handshakes
Creates, updates, deletes, gets or lists a handshakes resource.
Overview
| Name | handshakes |
| Type | Resource |
| Id | aws.organizations.handshakes |
Fields
The following fields are returned by SELECT queries:
- describe_handshake
| Name | Datatype | Description |
|---|---|---|
action | string | The type of handshake: INVITE: Handshake sent to a standalone account requesting that it to join the sender's organization. ENABLE_ALL_FEATURES: Handshake sent to invited member accounts to enable all features for the organization. APPROVE_ALL_FEATURES: Handshake sent to the management account when all invited member accounts have approved to enable all features. TRANSFER_RESPONSIBILITY: Handshake sent to another organization's management account requesting that it designate the sender with the specified responsibilities for recipient's organization. (INVITE, ENABLE_ALL_FEATURES, APPROVE_ALL_FEATURES, ADD_ORGANIZATIONS_SERVICE_LINKED_ROLE, TRANSFER_RESPONSIBILITY) |
arn | string | Amazon Resource Name (ARN) for the handshake. For more information about ARNs in Organizations, see ARN Formats Supported by Organizations in the Amazon Web Services Service Authorization Reference. (pattern: <code>^arn:aws:organizations::\d{12}:handshake/o-[a-z0-9]{10,32}/[a-z_]{1,32}/h-[0-9a-z]{8,32}</code>) |
expiration_timestamp | string (date-time) | Timestamp when the handshake expires. |
id | string | ID for the handshake. The regex pattern for handshake ID string requires "h-" followed by from 8 to 32 lowercase letters or digits. (pattern: <code>^h-[0-9a-z]{8,32}$</code>) |
parties | array | An array of HandshakeParty objects. Contains details for participant in a handshake. |
requested_timestamp | string (date-time) | Timestamp when the handshake request was made. |
resources | array | An array of HandshakeResource objects. When needed, contains additional details for a handshake. For example, the email address for the sender. |
state | string | Current state for the handshake. REQUESTED: Handshake awaiting a response from the recipient. OPEN: Handshake sent to multiple recipients and all recipients have responded. The sender can now complete the handshake action. CANCELED: Handshake canceled by the sender. ACCEPTED: Handshake accepted by the recipient. DECLINED: Handshake declined by the recipient. EXPIRED: Handshake has expired. (REQUESTED, OPEN, CANCELED, ACCEPTED, DECLINED, EXPIRED) |
Methods
The following methods are available for this resource:
| Name | Accessible by | Required Params | Optional Params | Description |
|---|---|---|---|---|
describe_handshake | select | region | Returns details for a handshake. A handshake is the secure exchange of information between two Amazon Web Services accounts: a sender and a recipient. You can view ACCEPTED, DECLINED, or CANCELED handshakes in API Responses for 30 days before they are deleted. You can call this operation from any account in a organization. | |
accept_handshake | exec | region, HandshakeId | Accepts a handshake by sending an ACCEPTED response to the sender. You can view accepted handshakes in API responses for 30 days before they are deleted. Only the management account can accept the following handshakes: Enable all features final confirmation (APPROVE_ALL_FEATURES) Billing transfer (TRANSFER_RESPONSIBILITY) For more information, see Enabling all features and Responding to a billing transfer invitation in the Organizations User Guide. Only a member account can accept the following handshakes: Invitation to join (INVITE) Approve all features request (ENABLE_ALL_FEATURES) For more information, see Responding to invitations and Enabling all features in the Organizations User Guide. When a handshake is accepted, Organizations logs membership events in CloudTrail, available only in the management account's event history. If the account was standalone and joined a new organization, an AccountJoinedOrganization event is logged with joinedMethod:INVITED and joinedTime fields. If the account departed one organization and joined another, both an AccountDepartedOrganization event with departureMethod:LEFT and departureTime and an AccountJoinedOrganization event with joinedMethod:INVITED and joinedTime are logged in their respective management accounts. When a billing transfer (TRANSFER_RESPONSIBILITY) handshake is accepted, Organizations publishes a ResponsibilityTransferAccepted service event to CloudTrail. Each affected account receives this event, including upstream participants such as distributors in a chained transfer. For an example log entry, see Example log entries: AcceptResponsibilityTransfer in the Organizations User Guide. | |
cancel_handshake | exec | region, HandshakeId | Cancels a Handshake. Only the account that sent a handshake can call this operation. The recipient of the handshake can't cancel it, but can use DeclineHandshake to decline. After a handshake is canceled, the recipient can no longer respond to the handshake. You can view canceled handshakes in API responses for 30 days before they are deleted. | |
decline_handshake | exec | region, HandshakeId | Declines a Handshake. Only the account that receives a handshake can call this operation. The sender of the handshake can use CancelHandshake to cancel if the handshake hasn't yet been responded to. You can view canceled handshakes in API responses for 30 days before they are deleted. |
Parameters
Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.
| Name | Datatype | Description |
|---|---|---|
region | string | AWS region (default: us-east-1) |
SELECT examples
- describe_handshake
Returns details for a handshake. A handshake is the secure exchange of information between two Amazon Web Services accounts: a sender and a recipient. You can view ACCEPTED, DECLINED, or CANCELED handshakes in API Responses for 30 days before they are deleted. You can call this operation from any account in a organization.
SELECT
action,
arn,
expiration_timestamp,
id,
parties,
requested_timestamp,
resources,
state
FROM aws.organizations.handshakes
WHERE region = '{{ region }}' -- required
;
Lifecycle Methods
- accept_handshake
- cancel_handshake
- decline_handshake
Accepts a handshake by sending an ACCEPTED response to the sender. You can view accepted handshakes in API responses for 30 days before they are deleted. Only the management account can accept the following handshakes: Enable all features final confirmation (APPROVE_ALL_FEATURES) Billing transfer (TRANSFER_RESPONSIBILITY) For more information, see Enabling all features and Responding to a billing transfer invitation in the Organizations User Guide. Only a member account can accept the following handshakes: Invitation to join (INVITE) Approve all features request (ENABLE_ALL_FEATURES) For more information, see Responding to invitations and Enabling all features in the Organizations User Guide. When a handshake is accepted, Organizations logs membership events in CloudTrail, available only in the management account's event history. If the account was standalone and joined a new organization, an AccountJoinedOrganization event is logged with joinedMethod:INVITED and joinedTime fields. If the account departed one organization and joined another, both an AccountDepartedOrganization event with departureMethod:LEFT and departureTime and an AccountJoinedOrganization event with joinedMethod:INVITED and joinedTime are logged in their respective management accounts. When a billing transfer (TRANSFER_RESPONSIBILITY) handshake is accepted, Organizations publishes a ResponsibilityTransferAccepted service event to CloudTrail. Each affected account receives this event, including upstream participants such as distributors in a chained transfer. For an example log entry, see Example log entries: AcceptResponsibilityTransfer in the Organizations User Guide.
EXEC aws.organizations.handshakes.accept_handshake
@region='{{ region }}' --required
@@json=
'{
"HandshakeId": "{{ HandshakeId }}"
}'
;
Cancels a Handshake. Only the account that sent a handshake can call this operation. The recipient of the handshake can't cancel it, but can use DeclineHandshake to decline. After a handshake is canceled, the recipient can no longer respond to the handshake. You can view canceled handshakes in API responses for 30 days before they are deleted.
EXEC aws.organizations.handshakes.cancel_handshake
@region='{{ region }}' --required
@@json=
'{
"HandshakeId": "{{ HandshakeId }}"
}'
;
Declines a Handshake. Only the account that receives a handshake can call this operation. The sender of the handshake can use CancelHandshake to cancel if the handshake hasn't yet been responded to. You can view canceled handshakes in API responses for 30 days before they are deleted.
EXEC aws.organizations.handshakes.decline_handshake
@region='{{ region }}' --required
@@json=
'{
"HandshakeId": "{{ HandshakeId }}"
}'
;