CreateMembersCommand

Suggest an Edit

CreateMembers is used to send invitations to accounts. For the organization behavior graph, the Detective administrator account uses CreateMembers to enable organization accounts as member accounts.

For invited accounts, CreateMembers sends a request to invite the specified Amazon Web Services accounts to be member accounts in the behavior graph. This operation can only be called by the administrator account for a behavior graph.

CreateMembers verifies the accounts and then invites the verified accounts. The administrator can optionally specify to not send invitation emails to the member accounts. This would be used when the administrator manages their member accounts centrally.

For organization accounts in the organization behavior graph, CreateMembers attempts to enable the accounts. The organization accounts do not receive invitations.

The request provides the behavior graph ARN and the list of accounts to invite or to enable.

The response separates the requested accounts into two lists:

  • The accounts that CreateMembers was able to process. For invited accounts, includes member accounts that are being verified, that have passed verification and are to be invited, and that have failed verification. For organization accounts in the organization behavior graph, includes accounts that can be enabled and that cannot be enabled.

  • The accounts that CreateMembers was unable to process. This list includes accounts that were already invited to be member accounts in the behavior graph.

Example Syntax

Use a bare-bones client and the command you need to make an API call.

import { DetectiveClient, CreateMembersCommand } from "@aws-sdk/client-detective"; // ES Modules import
// const { DetectiveClient, CreateMembersCommand } = require("@aws-sdk/client-detective"); // CommonJS import
const client = new DetectiveClient(config);
const input = { // CreateMembersRequest
  GraphArn: "STRING_VALUE", // required
  Message: "STRING_VALUE",
  DisableEmailNotification: true || false,
  Accounts: [ // AccountList // required
    { // Account
      AccountId: "STRING_VALUE", // required
      EmailAddress: "STRING_VALUE", // required
    },
  ],
};
const command = new CreateMembersCommand(input);
const response = await client.send(command);
// { // CreateMembersResponse
//   Members: [ // MemberDetailList
//     { // MemberDetail
//       AccountId: "STRING_VALUE",
//       EmailAddress: "STRING_VALUE",
//       GraphArn: "STRING_VALUE",
//       MasterId: "STRING_VALUE",
//       AdministratorId: "STRING_VALUE",
//       Status: "INVITED" || "VERIFICATION_IN_PROGRESS" || "VERIFICATION_FAILED" || "ENABLED" || "ACCEPTED_BUT_DISABLED",
//       DisabledReason: "VOLUME_TOO_HIGH" || "VOLUME_UNKNOWN",
//       InvitedTime: new Date("TIMESTAMP"),
//       UpdatedTime: new Date("TIMESTAMP"),
//       VolumeUsageInBytes: Number("long"),
//       VolumeUsageUpdatedTime: new Date("TIMESTAMP"),
//       PercentOfGraphUtilization: Number("double"),
//       PercentOfGraphUtilizationUpdatedTime: new Date("TIMESTAMP"),
//       InvitationType: "INVITATION" || "ORGANIZATION",
//       VolumeUsageByDatasourcePackage: { // VolumeUsageByDatasourcePackage
//         "<keys>": { // DatasourcePackageUsageInfo
//           VolumeUsageInBytes: Number("long"),
//           VolumeUsageUpdateTime: new Date("TIMESTAMP"),
//         },
//       },
//       DatasourcePackageIngestStates: { // DatasourcePackageIngestStates
//         "<keys>": "STARTED" || "STOPPED" || "DISABLED",
//       },
//     },
//   ],
//   UnprocessedAccounts: [ // UnprocessedAccountList
//     { // UnprocessedAccount
//       AccountId: "STRING_VALUE",
//       Reason: "STRING_VALUE",
//     },
//   ],
// };

CreateMembersCommand Input

See CreateMembersCommandInput for more details

Parameter
Type
Description
Accounts
Required
Account[] | undefined

The list of Amazon Web Services accounts to invite or to enable. You can invite or enable up to 50 accounts at a time. For each invited account, the account list contains the account identifier and the Amazon Web Services account root user email address. For organization accounts in the organization behavior graph, the email address is not required.

GraphArn
Required
string | undefined

The ARN of the behavior graph.

DisableEmailNotification
boolean | undefined

if set to true, then the invited accounts do not receive email notifications. By default, this is set to false, and the invited accounts receive email notifications.

Organization accounts in the organization behavior graph do not receive email notifications.

Message
string | undefined

Customized message text to include in the invitation email message to the invited member accounts.

CreateMembersCommand Output

See CreateMembersCommandOutput for details

Parameter
Type
Description
$metadata
Required
ResponseMetadata
Metadata pertaining to this request.
Members
MemberDetail[] | undefined

The set of member account invitation or enablement requests that Detective was able to process. This includes accounts that are being verified, that failed verification, and that passed verification and are being sent an invitation or are being enabled.

UnprocessedAccounts
UnprocessedAccount[] | undefined

The list of accounts for which Detective was unable to process the invitation or enablement request. For each account, the list provides the reason why the request could not be processed. The list includes accounts that are already member accounts in the behavior graph.

Throws

Name
Fault
Details
AccessDeniedException
client

The request issuer does not have permission to access this resource or perform this operation.

InternalServerException
server

The request was valid but failed because of a problem with the service.

ResourceNotFoundException
client

The request refers to a nonexistent resource.

ServiceQuotaExceededException
client

This request cannot be completed for one of the following reasons.

  • This request cannot be completed if it would cause the number of member accounts in the behavior graph to exceed the maximum allowed. A behavior graph cannot have more than 1,200 member accounts.

  • This request cannot be completed if the current volume ingested is above the limit of 10 TB per day. Detective will not allow you to add additional member accounts.

ValidationException
client

The request parameters are invalid.

DetectiveServiceException
Base exception class for all service exceptions from Detective service.