AccountAccess / Client / create_entitlement

create_entitlement¶

AccountAccess.Client.create_entitlement(**kwargs)¶

Creates an entitlement (assignment) in account access manager. An entitlement (assignment) grants a principal (IAM Identity Center user or group) permission to assume a specified IAM role in an Amazon Web Services account. This operation is idempotent.

Request Syntax

response = client.create_entitlement(
    applicationArn='string',
    entitlement={
        'principalRole': {
            'principal': {
                'identityCenter': {
                    'userId': 'string',
                    'groupId': 'string'
                }
            },
            'roleArn': 'string'
        }
    }
)

Parameters:

applicationArn (string) –
[REQUIRED]

Specifies the ARN of the application to create the entitlement for.
entitlement (dict) –
[REQUIRED]

Specifies the entitlement configuration, including the principal and the IAM role to grant access to.

Note
This is a Tagged Union structure. Only one of the following top level keys can be set: principalRole.
- principalRole (dict) –
  
  The principal-to-role mapping for the entitlement.
  - principal (dict) – [REQUIRED]
    
    The principal (user or group) that is granted access to assume the IAM role.
    
    Note
    This is a Tagged Union structure. Only one of the following top level keys can be set: identityCenter.
    - identityCenter (dict) –
      
      The IAM Identity Center principal (user or group).
      
      Note
      This is a Tagged Union structure. Only one of the following top level keys can be set: userId, groupId.
      - userId (string) –
        
        The unique identifier of a user in IAM Identity Center.
      - groupId (string) –
        
        The unique identifier of a group in IAM Identity Center.
  - roleArn (string) – [REQUIRED]
    
    The ARN of the IAM role that the principal can assume.

Return type:

dict

Returns:

Response Syntax

{
    'entitlementId': 'string'
}

Response Structure

(dict) –
- entitlementId (string) –
  
  The unique identifier of the created entitlement.

Exceptions

AccountAccess.Client.exceptions.AccessDeniedException
AccountAccess.Client.exceptions.ResourceNotFoundException
AccountAccess.Client.exceptions.ThrottlingException
AccountAccess.Client.exceptions.ConflictException
AccountAccess.Client.exceptions.ValidationException
AccountAccess.Client.exceptions.ServiceQuotaExceededException
AccountAccess.Client.exceptions.InternalServerException