permission_sets

Creates, updates, deletes, gets or lists a permission_sets resource.

Overview

Name	permission_sets
Type	Resource
Id	aws.sso_admin.permission_sets

Fields

The following fields are returned by SELECT queries:

describe_permission_set

Name	Datatype	Description
created_date	string (date-time)	The date that the permission set was created.
description	string	The description of the PermissionSet. (pattern: <code>[\u0009\u000A\u000D\u0020-\u007E\u00A1-\u00FF]*</code>)
name	string	The name of the permission set. (pattern: <code>[\w+=,.@-]+</code>)
permission_set_arn	string	The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference. (pattern: <code>arn:aws(-[a-z]{1,5}){0,3}:sso:::permissionSet/(sso)?ins-[a-zA-Z0-9-.]{16}/ps-[a-zA-Z0-9-./]{16}</code>)
relay_state	string	Used to redirect users within the application during the federation authentication process. (pattern: <code>[a-zA-Z0-9&$@#\/%?=~-_'"|!:,.;*+&#91;&#93;\ ()&#123;&#125;]+</code>)
session_duration	string	The length of time that the application user sessions are valid for in the ISO-8601 standard. (pattern: <code>(-?)P(?=\d|T\d)(?:(\d+)Y)?(?:(\d+)M)?(?:(\d+)([DW]))?(?:T(?:(\d+)H)?(?:(\d+)M)?(?:(\d+(?:.\d+)?)S)?)?</code>)

list_permission_sets

Name	Datatype	Description
permission_set	string	Defines the level of access on an Amazon Web Services account.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_permission_set	select	region		Gets the details of the permission set.
list_permission_sets	select	region		Lists the PermissionSets in an IAM Identity Center instance.
create_permission_set	insert	region, Name, InstanceArn		Creates a permission set within a specified IAM Identity Center instance. To grant users and groups access to Amazon Web Services account resources, use CreateAccountAssignment .
attach_customer_managed_policy_reference_to_permission_set	update	region, InstanceArn, PermissionSetArn, CustomerManagedPolicyReference		Attaches the specified customer managed policy to the specified PermissionSet.
attach_managed_policy_to_permission_set	update	region, InstanceArn, PermissionSetArn, ManagedPolicyArn		Attaches an Amazon Web Services managed policy ARN to a permission set. If the permission set is already referenced by one or more account assignments, you will need to call ProvisionPermissionSet after this operation. Calling ProvisionPermissionSet applies the corresponding IAM policy updates to all assigned accounts.
provision_permission_set	update	region, InstanceArn, PermissionSetArn, TargetType		The process by which a specified permission set is provisioned to the specified target.
update_permission_set	update	region, InstanceArn, PermissionSetArn		Updates an existing permission set.
put_inline_policy_to_permission_set	replace	region, InstanceArn, PermissionSetArn, InlinePolicy		Attaches an inline policy to a permission set. If the permission set is already referenced by one or more account assignments, you will need to call ProvisionPermissionSet after this action to apply the corresponding IAM policy updates to all assigned accounts.
put_permissions_boundary_to_permission_set	replace	region, InstanceArn, PermissionSetArn, PermissionsBoundary		Attaches an Amazon Web Services managed or customer managed policy to the specified PermissionSet as a permissions boundary.
delete_permission_set	delete	region		Deletes the specified permission set.
delete_inline_policy_from_permission_set	exec	region, InstanceArn, PermissionSetArn		Deletes the inline policy from a specified permission set.
delete_permissions_boundary_from_permission_set	exec	region, InstanceArn, PermissionSetArn		Deletes the permissions boundary from a specified PermissionSet.
detach_customer_managed_policy_reference_from_permission_set	exec	region, InstanceArn, PermissionSetArn, CustomerManagedPolicyReference		Detaches the specified customer managed policy from the specified PermissionSet.
detach_managed_policy_from_permission_set	exec	region, InstanceArn, PermissionSetArn, ManagedPolicyArn		Detaches the attached Amazon Web Services managed policy ARN from the specified permission set.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_permission_set

Gets the details of the permission set.

SELECT
created_date,
description,
name,
permission_set_arn,
relay_state,
session_duration
FROM aws.sso_admin.permission_sets
WHERE region = '{{ region }}' -- required
;

list_permission_sets

Lists the PermissionSets in an IAM Identity Center instance.

SELECT
permission_set
FROM aws.sso_admin.permission_sets
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_permission_set

Creates a permission set within a specified IAM Identity Center instance. To grant users and groups access to Amazon Web Services account resources, use CreateAccountAssignment .

INSERT INTO aws.sso_admin.permission_sets (
Name,
Description,
InstanceArn,
SessionDuration,
RelayState,
Tags,
region
)
SELECT 
'{{ Name }}' /* required */,
'{{ Description }}',
'{{ InstanceArn }}' /* required */,
'{{ SessionDuration }}',
'{{ RelayState }}',
'{{ Tags }}',
'{{ region }}'
RETURNING
permission_set
;

Manifest

# Description fields are for documentation purposes
- name: permission_sets
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the permission_sets resource.
  - name: Name
    value: "{{ Name }}"
    description: |
      The name of the PermissionSet.
  - name: Description
    value: "{{ Description }}"
    description: |
      The description of the PermissionSet.
  - name: InstanceArn
    value: "{{ InstanceArn }}"
    description: |
      The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.
  - name: SessionDuration
    value: "{{ SessionDuration }}"
    description: |
      The length of time that the application user sessions are valid in the ISO-8601 standard.
  - name: RelayState
    value: "{{ RelayState }}"
    description: |
      Used to redirect users within the application during the federation authentication process.
  - name: Tags
    description: |
      The tags to attach to the new PermissionSet.
    value:
      - Key: "{{ Key }}"
        Value: "{{ Value }}"

UPDATE examples

attach_customer_managed_policy_reference_to_permission_set

Attaches the specified customer managed policy to the specified PermissionSet.

UPDATE aws.sso_admin.permission_sets
SET 
InstanceArn = '{{ InstanceArn }}',
PermissionSetArn = '{{ PermissionSetArn }}',
CustomerManagedPolicyReference = '{{ CustomerManagedPolicyReference }}'
WHERE 
region = '{{ region }}' --required
AND InstanceArn = '{{ InstanceArn }}' --required
AND PermissionSetArn = '{{ PermissionSetArn }}' --required
AND CustomerManagedPolicyReference = '{{ CustomerManagedPolicyReference }}' --required;

attach_managed_policy_to_permission_set

Attaches an Amazon Web Services managed policy ARN to a permission set. If the permission set is already referenced by one or more account assignments, you will need to call ProvisionPermissionSet after this operation. Calling ProvisionPermissionSet applies the corresponding IAM policy updates to all assigned accounts.

UPDATE aws.sso_admin.permission_sets
SET 
InstanceArn = '{{ InstanceArn }}',
PermissionSetArn = '{{ PermissionSetArn }}',
ManagedPolicyArn = '{{ ManagedPolicyArn }}'
WHERE 
region = '{{ region }}' --required
AND InstanceArn = '{{ InstanceArn }}' --required
AND PermissionSetArn = '{{ PermissionSetArn }}' --required
AND ManagedPolicyArn = '{{ ManagedPolicyArn }}' --required;

provision_permission_set

The process by which a specified permission set is provisioned to the specified target.

UPDATE aws.sso_admin.permission_sets
SET 
InstanceArn = '{{ InstanceArn }}',
PermissionSetArn = '{{ PermissionSetArn }}',
TargetId = '{{ TargetId }}',
TargetType = '{{ TargetType }}'
WHERE 
region = '{{ region }}' --required
AND InstanceArn = '{{ InstanceArn }}' --required
AND PermissionSetArn = '{{ PermissionSetArn }}' --required
AND TargetType = '{{ TargetType }}' --required
RETURNING
permission_set_provisioning_status;

update_permission_set

Updates an existing permission set.

UPDATE aws.sso_admin.permission_sets
SET 
InstanceArn = '{{ InstanceArn }}',
PermissionSetArn = '{{ PermissionSetArn }}',
Description = '{{ Description }}',
SessionDuration = '{{ SessionDuration }}',
RelayState = '{{ RelayState }}'
WHERE 
region = '{{ region }}' --required
AND InstanceArn = '{{ InstanceArn }}' --required
AND PermissionSetArn = '{{ PermissionSetArn }}' --required;

REPLACE examples

put_inline_policy_to_permission_set

Attaches an inline policy to a permission set. If the permission set is already referenced by one or more account assignments, you will need to call ProvisionPermissionSet after this action to apply the corresponding IAM policy updates to all assigned accounts.

REPLACE aws.sso_admin.permission_sets
SET 
InstanceArn = '{{ InstanceArn }}',
PermissionSetArn = '{{ PermissionSetArn }}',
InlinePolicy = '{{ InlinePolicy }}'
WHERE 
region = '{{ region }}' --required
AND InstanceArn = '{{ InstanceArn }}' --required
AND PermissionSetArn = '{{ PermissionSetArn }}' --required
AND InlinePolicy = '{{ InlinePolicy }}' --required;

put_permissions_boundary_to_permission_set

Attaches an Amazon Web Services managed or customer managed policy to the specified PermissionSet as a permissions boundary.

REPLACE aws.sso_admin.permission_sets
SET 
InstanceArn = '{{ InstanceArn }}',
PermissionSetArn = '{{ PermissionSetArn }}',
PermissionsBoundary = '{{ PermissionsBoundary }}'
WHERE 
region = '{{ region }}' --required
AND InstanceArn = '{{ InstanceArn }}' --required
AND PermissionSetArn = '{{ PermissionSetArn }}' --required
AND PermissionsBoundary = '{{ PermissionsBoundary }}' --required;

DELETE examples

delete_permission_set

Deletes the specified permission set.

DELETE FROM aws.sso_admin.permission_sets
WHERE region = '{{ region }}' --required
;

Lifecycle Methods

delete_inline_policy_from_permission_set

Deletes the inline policy from a specified permission set.

EXEC aws.sso_admin.permission_sets.delete_inline_policy_from_permission_set 
@region='{{ region }}' --required 
@@json=
'{
"InstanceArn": "{{ InstanceArn }}", 
"PermissionSetArn": "{{ PermissionSetArn }}"
}'
;

delete_permissions_boundary_from_permission_set

Deletes the permissions boundary from a specified PermissionSet.

EXEC aws.sso_admin.permission_sets.delete_permissions_boundary_from_permission_set 
@region='{{ region }}' --required 
@@json=
'{
"InstanceArn": "{{ InstanceArn }}", 
"PermissionSetArn": "{{ PermissionSetArn }}"
}'
;

detach_customer_managed_policy_reference_from_permission_set

Detaches the specified customer managed policy from the specified PermissionSet.

EXEC aws.sso_admin.permission_sets.detach_customer_managed_policy_reference_from_permission_set 
@region='{{ region }}' --required 
@@json=
'{
"InstanceArn": "{{ InstanceArn }}", 
"PermissionSetArn": "{{ PermissionSetArn }}", 
"CustomerManagedPolicyReference": "{{ CustomerManagedPolicyReference }}"
}'
;

detach_managed_policy_from_permission_set

Detaches the attached Amazon Web Services managed policy ARN from the specified permission set.

EXEC aws.sso_admin.permission_sets.detach_managed_policy_from_permission_set 
@region='{{ region }}' --required 
@@json=
'{
"InstanceArn": "{{ InstanceArn }}", 
"PermissionSetArn": "{{ PermissionSetArn }}", 
"ManagedPolicyArn": "{{ ManagedPolicyArn }}"
}'
;