AccountAccess / Client / list_entitlements

list_entitlements

AccountAccess.Client.list_entitlements(**kwargs)

Lists the entitlements for a specified account access manager application. You can filter results by principal, IAM role, or account. Use pagination to ensure that the operation returns quickly and successfully.

See also: AWS API Documentation

Request Syntax

response = client.list_entitlements(
    applicationArn='string',
    filter={
        'principalRole': {
            'principal': {
                'identityCenter': {
                    'userId': 'string',
                    'groupId': 'string'
                }
            },
            'roleArn': 'string',
            'account': 'string'
        }
    },
    nextToken='string',
    maxResults=123
)

Parameters:

• applicationArn (string) –

  [REQUIRED]

  Specifies the ARN of the application to list entitlements for.

• filter (dict) –

  [REQUIRED]

  Specifies filter criteria to narrow the entitlements returned. You can filter by principal, IAM role, or account.

  • principalRole (dict) –

    The principal-to-role filter criteria for narrowing entitlement results.

    • principal (dict) –

      The principal to filter entitlements by.

      Note

      This is a Tagged Union structure. Only one of the following top level keys can be set: identityCenter.

      • identityCenter (dict) –

        The IAM Identity Center principal filter criteria.

        Note

        This is a Tagged Union structure. Only one of the following top level keys can be set: userId, groupId.

        • userId (string) –

          The unique identifier of a user in IAM Identity Center to filter by.

        • groupId (string) –

          The unique identifier of a group in IAM Identity Center to filter by.

    • roleArn (string) –

      The IAM role ARN to filter entitlements by.

    • account (string) –

      The 12-digit Amazon Web Services account ID to filter entitlements by.

• nextToken (string) – Specifies the pagination token from a previous call to retrieve the next set of results.

• maxResults (integer) – Specifies the maximum number of results to return in a single call.

Return type:

dict

Returns:

Response Syntax

{
    'entitlements': [
        {
            'entitlementId': 'string',
            'entitlement': {
                'principalRole': {
                    'principal': {
                        'identityCenter': {
                            'userId': 'string',
                            'groupId': 'string'
                        }
                    },
                    'roleArn': 'string',
                    'account': 'string',
                    'accountName': 'string'
                }
            },
            'createdAt': datetime(2015, 1, 1)
        },
    ],
    'nextToken': 'string'
}

Response Structure

• (dict) –

  • entitlements (list) –

    The list of entitlements for the specified application.

    • (dict) –

      Contains information about an entitlement in a list result.

      • entitlementId (string) –

        The unique identifier of the entitlement.

      • entitlement (dict) –

        The summary information for the entitlement.

        Note

        This is a Tagged Union structure. Only one of the following top level keys will be set: principalRole. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

        'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
        

        • principalRole (dict) –

          The principal-to-role mapping summary for the entitlement.

          • principal (dict) –

            The principal (user or group) that is granted access to assume the IAM role.

            Note

            This is a Tagged Union structure. Only one of the following top level keys will be set: identityCenter. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

            'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
            

            • identityCenter (dict) –

              The IAM Identity Center principal (user or group).

              Note

              This is a Tagged Union structure. Only one of the following top level keys will be set: userId, groupId. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

              'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
              

              • userId (string) –

                The unique identifier of a user in IAM Identity Center.

              • groupId (string) –

                The unique identifier of a group in IAM Identity Center.

          • roleArn (string) –

            The ARN of the IAM role that the principal can assume.

          • account (string) –

            The 12-digit Amazon Web Services account ID where the IAM role resides.

          • accountName (string) –

            The friendly name of the Amazon Web Services account where the IAM role resides.

      • createdAt (datetime) –

        The date and time when the entitlement was created.

  • nextToken (string) –

    The pagination token to use in a subsequent request to retrieve the next set of results. This value is null when there are no more results to return.

Exceptions

• AccountAccess.Client.exceptions.AccessDeniedException

• AccountAccess.Client.exceptions.ResourceNotFoundException

• AccountAccess.Client.exceptions.ThrottlingException

• AccountAccess.Client.exceptions.ValidationException

• AccountAccess.Client.exceptions.InternalServerException