AWS API Changes

2026/08/11 - Account Access - 11 new api methods

Changes Adds SDK support for AWS IAM account access manager, a feature that enables mapping of IAM roles to the users and groups in AWS IAM Identity Center.

ListEntitlements (new)

Link ¶

Lists the entitlements for a specified account access manager application. You can filter results by principal, IAM role, or account. Use pagination to ensure that the operation returns quickly and successfully.

See also: AWS API Documentation

Request Syntax

client.list_entitlements(
    applicationArn='string',
    filter={
        'principalRole': {
            'principal': {
                'identityCenter': {
                    'userId': 'string',
                    'groupId': 'string'
                }
            },
            'roleArn': 'string',
            'account': 'string'
        }
    },
    nextToken='string',
    maxResults=123
)

type applicationArn:

string

param applicationArn:

[REQUIRED]

Specifies the ARN of the application to list entitlements for.

type filter:

dict

param filter:

[REQUIRED]

Specifies filter criteria to narrow the entitlements returned. You can filter by principal, IAM role, or account.

principalRole (dict) --

The principal-to-role filter criteria for narrowing entitlement results.
- principal (dict) --
  
  The principal to filter entitlements by.
  
  Note
  
  This is a Tagged Union structure. Only one of the following top level keys can be set: identityCenter.
  - identityCenter (dict) --
    
    The IAM Identity Center principal filter criteria.
    
    Note
    
    This is a Tagged Union structure. Only one of the following top level keys can be set: userId, groupId.
    - userId (string) --
      
      The unique identifier of a user in IAM Identity Center to filter by.
    - groupId (string) --
      
      The unique identifier of a group in IAM Identity Center to filter by.
- roleArn (string) --
  
  The IAM role ARN to filter entitlements by.
- account (string) --
  
  The 12-digit Amazon Web Services account ID to filter entitlements by.

type nextToken:

string

param nextToken:

Specifies the pagination token from a previous call to retrieve the next set of results.

type maxResults:

integer

param maxResults:

Specifies the maximum number of results to return in a single call.

rtype:

dict

returns:

Response Syntax

{
    'entitlements': [
        {
            'entitlementId': 'string',
            'entitlement': {
                'principalRole': {
                    'principal': {
                        'identityCenter': {
                            'userId': 'string',
                            'groupId': 'string'
                        }
                    },
                    'roleArn': 'string',
                    'account': 'string',
                    'accountName': 'string'
                }
            },
            'createdAt': datetime(2015, 1, 1)
        },
    ],
    'nextToken': 'string'
}

Response Structure

(dict) --
- entitlements (list) --
  
  The list of entitlements for the specified application.
  - (dict) --
    
    Contains information about an entitlement in a list result.
    - entitlementId (string) --
      
      The unique identifier of the entitlement.
    - entitlement (dict) --
      
      The summary information for the entitlement.
      Note
      
      This is a Tagged Union structure. Only one of the following top level keys will be set: principalRole. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - principalRole (dict) --
        
        The principal-to-role mapping summary for the entitlement.
        
        principal (dict) --
        
        The principal (user or group) that is granted access to assume the IAM role.
        
        Note
        
        This is a Tagged Union structure. Only one of the following top level keys will be set: identityCenter. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
        
        'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
        
        identityCenter (dict) --
        
        The IAM Identity Center principal (user or group).
        
        Note
        
        This is a Tagged Union structure. Only one of the following top level keys will be set: userId, groupId. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
        
        'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
        
        userId (string) --
        
        The unique identifier of a user in IAM Identity Center.
        
        groupId (string) --
        
        The unique identifier of a group in IAM Identity Center.
        
        roleArn (string) --
        
        The ARN of the IAM role that the principal can assume.
        
        account (string) --
        
        The 12-digit Amazon Web Services account ID where the IAM role resides.
        
        accountName (string) --
        
        The friendly name of the Amazon Web Services account where the IAM role resides.
    - createdAt (datetime) --
      
      The date and time when the entitlement was created.
- nextToken (string) --
  
  The pagination token to use in a subsequent request to retrieve the next set of results. This value is null when there are no more results to return.

ListTagsForResource (new)

Link ¶

Lists the tags associated with an account access manager resource.

See also: AWS API Documentation

Request Syntax

client.list_tags_for_resource(
    resourceArn='string'
)

type resourceArn:

string

param resourceArn:

[REQUIRED]

Specifies the ARN of the resource to list tags for.

rtype:

dict

returns:

Response Syntax

{
    'tags': {
        'string': 'string'
    }
}

Response Structure

(dict) --
- tags (dict) --
  
  The tags associated with the resource.
  - (string) --
    - (string) --

DeleteEntitlement (new)

Link ¶

Deletes an entitlement from an account access manager application. This operation is idempotent; deleting an entitlement that has already been deleted does not return an error.

See also: AWS API Documentation

Request Syntax

client.delete_entitlement(
    applicationArn='string',
    entitlementId='string'
)

type applicationArn:

string

param applicationArn:

[REQUIRED]

Specifies the ARN of the application that the entitlement belongs to.

type entitlementId:

string

param entitlementId:

[REQUIRED]

Specifies the unique identifier of the entitlement to delete.

rtype:

dict

returns:

Response Syntax

{}

Response Structure

(dict) --

DeleteApplication (new)

Link ¶

Deletes an account access manager application. This operation is idempotent; deleting an application that has already been deleted does not return an error.

See also: AWS API Documentation

Request Syntax

client.delete_application(
    applicationArn='string'
)

type applicationArn:

string

param applicationArn:

[REQUIRED]

Specifies the ARN of the application to delete.

rtype:

dict

returns:

Response Syntax

{}

Response Structure

(dict) --

GetApplication (new)

Link ¶

Retrieves details about an account access manager application, including its status, identity source, and tags.

See also: AWS API Documentation

Request Syntax

client.get_application(
    applicationArn='string'
)

type applicationArn:

string

param applicationArn:

[REQUIRED]

Specifies the ARN of the application to retrieve.

rtype:

dict

returns:

Response Syntax

{
    'identitySource': {
        'identityCenter': {
            'instanceArn': 'string',
            'applicationArn': 'string'
        }
    },
    'status': 'CREATE_IN_PROGRESS'|'ACTIVE'|'DELETE_IN_PROGRESS'|'CREATE_FAILED'|'DELETE_FAILED',
    'tenantId': 'string',
    'createdAt': datetime(2015, 1, 1),
    'updatedAt': datetime(2015, 1, 1),
    'tags': {
        'string': 'string'
    },
    'error': {
        'code': 'AUTHORIZATION_ERROR'|'RESOURCE_NOT_FOUND_ERROR'|'SERVICE_QUOTA_EXCEEDED_ERROR'|'INTERNAL_SERVICE_ERROR',
        'message': 'string'
    }
}

Response Structure

(dict) --
- identitySource (dict) --
  
  The identity source details for the application, including the IAM Identity Center instance configuration.
  Note
  
  This is a Tagged Union structure. Only one of the following top level keys will be set: identityCenter. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
```
'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
```
  - identityCenter (dict) --
    
    The IAM Identity Center configuration details for the identity source.
    - instanceArn (string) --
      
      The ARN of the IAM Identity Center instance.
    - applicationArn (string) --
      
      The ARN of the IAM Identity Center application created for this account access manager application.
- status (string) --
  
  The current status of the application.
- tenantId (string) --
  
  The tenant identifier associated with the application.
- createdAt (datetime) --
  
  The date and time when the application was created.
- updatedAt (datetime) --
  
  The date and time when the application was last updated.
- tags (dict) --
  
  The tags associated with the application.
  - (string) --
    - (string) --
- error (dict) --
  
  The error details if the application is in a failed state.
  - code (string) --
    
    The error code that identifies the type of error.
  - message (string) --
    
    A human-readable message that describes the error.

TagResource (new)

Link ¶

Adds tags to an account access manager resource.

See also: AWS API Documentation

Request Syntax

client.tag_resource(
    resourceArn='string',
    tags={
        'string': 'string'
    }
)

type resourceArn:

string

param resourceArn:

[REQUIRED]

Specifies the ARN of the resource to add tags to.

type tags:

dict

param tags:

[REQUIRED]

Specifies the tags to add to the resource.

(string) --
- (string) --

rtype:

dict

returns:

Response Syntax

{}

Response Structure

(dict) --

GetEntitlement (new)

Link ¶

Retrieves details about a specific entitlement for an account access manager application, including the principal, IAM role, and target account.

See also: AWS API Documentation

Request Syntax

client.get_entitlement(
    applicationArn='string',
    entitlementId='string'
)

type applicationArn:

string

param applicationArn:

[REQUIRED]

Specifies the ARN of the application that the entitlement belongs to.

type entitlementId:

string

param entitlementId:

[REQUIRED]

Specifies the unique identifier of the entitlement to retrieve.

rtype:

dict

returns:

Response Syntax

{
    'applicationArn': 'string',
    'entitlementId': 'string',
    'entitlement': {
        'principalRole': {
            'principal': {
                'identityCenter': {
                    'userId': 'string',
                    'groupId': 'string'
                }
            },
            'roleArn': 'string',
            'account': 'string',
            'accountName': 'string'
        }
    },
    'createdAt': datetime(2015, 1, 1)
}

Response Structure

(dict) --
- applicationArn (string) --
  
  The ARN of the application that the entitlement belongs to.
- entitlementId (string) --
  
  The unique identifier of the entitlement.
- entitlement (dict) --
  
  The entitlement details, including the principal, IAM role, and target account.
  Note
  
  This is a Tagged Union structure. Only one of the following top level keys will be set: principalRole. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
```
'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
```
  - principalRole (dict) --
    
    The principal-to-role mapping details for the entitlement, including the target account.
    - principal (dict) --
      
      The principal (user or group) that is granted access to assume the IAM role.
      Note
      
      This is a Tagged Union structure. Only one of the following top level keys will be set: identityCenter. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - identityCenter (dict) --
        
        The IAM Identity Center principal (user or group).
        
        Note
        
        This is a Tagged Union structure. Only one of the following top level keys will be set: userId, groupId. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
        
        'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
        
        userId (string) --
        
        The unique identifier of a user in IAM Identity Center.
        
        groupId (string) --
        
        The unique identifier of a group in IAM Identity Center.
    - roleArn (string) --
      
      The ARN of the IAM role that the principal can assume.
    - account (string) --
      
      The 12-digit Amazon Web Services account ID where the IAM role resides.
    - accountName (string) --
      
      The friendly name of the Amazon Web Services account where the IAM role resides.
- createdAt (datetime) --
  
  The date and time when the entitlement was created.

ListApplications (new)

Link ¶

Lists the account access manager applications in your account. Use pagination to ensure that the operation returns quickly and successfully.

See also: AWS API Documentation

Request Syntax

client.list_applications(
    maxResults=123,
    nextToken='string'
)

type maxResults:

integer

param maxResults:

Specifies the maximum number of results to return in a single call.

type nextToken:

string

param nextToken:

Specifies the pagination token from a previous call to retrieve the next set of results.

rtype:

dict

returns:

Response Syntax

{
    'applications': [
        {
            'applicationArn': 'string',
            'tenantId': 'string',
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1)
        },
    ],
    'nextToken': 'string'
}

Response Structure

(dict) --
- applications (list) --
  
  The list of applications.
  - (dict) --
    
    Contains summary information about an account access manager application.
    - applicationArn (string) --
      
      The ARN of the application.
    - tenantId (string) --
      
      The tenant identifier associated with the application.
    - createdAt (datetime) --
      
      The date and time when the application was created.
    - updatedAt (datetime) --
      
      The date and time when the application was last updated.
- nextToken (string) --
  
  The pagination token to use in a subsequent request to retrieve the next set of results. This value is null when there are no more results to return.

CreateApplication (new)

Link ¶

Creates an account access manager instance and its Amazon Web Services account access application in the associated IAM Identity Center instance. This operation is idempotent; calling it multiple times with the same parameters returns the existing application.

See also: AWS API Documentation

Request Syntax

client.create_application(
    identitySource={
        'identityCenter': {
            'instanceArn': 'string'
        }
    },
    tags={
        'string': 'string'
    }
)

type identitySource:

dict

param identitySource:

[REQUIRED]

Specifies the identity source for the application. The identity source defines the IAM Identity Center instance that provides principals for entitlements.

identityCenter (dict) --

The IAM Identity Center instance to use as the identity source.
- instanceArn (string) -- [REQUIRED]
  
  The ARN of the IAM Identity Center instance.

type tags:

dict

param tags:

Specifies the tags to assign to the application.

(string) --
- (string) --

rtype:

dict

returns:

Response Syntax

{
    'applicationArn': 'string'
}

Response Structure

(dict) --
- applicationArn (string) --
  
  The Amazon Resource Name (ARN) of the created application.

CreateEntitlement (new)

Link ¶

Creates an entitlement (assignment) in account access manager. An entitlement (assignment) grants a principal (IAM Identity Center user or group) permission to assume a specified IAM role in an Amazon Web Services account. This operation is idempotent.

See also: AWS API Documentation

Request Syntax

client.create_entitlement(
    applicationArn='string',
    entitlement={
        'principalRole': {
            'principal': {
                'identityCenter': {
                    'userId': 'string',
                    'groupId': 'string'
                }
            },
            'roleArn': 'string'
        }
    }
)

type applicationArn:

string

param applicationArn:

[REQUIRED]

Specifies the ARN of the application to create the entitlement for.

type entitlement:

dict

param entitlement:

[REQUIRED]

Specifies the entitlement configuration, including the principal and the IAM role to grant access to.

principalRole (dict) --

The principal-to-role mapping for the entitlement.
- principal (dict) -- [REQUIRED]
  
  The principal (user or group) that is granted access to assume the IAM role.
  
  Note
  
  This is a Tagged Union structure. Only one of the following top level keys can be set: identityCenter.
  - identityCenter (dict) --
    
    The IAM Identity Center principal (user or group).
    
    Note
    
    This is a Tagged Union structure. Only one of the following top level keys can be set: userId, groupId.
    - userId (string) --
      
      The unique identifier of a user in IAM Identity Center.
    - groupId (string) --
      
      The unique identifier of a group in IAM Identity Center.
- roleArn (string) -- [REQUIRED]
  
  The ARN of the IAM role that the principal can assume.

rtype:

dict

returns:

Response Syntax

{
    'entitlementId': 'string'
}

Response Structure

(dict) --
- entitlementId (string) --
  
  The unique identifier of the created entitlement.

UntagResource (new)

Link ¶

Removes tags from an account access manager resource.

See also: AWS API Documentation

Request Syntax

client.untag_resource(
    resourceArn='string',
    tagKeys=[
        'string',
    ]
)

type resourceArn:

string

param resourceArn:

[REQUIRED]

Specifies the ARN of the resource to remove tags from.

type tagKeys:

list

param tagKeys:

[REQUIRED]

Specifies the tag keys to remove from the resource.

(string) --

rtype:

dict

returns:

Response Syntax

{}

Response Structure

(dict) --