Account Access Runtime

Returns temporary Amazon Web Services credentials for a role that you are entitled to assume within a tenant. You can use these credentials for programmatic access with the CLI or an Amazon Web Services SDK. If you aren't entitled to the role, the request fails with an AccessDeniedException error.

See also: AWS API Documentation

Request Syntax

client.get_role_credentials(
    tenantId='string',
    roleArn='string',
    accessType='PROGRAMMATIC_ACCESS',
    sessionName='string',
    sessionDuration=123
)

type tenantId:

string

param tenantId:

[REQUIRED]

The identifier of the tenant that the request applies to. A tenant ID begins with aa- and is 3 to 24 characters long. It can contain lowercase letters, numbers, and hyphens.

type roleArn:

string

param roleArn:

[REQUIRED]

The Amazon Resource Name (ARN) of the role to retrieve credentials for. You must be entitled to assume this role.

type accessType:

string

param accessType:

[REQUIRED]

The type of access to request for the role. Specify PROGRAMMATIC_ACCESS to receive access key credentials for use with the CLI or an Amazon Web Services SDK.

type sessionName:

string

param sessionName:

An optional name for the role session. The name can be 2 to 64 characters and can contain alphanumeric characters and the following symbols: plus (+), equal (=), comma (,), period (.), at (@), and hyphen (-). The session name appears in CloudTrail logs for the assumed role session.

type sessionDuration:

integer

param sessionDuration:

The duration, in seconds, that the returned credentials remain valid. If you don't specify a value, the service uses the default session duration. The maximum value can't exceed the maximum session duration configured for the role.

rtype:

dict

returns:

Response Syntax

{
    'credentialsDetails': {
        'programmaticAccess': {
            'accessKeyId': 'string',
            'secretAccessKey': 'string',
            'sessionToken': 'string',
            'expiresAt': datetime(2015, 1, 1)
        }
    }
}

Response Structure

• (dict) --

  • credentialsDetails (dict) --

    The temporary credentials that the service returns for the requested role.

    • programmaticAccess (dict) --

      The access key credentials returned for programmatic access with the CLI or an Amazon Web Services SDK.

      • accessKeyId (string) --

        The access key ID for the temporary credentials.

      • secretAccessKey (string) --

        The secret access key for the temporary credentials. Treat this value as a secret.

      • sessionToken (string) --

        The session token that you must include along with the access key ID and secret access key when you make requests with the temporary credentials.

      • expiresAt (datetime) --

        The date and time when the temporary credentials expire, after which they can no longer be used.

Returns the roles that you are entitled to access within a tenant. The results are paginated. Use a returned role with GetRoleCredentials to obtain temporary credentials.

See also: AWS API Documentation

Request Syntax

client.list_roles(
    tenantId='string',
    maxResults=123,
    nextToken='string'
)

type tenantId:

string

param tenantId:

[REQUIRED]

The identifier of the tenant whose roles you want to list. A tenant ID begins with aa- and is 3 to 24 characters long. It can contain lowercase letters, numbers, and hyphens.

type maxResults:

integer

param maxResults:

The maximum number of roles to return in a single response. If more roles are available than the specified value, the response includes a nextToken value that you can use to retrieve the next page of results. If you don't specify a value, the service uses a default page size.

type nextToken:

string

param nextToken:

The pagination token from a previous ListRoles response. Use it to retrieve the next page of results. Omit this parameter on the first call.

rtype:

dict

returns:

Response Syntax

{
    'roles': [
        {
            'accountId': 'string',
            'accountName': 'string',
            'roleArn': 'string'
        },
    ],
    'nextToken': 'string'
}

Response Structure

• (dict) --

  • roles (list) --

    The list of roles that you can access in the tenant. Each entry describes an Amazon Web Services account and a role.

    • (dict) --

      Describes a role that you can access, including the Amazon Web Services account that contains the role and the role's ARN.

      • accountId (string) --

        The 12-digit identifier of the Amazon Web Services account that contains the role.

      • accountName (string) --

        The display name of the Amazon Web Services account, if available. This value can be absent when the account name can't be resolved.

      • roleArn (string) --

        The Amazon Resource Name (ARN) of the role that you can access.

  • nextToken (string) --

    The pagination token to include in a subsequent ListRoles request to retrieve the next page of results. This value is absent when there are no more results to return.