AccountAccess / Client / list_entitlements

list_entitlements

AccountAccess.Client.list_entitlements(**kwargs)

Lists the entitlements for a specified account access manager application. You can filter results by principal, IAM role, or account. Use pagination to ensure that the operation returns quickly and successfully.

See also: AWS API Documentation

Request Syntax

response = client.list_entitlements(
    applicationArn='string',
    filter={
        'principalRole': {
            'principal': {
                'identityCenter': {
                    'userId': 'string',
                    'groupId': 'string'
                }
            },
            'roleArn': 'string',
            'account': 'string'
        }
    },
    nextToken='string',
    maxResults=123
)
Parameters:

  • applicationArn (string) –

    [REQUIRED]

    Specifies the ARN of the application to list entitlements for.

  • filter (dict) –

    [REQUIRED]

    Specifies filter criteria to narrow the entitlements returned. You can filter by principal, IAM role, or account.

    • principalRole (dict) –

      The principal-to-role filter criteria for narrowing entitlement results.

      • principal (dict) –

        The principal to filter entitlements by.

        Note

        This is a Tagged Union structure. Only one of the following top level keys can be set: identityCenter.

        • identityCenter (dict) –

          The IAM Identity Center principal filter criteria.

          Note

          This is a Tagged Union structure. Only one of the following top level keys can be set: userId, groupId.

          • userId (string) –

            The unique identifier of a user in IAM Identity Center to filter by.

          • groupId (string) –

            The unique identifier of a group in IAM Identity Center to filter by.

      • roleArn (string) –

        The IAM role ARN to filter entitlements by.

      • account (string) –

        The 12-digit Amazon Web Services account ID to filter entitlements by.

  • nextToken (string) – Specifies the pagination token from a previous call to retrieve the next set of results.

  • maxResults (integer) – Specifies the maximum number of results to return in a single call.

Return type:

dict

Returns:

Response Syntax

{
    'entitlements': [
        {
            'entitlementId': 'string',
            'entitlement': {
                'principalRole': {
                    'principal': {
                        'identityCenter': {
                            'userId': 'string',
                            'groupId': 'string'
                        }
                    },
                    'roleArn': 'string',
                    'account': 'string',
                    'accountName': 'string'
                }
            },
            'createdAt': datetime(2015, 1, 1)
        },
    ],
    'nextToken': 'string'
}

Response Structure

  • (dict) –

    • entitlements (list) –

      The list of entitlements for the specified application.

      • (dict) –

        Contains information about an entitlement in a list result.

        • entitlementId (string) –

          The unique identifier of the entitlement.

        • entitlement (dict) –

          The summary information for the entitlement.

          Note

          This is a Tagged Union structure. Only one of the following top level keys will be set: principalRole. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

          'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}

          • principalRole (dict) –

            The principal-to-role mapping summary for the entitlement.

            • principal (dict) –

              The principal (user or group) that is granted access to assume the IAM role.

              Note

              This is a Tagged Union structure. Only one of the following top level keys will be set: identityCenter. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

              'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}

              • identityCenter (dict) –

                The IAM Identity Center principal (user or group).

                Note

                This is a Tagged Union structure. Only one of the following top level keys will be set: userId, groupId. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

                'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}

                • userId (string) –

                  The unique identifier of a user in IAM Identity Center.

                • groupId (string) –

                  The unique identifier of a group in IAM Identity Center.

            • roleArn (string) –

              The ARN of the IAM role that the principal can assume.

            • account (string) –

              The 12-digit Amazon Web Services account ID where the IAM role resides.

            • accountName (string) –

              The friendly name of the Amazon Web Services account where the IAM role resides.

        • createdAt (datetime) –

          The date and time when the entitlement was created.

    • nextToken (string) –

      The pagination token to use in a subsequent request to retrieve the next set of results. This value is null when there are no more results to return.

Exceptions