CloudWatchOmni / Client / create_domain_access_grant_for_organization

create_domain_access_grant_for_organization

CloudWatchOmni.Client.create_domain_access_grant_for_organization(**kwargs)

Creates an AccessGrant that authorizes a principal to administer an organization domain.

See also: AWS API Documentation

Request Syntax

response = client.create_domain_access_grant_for_organization(
    domainId='string',
    name='string',
    principal={
        'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT',
        'principalId': 'string',
        'principalAttributes': [
            {
                'key': 'string',
                'value': 'string'
            },
        ]
    },
    permission='ADMIN',
    tags={
        'string': 'string'
    },
    clientToken='string'
)

Parameters:

• domainId (string) –

  [REQUIRED]

  The ID of the organization domain to create the grant on.

• name (string) –

  [REQUIRED]

  A name that identifies the access grant.

• principal (dict) –

  [REQUIRED]

  The principal receiving the grant.

  • principalType (string) – [REQUIRED]

    The type of principal receiving the grant.

  • principalId (string) –

    The ID of the principal receiving the grant.

  • principalAttributes (list) –

    Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.

    • (dict) –

      A single attribute condition used to match principals for attribute-based access.

      • key (string) – [REQUIRED]

        The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.

      • value (string) – [REQUIRED]

        The attribute value.

• permission (string) –

  [REQUIRED]

  The permission to grant.

• tags (dict) –

  The tags to associate with the access grant.

  • (string) –

    Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.

    • (string) –

      Tag value. AWS-standard maximum length; may be empty.

• clientToken (string) –

  Idempotency token for safe retries. Repeated requests with the same token return the original result instead of creating a duplicate.

  This field is autopopulated if not provided.

Return type:

dict

Returns:

Response Syntax

{
    'accessGrant': {
        'grantId': 'string',
        'grantArn': 'string',
        'name': 'string',
        'domainId': 'string',
        'principal': {
            'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT',
            'principalId': 'string',
            'principalAttributes': [
                {
                    'key': 'string',
                    'value': 'string'
                },
            ]
        },
        'permission': 'ADMIN',
        'grantType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED',
        'createdBy': 'string',
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

• (dict) –

  • accessGrant (dict) –

    The details of the created organization access grant.

    • grantId (string) –

      The unique ID of the access grant.

    • grantArn (string) –

      The Amazon Resource Name (ARN) of the access grant.

    • name (string) –

      A name that identifies the access grant.

    • domainId (string) –

      The ID of the organization domain the grant belongs to.

    • principal (dict) –

      The principal receiving the grant.

      • principalType (string) –

        The type of principal receiving the grant.

      • principalId (string) –

        The ID of the principal receiving the grant.

      • principalAttributes (list) –

        Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.

        • (dict) –

          A single attribute condition used to match principals for attribute-based access.

          • key (string) –

            The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.

          • value (string) –

            The attribute value.

    • permission (string) –

      The permission granted.

    • grantType (string) –

      Who manages the grant.

    • createdBy (string) –

      The principal that created the grant.

    • createdAt (datetime) –

      The timestamp when the grant was created.

    • updatedAt (datetime) –

      The timestamp when the grant was last updated.

Exceptions

• CloudWatchOmni.Client.exceptions.ThrottlingException

• CloudWatchOmni.Client.exceptions.ValidationException

• CloudWatchOmni.Client.exceptions.ResourceNotFoundException

• CloudWatchOmni.Client.exceptions.AccessDeniedException

• CloudWatchOmni.Client.exceptions.InternalServerException

• CloudWatchOmni.Client.exceptions.ConflictException

• CloudWatchOmni.Client.exceptions.ServiceQuotaExceededException