Skip to main content

groups

Creates, updates, deletes, gets or lists a groups resource.

Overview​

Namegroups
TypeResource
Idaws.identitystore.groups

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
created_atstring (date-time)The date and time the group was created.
created_bystringThe identifier of the user or system that created the group.
descriptionstringA string containing a description of the group. (pattern: <code>[\p{L}\p{M}\p{S}\p{N}\p{P}\t\n\r  　]+</code>)
display_namestringThe group’s display name value. The length limit is 1,024 characters. This value can consist of letters, accented characters, symbols, numbers, punctuation, tab, new line, carriage return, space, and nonbreaking space in this attribute. This value is specified at the time that the group is created and stored as an attribute of the group object in the identity store. (pattern: <code>[\p{L}\p{M}\p{S}\p{N}\p{P}\t\n\r  ]+</code>)
external_idsarrayA list of ExternalId objects that contains the identifiers issued to this resource by an external identity provider.
group_idstringThe identifier for a group in the identity store. (pattern: <code>([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}</code>)
identity_store_idstringThe globally unique identifier for the identity store. (pattern: <code>d-[0-9a-f]{10}$|^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}</code>)
updated_atstring (date-time)The date and time the group was last updated.
updated_bystringThe identifier of the user or system that last updated the group.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
describe_groupselectregionRetrieves the group metadata and attributes from GroupId in an identity store. If you have access to a member account, you can use this API operation from the member account. For more information, see Limiting access to the identity store from member accounts in the IAM Identity Center User Guide.
list_groupsselectregionLists all groups in the identity store. Returns a paginated list of complete Group objects. Filtering for a Group by the DisplayName attribute is deprecated. Instead, use the GetGroupId API action. If you have access to a member account, you can use this API operation from the member account. For more information, see Limiting access to the identity store from member accounts in the IAM Identity Center User Guide.
create_groupinsertregion, IdentityStoreIdCreates a group within the specified identity store.
update_groupupdateregion, IdentityStoreId, GroupId, OperationsUpdates the specified group metadata and attributes in the specified identity store.
delete_groupdeleteregionDelete a group within an identity store given GroupId.
is_member_in_groupsexecregion, IdentityStoreId, MemberId, GroupIdsChecks the user's membership in all requested groups and returns if the member exists in all queried groups. If you have access to a member account, you can use this API operation from the member account. For more information, see Limiting access to the identity store from member accounts in the IAM Identity Center User Guide.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
regionstringAWS region (default: us-east-1)

SELECT examples​

Retrieves the group metadata and attributes from GroupId in an identity store. If you have access to a member account, you can use this API operation from the member account. For more information, see Limiting access to the identity store from member accounts in the IAM Identity Center User Guide.

SELECT
created_at,
created_by,
description,
display_name,
external_ids,
group_id,
identity_store_id,
updated_at,
updated_by
FROM aws.identitystore.groups
WHERE region = '{{ region }}' -- required
;

INSERT examples​

Creates a group within the specified identity store.

INSERT INTO aws.identitystore.groups (
IdentityStoreId,
DisplayName,
Description,
region
)
SELECT 
'{{ IdentityStoreId }}' /* required */,
'{{ DisplayName }}',
'{{ Description }}',
'{{ region }}'
RETURNING
group_id,
identity_store_id
;

UPDATE examples​

Updates the specified group metadata and attributes in the specified identity store.

UPDATE aws.identitystore.groups
SET 
IdentityStoreId = '{{ IdentityStoreId }}',
GroupId = '{{ GroupId }}',
Operations = '{{ Operations }}'
WHERE 
region = '{{ region }}' --required
AND IdentityStoreId = '{{ IdentityStoreId }}' --required
AND GroupId = '{{ GroupId }}' --required
AND Operations = '{{ Operations }}' --required;

DELETE examples​

Delete a group within an identity store given GroupId.

DELETE FROM aws.identitystore.groups
WHERE region = '{{ region }}' --required
;

Lifecycle Methods​

Checks the user's membership in all requested groups and returns if the member exists in all queried groups. If you have access to a member account, you can use this API operation from the member account. For more information, see Limiting access to the identity store from member accounts in the IAM Identity Center User Guide.

EXEC aws.identitystore.groups.is_member_in_groups 
@region='{{ region }}' --required 
@@json=
'{
"IdentityStoreId": "{{ IdentityStoreId }}", 
"MemberId": "{{ MemberId }}", 
"GroupIds": "{{ GroupIds }}"
}'
;
Last updated on