CloudWatchOmni / Client / list_access_grants

list_access_grants¶

CloudWatchOmni.Client.list_access_grants(**kwargs)¶

Returns AccessGrants, with optional filtering by domain, space, principal, or permission. A grant is returned only when it matches every filter supplied. With no filters, returns the grants for the current account and Region.

Request Syntax

response = client.list_access_grants(
    domainId='string',
    spaceId='string',
    principalId='string',
    principalType='IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT'|'ACCESS_PROFILE'|'ALERT'|'AGENT',
    permission='SPACE_ADMIN'|'READ'|'READ_WRITE_DELETE'|'CUSTOM',
    nextToken='string',
    maxResults=123
)

Parameters:

domainId (string) – Filter by domain ID.
spaceId (string) – Filter by space ID.
principalId (string) – Filter by principal ID.
principalType (string) – Filter by principal type.
permission (string) – Filter by permission level.
nextToken (string) – A token to retrieve the next page of results. Supply the same filters used on the request that returned it. Tokens expire after 24 hours.
maxResults (integer) – The maximum number of access grants to return per page. Defaults to 100. A page can contain fewer results than this value even when more results remain; continue while nextToken is present.

Return type:

dict

Returns:

Response Syntax

{
    'items': [
        {
            'grantId': 'string',
            'grantArn': 'string',
            'name': 'string',
            'domainId': 'string',
            'principal': {
                'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT'|'ACCESS_PROFILE'|'ALERT'|'AGENT',
                'principalId': 'string',
                'principalAttributes': [
                    {
                        'key': 'string',
                        'value': 'string'
                    },
                ]
            },
            'permission': 'SPACE_ADMIN'|'READ'|'READ_WRITE_DELETE'|'CUSTOM',
            'grantType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED',
            'spaceId': 'string'
        },
    ],
    'nextToken': 'string'
}

Response Structure

(dict) –
- items (list) –
  
  The list of access grant summaries.
  - (dict) –
    
    Summary of an AccessGrant. Call GetAccessGrant for the full grant.
    - grantId (string) –
      
      The unique ID of the access grant.
    - grantArn (string) –
      
      The Amazon Resource Name (ARN) of the access grant.
    - name (string) –
      
      A name that identifies the access grant.
    - domainId (string) –
      
      The ID of the domain the grant belongs to.
    - principal (dict) –
      
      The principal receiving the grant.
      - principalType (string) –
        
        The type of principal receiving the grant.
      - principalId (string) –
        
        The ID of the principal receiving the grant.
      - principalAttributes (list) –
        
        Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.
        
        (dict) –
        
        A single attribute condition used to match principals for attribute-based access.
        
        key (string) –
        
        The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.
        
        value (string) –
        
        The attribute value.
    - permission (string) –
      
      The permission granted.
    - grantType (string) –
      
      Who manages the grant.
    - spaceId (string) –
      
      The space this grant applies to. Domain-scoped grants are returned by ListDomainAccessGrantsForOrganization instead.
- nextToken (string) –
  
  A token to retrieve the next page of results, or null if there are no more results.

Exceptions

CloudWatchOmni.Client.exceptions.ThrottlingException
CloudWatchOmni.Client.exceptions.ValidationException
CloudWatchOmni.Client.exceptions.ResourceNotFoundException
CloudWatchOmni.Client.exceptions.AccessDeniedException
CloudWatchOmni.Client.exceptions.InternalServerException