profiles

Creates, updates, deletes, gets or lists a profiles resource.

Overview

Name	profiles
Type	Resource
Id	aws.rolesanywhere.profiles

Fields

The following fields are returned by SELECT queries:

get_profile

Name	Datatype	Description
name	string	The name of the profile. (pattern: <code>[ a-zA-Z0-9-_]*</code>)
accept_role_session_name	boolean	Used to determine if a custom role session name will be accepted in a temporary credential request.
attribute_mappings	array	A mapping applied to the authenticating end-entity certificate.
created_at	string (date-time)	The ISO-8601 timestamp when the profile was created.
created_by	string	The Amazon Web Services account that created the profile.
duration_seconds	integer	Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.
enabled	boolean	Indicates whether the profile is enabled.
managed_policy_arns	array	A list of managed policy ARNs that apply to the vended session credentials.
profile_arn	string	The ARN of the profile. (pattern: <code>arn:aws(-[^:]+)?:rolesanywhere(:.){2}(:profile.)</code>)
profile_id	string	The unique identifier of the profile. (pattern: <code>.[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}.</code>)
require_instance_properties	boolean	Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.
role_arns	array	A list of IAM roles that this profile can assume in a temporary credential request.
session_policy	string	A session policy that applies to the trust boundary of the vended session credentials.
updated_at	string (date-time)	The ISO-8601 timestamp when the profile was last updated.

list_profiles

Name	Datatype	Description
name	string	The name of the profile. (pattern: <code>[ a-zA-Z0-9-_]*</code>)
accept_role_session_name	boolean	Used to determine if a custom role session name will be accepted in a temporary credential request.
attribute_mappings	array	A mapping applied to the authenticating end-entity certificate.
created_at	string (date-time)	The ISO-8601 timestamp when the profile was created.
created_by	string	The Amazon Web Services account that created the profile.
duration_seconds	integer	Used to determine how long sessions vended using this profile are valid for. See the Expiration section of the CreateSession API documentation page for more details. In requests, if this value is not provided, the default value will be 3600.
enabled	boolean	Indicates whether the profile is enabled.
managed_policy_arns	array	A list of managed policy ARNs that apply to the vended session credentials.
profile_arn	string	The ARN of the profile. (pattern: <code>arn:aws(-[^:]+)?:rolesanywhere(:.){2}(:profile.)</code>)
profile_id	string	The unique identifier of the profile. (pattern: <code>.[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}.</code>)
require_instance_properties	boolean	Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile.
role_arns	array	A list of IAM roles that this profile can assume in a temporary credential request.
session_policy	string	A session policy that applies to the trust boundary of the vended session credentials.
updated_at	string (date-time)	The ISO-8601 timestamp when the profile was last updated.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_profile	select	profile_id, region		Gets a profile. Required permissions: rolesanywhere:GetProfile.
list_profiles	select	region	nextToken, pageSize	Lists all profiles in the authenticated account and Amazon Web Services Region. Required permissions: rolesanywhere:ListProfiles.
create_profile	insert	region, name, roleArns		Creates a profile, a list of the roles that Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies. Required permissions: rolesanywhere:CreateProfile.
update_profile	update	profile_id, region		Updates a profile, a list of the roles that IAM Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies. Required permissions: rolesanywhere:UpdateProfile.
put_attribute_mapping	replace	profile_id, region, certificateField, mappingRules		Put an entry in the attribute mapping rules that will be enforced by a given profile. A mapping specifies a certificate field and one or more specifiers that have contextual meanings.
delete_attribute_mapping	delete	profile_id, certificateField, region	specifiers	Delete an entry from the attribute mapping rules enforced by a given profile.
delete_profile	delete	profile_id, region		Deletes a profile. Required permissions: rolesanywhere:DeleteProfile.
disable_profile	exec	profile_id, region		Disables a profile. When disabled, temporary credential requests with this profile fail. Required permissions: rolesanywhere:DisableProfile.
enable_profile	exec	profile_id, region		Enables temporary credential requests for a profile. Required permissions: rolesanywhere:EnableProfile.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
certificateField	string	Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates.
profile_id	string	The unique identifier of the profile.
region	string	AWS region (default: us-east-1)
nextToken	string	A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.
pageSize	integer	The number of resources in the paginated list.
specifiers	array	A list of specifiers of a certificate field; for example, CN, OU, UID from a Subject.

SELECT examples

get_profile

Gets a profile. Required permissions: rolesanywhere:GetProfile.

SELECT
name,
accept_role_session_name,
attribute_mappings,
created_at,
created_by,
duration_seconds,
enabled,
managed_policy_arns,
profile_arn,
profile_id,
require_instance_properties,
role_arns,
session_policy,
updated_at
FROM aws.rolesanywhere.profiles
WHERE profile_id = '{{ profile_id }}' -- required
AND region = '{{ region }}' -- required
;

list_profiles

Lists all profiles in the authenticated account and Amazon Web Services Region. Required permissions: rolesanywhere:ListProfiles.

SELECT
name,
accept_role_session_name,
attribute_mappings,
created_at,
created_by,
duration_seconds,
enabled,
managed_policy_arns,
profile_arn,
profile_id,
require_instance_properties,
role_arns,
session_policy,
updated_at
FROM aws.rolesanywhere.profiles
WHERE region = '{{ region }}' -- required
AND nextToken = '{{ nextToken }}'
AND pageSize = '{{ pageSize }}'
;

INSERT examples

create_profile

Creates a profile, a list of the roles that Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies. Required permissions: rolesanywhere:CreateProfile.

INSERT INTO aws.rolesanywhere.profiles (
name,
requireInstanceProperties,
sessionPolicy,
roleArns,
managedPolicyArns,
durationSeconds,
enabled,
tags,
acceptRoleSessionName,
region
)
SELECT 
'{{ name }}' /* required */,
{{ requireInstanceProperties }},
'{{ sessionPolicy }}',
'{{ roleArns }}' /* required */,
'{{ managedPolicyArns }}',
{{ durationSeconds }},
{{ enabled }},
'{{ tags }}',
{{ acceptRoleSessionName }},
'{{ region }}'
RETURNING
profile
;

Manifest

# Description fields are for documentation purposes
- name: profiles
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the profiles resource.
  - name: name
    value: "{{ name }}"
  - name: requireInstanceProperties
    value: {{ requireInstanceProperties }}
  - name: sessionPolicy
    value: "{{ sessionPolicy }}"
  - name: roleArns
    value:
      - "{{ roleArns }}"
  - name: managedPolicyArns
    value:
      - "{{ managedPolicyArns }}"
  - name: durationSeconds
    value: {{ durationSeconds }}
  - name: enabled
    value: {{ enabled }}
  - name: tags
    value:
      - key: "{{ key }}"
        value: "{{ value }}"
  - name: acceptRoleSessionName
    value: {{ acceptRoleSessionName }}

UPDATE examples

update_profile

Updates a profile, a list of the roles that IAM Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies. Required permissions: rolesanywhere:UpdateProfile.

UPDATE aws.rolesanywhere.profiles
SET 
name = '{{ name }}',
sessionPolicy = '{{ sessionPolicy }}',
roleArns = '{{ roleArns }}',
managedPolicyArns = '{{ managedPolicyArns }}',
durationSeconds = {{ durationSeconds }},
acceptRoleSessionName = {{ acceptRoleSessionName }}
WHERE 
profile_id = '{{ profile_id }}' --required
AND region = '{{ region }}' --required
RETURNING
profile;

REPLACE examples

put_attribute_mapping

Put an entry in the attribute mapping rules that will be enforced by a given profile. A mapping specifies a certificate field and one or more specifiers that have contextual meanings.

REPLACE aws.rolesanywhere.profiles
SET 
certificateField = '{{ certificateField }}',
mappingRules = '{{ mappingRules }}'
WHERE 
profile_id = '{{ profile_id }}' --required
AND region = '{{ region }}' --required
AND certificateField = '{{ certificateField }}' --required
AND mappingRules = '{{ mappingRules }}' --required
RETURNING
profile;

DELETE examples

delete_attribute_mapping

Delete an entry from the attribute mapping rules enforced by a given profile.

DELETE FROM aws.rolesanywhere.profiles
WHERE profile_id = '{{ profile_id }}' --required
AND certificateField = '{{ certificateField }}' --required
AND region = '{{ region }}' --required
AND specifiers = '{{ specifiers }}'
;

delete_profile

Deletes a profile. Required permissions: rolesanywhere:DeleteProfile.

DELETE FROM aws.rolesanywhere.profiles
WHERE profile_id = '{{ profile_id }}' --required
AND region = '{{ region }}' --required
;

Lifecycle Methods

disable_profile

Disables a profile. When disabled, temporary credential requests with this profile fail. Required permissions: rolesanywhere:DisableProfile.

EXEC aws.rolesanywhere.profiles.disable_profile 
@profile_id='{{ profile_id }}' --required, 
@region='{{ region }}' --required
;

enable_profile

Enables temporary credential requests for a profile. Required permissions: rolesanywhere:EnableProfile.

EXEC aws.rolesanywhere.profiles.enable_profile 
@profile_id='{{ profile_id }}' --required, 
@region='{{ region }}' --required
;