principal_policies

Creates, updates, deletes, gets or lists a principal_policies resource.

Overview

Name	principal_policies
Type	Resource
Id	aws.iot.principal_policies

Fields

The following fields are returned by SELECT queries:

list_principal_policies

Name	Datatype	Description
policy_arn	string	The policy ARN.
policy_name	string	The policy name. (pattern: <code>[\w+=,.@-]+</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_principal_policies	select	x-amzn-iot-principal, region	marker, pageSize, isAscendingOrder	Lists the policies attached to the specified principal. If you use an Cognito identity, the ID must be in AmazonCognito Identity format. Note: This action is deprecated and works as expected for backward compatibility, but we won't add enhancements. Use ListAttachedPolicies instead. Requires permission to access the ListPrincipalPolicies action.
attach_principal_policy	update	policy_name, x-amzn-iot-principal, region		Attaches the specified policy to the specified principal (certificate or other credential). Note: This action is deprecated and works as expected for backward compatibility, but we won't add enhancements. Use AttachPolicy instead. Requires permission to access the AttachPrincipalPolicy action.
detach_principal_policy	exec	policy_name, x-amzn-iot-principal, region		Removes the specified policy from the specified certificate. Note: This action is deprecated and works as expected for backward compatibility, but we won't add enhancements. Use DetachPolicy instead. Requires permission to access the DetachPrincipalPolicy action.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
policy_name	string	The name of the policy to detach.
region	string	AWS region (default: us-east-1)
x-amzn-iot-principal	string	The principal. Valid principals are CertificateArn (arn:aws:iot:region:accountId:cert/certificateId), thingGroupArn (arn:aws:iot:region:accountId:thinggroup/groupName) and CognitoId (region:id).
isAscendingOrder	boolean	Specifies the order for results. If true, results are returned in ascending creation order.
marker	string	The marker for the next set of results.
pageSize	integer	The result page size.

SELECT examples

list_principal_policies

Lists the policies attached to the specified principal. If you use an Cognito identity, the ID must be in AmazonCognito Identity format. Note: This action is deprecated and works as expected for backward compatibility, but we won't add enhancements. Use ListAttachedPolicies instead. Requires permission to access the ListPrincipalPolicies action.

SELECT
policy_arn,
policy_name
FROM aws.iot.principal_policies
WHERE `x-amzn-iot-principal` = '{{ x-amzn-iot-principal }}' -- required
AND region = '{{ region }}' -- required
AND marker = '{{ marker }}'
AND pageSize = '{{ pageSize }}'
AND isAscendingOrder = '{{ isAscendingOrder }}'
;

UPDATE examples

attach_principal_policy

Attaches the specified policy to the specified principal (certificate or other credential). Note: This action is deprecated and works as expected for backward compatibility, but we won't add enhancements. Use AttachPolicy instead. Requires permission to access the AttachPrincipalPolicy action.

UPDATE aws.iot.principal_policies
SET 
-- No updatable properties
WHERE 
policy_name = '{{ policy_name }}' --required
AND `x-amzn-iot-principal` = '{{ x-amzn-iot-principal }}' --required
AND region = '{{ region }}' --required;

Lifecycle Methods

detach_principal_policy

Removes the specified policy from the specified certificate. Note: This action is deprecated and works as expected for backward compatibility, but we won't add enhancements. Use DetachPolicy instead. Requires permission to access the DetachPrincipalPolicy action.

EXEC aws.iot.principal_policies.detach_principal_policy 
@policy_name='{{ policy_name }}' --required, 
@x-amzn-iot-principal='{{ x-amzn-iot-principal }}' --required, 
@region='{{ region }}' --required
;