AgentsforBedrockRuntime / Client / get_ingested_document_acl

get_ingested_document_acl

AgentsforBedrockRuntime.Client.get_ingested_document_acl(**kwargs)

Retrieves the ingested access control list (ACL) for a specific document in a knowledge base. Use this operation to inspect the allow and deny lists that were ingested for a document to troubleshoot access control issues. To use this operation, you must have the bedrock:GetIngestedDocumentAcl permission.

See also: AWS API Documentation

Request Syntax

response = client.get_ingested_document_acl(
    dataSourceId='string',
    documentId='string',
    knowledgeBaseId='string'
)

Parameters:

• dataSourceId (string) –

  [REQUIRED]

  The unique identifier of the data source that contains the document.

• documentId (string) –

  [REQUIRED]

  The unique identifier of the document to retrieve the ingested access control list (ACL) for.

• knowledgeBaseId (string) –

  [REQUIRED]

  The unique identifier of the knowledge base that contains the document.

Return type:

dict

Returns:

Response Syntax

{
    'documentAcl': {
        'allowList': {
            'conditions': [
                {
                    'conditionOperator': 'AND'|'OR',
                    'groups': [
                        {
                            'id': 'string',
                            'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
                        },
                    ],
                    'users': [
                        {
                            'id': 'string',
                            'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
                        },
                    ]
                },
            ],
            'memberRelation': 'AND'|'OR'
        },
        'denyList': {
            'conditions': [
                {
                    'conditionOperator': 'AND'|'OR',
                    'groups': [
                        {
                            'id': 'string',
                            'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
                        },
                    ],
                    'users': [
                        {
                            'id': 'string',
                            'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
                        },
                    ]
                },
            ],
            'memberRelation': 'AND'|'OR'
        }
    }
}

Response Structure

• (dict) –

  • documentAcl (dict) –

    The ingested document access control list (ACL) containing allow and deny membership information.

    • allowList (dict) –

      The list of principals allowed access to the document.

      • conditions (list) –

        The list of conditions that determine membership.

        • (dict) –

          A condition within a document access control list (ACL) membership, specifying users and groups that are evaluated together.

          • conditionOperator (string) –

            The logical operator for combining users and groups within this condition. Valid values: AND – Both a user match and a group match are required. OR – Either a user match or a group match is sufficient.

          • groups (list) –

            The list of group entries in this condition.

            • (dict) –

              A group entry within a document access control list (ACL) condition.

              • id (string) –

                The identifier of the group.

              • type (string) –

                The membership type indicating the scope of the group entry.

          • users (list) –

            The list of user entries in this condition.

            • (dict) –

              A user entry within a document access control list (ACL) condition.

              • id (string) –

                The identifier of the user.

              • type (string) –

                The membership type indicating the scope of the user entry.

      • memberRelation (string) –

        The logical relation between conditions. Valid values: AND – All conditions must match. OR – At least one condition must match.

    • denyList (dict) –

      The list of principals denied access to the document.

      • conditions (list) –

        The list of conditions that determine membership.

        • (dict) –

          A condition within a document access control list (ACL) membership, specifying users and groups that are evaluated together.

          • conditionOperator (string) –

            The logical operator for combining users and groups within this condition. Valid values: AND – Both a user match and a group match are required. OR – Either a user match or a group match is sufficient.

          • groups (list) –

            The list of group entries in this condition.

            • (dict) –

              A group entry within a document access control list (ACL) condition.

              • id (string) –

                The identifier of the group.

              • type (string) –

                The membership type indicating the scope of the group entry.

          • users (list) –

            The list of user entries in this condition.

            • (dict) –

              A user entry within a document access control list (ACL) condition.

              • id (string) –

                The identifier of the user.

              • type (string) –

                The membership type indicating the scope of the user entry.

      • memberRelation (string) –

        The logical relation between conditions. Valid values: AND – All conditions must match. OR – At least one condition must match.

Exceptions

• AgentsforBedrockRuntime.Client.exceptions.ResourceNotFoundException

• AgentsforBedrockRuntime.Client.exceptions.ValidationException

• AgentsforBedrockRuntime.Client.exceptions.InternalServerException

• AgentsforBedrockRuntime.Client.exceptions.ThrottlingException

• AgentsforBedrockRuntime.Client.exceptions.AccessDeniedException