application_assignments

Creates, updates, deletes, gets or lists an application_assignments resource.

Overview

Name	application_assignments
Type	Resource
Id	aws.sso_admin.application_assignments

Fields

The following fields are returned by SELECT queries:

describe_application_assignment

Name	Datatype	Description
application_arn	string	Specifies the ARN of the application. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference. (pattern: <code>arn:aws(-[a-z]{1,5}){0,3}:sso::\d{12}:application/(sso)?ins-[a-zA-Z0-9-.]{16}/apl-[a-zA-Z0-9]{16}</code>)
principal_id	string	An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference. (pattern: <code>([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}</code>)
principal_type	string	The entity type for which the assignment will be created. (USER, GROUP)

list_application_assignments

Name	Datatype	Description
application_arn	string	The ARN of the application that has principals assigned. (pattern: <code>arn:aws(-[a-z]{1,5}){0,3}:sso::\d{12}:application/(sso)?ins-[a-zA-Z0-9-.]{16}/apl-[a-zA-Z0-9]{16}</code>)
principal_id	string	The unique identifier of the principal assigned to the application. (pattern: <code>([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}</code>)
principal_type	string	The type of the principal assigned to the application. (USER, GROUP)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_application_assignment	select	region		Retrieves a direct assignment of a user or group to an application. If the user doesn’t have a direct assignment to the application, the user may still have access to the application through a group. Therefore, don’t use this API to test access to an application for a user. Instead use ListApplicationAssignmentsForPrincipal.
list_application_assignments	select	region		Lists Amazon Web Services account users that are assigned to an application.
create_application_assignment	insert	region, ApplicationArn, PrincipalId, PrincipalType		Grant application access to a user or group.
delete_application_assignment	delete	region		Revoke application access to an application by deleting application assignments for a user or group.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_application_assignment

Retrieves a direct assignment of a user or group to an application. If the user doesn’t have a direct assignment to the application, the user may still have access to the application through a group. Therefore, don’t use this API to test access to an application for a user. Instead use ListApplicationAssignmentsForPrincipal.

SELECT
application_arn,
principal_id,
principal_type
FROM aws.sso_admin.application_assignments
WHERE region = '{{ region }}' -- required
;

list_application_assignments

Lists Amazon Web Services account users that are assigned to an application.

SELECT
application_arn,
principal_id,
principal_type
FROM aws.sso_admin.application_assignments
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_application_assignment

Grant application access to a user or group.

INSERT INTO aws.sso_admin.application_assignments (
ApplicationArn,
PrincipalId,
PrincipalType,
region
)
SELECT 
'{{ ApplicationArn }}' /* required */,
'{{ PrincipalId }}' /* required */,
'{{ PrincipalType }}' /* required */,
'{{ region }}'
;

Manifest

# Description fields are for documentation purposes
- name: application_assignments
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the application_assignments resource.
  - name: ApplicationArn
    value: "{{ ApplicationArn }}"
    description: |
      The ARN of the application for which the assignment is created.
  - name: PrincipalId
    value: "{{ PrincipalId }}"
    description: |
      An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.
  - name: PrincipalType
    value: "{{ PrincipalType }}"
    description: |
      The entity type for which the assignment will be created.
    valid_values: ['USER', 'GROUP']

DELETE examples

delete_application_assignment

Revoke application access to an application by deleting application assignments for a user or group.

DELETE FROM aws.sso_admin.application_assignments
WHERE region = '{{ region }}' --required
;