account_assignments

Creates, updates, deletes, gets or lists an account_assignments resource.

Overview

Name	account_assignments
Type	Resource
Id	aws.sso_admin.account_assignments

Fields

The following fields are returned by SELECT queries:

list_account_assignments

Name	Datatype	Description
account_id	string	The identifier of the Amazon Web Services account. (pattern: <code>\d{12}</code>)
permission_set_arn	string	The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference. (pattern: <code>arn:aws(-[a-z]{1,5}){0,3}:sso:::permissionSet/(sso)?ins-[a-zA-Z0-9-.]{16}/ps-[a-zA-Z0-9-./]{16}</code>)
principal_id	string	An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference. (pattern: <code>([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}</code>)
principal_type	string	The entity type for which the assignment will be created. (USER, GROUP)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_account_assignments	select	region		Lists the assignee of the specified Amazon Web Services account with the specified permission set.
create_account_assignment	insert	region, InstanceArn, TargetId, TargetType, PermissionSetArn, PrincipalType, PrincipalId		Assigns access to a principal for a specified Amazon Web Services account using a specified permission set. The term principal here refers to a user or group that is defined in IAM Identity Center. As part of a successful CreateAccountAssignment call, the specified permission set will automatically be provisioned to the account in the form of an IAM policy. That policy is attached to the IAM role created in IAM Identity Center. If the permission set is subsequently updated, the corresponding IAM policies attached to roles in your accounts will not be updated automatically. In this case, you must call ProvisionPermissionSet to make these updates. After a successful response, call DescribeAccountAssignmentCreationStatus to describe the status of an assignment creation request.
delete_account_assignment	delete	region		Deletes a principal's access from a specified Amazon Web Services account using a specified permission set. After a successful response, call DescribeAccountAssignmentDeletionStatus to describe the status of an assignment deletion request.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

list_account_assignments

Lists the assignee of the specified Amazon Web Services account with the specified permission set.

SELECT
account_id,
permission_set_arn,
principal_id,
principal_type
FROM aws.sso_admin.account_assignments
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_account_assignment

Assigns access to a principal for a specified Amazon Web Services account using a specified permission set. The term principal here refers to a user or group that is defined in IAM Identity Center. As part of a successful CreateAccountAssignment call, the specified permission set will automatically be provisioned to the account in the form of an IAM policy. That policy is attached to the IAM role created in IAM Identity Center. If the permission set is subsequently updated, the corresponding IAM policies attached to roles in your accounts will not be updated automatically. In this case, you must call ProvisionPermissionSet to make these updates. After a successful response, call DescribeAccountAssignmentCreationStatus to describe the status of an assignment creation request.

INSERT INTO aws.sso_admin.account_assignments (
InstanceArn,
TargetId,
TargetType,
PermissionSetArn,
PrincipalType,
PrincipalId,
region
)
SELECT 
'{{ InstanceArn }}' /* required */,
'{{ TargetId }}' /* required */,
'{{ TargetType }}' /* required */,
'{{ PermissionSetArn }}' /* required */,
'{{ PrincipalType }}' /* required */,
'{{ PrincipalId }}' /* required */,
'{{ region }}'
RETURNING
account_assignment_creation_status
;

Manifest

# Description fields are for documentation purposes
- name: account_assignments
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the account_assignments resource.
  - name: InstanceArn
    value: "{{ InstanceArn }}"
    description: |
      The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.
  - name: TargetId
    value: "{{ TargetId }}"
    description: |
      TargetID is an Amazon Web Services account identifier, (For example, 123456789012).
  - name: TargetType
    value: "{{ TargetType }}"
    description: |
      The entity type for which the assignment will be created.
    valid_values: ['AWS_ACCOUNT']
  - name: PermissionSetArn
    value: "{{ PermissionSetArn }}"
    description: |
      The ARN of the permission set that the admin wants to grant the principal access to.
  - name: PrincipalType
    value: "{{ PrincipalType }}"
    description: |
      The entity type for which the assignment will be created.
    valid_values: ['USER', 'GROUP']
  - name: PrincipalId
    value: "{{ PrincipalId }}"
    description: |
      An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

DELETE examples

delete_account_assignment

Deletes a principal's access from a specified Amazon Web Services account using a specified permission set. After a successful response, call DescribeAccountAssignmentDeletionStatus to describe the status of an assignment deletion request.

DELETE FROM aws.sso_admin.account_assignments
WHERE region = '{{ region }}' --required
;