AWS Single Sign-On Admin

2026/11/12 - AWS Single Sign-On Admin - 2 updated api methods

Changes  Adds support for Network Controls on IAM Identity Center instances. You can now require that access to your instance and AWS managed applications originate from VPC endpoints in your organization, and optionally narrow that perimeter to specific VPCs, IP ranges, or application exceptions.

DescribeInstance (updated) Link ¶
Changes (response) 
{'NetworkConfigurationDetails': {'AllowSourceIps': ['string'],
                                 'ExcludeApplicationArns': ['string'],
                                 'RestrictSourceVpcs': ['string'],
                                 'VpceAccessRequired': 'boolean'}}

Returns the details of an instance of IAM Identity Center. The status can be one of the following:

  • CREATE_IN_PROGRESS - The instance is in the process of being created. When the instance is ready for use, DescribeInstance returns the status of ACTIVE. While the instance is in the CREATE_IN_PROGRESS state, you can call only DescribeInstance and DeleteInstance operations.

  • DELETE_IN_PROGRESS - The instance is being deleted. Returns AccessDeniedException after the delete operation completes.

  • ACTIVE - The instance is active.

See also: AWS API Documentation

Request Syntax

client.describe_instance(
    InstanceArn='string'
)
type InstanceArn:

string

param InstanceArn:

[REQUIRED]

The ARN of the instance of IAM Identity Center under which the operation will run.

rtype:

dict

returns:

Response Syntax

{
    'InstanceArn': 'string',
    'IdentityStoreId': 'string',
    'IdentityStoreArn': 'string',
    'OwnerAccountId': 'string',
    'Name': 'string',
    'CreatedDate': datetime(2015, 1, 1),
    'Status': 'CREATE_IN_PROGRESS'|'CREATE_FAILED'|'DELETE_IN_PROGRESS'|'ACTIVE',
    'StatusReason': 'string',
    'PrimaryRegion': 'string',
    'Regions': [
        {
            'RegionName': 'string',
            'Status': 'ACTIVE'|'ADDING'|'REMOVING',
            'AddedDate': datetime(2015, 1, 1),
            'IsPrimaryRegion': True|False
        },
    ],
    'EncryptionConfigurationDetails': {
        'KeyType': 'AWS_OWNED_KMS_KEY'|'CUSTOMER_MANAGED_KEY',
        'KmsKeyArn': 'string',
        'EncryptionStatus': 'UPDATING'|'ENABLED'|'UPDATE_FAILED',
        'EncryptionStatusReason': 'string'
    },
    'NetworkConfigurationDetails': {
        'VpceAccessRequired': True|False,
        'RestrictSourceVpcs': [
            'string',
        ],
        'AllowSourceIps': [
            'string',
        ],
        'ExcludeApplicationArns': [
            'string',
        ]
    },
    'PermissionSetsEnabled': True|False
}

Response Structure

  • (dict) --

    • InstanceArn (string) --

      The ARN of the instance of IAM Identity Center under which the operation will run. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    • IdentityStoreId (string) --

      The identifier of the identity store that is connected to the instance of IAM Identity Center.

    • IdentityStoreArn (string) --

      The ARN of the identity store that is connected to the instance of IAM Identity Center.

    • OwnerAccountId (string) --

      The identifier of the Amazon Web Services account for which the instance was created.

    • Name (string) --

      Specifies the instance name.

    • CreatedDate (datetime) --

      The date the instance was created.

    • Status (string) --

      The status of the instance.

    • StatusReason (string) --

      Provides additional context about the current status of the IAM Identity Center instance. This field is particularly useful when an instance is in a non-ACTIVE state, such as CREATE_FAILED. When an instance fails to create or update, this field contains information about the cause, which may include issues with KMS key configuration, permission problems with the specified KMS key, or service-related errors.

    • PrimaryRegion (string) --

      The primary Region where the IAM Identity Center instance was originally enabled. The primary Region cannot be removed.

    • Regions (list) --

      The list of Regions enabled in the IAM Identity Center instance, including Regions with ACTIVE, ADDING, or REMOVING status.

      • (dict) --

        Contains information about an enabled Region of an IAM Identity Center instance, including the Region name, status, date added, and whether it is the primary Region.

        • RegionName (string) --

          The Amazon Web Services Region name.

        • Status (string) --

          The current status of the Region. Valid values are ACTIVE (Region is operational), ADDING (Region extension workflow is in progress), or REMOVING (Region removal workflow is in progress).

        • AddedDate (datetime) --

          The timestamp when the Region was added to the IAM Identity Center instance. For the primary Region, this is the instance creation time.

        • IsPrimaryRegion (boolean) --

          Indicates whether this is the primary Region where the IAM Identity Center instance was originally enabled. The primary Region cannot be removed.

    • EncryptionConfigurationDetails (dict) --

      Contains the encryption configuration for your IAM Identity Center instance, including the encryption status, KMS key type, and KMS key ARN.

      • KeyType (string) --

        The type of KMS key used for encryption.

      • KmsKeyArn (string) --

        The ARN of the KMS key currently used to encrypt data in your IAM Identity Center instance.

      • EncryptionStatus (string) --

        The current status of encryption configuration.

      • EncryptionStatusReason (string) --

        Provides additional context about the current encryption status. This field is particularly useful when the encryption status is UPDATE_FAILED. When encryption configuration update fails, this field contains information about the cause, which may include KMS key access issues, key not found errors, invalid key configuration, key in an invalid state, or a disabled key.

    • NetworkConfigurationDetails (dict) --

      The network access controls configured for your Identity Center instance, including whether VPC endpoint access is required, and any VPC, IP address range, or application controls applied to instance traffic. Present only after a network configuration has been set on the instance.

      • VpceAccessRequired (boolean) --

        Specifies whether access to your Identity Center instance and to applications must originate from a VPC endpoint. When this value is true and no other field is specified, access is allowed from any VPC in your organization, or from any VPC in the Amazon Web Services account for an account instance, and applies to all applications. When this value is false, no network access control is enforced and the values of RestrictSourceVpcs, AllowSourceIps, and ExcludeApplicationArns are cleared.

      • RestrictSourceVpcs (list) --

        Limits access to the VPC endpoints in the VPCs that you specify. These VPCs must be in your organization, or in the Amazon Web Services account for an account instance. If you don't specify this value, access is allowed from any VPC in your organization or Amazon Web Services account.

        • (string) --

      • AllowSourceIps (list) --

        Allows access from the IPv4 or IPv6 CIDR blocks that you specify, in addition to the VPCs allowed by RestrictSourceVpcs. If you don't specify this value, no additional IP address ranges are allowed.

        • (string) --

      • ExcludeApplicationArns (list) --

        Exempts the applications that you specify from the network access control, so that access to them is unchanged. You can specify both Amazon Web Services managed applications and customer managed applications, and you can use wildcards. These applications are not restricted by RestrictSourceVpcs or AllowSourceIps. If you don't specify this value, the controls apply to all applications.

        • (string) --

    • PermissionSetsEnabled (boolean) --

      Indicates whether permission sets are enabled for this Identity Center instance.

UpdateInstance (updated) Link ¶
Changes (request) 
{'NetworkConfiguration': {'AllowSourceIps': ['string'],
                          'ExcludeApplicationArns': ['string'],
                          'RestrictSourceVpcs': ['string'],
                          'VpceAccessRequired': 'boolean'}}

Update the details for the instance of IAM Identity Center that is owned by the Amazon Web Services account.

In a single UpdateInstance request, you can perform only one of the following operations:

  • Update the encryption configuration of the instance by specifying EncryptionConfiguration.

  • Enable permission sets for the instance by specifying PermissionSetsEnabled.

  • Update the network configuration of the instance by specifying NetworkConfiguration.

A request that specifies more than one of EncryptionConfiguration, PermissionSetsEnabled, and NetworkConfiguration returns a ValidationException. To perform more than one of these operations, call UpdateInstance separately for each. The calls can be made in parallel.

See also: AWS API Documentation

Request Syntax

client.update_instance(
    Name='string',
    InstanceArn='string',
    EncryptionConfiguration={
        'KeyType': 'AWS_OWNED_KMS_KEY'|'CUSTOMER_MANAGED_KEY',
        'KmsKeyArn': 'string'
    },
    PermissionSetsEnabled=True|False,
    NetworkConfiguration={
        'VpceAccessRequired': True|False,
        'RestrictSourceVpcs': [
            'string',
        ],
        'AllowSourceIps': [
            'string',
        ],
        'ExcludeApplicationArns': [
            'string',
        ]
    }
)
type Name:

string

param Name:

Updates the instance name.

type InstanceArn:

string

param InstanceArn:

[REQUIRED]

The ARN of the instance of IAM Identity Center under which the operation will run. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

type EncryptionConfiguration:

dict

param EncryptionConfiguration:

Specifies the encryption configuration for your IAM Identity Center instance. You can use this to configure customer managed KMS keys or Amazon Web Services owned KMS keys for encrypting your instance data.

  • KeyType (string) -- [REQUIRED]

    The type of KMS key used for encryption.

  • KmsKeyArn (string) --

    The ARN of the KMS key used to encrypt data. Required when KeyType is CUSTOMER_MANAGED_KEY. Cannot be specified when KeyType is AWS_OWNED_KMS_KEY.

type PermissionSetsEnabled:

boolean

param PermissionSetsEnabled:

Enables permission sets for this Identity Center instance. The only accepted value is ``true ``. After permission sets are enabled, they cannot be disabled.

type NetworkConfiguration:

dict

param NetworkConfiguration:

Specifies the network access controls for your Identity Center instance. Use this to require that access to your instance and to applications originates from VPC endpoints, and to optionally restrict which VPCs are permitted, allow specific IP address ranges that bypass the VPC endpoint requirement, or exempt specific applications from the controls.

If you omit NetworkConfiguration, the stored network configuration is preserved. If you specify NetworkConfiguration, it replaces the stored network configuration in its entirety. Any list that you omit from the object, or include as an empty list, is cleared.

  • VpceAccessRequired (boolean) -- [REQUIRED]

    Specifies whether access to your Identity Center instance and to applications must originate from a VPC endpoint. When this value is true and no other field is specified, access is allowed from any VPC in your organization, or from any VPC in the Amazon Web Services account for an account instance, and applies to all applications. When this value is false, no network access control is enforced and the values of RestrictSourceVpcs, AllowSourceIps, and ExcludeApplicationArns are cleared.

  • RestrictSourceVpcs (list) --

    Limits access to the VPC endpoints in the VPCs that you specify. These VPCs must be in your organization, or in the Amazon Web Services account for an account instance. If you don't specify this value, access is allowed from any VPC in your organization or Amazon Web Services account.

    • (string) --

  • AllowSourceIps (list) --

    Allows access from the IPv4 or IPv6 CIDR blocks that you specify, in addition to the VPCs allowed by RestrictSourceVpcs. If you don't specify this value, no additional IP address ranges are allowed.

    • (string) --

  • ExcludeApplicationArns (list) --

    Exempts the applications that you specify from the network access control, so that access to them is unchanged. You can specify both Amazon Web Services managed applications and customer managed applications, and you can use wildcards. These applications are not restricted by RestrictSourceVpcs or AllowSourceIps. If you don't specify this value, the controls apply to all applications.

    • (string) --

rtype:

dict

returns:

Response Syntax

{}

Response Structure

  • (dict) --