resource_policies

Creates, updates, deletes, gets or lists a resource_policies resource.

Overview

Name	resource_policies
Type	Resource
Id	aws.amp.resource_policies

Fields

The following fields are returned by SELECT queries:

describe_resource_policy

Name	Datatype	Description
policy_document	string	The JSON policy document for the resource-based policy attached to the workspace.
policy_status	string	The current status of the resource-based policy. (CREATING, ACTIVE, UPDATING, DELETING)
revision_id	string	The revision ID of the current resource-based policy.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_resource_policy	select	workspace_id, region		Returns information about the resource-based policy attached to an Amazon Managed Service for Prometheus workspace.
put_resource_policy	replace	workspace_id, region, policyDocument		Creates or updates a resource-based policy for an Amazon Managed Service for Prometheus workspace. Use resource-based policies to grant permissions to other AWS accounts or services to access your workspace. Only Prometheus-compatible APIs can be used for workspace sharing. You can add non-Prometheus-compatible APIs to the policy, but they will be ignored. For more information, see Prometheus-compatible APIs in the Amazon Managed Service for Prometheus User Guide. If your workspace uses customer-managed KMS keys for encryption, you must grant the principals in your resource-based policy access to those KMS keys. You can do this by creating KMS grants. For more information, see CreateGrant in the AWS Key Management Service API Reference and Encryption at rest in the Amazon Managed Service for Prometheus User Guide. For more information about working with IAM, see Using Amazon Managed Service for Prometheus with IAM in the Amazon Managed Service for Prometheus User Guide.
delete_resource_policy	delete	workspace_id, region	clientToken, revisionId	Deletes the resource-based policy attached to an Amazon Managed Service for Prometheus workspace.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)
workspace_id	string	The ID of the workspace from which to delete the resource-based policy.
clientToken	string	A unique, case-sensitive identifier that you provide to ensure the request is safe to retry (idempotent).
revisionId	string	The revision ID of the policy to delete. Use this parameter to ensure that you are deleting the correct version of the policy.

SELECT examples

describe_resource_policy

Returns information about the resource-based policy attached to an Amazon Managed Service for Prometheus workspace.

SELECT
policy_document,
policy_status,
revision_id
FROM aws.amp.resource_policies
WHERE workspace_id = '{{ workspace_id }}' -- required
AND region = '{{ region }}' -- required
;

REPLACE examples

put_resource_policy

Creates or updates a resource-based policy for an Amazon Managed Service for Prometheus workspace. Use resource-based policies to grant permissions to other AWS accounts or services to access your workspace. Only Prometheus-compatible APIs can be used for workspace sharing. You can add non-Prometheus-compatible APIs to the policy, but they will be ignored. For more information, see Prometheus-compatible APIs in the Amazon Managed Service for Prometheus User Guide. If your workspace uses customer-managed KMS keys for encryption, you must grant the principals in your resource-based policy access to those KMS keys. You can do this by creating KMS grants. For more information, see CreateGrant in the AWS Key Management Service API Reference and Encryption at rest in the Amazon Managed Service for Prometheus User Guide. For more information about working with IAM, see Using Amazon Managed Service for Prometheus with IAM in the Amazon Managed Service for Prometheus User Guide.

REPLACE aws.amp.resource_policies
SET 
policyDocument = '{{ policyDocument }}',
clientToken = '{{ clientToken }}',
revisionId = '{{ revisionId }}'
WHERE 
workspace_id = '{{ workspace_id }}' --required
AND region = '{{ region }}' --required
AND policyDocument = '{{ policyDocument }}' --required
RETURNING
policy_status,
revision_id;

DELETE examples

delete_resource_policy

Deletes the resource-based policy attached to an Amazon Managed Service for Prometheus workspace.

DELETE FROM aws.amp.resource_policies
WHERE workspace_id = '{{ workspace_id }}' --required
AND region = '{{ region }}' --required
AND clientToken = '{{ clientToken }}'
AND revisionId = '{{ revisionId }}'
;