entitlements

Creates, updates, deletes, gets or lists an entitlements resource.

Overview

Name	entitlements
Type	Resource
Id	aws.account_access.entitlements

Fields

The following fields are returned by SELECT queries:

get_entitlement

Name	Datatype	Description
application_arn	string	The ARN of the application that the entitlement belongs to. (pattern: <code>arn:[a-z0-9-]+:account-access:[a-z0-9]+(-[a-z0-9]+)*:[0-9]{12}:application/[a-zA-Z0-9-]+</code>)
created_at	string (date-time)	The date and time when the entitlement was created.
entitlement	object	The entitlement details, including the principal, IAM role, and target account.
entitlement_id	string	The unique identifier of the entitlement.

list_entitlements

Name	Datatype	Description
created_at	string (date-time)	The date and time when the entitlement was created.
entitlement	object	The summary information for the entitlement.
entitlement_id	string	The unique identifier of the entitlement.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_entitlement	select	applicationArn, entitlement_id, region		Retrieves details about a specific entitlement for an account access manager application, including the principal, IAM role, and target account.
list_entitlements	select	region		Lists the entitlements for a specified account access manager application. You can filter results by principal, IAM role, or account. Use pagination to ensure that the operation returns quickly and successfully.
create_entitlement	insert	region, applicationArn, entitlement		Creates an entitlement (assignment) in account access manager. An entitlement (assignment) grants a principal (IAM Identity Center user or group) permission to assume a specified IAM role in an Amazon Web Services account. This operation is idempotent.
delete_entitlement	delete	applicationArn, entitlement_id, region		Deletes an entitlement from an account access manager application. This operation is idempotent; deleting an entitlement that has already been deleted does not return an error.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
applicationArn	string	Specifies the ARN of the application that the entitlement belongs to.
entitlement_id	string	Specifies the unique identifier of the entitlement to delete.
region	string	AWS region (default: us-east-1)

SELECT examples

get_entitlement

Retrieves details about a specific entitlement for an account access manager application, including the principal, IAM role, and target account.

SELECT
application_arn,
created_at,
entitlement,
entitlement_id
FROM aws.account_access.entitlements
WHERE applicationArn = '{{ applicationArn }}' -- required
AND entitlement_id = '{{ entitlement_id }}' -- required
AND region = '{{ region }}' -- required
;

list_entitlements

Lists the entitlements for a specified account access manager application. You can filter results by principal, IAM role, or account. Use pagination to ensure that the operation returns quickly and successfully.

SELECT
created_at,
entitlement,
entitlement_id
FROM aws.account_access.entitlements
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_entitlement

Creates an entitlement (assignment) in account access manager. An entitlement (assignment) grants a principal (IAM Identity Center user or group) permission to assume a specified IAM role in an Amazon Web Services account. This operation is idempotent.

INSERT INTO aws.account_access.entitlements (
applicationArn,
entitlement,
region
)
SELECT 
'{{ applicationArn }}' /* required */,
'{{ entitlement }}' /* required */,
'{{ region }}'
RETURNING
entitlement_id
;

Manifest

# Description fields are for documentation purposes
- name: entitlements
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the entitlements resource.
  - name: applicationArn
    value: "{{ applicationArn }}"
  - name: entitlement
    description: |
      Specifies the entitlement configuration for an account access manager application, defining which principal can assume which IAM role.
    value:
      principalRole:
        principal:
          identityCenter:
            userId: "{{ userId }}"
            groupId: "{{ groupId }}"
        roleArn: "{{ roleArn }}"

DELETE examples

delete_entitlement

Deletes an entitlement from an account access manager application. This operation is idempotent; deleting an entitlement that has already been deleted does not return an error.

DELETE FROM aws.account_access.entitlements
WHERE applicationArn = '{{ applicationArn }}' --required
AND entitlement_id = '{{ entitlement_id }}' --required
AND region = '{{ region }}' --required
;