trust_anchors

Creates, updates, deletes, gets or lists a trust_anchors resource.

Overview

Name	trust_anchors
Type	Resource
Id	aws.rolesanywhere.trust_anchors

Fields

The following fields are returned by SELECT queries:

get_trust_anchor

Name	Datatype	Description
name	string	The name of the trust anchor. (pattern: <code>[ a-zA-Z0-9-_]*</code>)
created_at	string (date-time)	The ISO-8601 timestamp when the trust anchor was created.
enabled	boolean	Indicates whether the trust anchor is enabled.
notification_settings	array	A list of notification settings to be associated to the trust anchor.
source	object	The trust anchor type and its related certificate data.
trust_anchor_arn	string	The ARN of the trust anchor.
trust_anchor_id	string	The unique identifier of the trust anchor. (pattern: <code>.[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}.</code>)
updated_at	string (date-time)	The ISO-8601 timestamp when the trust anchor was last updated.

list_trust_anchors

Name	Datatype	Description
name	string	The name of the trust anchor. (pattern: <code>[ a-zA-Z0-9-_]*</code>)
created_at	string (date-time)	The ISO-8601 timestamp when the trust anchor was created.
enabled	boolean	Indicates whether the trust anchor is enabled.
notification_settings	array	A list of notification settings to be associated to the trust anchor.
source	object	The trust anchor type and its related certificate data.
trust_anchor_arn	string	The ARN of the trust anchor.
trust_anchor_id	string	The unique identifier of the trust anchor. (pattern: <code>.[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}.</code>)
updated_at	string (date-time)	The ISO-8601 timestamp when the trust anchor was last updated.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_trust_anchor	select	trust_anchor_id, region		Gets a trust anchor. Required permissions: rolesanywhere:GetTrustAnchor.
list_trust_anchors	select	region	nextToken, pageSize	Lists the trust anchors in the authenticated account and Amazon Web Services Region. Required permissions: rolesanywhere:ListTrustAnchors.
create_trust_anchor	insert	region, name, source		Creates a trust anchor to establish trust between IAM Roles Anywhere and your certificate authority (CA). You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials. Required permissions: rolesanywhere:CreateTrustAnchor.
update_trust_anchor	update	trust_anchor_id, region		Updates a trust anchor. You establish trust between IAM Roles Anywhere and your certificate authority (CA) by configuring a trust anchor. You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials. Required permissions: rolesanywhere:UpdateTrustAnchor.
put_notification_settings	replace	region, trustAnchorId, notificationSettings		Attaches a list of notification settings to a trust anchor. A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify. Required permissions: rolesanywhere:PutNotificationSettings.
delete_trust_anchor	delete	trust_anchor_id, region		Deletes a trust anchor. Required permissions: rolesanywhere:DeleteTrustAnchor.
disable_trust_anchor	exec	trust_anchor_id, region		Disables a trust anchor. When disabled, temporary credential requests specifying this trust anchor are unauthorized. Required permissions: rolesanywhere:DisableTrustAnchor.
enable_trust_anchor	exec	trust_anchor_id, region		Enables a trust anchor. When enabled, certificates in the trust anchor chain are authorized for trust validation. Required permissions: rolesanywhere:EnableTrustAnchor.
reset_notification_settings	exec	region, trustAnchorId, notificationSettingKeys		Resets the custom notification setting to IAM Roles Anywhere default setting. Required permissions: rolesanywhere:ResetNotificationSettings.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)
trust_anchor_id	string	The unique identifier of the trust anchor.
nextToken	string	A token that indicates where the output should continue from, if a previous request did not show all results. To get the next results, make the request again with this value.
pageSize	integer	The number of resources in the paginated list.

SELECT examples

get_trust_anchor

Gets a trust anchor. Required permissions: rolesanywhere:GetTrustAnchor.

SELECT
name,
created_at,
enabled,
notification_settings,
source,
trust_anchor_arn,
trust_anchor_id,
updated_at
FROM aws.rolesanywhere.trust_anchors
WHERE trust_anchor_id = '{{ trust_anchor_id }}' -- required
AND region = '{{ region }}' -- required
;

list_trust_anchors

Lists the trust anchors in the authenticated account and Amazon Web Services Region. Required permissions: rolesanywhere:ListTrustAnchors.

SELECT
name,
created_at,
enabled,
notification_settings,
source,
trust_anchor_arn,
trust_anchor_id,
updated_at
FROM aws.rolesanywhere.trust_anchors
WHERE region = '{{ region }}' -- required
AND nextToken = '{{ nextToken }}'
AND pageSize = '{{ pageSize }}'
;

INSERT examples

create_trust_anchor

Creates a trust anchor to establish trust between IAM Roles Anywhere and your certificate authority (CA). You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials. Required permissions: rolesanywhere:CreateTrustAnchor.

INSERT INTO aws.rolesanywhere.trust_anchors (
name,
source,
enabled,
tags,
notificationSettings,
region
)
SELECT 
'{{ name }}' /* required */,
'{{ source }}' /* required */,
{{ enabled }},
'{{ tags }}',
'{{ notificationSettings }}',
'{{ region }}'
RETURNING
trust_anchor
;

Manifest

# Description fields are for documentation purposes
- name: trust_anchors
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the trust_anchors resource.
  - name: name
    value: "{{ name }}"
  - name: source
    description: |
      The trust anchor type and its related certificate data.
    value:
      sourceType: "{{ sourceType }}"
      sourceData:
        x509CertificateData: "{{ x509CertificateData }}"
        acmPcaArn: "{{ acmPcaArn }}"
  - name: enabled
    value: {{ enabled }}
  - name: tags
    value:
      - key: "{{ key }}"
        value: "{{ value }}"
  - name: notificationSettings
    value:
      - enabled: {{ enabled }}
        event: "{{ event }}"
        threshold: {{ threshold }}
        channel: "{{ channel }}"

UPDATE examples

update_trust_anchor

Updates a trust anchor. You establish trust between IAM Roles Anywhere and your certificate authority (CA) by configuring a trust anchor. You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials. Required permissions: rolesanywhere:UpdateTrustAnchor.

UPDATE aws.rolesanywhere.trust_anchors
SET 
name = '{{ name }}',
source = '{{ source }}'
WHERE 
trust_anchor_id = '{{ trust_anchor_id }}' --required
AND region = '{{ region }}' --required
RETURNING
trust_anchor;

REPLACE examples

put_notification_settings

Attaches a list of notification settings to a trust anchor. A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify. Required permissions: rolesanywhere:PutNotificationSettings.

REPLACE aws.rolesanywhere.trust_anchors
SET 
trustAnchorId = '{{ trustAnchorId }}',
notificationSettings = '{{ notificationSettings }}'
WHERE 
region = '{{ region }}' --required
AND trustAnchorId = '{{ trustAnchorId }}' --required
AND notificationSettings = '{{ notificationSettings }}' --required
RETURNING
trust_anchor;

DELETE examples

delete_trust_anchor

Deletes a trust anchor. Required permissions: rolesanywhere:DeleteTrustAnchor.

DELETE FROM aws.rolesanywhere.trust_anchors
WHERE trust_anchor_id = '{{ trust_anchor_id }}' --required
AND region = '{{ region }}' --required
;

Lifecycle Methods

disable_trust_anchor

Disables a trust anchor. When disabled, temporary credential requests specifying this trust anchor are unauthorized. Required permissions: rolesanywhere:DisableTrustAnchor.

EXEC aws.rolesanywhere.trust_anchors.disable_trust_anchor 
@trust_anchor_id='{{ trust_anchor_id }}' --required, 
@region='{{ region }}' --required
;

enable_trust_anchor

Enables a trust anchor. When enabled, certificates in the trust anchor chain are authorized for trust validation. Required permissions: rolesanywhere:EnableTrustAnchor.

EXEC aws.rolesanywhere.trust_anchors.enable_trust_anchor 
@trust_anchor_id='{{ trust_anchor_id }}' --required, 
@region='{{ region }}' --required
;

reset_notification_settings

Resets the custom notification setting to IAM Roles Anywhere default setting. Required permissions: rolesanywhere:ResetNotificationSettings.

EXEC aws.rolesanywhere.trust_anchors.reset_notification_settings 
@region='{{ region }}' --required 
@@json=
'{
"trustAnchorId": "{{ trustAnchorId }}", 
"notificationSettingKeys": "{{ notificationSettingKeys }}"
}'
;