': 'ACTIVE'
}
}
Response Structure
(dict) --
domain (dict) --
The details of the domain.
domainId (string) --
The unique ID of the domain.
domainArn (string) --
The Amazon Resource Name (ARN) of the domain.
name (string) --
A name that identifies the domain.
identityProviders (list) --
The identity providers configured for the domain.
(string) --
Identity provider type for a domain. Determines which identity mechanisms are active for authentication.
identityProviderConfiguration (dict) --
Identity provider configuration for the domain.
identityCenterConfiguration (dict) --
Identity Center configuration. Required when identityProviders includes IDC.
identityCenterInstanceArn (string) --
Identity Center instance ARN
domainEndpointUrl (string) --
The HTTPS endpoint URL for accessing the domain.
customEndpointUrls (list) --
Additional endpoint URLs derived from the domain name.
(string) --
identityCenterApplicationArn (string) --
The ARN of the Identity Center application. Absent for IAM-only domains.
region (string) --
The Region where this domain was created.
createdAt (datetime) --
The timestamp when the domain was created.
updatedAt (datetime) --
The timestamp when the domain was last updated.
status (string) --
Current status of the domain.
Updates an existing alert.
Only non-null fields overwrite existing values.
See also: AWS API Documentation
Request Syntax
client.update_alert(
spaceId='string',
alertId='string',
profileId='string',
name='string',
description='string',
rule={
'telemetryRule': {
'query': {
'language': 'SQL'|'PROMQL',
'expression': 'string'
},
'condition': {
'thresholdMode': 'COUNT_OF_RESULTS'|'FIELD_VALUE',
'thresholdField': 'string',
'comparator': 'GT'|'LT'|'GTE'|'LTE',
'warningThreshold': 123.0,
'criticalThreshold': 123.0
},
'evaluation': {
'intervalSeconds': 123,
'pendingDurationSeconds': 123,
'recoveryDurationSeconds': 123
},
'noData': {
'treatAs': 'OK'|'WARNING'|'CRITICAL'|'NODATA'
}
}
},
notificationsEnabled=True|False,
notificationRules=[
{
'trigger': {
'stateValues': [
'OK'|'WARNING'|'CRITICAL'|'NODATA',
]
},
'target': {
'type': 'sns'|'slack'|'pagerduty',
'arn': 'string',
'metadata': {
'string': 'string'
}
}
},
]
)
string
[REQUIRED]
The unique ID of the space.
string
[REQUIRED]
The alert to update.
string
The ID of the access profile associated with the alert.
string
A new display name for the alert. Omit to leave the name unchanged (apply-if-present / PATCH). Same constraints as CreateAlert.name; the name is not the alert's identity, so a rename never changes the alertId.
string
A new description of the alert. Omit to leave unchanged.
dict
The rule that defines how the alert is evaluated. Omit to leave unchanged. Each sub-block is replaced whole when present: {@code query}, {@code condition}, {@code evaluation} and {@code noData} are applied only when supplied, and within a supplied block an omitted optional member is cleared to unset (null/absent) rather than preserved from the stored alert or defaulted. See {@link AlertCondition} and {@link AlertEvaluation}.
telemetryRule (dict) --
The telemetry-based rule definition.
query (dict) --
The query expression to evaluate.
language (string) -- [REQUIRED]
The query language of the expression.
expression (string) -- [REQUIRED]
The query expression to evaluate.
condition (dict) --
The condition that determines when the alert fires.
thresholdMode (string) --
How the threshold is applied to query results.
thresholdField (string) --
The field the threshold is evaluated against.
comparator (string) --
The comparison operator applied to the threshold.
warningThreshold (float) --
The value at which the alert enters the WARNING state.
criticalThreshold (float) --
The value at which the alert enters the CRITICAL state.
evaluation (dict) --
The evaluation cadence and durations.
intervalSeconds (integer) -- [REQUIRED]
The interval between evaluations, in seconds.
pendingDurationSeconds (integer) --
The duration a breach must persist before the alert fires, in seconds.
recoveryDurationSeconds (integer) --
The duration a recovery must persist before the alert clears, in seconds.
noData (dict) --
How the alert behaves when a query produces no data.
treatAs (string) -- [REQUIRED]
The state to report when an evaluation produces no data.
boolean
Whether actions (notifications) are enabled for this alert. Omitted = leave existing value unchanged.
list
Replaces the entire notification rule list when present; full-replace, not merge. Omitted = leave existing rules unchanged. An empty list clears all rules (the alert keeps evaluating; only notifications stop).
(dict) --
Single notification rule: which transitions trigger this rule and where the resulting notification should be sent.
trigger (dict) -- [REQUIRED]
The conditions that trigger this notification rule.
stateValues (list) --
Alert state(s) that trigger this rule. Empty / omitted = any state.
(string) --
Flat alert state. Severity is folded in: a WARNING/CRITICAL alert reports that state directly. {@code NODATA} indicates the evaluation produced no data (subject to the rule's noData.treatAs handling).
target (dict) -- [REQUIRED]
The destination for notifications from this rule.
type (string) -- [REQUIRED]
The type of notification target.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the notification target. For {@code slack} and {@code pagerduty}, an integration ARN as returned by {@code ListIntegrations}.
metadata (dict) --
Additional target-specific metadata.
(string) --
(string) --
dict
Response Syntax
{}
Response Structure
(dict) --
Creates a new alert within a space.
Use GetAlert and ListAlerts to retrieve alerts, UpdateAlert to modify one, and DeleteAlert to remove it.
See also: AWS API Documentation
Request Syntax
client.create_alert(
spaceId='string',
profileId='string',
name='string',
description='string',
rule={
'telemetryRule': {
'query': {
'language': 'SQL'|'PROMQL',
'expression': 'string'
},
'condition': {
'thresholdMode': 'COUNT_OF_RESULTS'|'FIELD_VALUE',
'thresholdField': 'string',
'comparator': 'GT'|'LT'|'GTE'|'LTE',
'warningThreshold': 123.0,
'criticalThreshold': 123.0
},
'evaluation': {
'intervalSeconds': 123,
'pendingDurationSeconds': 123,
'recoveryDurationSeconds': 123
},
'noData': {
'treatAs': 'OK'|'WARNING'|'CRITICAL'|'NODATA'
}
}
},
notificationsEnabled=True|False,
tags={
'string': 'string'
},
notificationRules=[
{
'trigger': {
'stateValues': [
'OK'|'WARNING'|'CRITICAL'|'NODATA',
]
},
'target': {
'type': 'sns'|'slack'|'pagerduty',
'arn': 'string',
'metadata': {
'string': 'string'
}
}
},
],
clientToken='string'
)
string
[REQUIRED]
The unique ID of the space to create the alert in.
string
[REQUIRED]
The ID of the access profile the alert uses to evaluate its query and execute notifications. The caller supplies it: there is no managed alert profile, and the service does not pick one on the caller's behalf.
string
[REQUIRED]
Alert name, for display. Max 256 (the AlarmName budget). Not the alert's identity: the backend mints a separate uuid as the {@link AlertId}, so the name need not be unique within a space and addressing an alert never depends on it. UpdateAlert accepts a new name to rename the alert.
string
An optional description of the alert.
dict
[REQUIRED]
The rule that defines how the alert is evaluated.
telemetryRule (dict) --
The telemetry-based rule definition.
query (dict) --
The query expression to evaluate.
language (string) -- [REQUIRED]
The query language of the expression.
expression (string) -- [REQUIRED]
The query expression to evaluate.
condition (dict) --
The condition that determines when the alert fires.
thresholdMode (string) --
How the threshold is applied to query results.
thresholdField (string) --
The field the threshold is evaluated against.
comparator (string) --
The comparison operator applied to the threshold.
warningThreshold (float) --
The value at which the alert enters the WARNING state.
criticalThreshold (float) --
The value at which the alert enters the CRITICAL state.
evaluation (dict) --
The evaluation cadence and durations.
intervalSeconds (integer) -- [REQUIRED]
The interval between evaluations, in seconds.
pendingDurationSeconds (integer) --
The duration a breach must persist before the alert fires, in seconds.
recoveryDurationSeconds (integer) --
The duration a recovery must persist before the alert clears, in seconds.
noData (dict) --
How the alert behaves when a query produces no data.
treatAs (string) -- [REQUIRED]
The state to report when an evaluation produces no data.
boolean
Whether actions (notifications) are enabled for this alert. Defaults to true when omitted.
dict
The tags to associate with the alert.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
list
The notification rules that determine when and where notifications are sent.
(dict) --
Single notification rule: which transitions trigger this rule and where the resulting notification should be sent.
trigger (dict) -- [REQUIRED]
The conditions that trigger this notification rule.
stateValues (list) --
Alert state(s) that trigger this rule. Empty / omitted = any state.
(string) --
Flat alert state. Severity is folded in: a WARNING/CRITICAL alert reports that state directly. {@code NODATA} indicates the evaluation produced no data (subject to the rule's noData.treatAs handling).
target (dict) -- [REQUIRED]
The destination for notifications from this rule.
type (string) -- [REQUIRED]
The type of notification target.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the notification target. For {@code slack} and {@code pagerduty}, an integration ARN as returned by {@code ListIntegrations}.
metadata (dict) --
Additional target-specific metadata.
(string) --
(string) --
string
Idempotency token for safe retries. Retrying with the same token within the idempotency window returns the original alert instead of creating a duplicate.
This field is autopopulated if not provided.
dict
Response Syntax
{
'alertArn': 'string',
'alert': {
'name': 'string',
'alertId': 'string',
'description': 'string',
'accountId': 'string',
'spaceId': 'string',
'profileId': 'string',
'rule': {
'telemetryRule': {
'query': {
'language': 'SQL'|'PROMQL',
'expression': 'string'
},
'condition': {
'thresholdMode': 'COUNT_OF_RESULTS'|'FIELD_VALUE',
'thresholdField': 'string',
'comparator': 'GT'|'LT'|'GTE'|'LTE',
'warningThreshold': 123.0,
'criticalThreshold': 123.0
},
'evaluation': {
'intervalSeconds': 123,
'pendingDurationSeconds': 123,
'recoveryDurationSeconds': 123
},
'noData': {
'treatAs': 'OK'|'WARNING'|'CRITICAL'|'NODATA'
}
}
},
'notificationStatus': 'ENABLED'|'DISABLED',
'state': {
'value': 'OK'|'WARNING'|'CRITICAL'|'NODATA',
'transitionedAt': datetime(2015, 1, 1),
'contributorSummary': {
'warningCount': 123,
'criticalCount': 123
},
'data': {
'thresholdBreached': 123.0
}
},
'notificationRules': [
{
'trigger': {
'stateValues': [
'OK'|'WARNING'|'CRITICAL'|'NODATA',
]
},
'target': {
'type': 'sns'|'slack'|'pagerduty',
'arn': 'string',
'metadata': {
'string': 'string'
}
}
},
],
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'alertArn': 'string'
}
}
Response Structure
(dict) --
alertArn (string) --
Deprecated. Use alert.alertArn, which carries the same value. Kept so an existing caller keeps working while it moves to alert.
alert (dict) --
The alert that was created. The same Alert shape GetAlert returns, so a caller need not read the alert back to learn its timestamps or its minted alert id.
{@code alert.state} is absent here — see the state member of Alert. Every other member is populated exactly as GetAlert populates it.
name (string) --
The name of the alert.
alertId (string) --
The stable alert identifier (see {@link AlertId}), minted on create and immutable across updates. Use it (not {@code name}) to address the alert on GetAlert/UpdateAlert/DeleteAlert; it is also the ARN's resource id.
description (string) --
An optional description of the alert.
accountId (string) --
The AWS account ID that owns the alert.
spaceId (string) --
The ID of the space the alert belongs to.
profileId (string) --
The ID of the access profile associated with the alert.
rule (dict) --
The rule that defines how the alert is evaluated.
telemetryRule (dict) --
The telemetry-based rule definition.
query (dict) --
The query expression to evaluate.
language (string) --
The query language of the expression.
expression (string) --
The query expression to evaluate.
condition (dict) --
The condition that determines when the alert fires.
thresholdMode (string) --
How the threshold is applied to query results.
thresholdField (string) --
The field the threshold is evaluated against.
comparator (string) --
The comparison operator applied to the threshold.
warningThreshold (float) --
The value at which the alert enters the WARNING state.
criticalThreshold (float) --
The value at which the alert enters the CRITICAL state.
evaluation (dict) --
The evaluation cadence and durations.
intervalSeconds (integer) --
The interval between evaluations, in seconds.
pendingDurationSeconds (integer) --
The duration a breach must persist before the alert fires, in seconds.
recoveryDurationSeconds (integer) --
The duration a recovery must persist before the alert clears, in seconds.
noData (dict) --
How the alert behaves when a query produces no data.
treatAs (string) --
The state to report when an evaluation produces no data.
notificationStatus (string) --
Whether notifications are enabled.
state (dict) --
Live evaluation state (read-only, system-managed). Populated by GetAlert. ListAlerts reports state on AlertSummary instead, where it stays required.
Absent on CreateAlert: a newly created alert has never been evaluated, so any state reported there would be a default rather than an observation. Call GetAlert for live state. Not @required for that reason — GetAlert always populates it.
contributorSummary is nested inside this member, so it too is absent on CreateAlert.
value (string) --
Current flat state.
transitionedAt (datetime) --
When the alert transitioned to its current state.
contributorSummary (dict) --
Counts of contributors currently breaching each severity threshold. Present only when contributor-level tracking is active; absent until the first contributor breaches a {@code WARNING} or {@code CRITICAL} threshold.
warningCount (integer) --
Number of contributors currently breaching the warning threshold.
criticalCount (integer) --
Number of contributors currently breaching the critical threshold.
data (dict) --
Structured detail about why the alert is in its current state.
thresholdBreached (float) --
For COUNT_OF_RESULTS alerts, the row count that breached; null for FIELD_VALUE (multi-contributor) alerts.
notificationRules (list) --
The notification rules for the alert.
(dict) --
Single notification rule: which transitions trigger this rule and where the resulting notification should be sent.
trigger (dict) --
The conditions that trigger this notification rule.
stateValues (list) --
Alert state(s) that trigger this rule. Empty / omitted = any state.
(string) --
Flat alert state. Severity is folded in: a WARNING/CRITICAL alert reports that state directly. {@code NODATA} indicates the evaluation produced no data (subject to the rule's noData.treatAs handling).
target (dict) --
The destination for notifications from this rule.
type (string) --
The type of notification target.
arn (string) --
The Amazon Resource Name (ARN) of the notification target. For {@code slack} and {@code pagerduty}, an integration ARN as returned by {@code ListIntegrations}.
metadata (dict) --
Additional target-specific metadata.
(string) --
(string) --
createdAt (datetime) --
The timestamp when the alert was created.
updatedAt (datetime) --
The timestamp when the alert was last updated.
alertArn (string) --
The Amazon Resource Name (ARN) of the alert.
Removes an existing organization access grant, revoking the access it granted.
A service-managed grant cannot be deleted.
See also: AWS API Documentation
Request Syntax
client.delete_domain_access_grant_for_organization(
grantId='string'
)
string
[REQUIRED]
The ID of the access grant to delete.
dict
Response Syntax
{}
Response Structure
(dict) --
Updates a space.
Only the provided fields are changed; omitted fields are left unchanged.
See also: AWS API Documentation
Request Syntax
client.update_space(
spaceId='string',
name='string',
encryptionConfiguration={
'encryptionStrategy': 'AWS_OWNED'|'CUSTOMER_MANAGED',
'kmsKeyArn': 'string'
}
)
string
[REQUIRED]
The unique ID of the space to update.
string
A new name for the space. Omit to leave unchanged. Must be 3-64 characters: lowercase letters, numbers, and hyphens. It must begin and end with a letter or number and cannot contain consecutive hyphens.
dict
How to encrypt the space's data at rest. Omit to leave encryption unchanged. Pass encryptionStrategy AWS_OWNED to stop using a customer managed key and revert to service owned encryption.
encryptionStrategy (string) -- [REQUIRED]
Which kind of key to use. Required.
kmsKeyArn (string) --
Customer managed KMS key ARN. Required when encryptionStrategy is CUSTOMER_MANAGED, and must be omitted when it is AWS_OWNED. Must be a symmetric ENCRYPT_DECRYPT key in the caller's account and region.
dict
Response Syntax
{
'space': {
'spaceId': 'string',
'name': 'string',
'spaceArn': 'string',
'domainArn': 'string',
'region': 'string',
'ownerAccountId': 'string',
'dataAccessRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'agentCoreEvaluationRoleArn': 'string',
'status': 'ACTIVE'|'SUSPENDED'|'MOVING',
'statusReason': 'string',
'encryptionConfiguration': {
'encryptionStrategy': 'AWS_OWNED'|'CUSTOMER_MANAGED',
'kmsKeyArn': 'string'
}
}
}
Response Structure
(dict) --
space (dict) --
The updated details of the space.
spaceId (string) --
The unique ID of the space.
name (string) --
A name that identifies the space.
spaceArn (string) --
The Amazon Resource Name (ARN) of the space.
domainArn (string) --
The Amazon Resource Name (ARN) of the domain the space belongs to. Absent when the space is not associated with a domain, so callers must tolerate its absence.
region (string) --
The region where this space was created.
ownerAccountId (string) --
AWS account ID that owns this space.
dataAccessRoleArn (string) --
The ARN of the IAM role used for data access.
createdAt (datetime) --
The timestamp when the space was created.
updatedAt (datetime) --
The timestamp when the space was last updated.
agentCoreEvaluationRoleArn (string) --
The ARN of the IAM role used by AgentCore online evaluation. Absent when the space was created without one.
status (string) --
The status of the space.
statusReason (string) --
Reason for the current space status.
encryptionConfiguration (dict) --
How the space's data at rest is encrypted. Always populated: a space with no customer managed key reports encryptionStrategy AWS_OWNED and no kmsKeyArn.
encryptionStrategy (string) --
Which kind of key to use. Required.
kmsKeyArn (string) --
Customer managed KMS key ARN. Required when encryptionStrategy is CUSTOMER_MANAGED, and must be omitted when it is AWS_OWNED. Must be a symmetric ENCRYPT_DECRYPT key in the caller's account and region.
Removes a dashboard from a space.
See also: AWS API Documentation
Request Syntax
client.delete_omni_dashboard(
spaceId='string',
dashboardId='string'
)
string
[REQUIRED]
The unique ID of the space.
string
[REQUIRED]
The unique ID of the dashboard.
dict
Response Syntax
{}
Response Structure
(dict) --
Retrieves the intelligence configuration for the calling account. Account is identified via FAS (caller identity). Returns the default configuration if none exists yet.
See also: AWS API Documentation
Request Syntax
client.get_intelligence_configuration()
dict
Response Syntax
{
'accountId': 'string',
'kmsKeyArn': 'string',
'updatedAt': datetime(2015, 1, 1),
'createdAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
The intelligence configuration for the calling account.
accountId (string) --
The AWS account ID this configuration applies to.
kmsKeyArn (string) --
The currently active KMS key ARN for customer-managed encryption, if configured.
updatedAt (datetime) --
ISO-8601 timestamp of the last update.
createdAt (datetime) --
ISO-8601 timestamp of initial creation.
Removes an existing AccessGrant, revoking the access it granted.
A service-managed grant cannot be deleted.
See also: AWS API Documentation
Request Syntax
client.delete_access_grant(
grantId='string'
)
string
[REQUIRED]
The ID of the access grant to delete.
dict
Response Syntax
{}
Response Structure
(dict) --
Lists alerts within a space, optionally filtered by exact name(s), a single name prefix, or exact alertId(s), with pagination.
Use GetAlert to retrieve a single alert's full detail.
See also: AWS API Documentation
Request Syntax
client.list_alerts(
spaceId='string',
filterCriteria={
'names': [
'string',
],
'namePrefix': 'string',
'ids': [
'string',
],
'stateValue': [
'OK'|'WARNING'|'CRITICAL'|'NODATA',
],
'notificationsEnabled': True|False
},
sortBy='NAME'|'STATE',
sortOrder='ASC'|'DESC',
nextToken='string',
maxResults=123
)
string
[REQUIRED]
The unique ID of the space.
dict
Filter criteria narrowing which alerts are returned. All members are optional; the three name/id filters are mutually exclusive.
names (list) --
Filter to alerts whose name exactly matches any entry (OR semantics). Mutually exclusive with {@code namePrefix} and {@code ids}.
(string) --
namePrefix (string) --
Filter to alerts whose name starts with this prefix. Mutually exclusive with {@code names} and {@code ids}.
ids (list) --
Filter to alerts whose {@link AlertId} exactly matches any entry (OR semantics). Mutually exclusive with {@code names} and {@code namePrefix}.
(string) --
The stable alert identifier: a 32-character lowercase hex uuid, minted by the backend on create and immutable across updates.
It deliberately carries no name, so that a future rename cannot change an alert's identity and break the ARNs, saved links and IAM policies pointing at it. Use {@code name} to display an alert and {@code alertId} to address one.
stateValue (list) --
Filter to alerts currently in any of these states (OR semantics).
(string) --
Flat alert state. Severity is folded in: a WARNING/CRITICAL alert reports that state directly. {@code NODATA} indicates the evaluation produced no data (subject to the rule's noData.treatAs handling).
notificationsEnabled (boolean) --
Filter to alerts by whether notifications are enabled.
string
The field to sort results by.
string
The order in which to sort results.
string
A token to retrieve the next page of results.
integer
The maximum number of alerts to return per page.
dict
Response Syntax
{
'items': [
{
'name': 'string',
'alertId': 'string',
'spaceId': 'string',
'profileId': 'string',
'notificationStatus': 'ENABLED'|'DISABLED',
'state': {
'value': 'OK'|'WARNING'|'CRITICAL'|'NODATA',
'transitionedAt': datetime(2015, 1, 1),
'contributorSummary': {
'warningCount': 123,
'criticalCount': 123
},
'data': {
'thresholdBreached': 123.0
}
},
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'alertArn': 'string'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
items (list) --
The list of alert summaries.
(dict) --
Summary representation of an alert used in list responses.
name (string) --
The name of the alert.
alertId (string) --
The stable alert identifier (see {@link Alert#alertId}). Use it to address the alert; it is also the ARN's resource id.
spaceId (string) --
The ID of the space the alert belongs to.
profileId (string) --
The ID of the access profile associated with the alert.
notificationStatus (string) --
Whether notifications are enabled.
state (dict) --
Live evaluation state (read-only, system-managed).
value (string) --
Current flat state.
transitionedAt (datetime) --
When the alert transitioned to its current state.
contributorSummary (dict) --
Counts of contributors currently breaching each severity threshold. Present only when contributor-level tracking is active; absent until the first contributor breaches a {@code WARNING} or {@code CRITICAL} threshold.
warningCount (integer) --
Number of contributors currently breaching the warning threshold.
criticalCount (integer) --
Number of contributors currently breaching the critical threshold.
data (dict) --
Structured detail about why the alert is in its current state.
thresholdBreached (float) --
For COUNT_OF_RESULTS alerts, the row count that breached; null for FIELD_VALUE (multi-contributor) alerts.
createdAt (datetime) --
The timestamp when the alert was created.
updatedAt (datetime) --
The timestamp when the alert was last updated.
alertArn (string) --
The Amazon Resource Name (ARN) of the alert.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Retrieves the full detail of a single AccessGrant by ID.
See also: AWS API Documentation
Request Syntax
client.get_access_grant(
grantId='string'
)
string
[REQUIRED]
The ID of the access grant to retrieve.
dict
Response Syntax
{
'accessGrant': {
'grantId': 'string',
'grantArn': 'string',
'name': 'string',
'accountId': 'string',
'domainId': 'string',
'principal': {
'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT'|'ACCESS_PROFILE'|'ALERT'|'AGENT',
'principalId': 'string',
'principalAttributes': [
{
'key': 'string',
'value': 'string'
},
]
},
'permission': 'SPACE_ADMIN'|'READ'|'READ_WRITE_DELETE'|'CUSTOM',
'grantType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED',
'createdBy': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'spaceId': 'string',
'scopedActions': [
{
'actions': [
'string',
],
'resources': [
{
'resourceType': 'string',
'resourceArns': [
'string',
],
'tags': {
'string': 'string'
},
'signalTypes': [
'LOGS'|'TRACES',
],
'rowScopeGroups': [
[
{
'field': 'string',
'operator': 'IN',
'values': [
'string',
]
},
],
]
},
],
'contextConditions': {
'string': [
'string',
]
}
},
]
}
}
Response Structure
(dict) --
accessGrant (dict) --
The full details of the access grant.
grantId (string) --
The unique ID of the access grant.
grantArn (string) --
The Amazon Resource Name (ARN) of the access grant.
name (string) --
A name that identifies the access grant.
accountId (string) --
The AWS account ID that owns the grant.
domainId (string) --
The ID of the domain the grant belongs to.
principal (dict) --
The principal receiving the grant.
principalType (string) --
The type of principal receiving the grant.
principalId (string) --
The ID of the principal receiving the grant.
principalAttributes (list) --
Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.
(dict) --
A single attribute condition used to match principals for attribute-based access.
key (string) --
The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.
value (string) --
The attribute value.
permission (string) --
The permission granted.
grantType (string) --
Who manages the grant.
createdBy (string) --
The principal that created the grant.
createdAt (datetime) --
The timestamp when the grant was created.
updatedAt (datetime) --
The timestamp when the grant was last updated.
spaceId (string) --
The space this grant applies to. Domain-scoped grants are returned by ListDomainAccessGrantsForOrganization instead.
scopedActions (list) --
Groups of actions allowed by the grant, each with the resource scopes and conditions that limit those actions.
(dict) --
A group of actions within an access grant, together with the resource scopes and context conditions that apply to exactly those actions.
actions (list) --
The actions this group applies to.
(string) --
A single scoped action in "vendor-code:Action" form (e.g. "bedrock:InvokeModel"). Wildcards are not permitted.
resources (list) --
Optional resource scopes constraining these actions to specific resources.
(dict) --
A single resource scope entry within an AccessGrant. Associates a resource type with optional ARN patterns, tag conditions, and row-level filters.
resourceType (string) --
Resource type name (e.g., "DataSet", "OmniDashboard").
resourceArns (list) --
Specific resource ARNs or ARN patterns. When set, actions are limited to these resources. When absent, defaults to "*".
(string) --
tags (dict) --
Tag-based conditions for dynamic resource scoping. Access applies only to resources carrying all of the specified tag key/value pairs.
(string) --
(string) --
signalTypes (list) --
Signal types this scope's row filtering applies to. Required when rowScopeGroups is set.
(string) --
Telemetry signal type that row-scoped access control applies to.
rowScopeGroups (list) --
Row-level filters for this scope, as an OR of AND-groups: a row is visible when it matches every filter in any one group. Requires signalTypes.
Row filters are additive across a principal's matching grants. A signal type with no matching group is unrestricted, and when rowScopeGroups is omitted all rows are visible for all signal types.
(list) --
A group of row filters that must all match. A row satisfies the group only when it matches every filter in it.
(dict) --
A single additive row-level filter on an AccessGrant. A row is visible when its value for the given field matches the filter's values. Row filters are additive: the visible rows are the union of all row filters across a principal's matching grants.
field (string) --
The field (column) the allowlist applies to (e.g., "serviceName", "accountId").
operator (string) --
Match operator applied to this filter's values.
values (list) --
The values the field is matched against.
(string) --
A single allowlist value for a RowScope field.
contextConditions (dict) --
Optional context conditions for fine-grained access control on these actions.
(string) --
(list) --
Generic list of strings.
(string) --
Creates a domain with identity provider configuration.
Use GetDomain to retrieve the domain, UpdateDomain to change its configuration, and CreateSpace to add spaces within it.
See also: AWS API Documentation
Request Syntax
client.create_domain(
name='string',
identityProviders=[
'IAM'|'IDC',
],
identityProviderConfiguration={
'identityCenterConfiguration': {
'identityCenterInstanceArn': 'string'
}
},
tags={
'string': 'string'
},
clientToken='string'
)
string
[REQUIRED]
A name that identifies the domain. Must be 3-63 characters: lowercase letters, numbers, and hyphens. It must begin and end with a letter or number and cannot contain consecutive hyphens.
list
[REQUIRED]
The identity providers to configure for the domain.
(string) --
Identity provider type for a domain. Determines which identity mechanisms are active for authentication.
dict
Identity provider configuration for the domain.
identityCenterConfiguration (dict) --
Identity Center configuration. Required when identityProviders includes IDC.
identityCenterInstanceArn (string) --
Identity Center instance ARN
dict
The tags to associate with the domain.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
string
Idempotency token for safe retries. Repeated requests with the same token return the original result instead of creating a duplicate.
This field is autopopulated if not provided.
dict
Response Syntax
{
'domain': {
'domainId': 'string',
'domainArn': 'string',
'name': 'string',
'identityProviders': [
'IAM'|'IDC',
],
'identityProviderConfiguration': {
'identityCenterConfiguration': {
'identityCenterInstanceArn': 'string'
}
},
'domainEndpointUrl': 'string',
'customEndpointUrls': [
'string',
],
'identityCenterApplicationArn': 'string',
'region': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'status': 'ACTIVE'
}
}
Response Structure
(dict) --
domain (dict) --
The details of the created domain.
domainId (string) --
The unique ID of the domain.
domainArn (string) --
The Amazon Resource Name (ARN) of the domain.
name (string) --
A name that identifies the domain.
identityProviders (list) --
The identity providers configured for the domain.
(string) --
Identity provider type for a domain. Determines which identity mechanisms are active for authentication.
identityProviderConfiguration (dict) --
Identity provider configuration for the domain.
identityCenterConfiguration (dict) --
Identity Center configuration. Required when identityProviders includes IDC.
identityCenterInstanceArn (string) --
Identity Center instance ARN
domainEndpointUrl (string) --
The HTTPS endpoint URL for accessing the domain.
customEndpointUrls (list) --
Additional endpoint URLs derived from the domain name.
(string) --
identityCenterApplicationArn (string) --
The ARN of the Identity Center application. Absent for IAM-only domains.
region (string) --
The Region where this domain was created.
createdAt (datetime) --
The timestamp when the domain was created.
updatedAt (datetime) --
The timestamp when the domain was last updated.
status (string) --
Current status of the domain.
Updates the name or description of an access profile.
Only the provided fields are changed; omitted fields are left unchanged.
See also: AWS API Documentation
Request Syntax
client.update_access_profile(
spaceId='string',
profileId='string',
name='string',
description='string'
)
string
[REQUIRED]
The unique ID of the space.
string
[REQUIRED]
The unique ID of the access profile to update.
string
A new name for the access profile. Omit to leave unchanged.
string
A new description of the access profile. Omit to leave unchanged.
dict
Response Syntax
{
'accessProfile': {
'profileId': 'string',
'spaceId': 'string',
'arn': 'string',
'name': 'string',
'description': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'assumeStatus': 'ALLOWED'|'DENIED',
'profileType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED'
}
}
Response Structure
(dict) --
accessProfile (dict) --
The access profile.
profileId (string) --
The unique ID of the access profile.
spaceId (string) --
The ID of the space the profile belongs to.
arn (string) --
The ARN of this access profile.
name (string) --
A name that identifies the access profile.
description (string) --
An optional description of the access profile.
createdAt (datetime) --
The timestamp when the access profile was created.
updatedAt (datetime) --
The timestamp when the access profile was last updated.
assumeStatus (string) --
The calling principal's authorization to assume this access profile.
profileType (string) --
Who manages the access profile.
Updates an existing integration, identified by its id, ARN, or name. Only the fields you provide are changed.
See also: AWS API Documentation
Request Syntax
client.update_integration(
identifier={
'integrationId': 'string',
'integrationArn': 'string',
'integrationName': 'string'
},
credential={
'oauthCodeCredential': {
'authCode': 'string'
},
'oauthClientCredential': {
'clientId': 'string',
'clientSecret': 'string',
'providerId': 'string'
},
'apiKeyCredential': {
'apiKeyValue': 'string'
}
},
integrationAttributes={
'string': 'string'
},
roleArn='string'
)
dict
[REQUIRED]
Identifies the integration to update — exactly one of integrationId, integrationArn, or integrationName.
integrationId (string) --
The unique identifier of the integration.
integrationArn (string) --
The Amazon Resource Name of the integration.
integrationName (string) --
The name of the integration; unique within the account.
dict
The replacement credential used to authenticate with the provider.
oauthCodeCredential (dict) --
Credentials for an OAuth 2.0 authorization-code grant.
authCode (string) -- [REQUIRED]
The OAuth 2.0 authorization code returned by the external system's authorization endpoint.
oauthClientCredential (dict) --
Credentials for an OAuth 2.0 client-credentials grant.
clientId (string) -- [REQUIRED]
The OAuth 2.0 client identifier registered with the external system.
clientSecret (string) -- [REQUIRED]
The OAuth 2.0 client secret that pairs with the client identifier.
providerId (string) --
The identifier of the OAuth provider that issued the client credentials.
apiKeyCredential (dict) --
An API key credential.
apiKeyValue (string) -- [REQUIRED]
The API key value used to authenticate with the external system.
dict
The provider-specific attributes to associate with the integration.
(string) --
(string) --
string
The Amazon Resource Name of the IAM role assumed to access the integration.
dict
Response Syntax
{
'integration': {
'integrationId': 'string',
'integrationArn': 'string',
'integrationType': 'AWS_CONFIG_SLREC'|'SLACK'|'EXTERNAL_AGENT'|'AWS_INTEGRATION',
'name': 'string',
'status': 'ACTIVE'|'DELETED'|'PENDING'|'PENDING_OAUTH'|'ERROR'|'FAILED',
'authType': 'NONE'|'OAUTH2'|'API_KEY',
'credentialArn': 'string',
'roleArn': 'string',
'integrationAttributes': {
'string': 'string'
},
'authorizationUrl': 'string',
'errorMessage': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'scope': 'ACCOUNT'|'ORGANIZATION'
}
}
Response Structure
(dict) --
The response from updating an integration.
integration (dict) --
The details of the updated integration. This is the same object returned by GetIntegration and CreateIntegration. Populated on a successful update; absent only if the post-update read-back of the resource did not complete.
integrationId (string) --
The unique identifier of the integration.
integrationArn (string) --
The Amazon Resource Name (ARN) of the integration.
integrationType (string) --
The type of external system that an integration connects to, such as a source of configuration data, a messaging destination, or a model provider.
name (string) --
The customer-provided name of the integration.
status (string) --
The current lifecycle state of an integration.
authType (string) --
The authentication method that an integration uses to connect to its external system.
credentialArn (string) --
The Amazon Resource Name (ARN) of the secret that stores the integration's credentials.
roleArn (string) --
The Amazon Resource Name (ARN) of the IAM role that CloudWatch assumes to access the external system.
integrationAttributes (dict) --
Provider-specific key/value attributes that configure the integration.
(string) --
(string) --
authorizationUrl (string) --
The URL the customer visits to authorize the integration. Present while an OAuth authorization is pending.
errorMessage (string) --
A human-readable description of why the integration is in an ERROR or FAILED state. Present only when the integration has failed.
createdAt (datetime) --
The time at which the integration was created.
updatedAt (datetime) --
The time at which the integration was last updated.
scope (string) --
Whether this integration is account-scoped (ACCOUNT, customer-created) or organization-scoped (ORGANIZATION, created by an org-enablement rule). Absent on legacy records is treated as ACCOUNT.
Updates an existing dashboard within a space.
Only the provided fields are changed; omitted fields are left unchanged.
See also: AWS API Documentation
Request Syntax
client.update_omni_dashboard(
spaceId='string',
dashboardId='string',
body='string',
name='string',
description='string'
)
string
[REQUIRED]
The unique ID of the space.
string
[REQUIRED]
The unique ID of the dashboard.
string
The new dashboard definition, as a JSON document. Maximum 1 MiB. Omit to leave unchanged.
string
A new name for the dashboard. Omit to leave unchanged.
string
A new description of the dashboard. Omit to leave unchanged.
dict
Response Syntax
{
'omniDashboard': {
'dashboardId': 'string',
'arn': 'string',
'name': 'string',
'body': 'string',
'createdBy': 'string',
'description': 'string',
'tags': {
'string': 'string'
},
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
omniDashboard (dict) --
The dashboard.
dashboardId (string) --
The unique ID of the dashboard.
arn (string) --
The Amazon Resource Name (ARN) of the dashboard.
name (string) --
A name that identifies the dashboard.
body (string) --
The dashboard definition.
createdBy (string) --
The principal that created the dashboard.
description (string) --
An optional description of the dashboard.
tags (dict) --
The tags associated with the dashboard.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
createdAt (datetime) --
The timestamp when the dashboard was created.
updatedAt (datetime) --
The timestamp when the dashboard was last updated.
Retrieves the full detail of a single organization access grant by ID.
See also: AWS API Documentation
Request Syntax
client.get_domain_access_grant_for_organization(
grantId='string'
)
string
[REQUIRED]
The ID of the access grant to retrieve.
dict
Response Syntax
{
'accessGrant': {
'grantId': 'string',
'grantArn': 'string',
'name': 'string',
'domainId': 'string',
'principal': {
'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT',
'principalId': 'string',
'principalAttributes': [
{
'key': 'string',
'value': 'string'
},
]
},
'permission': 'ADMIN',
'grantType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED',
'createdBy': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
accessGrant (dict) --
The retrieved organization access grant.
grantId (string) --
The unique ID of the access grant.
grantArn (string) --
The Amazon Resource Name (ARN) of the access grant.
name (string) --
A name that identifies the access grant.
domainId (string) --
The ID of the organization domain the grant belongs to.
principal (dict) --
The principal receiving the grant.
principalType (string) --
The type of principal receiving the grant.
principalId (string) --
The ID of the principal receiving the grant.
principalAttributes (list) --
Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.
(dict) --
A single attribute condition used to match principals for attribute-based access.
key (string) --
The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.
value (string) --
The attribute value.
permission (string) --
The permission granted.
grantType (string) --
Who manages the grant.
createdBy (string) --
The principal that created the grant.
createdAt (datetime) --
The timestamp when the grant was created.
updatedAt (datetime) --
The timestamp when the grant was last updated.
Updates an existing view's definition and/or description.
Only the fields you provide are changed. Managed views cannot be updated.
See also: AWS API Documentation
Request Syntax
client.update_view(
name='string',
definition='string',
description='string'
)
string
[REQUIRED]
The name of the view to update.
string
The new SQL query that defines the view. Omit to leave unchanged.
string
The new description of the view. Omit to leave unchanged.
dict
Response Syntax
{
'name': 'string',
'type': 'USER'|'MANAGED',
'description': 'string',
'definition': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'arn': 'string'
}
Response Structure
(dict) --
name (string) --
The name of the view.
type (string) --
The ownership category of the view.
description (string) --
The description of the view.
definition (string) --
The SQL query that defines the view.
createdAt (datetime) --
The timestamp when the view was created.
updatedAt (datetime) --
The timestamp when the view was last updated.
arn (string) --
The ARN of the view.
Retrieves the details of a space by ID.
See also: AWS API Documentation
Request Syntax
client.get_space(
spaceId='string'
)
string
[REQUIRED]
The unique ID of the space.
dict
Response Syntax
{
'space': {
'spaceId': 'string',
'name': 'string',
'spaceArn': 'string',
'domainArn': 'string',
'region': 'string',
'ownerAccountId': 'string',
'dataAccessRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'agentCoreEvaluationRoleArn': 'string',
'status': 'ACTIVE'|'SUSPENDED'|'MOVING',
'statusReason': 'string',
'encryptionConfiguration': {
'encryptionStrategy': 'AWS_OWNED'|'CUSTOMER_MANAGED',
'kmsKeyArn': 'string'
}
}
}
Response Structure
(dict) --
space (dict) --
The details of the space.
spaceId (string) --
The unique ID of the space.
name (string) --
A name that identifies the space.
spaceArn (string) --
The Amazon Resource Name (ARN) of the space.
domainArn (string) --
The Amazon Resource Name (ARN) of the domain the space belongs to. Absent when the space is not associated with a domain, so callers must tolerate its absence.
region (string) --
The region where this space was created.
ownerAccountId (string) --
AWS account ID that owns this space.
dataAccessRoleArn (string) --
The ARN of the IAM role used for data access.
createdAt (datetime) --
The timestamp when the space was created.
updatedAt (datetime) --
The timestamp when the space was last updated.
agentCoreEvaluationRoleArn (string) --
The ARN of the IAM role used by AgentCore online evaluation. Absent when the space was created without one.
status (string) --
The status of the space.
statusReason (string) --
Reason for the current space status.
encryptionConfiguration (dict) --
How the space's data at rest is encrypted. Always populated: a space with no customer managed key reports encryptionStrategy AWS_OWNED and no kmsKeyArn.
encryptionStrategy (string) --
Which kind of key to use. Required.
kmsKeyArn (string) --
Customer managed KMS key ARN. Required when encryptionStrategy is CUSTOMER_MANAGED, and must be omitted when it is AWS_OWNED. Must be a symmetric ENCRYPT_DECRYPT key in the caller's account and region.
Lists fields available for telemetry queries.
Returns a list of fields included in the specified dataset, granular to telemetry type. Returned field names reflect the exact stored casing and are case-sensitive when referenced in query expressions; the query engine does not normalize identifier case.
See also: AWS API Documentation
Request Syntax
client.list_telemetry_fields(
dataSetName='string',
telemetryType='LOGS'|'TRACES',
startTime=datetime(2015, 1, 1),
endTime=datetime(2015, 1, 1),
nextToken='string'
)
string
[REQUIRED]
The name of the dataset to list fields for.
string
The type of telemetry to filter fields by.
datetime
Inclusive start of the lookback window. When omitted, the service defaults to the configured lookback before endTime.
datetime
Inclusive end of the lookback window. When omitted, the service defaults to the current time.
string
A token to retrieve the next page of results. Reserved for future pagination; the service does not paginate at this time and returns null.
dict
Response Syntax
{
'fields': [
{
'name': 'string',
'children': [
{'... recursive ...'},
]
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
fields (list) --
The list of fields available for queries.
(dict) --
A telemetry field available for use in query expressions.
name (string) --
The name of the field. Field names are case-sensitive and must be used exactly as returned when referencing them in query expressions.
children (list) --
Child fields nested under this field.
(dict) --
A telemetry field available for use in query expressions.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Lists the integrations in the account, optionally filtered by type, status, or name. Results are paginated.
See also: AWS API Documentation
Request Syntax
client.list_integrations(
integrationType='AWS_CONFIG_SLREC'|'SLACK'|'EXTERNAL_AGENT'|'AWS_INTEGRATION',
status='ACTIVE'|'DELETED'|'PENDING'|'PENDING_OAUTH'|'ERROR'|'FAILED',
name='string',
nextToken='string',
maxResults=123
)
string
Returns only integrations of this provider type.
string
Returns only integrations in this status.
string
Returns only the integration with this exact name.
string
Pagination token from a previous response; omit for the first page.
integer
Maximum number of integrations to return in one page.
dict
Response Syntax
{
'items': [
{
'integrationId': 'string',
'integrationArn': 'string',
'integrationType': 'AWS_CONFIG_SLREC'|'SLACK'|'EXTERNAL_AGENT'|'AWS_INTEGRATION',
'name': 'string',
'status': 'ACTIVE'|'DELETED'|'PENDING'|'PENDING_OAUTH'|'ERROR'|'FAILED',
'authType': 'NONE'|'OAUTH2'|'API_KEY',
'credentialArn': 'string',
'roleArn': 'string',
'integrationAttributes': {
'string': 'string'
},
'authorizationUrl': 'string',
'errorMessage': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'scope': 'ACCOUNT'|'ORGANIZATION'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
The response containing a page of integrations.
items (list) --
The page of integrations.
(dict) --
A connection between CloudWatch and an external system — such as a source of telemetry or configuration data, a messaging destination, or a model provider.
integrationId (string) --
The unique identifier of the integration.
integrationArn (string) --
The Amazon Resource Name (ARN) of the integration.
integrationType (string) --
The type of external system that an integration connects to, such as a source of configuration data, a messaging destination, or a model provider.
name (string) --
The customer-provided name of the integration.
status (string) --
The current lifecycle state of an integration.
authType (string) --
The authentication method that an integration uses to connect to its external system.
credentialArn (string) --
The Amazon Resource Name (ARN) of the secret that stores the integration's credentials.
roleArn (string) --
The Amazon Resource Name (ARN) of the IAM role that CloudWatch assumes to access the external system.
integrationAttributes (dict) --
Provider-specific key/value attributes that configure the integration.
(string) --
(string) --
authorizationUrl (string) --
The URL the customer visits to authorize the integration. Present while an OAuth authorization is pending.
errorMessage (string) --
A human-readable description of why the integration is in an ERROR or FAILED state. Present only when the integration has failed.
createdAt (datetime) --
The time at which the integration was created.
updatedAt (datetime) --
The time at which the integration was last updated.
scope (string) --
Whether this integration is account-scoped (ACCOUNT, customer-created) or organization-scoped (ORGANIZATION, created by an org-enablement rule). Absent on legacy records is treated as ACCOUNT.
nextToken (string) --
Pagination token for the next page; absent when there are no more results.
Retrieves a dashboard by ID within a space.
See also: AWS API Documentation
Request Syntax
client.get_omni_dashboard(
spaceId='string',
dashboardId='string'
)
string
[REQUIRED]
The unique ID of the space.
string
[REQUIRED]
The unique ID of the dashboard.
dict
Response Syntax
{
'omniDashboard': {
'dashboardId': 'string',
'arn': 'string',
'name': 'string',
'body': 'string',
'createdBy': 'string',
'description': 'string',
'tags': {
'string': 'string'
},
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
omniDashboard (dict) --
The dashboard.
dashboardId (string) --
The unique ID of the dashboard.
arn (string) --
The Amazon Resource Name (ARN) of the dashboard.
name (string) --
A name that identifies the dashboard.
body (string) --
The dashboard definition.
createdBy (string) --
The principal that created the dashboard.
description (string) --
An optional description of the dashboard.
tags (dict) --
The tags associated with the dashboard.
(string) --
Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.
(string) --
Tag value. AWS-standard maximum length; may be empty.
createdAt (datetime) --
The timestamp when the dashboard was created.
updatedAt (datetime) --
The timestamp when the dashboard was last updated.
Returns AccessGrants, with optional filtering by domain, space, principal, or permission. A grant is returned only when it matches every filter supplied. With no filters, returns the grants for the current account and Region.
See also: AWS API Documentation
Request Syntax
client.list_access_grants(
domainId='string',
spaceId='string',
principalId='string',
principalType='IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT'|'ACCESS_PROFILE'|'ALERT'|'AGENT',
permission='SPACE_ADMIN'|'READ'|'READ_WRITE_DELETE'|'CUSTOM',
nextToken='string',
maxResults=123
)
string
Filter by domain ID.
string
Filter by space ID.
string
Filter by principal ID.
string
Filter by principal type.
string
Filter by permission level.
string
A token to retrieve the next page of results. Supply the same filters used on the request that returned it. Tokens expire after 24 hours.
integer
The maximum number of access grants to return per page. Defaults to 100. A page can contain fewer results than this value even when more results remain; continue while nextToken is present.
dict
Response Syntax
{
'items': [
{
'grantId': 'string',
'grantArn': 'string',
'name': 'string',
'domainId': 'string',
'principal': {
'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT'|'ACCESS_PROFILE'|'ALERT'|'AGENT',
'principalId': 'string',
'principalAttributes': [
{
'key': 'string',
'value': 'string'
},
]
},
'permission': 'SPACE_ADMIN'|'READ'|'READ_WRITE_DELETE'|'CUSTOM',
'grantType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED',
'spaceId': 'string'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
items (list) --
The list of access grant summaries.
(dict) --
Summary of an AccessGrant. Call GetAccessGrant for the full grant.
grantId (string) --
The unique ID of the access grant.
grantArn (string) --
The Amazon Resource Name (ARN) of the access grant.
name (string) --
A name that identifies the access grant.
domainId (string) --
The ID of the domain the grant belongs to.
principal (dict) --
The principal receiving the grant.
principalType (string) --
The type of principal receiving the grant.
principalId (string) --
The ID of the principal receiving the grant.
principalAttributes (list) --
Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.
(dict) --
A single attribute condition used to match principals for attribute-based access.
key (string) --
The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.
value (string) --
The attribute value.
permission (string) --
The permission granted.
grantType (string) --
Who manages the grant.
spaceId (string) --
The space this grant applies to. Domain-scoped grants are returned by ListDomainAccessGrantsForOrganization instead.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Returns the caller's domains: the account-scoped domain and the organization-scoped domain, if either exists. At most two domains are returned.
See also: AWS API Documentation
Request Syntax
client.list_domains(
nextToken='string',
maxResults=123
)
string
A token to retrieve the next page of results. Tokens expire after 24 hours.
integer
The maximum number of domains to return per page. Defaults to 100.
dict
Response Syntax
{
'items': [
{
'domainId': 'string',
'domainArn': 'string',
'name': 'string',
'identityCenterInstanceArn': 'string',
'region': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'status': 'ACTIVE'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
items (list) --
The list of domain summaries.
(dict) --
Summary of a domain. Call GetDomain for the full domain.
domainId (string) --
The unique ID of the domain.
domainArn (string) --
The Amazon Resource Name (ARN) of the domain.
name (string) --
A name that identifies the domain.
identityCenterInstanceArn (string) --
Identity Center instance ARN configured for the domain. Absent for IAM-only domains.
region (string) --
The Region where this domain was created.
createdAt (datetime) --
The timestamp when the domain was created.
updatedAt (datetime) --
The timestamp when the domain was last updated.
status (string) --
Current status of the domain.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Searches Identity Center for users and groups in a domain. The domain must be configured with Identity Center.
To grant access to a result, pass its principalId to CreateAccessGrant with a principalType of IDC_USER for a user or IDC_GROUP for a group.
See also: AWS API Documentation
Request Syntax
client.search_principals(
domainId='string',
searchQuery='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The ID of the domain to search within.
string
[REQUIRED]
A search term to match against user names, display names, and IDs. Pass * to list all principals. Maximum 128 characters.
integer
The maximum number of results to return. Defaults to 10. Valid only when searchQuery is *; other searches reject this parameter and return at most 10 results.
string
A token to retrieve the next page of results. Valid only when searchQuery is *; other searches do not paginate and reject this parameter. Tokens expire after 24 hours.
dict
Response Syntax
{
'results': [
{
'principalId': 'string',
'principalType': 'USER'|'GROUP',
'displayName': 'string',
'userName': 'string',
'description': 'string'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
results (list) --
The list of matching principals.
(dict) --
A user or group matched by SearchPrincipals.
principalId (string) --
The unique ID of the principal.
principalType (string) --
Whether the principal is a user or a group.
displayName (string) --
The display name of the principal.
userName (string) --
The user name of the principal. Present for users only.
description (string) --
An optional description of the principal.
nextToken (string) --
A token to retrieve the next page of results, or null if there are no more results.
Retrieves the details of an organization domain by ID.
See also: AWS API Documentation
Request Syntax
client.get_domain_for_organization(
domainId='string'
)
string
[REQUIRED]
The ID of the organization domain.
dict
Response Syntax
{
'organizationDomain': {
'domainId': 'string',
'domainArn': 'string',
'name': 'string',
'domainEndpointUrl': 'string',
'customEndpointUrls': [
'string',
],
'organizationId': 'string',
'ownerAccountId': 'string',
'identityProviders': [
'IAM'|'IDC',
],
'identityProviderConfiguration': {
'identityCenterConfiguration': {
'identityCenterInstanceArn': 'string'
}
},
'identityCenterApplicationArn': 'string',
'region': 'string',
'status': 'ACTIVE',
'domainAccessRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
organizationDomain (dict) --
The details of the organization domain.
domainId (string) --
The unique ID of the organization domain.
domainArn (string) --
The Amazon Resource Name (ARN) of the organization domain.
name (string) --
A name that identifies the organization domain.
domainEndpointUrl (string) --
The HTTPS endpoint URL for accessing the organization domain.
customEndpointUrls (list) --
Additional endpoint URLs derived from the domain name.
(string) --
organizationId (string) --
The ID of the AWS Organization that owns the domain.
ownerAccountId (string) --
The AWS account ID that owns the organization domain.
identityProviders (list) --
The identity providers configured for the organization domain.
(string) --
Identity provider type for a domain. Determines which identity mechanisms are active for authentication.
identityProviderConfiguration (dict) --
Identity provider configuration for the organization domain.
identityCenterConfiguration (dict) --
Identity Center configuration. Required when identityProviders includes IDC.
identityCenterInstanceArn (string) --
Identity Center instance ARN
identityCenterApplicationArn (string) --
The ARN of the Identity Center application. Absent for IAM-only domains.
region (string) --
The Region where this organization domain was created.
status (string) --
Current status of the organization domain.
domainAccessRoleArn (string) --
The ARN of the customer-provided IAM role in the management account used for domain access.
createdAt (datetime) --
The timestamp when the organization domain was created.
updatedAt (datetime) --
The timestamp when the organization domain was last updated.