template_group_access_control_entries

Creates, updates, deletes, gets or lists a template_group_access_control_entries resource.

Overview

Name	template_group_access_control_entries
Type	Resource
Id	aws.pca_connector_ad.template_group_access_control_entries

Fields

The following fields are returned by SELECT queries:

get_template_group_access_control_entry

Name	Datatype	Description
access_rights	object	Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.
created_at	string (date-time)	The date and time that the Access Control Entry was created.
group_display_name	string	Name of the Active Directory group. This name does not need to match the group name in Active Directory. (pattern: <code>^[\x20-\x7E]+$</code>)
group_security_identifier	string	Security identifier (SID) of the group object from Active Directory. The SID starts with "S-". (pattern: <code>^S-[0-9]-([0-9]+-){1,14}[0-9]+$</code>)
template_arn	string	The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. (pattern: <code>^arn:[\w-]+:pca-connector-ad:[\w-]+:[0-9]+:connector/[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}/template/[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$</code>)
updated_at	string (date-time)	The date and time that the Access Control Entry was updated.

list_template_group_access_control_entries

Name	Datatype	Description
access_rights	object	Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.
created_at	string (date-time)	The date and time that the Access Control Entry was created.
group_display_name	string	Name of the Active Directory group. This name does not need to match the group name in Active Directory. (pattern: <code>^[\x20-\x7E]+$</code>)
group_security_identifier	string	Security identifier (SID) of the group object from Active Directory. The SID starts with "S-". (pattern: <code>^S-[0-9]-([0-9]+-){1,14}[0-9]+$</code>)
template_arn	string	The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. (pattern: <code>^arn:[\w-]+:pca-connector-ad:[\w-]+:[0-9]+:connector/[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}/template/[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$</code>)
updated_at	string (date-time)	The date and time that the Access Control Entry was updated.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_template_group_access_control_entry	select	group_security_identifier, template_arn, region		Retrieves the group access control entries for a template.
list_template_group_access_control_entries	select	template_arn, region	MaxResults, NextToken	Lists group access control entries you created.
create_template_group_access_control_entry	insert	template_arn, region, AccessRights, GroupDisplayName, GroupSecurityIdentifier		Create a group access control entry. Allow or deny Active Directory groups from enrolling and/or autoenrolling with the template based on the group security identifiers (SIDs).
update_template_group_access_control_entry	update	group_security_identifier, template_arn, region		Update a group access control entry you created using CreateTemplateGroupAccessControlEntry.
delete_template_group_access_control_entry	delete	group_security_identifier, template_arn, region		Deletes a group access control entry.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
group_security_identifier	string	Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".
region	string	AWS region (default: us-east-1)
template_arn	string	The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.
MaxResults	integer	Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the NextToken element is sent in the response. Use this NextToken value in a subsequent request to retrieve additional items.
NextToken	string	Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received.

SELECT examples

get_template_group_access_control_entry

Retrieves the group access control entries for a template.

SELECT
access_rights,
created_at,
group_display_name,
group_security_identifier,
template_arn,
updated_at
FROM aws.pca_connector_ad.template_group_access_control_entries
WHERE group_security_identifier = '{{ group_security_identifier }}' -- required
AND template_arn = '{{ template_arn }}' -- required
AND region = '{{ region }}' -- required
;

list_template_group_access_control_entries

Lists group access control entries you created.

SELECT
access_rights,
created_at,
group_display_name,
group_security_identifier,
template_arn,
updated_at
FROM aws.pca_connector_ad.template_group_access_control_entries
WHERE template_arn = '{{ template_arn }}' -- required
AND region = '{{ region }}' -- required
AND MaxResults = '{{ MaxResults }}'
AND NextToken = '{{ NextToken }}'
;

INSERT examples

create_template_group_access_control_entry

Create a group access control entry. Allow or deny Active Directory groups from enrolling and/or autoenrolling with the template based on the group security identifiers (SIDs).

INSERT INTO aws.pca_connector_ad.template_group_access_control_entries (
AccessRights,
ClientToken,
GroupDisplayName,
GroupSecurityIdentifier,
template_arn,
region
)
SELECT 
'{{ AccessRights }}' /* required */,
'{{ ClientToken }}',
'{{ GroupDisplayName }}' /* required */,
'{{ GroupSecurityIdentifier }}' /* required */,
'{{ template_arn }}',
'{{ region }}'
;

Manifest

# Description fields are for documentation purposes
- name: template_group_access_control_entries
props:
  - name: template_arn
    value: "{{ template_arn }}"
    description: Required parameter for the template_group_access_control_entries resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the template_group_access_control_entries resource.
  - name: AccessRights
    description: |
      Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.
    value:
      AutoEnroll: "{{ AutoEnroll }}"
      Enroll: "{{ Enroll }}"
  - name: ClientToken
    value: "{{ ClientToken }}"
  - name: GroupDisplayName
    value: "{{ GroupDisplayName }}"
  - name: GroupSecurityIdentifier
    value: "{{ GroupSecurityIdentifier }}"

UPDATE examples

update_template_group_access_control_entry

Update a group access control entry you created using CreateTemplateGroupAccessControlEntry.

UPDATE aws.pca_connector_ad.template_group_access_control_entries
SET 
AccessRights = '{{ AccessRights }}',
GroupDisplayName = '{{ GroupDisplayName }}'
WHERE 
group_security_identifier = '{{ group_security_identifier }}' --required
AND template_arn = '{{ template_arn }}' --required
AND region = '{{ region }}' --required;

DELETE examples

delete_template_group_access_control_entry

Deletes a group access control entry.

DELETE FROM aws.pca_connector_ad.template_group_access_control_entries
WHERE group_security_identifier = '{{ group_security_identifier }}' --required
AND template_arn = '{{ template_arn }}' --required
AND region = '{{ region }}' --required
;