SDK for PHP V3

Client: Aws\AccountAccess\AccountAccessClient
Service ID: account-access
Version: 2018-05-10

This page describes the parameters and results for the operations of the Account Access (2018-05-10), and shows how to use the Aws\AccountAccess\AccountAccessClient object to call the described operations. This documentation is specific to the 2018-05-10 API version of the service.

Operation Summary

Each of the following operations can be created from a client using $client->getCommand('CommandName'), where "CommandName" is the name of one of the following operations. Note: a command is a value that encapsulates an operation and the parameters used to create an HTTP request.

You can also create and send a command immediately using the magic methods available on a client object: $client->commandName(/* parameters */). You can send the command asynchronously (returning a promise) by appending the word "Async" to the operation name: $client->commandNameAsync(/* parameters */).

CreateApplication ( array $params = [] )
Creates an account access manager instance and its Amazon Web Services account access application in the associated IAM Identity Center instance.
CreateEntitlement ( array $params = [] )
Creates an entitlement (assignment) in account access manager.
DeleteApplication ( array $params = [] )
Deletes an account access manager application.
DeleteEntitlement ( array $params = [] )
Deletes an entitlement from an account access manager application.
GetApplication ( array $params = [] )
Retrieves details about an account access manager application, including its status, identity source, and tags.
GetEntitlement ( array $params = [] )
Retrieves details about a specific entitlement for an account access manager application, including the principal, IAM role, and target account.
ListApplications ( array $params = [] )
Lists the account access manager applications in your account.
ListEntitlements ( array $params = [] )
Lists the entitlements for a specified account access manager application.
ListTagsForResource ( array $params = [] )
Lists the tags associated with an account access manager resource.
TagResource ( array $params = [] )
Adds tags to an account access manager resource.
UntagResource ( array $params = [] )
Removes tags from an account access manager resource.

Paginators

Paginators handle automatically iterating over paginated API results. Paginators are associated with specific API operations, and they accept the parameters that the corresponding API operation accepts. You can get a paginator from a client class using getPaginator($paginatorName, $operationParameters). This client supports the following paginators:

ListApplications
ListEntitlements

Waiters

Waiters allow you to poll a resource until it enters into a desired state. A waiter has a name used to describe what it does, and is associated with an API operation. When creating a waiter, you can provide the API operation parameters associated with the corresponding operation. Waiters can be accessed using the getWaiter($waiterName, $operationParameters) method of a client object. This client supports the following waiters:

Waiter name API Operation Delay Max Attempts
ApplicationActive GetApplication 5 24

Operations

CreateApplication

$result = $client->createApplication([/* ... */]);
$promise = $client->createApplicationAsync([/* ... */]);

Creates an account access manager instance and its Amazon Web Services account access application in the associated IAM Identity Center instance. This operation is idempotent; calling it multiple times with the same parameters returns the existing application.

Parameter Syntax

$result = $client->createApplication([
    'identitySource' => [ // REQUIRED
        'identityCenter' => [
            'instanceArn' => '<string>', // REQUIRED
        ],
    ],
    'tags' => ['<string>', ...],
]);

Parameter Details

Members
identitySource
Required: Yes
Type: IdentitySource structure

Specifies the identity source for the application. The identity source defines the IAM Identity Center instance that provides principals for entitlements.

tags
Type: Associative array of custom strings keys (String) to strings

Specifies the tags to assign to the application.

Result Syntax

[
    'applicationArn' => '<string>',
]

Result Details

Members
applicationArn
Required: Yes
Type: string

The Amazon Resource Name (ARN) of the created application.

Errors

AlreadyCreatedException:

The resource you are trying to create already exists. To retrieve the existing resource, use the corresponding Get operation.

AccessDeniedException:

You do not have sufficient access to perform this operation.

ConflictException:

The request conflicts with the current state of the resource.

ValidationException:

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

InternalServerException:

An internal service error occurred. Try your request again later.

CreateEntitlement

$result = $client->createEntitlement([/* ... */]);
$promise = $client->createEntitlementAsync([/* ... */]);

Creates an entitlement (assignment) in account access manager. An entitlement (assignment) grants a principal (IAM Identity Center user or group) permission to assume a specified IAM role in an Amazon Web Services account. This operation is idempotent.

Parameter Syntax

$result = $client->createEntitlement([
    'applicationArn' => '<string>', // REQUIRED
    'entitlement' => [ // REQUIRED
        'principalRole' => [
            'principal' => [ // REQUIRED
                'identityCenter' => [
                    'groupId' => '<string>',
                    'userId' => '<string>',
                ],
            ],
            'roleArn' => '<string>', // REQUIRED
        ],
    ],
]);

Parameter Details

Members
applicationArn
Required: Yes
Type: string

Specifies the ARN of the application to create the entitlement for.

entitlement
Required: Yes
Type: Entitlement structure

Specifies the entitlement configuration, including the principal and the IAM role to grant access to.

Result Syntax

[
    'entitlementId' => '<string>',
]

Result Details

Members
entitlementId
Required: Yes
Type: string

The unique identifier of the created entitlement.

Errors

AccessDeniedException:

You do not have sufficient access to perform this operation.

ResourceNotFoundException:

The specified resource does not exist. Verify that the resource identifier is correct and that the resource exists in the current Region.

ThrottlingException:

The request was denied due to request throttling. Try your request again later.

ConflictException:

The request conflicts with the current state of the resource.

ValidationException:

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

ServiceQuotaExceededException:

The request exceeds a service quota for your account.

InternalServerException:

An internal service error occurred. Try your request again later.

DeleteApplication

$result = $client->deleteApplication([/* ... */]);
$promise = $client->deleteApplicationAsync([/* ... */]);

Deletes an account access manager application. This operation is idempotent; deleting an application that has already been deleted does not return an error.

Parameter Syntax

$result = $client->deleteApplication([
    'applicationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members
applicationArn
Required: Yes
Type: string

Specifies the ARN of the application to delete.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You do not have sufficient access to perform this operation.

ResourceNotFoundException:

The specified resource does not exist. Verify that the resource identifier is correct and that the resource exists in the current Region.

ConflictException:

The request conflicts with the current state of the resource.

ValidationException:

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

InternalServerException:

An internal service error occurred. Try your request again later.

DeleteEntitlement

$result = $client->deleteEntitlement([/* ... */]);
$promise = $client->deleteEntitlementAsync([/* ... */]);

Deletes an entitlement from an account access manager application. This operation is idempotent; deleting an entitlement that has already been deleted does not return an error.

Parameter Syntax

$result = $client->deleteEntitlement([
    'applicationArn' => '<string>', // REQUIRED
    'entitlementId' => '<string>', // REQUIRED
]);

Parameter Details

Members
applicationArn
Required: Yes
Type: string

Specifies the ARN of the application that the entitlement belongs to.

entitlementId
Required: Yes
Type: string

Specifies the unique identifier of the entitlement to delete.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

AccessDeniedException:

You do not have sufficient access to perform this operation.

ResourceNotFoundException:

The specified resource does not exist. Verify that the resource identifier is correct and that the resource exists in the current Region.

ThrottlingException:

The request was denied due to request throttling. Try your request again later.

ConflictException:

The request conflicts with the current state of the resource.

ValidationException:

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

InternalServerException:

An internal service error occurred. Try your request again later.

GetApplication

$result = $client->getApplication([/* ... */]);
$promise = $client->getApplicationAsync([/* ... */]);

Retrieves details about an account access manager application, including its status, identity source, and tags.

Parameter Syntax

$result = $client->getApplication([
    'applicationArn' => '<string>', // REQUIRED
]);

Parameter Details

Members
applicationArn
Required: Yes
Type: string

Specifies the ARN of the application to retrieve.

Result Syntax

[
    'createdAt' => <DateTime>,
    'error' => [
        'code' => 'AUTHORIZATION_ERROR|RESOURCE_NOT_FOUND_ERROR|SERVICE_QUOTA_EXCEEDED_ERROR|INTERNAL_SERVICE_ERROR',
        'message' => '<string>',
    ],
    'identitySource' => [
        'identityCenter' => [
            'applicationArn' => '<string>',
            'instanceArn' => '<string>',
        ],
    ],
    'status' => 'CREATE_IN_PROGRESS|ACTIVE|DELETE_IN_PROGRESS|CREATE_FAILED|DELETE_FAILED',
    'tags' => ['<string>', ...],
    'tenantId' => '<string>',
    'updatedAt' => <DateTime>,
]

Result Details

Members
createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time when the application was created.

error
Type: ErrorDetails structure

The error details if the application is in a failed state.

identitySource
Required: Yes
Type: IdentitySourceDetails structure

The identity source details for the application, including the IAM Identity Center instance configuration.

status
Required: Yes
Type: string

The current status of the application.

tags
Type: Associative array of custom strings keys (String) to strings

The tags associated with the application.

tenantId
Type: string

The tenant identifier associated with the application.

updatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time when the application was last updated.

Errors

AccessDeniedException:

You do not have sufficient access to perform this operation.

ResourceNotFoundException:

The specified resource does not exist. Verify that the resource identifier is correct and that the resource exists in the current Region.

ValidationException:

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

InternalServerException:

An internal service error occurred. Try your request again later.

GetEntitlement

$result = $client->getEntitlement([/* ... */]);
$promise = $client->getEntitlementAsync([/* ... */]);

Retrieves details about a specific entitlement for an account access manager application, including the principal, IAM role, and target account.

Parameter Syntax

$result = $client->getEntitlement([
    'applicationArn' => '<string>', // REQUIRED
    'entitlementId' => '<string>', // REQUIRED
]);

Parameter Details

Members
applicationArn
Required: Yes
Type: string

Specifies the ARN of the application that the entitlement belongs to.

entitlementId
Required: Yes
Type: string

Specifies the unique identifier of the entitlement to retrieve.

Result Syntax

[
    'applicationArn' => '<string>',
    'createdAt' => <DateTime>,
    'entitlement' => [
        'principalRole' => [
            'account' => '<string>',
            'accountName' => '<string>',
            'principal' => [
                'identityCenter' => [
                    'groupId' => '<string>',
                    'userId' => '<string>',
                ],
            ],
            'roleArn' => '<string>',
        ],
    ],
    'entitlementId' => '<string>',
]

Result Details

Members
applicationArn
Required: Yes
Type: string

The ARN of the application that the entitlement belongs to.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time when the entitlement was created.

entitlement
Required: Yes
Type: EntitlementDetails structure

The entitlement details, including the principal, IAM role, and target account.

entitlementId
Required: Yes
Type: string

The unique identifier of the entitlement.

Errors

AccessDeniedException:

You do not have sufficient access to perform this operation.

ResourceNotFoundException:

The specified resource does not exist. Verify that the resource identifier is correct and that the resource exists in the current Region.

ThrottlingException:

The request was denied due to request throttling. Try your request again later.

ValidationException:

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

InternalServerException:

An internal service error occurred. Try your request again later.

ListApplications

$result = $client->listApplications([/* ... */]);
$promise = $client->listApplicationsAsync([/* ... */]);

Lists the account access manager applications in your account. Use pagination to ensure that the operation returns quickly and successfully.

Parameter Syntax

$result = $client->listApplications([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Members
maxResults
Type: int

Specifies the maximum number of results to return in a single call.

nextToken
Type: string

Specifies the pagination token from a previous call to retrieve the next set of results.

Result Syntax

[
    'applications' => [
        [
            'applicationArn' => '<string>',
            'createdAt' => <DateTime>,
            'tenantId' => '<string>',
            'updatedAt' => <DateTime>,
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Members
applications
Required: Yes
Type: Array of ApplicationSummary structures

The list of applications.

nextToken
Type: string

The pagination token to use in a subsequent request to retrieve the next set of results. This value is null when there are no more results to return.

Errors

AccessDeniedException:

You do not have sufficient access to perform this operation.

ThrottlingException:

The request was denied due to request throttling. Try your request again later.

ValidationException:

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

InternalServerException:

An internal service error occurred. Try your request again later.

ListEntitlements

$result = $client->listEntitlements([/* ... */]);
$promise = $client->listEntitlementsAsync([/* ... */]);

Lists the entitlements for a specified account access manager application. You can filter results by principal, IAM role, or account. Use pagination to ensure that the operation returns quickly and successfully.

Parameter Syntax

$result = $client->listEntitlements([
    'applicationArn' => '<string>', // REQUIRED
    'filter' => [ // REQUIRED
        'principalRole' => [
            'account' => '<string>',
            'principal' => [
                'identityCenter' => [
                    'groupId' => '<string>',
                    'userId' => '<string>',
                ],
            ],
            'roleArn' => '<string>',
        ],
    ],
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Members
applicationArn
Required: Yes
Type: string

Specifies the ARN of the application to list entitlements for.

filter
Required: Yes
Type: EntitlementFilter structure

Specifies filter criteria to narrow the entitlements returned. You can filter by principal, IAM role, or account.

maxResults
Type: int

Specifies the maximum number of results to return in a single call.

nextToken
Type: string

Specifies the pagination token from a previous call to retrieve the next set of results.

Result Syntax

[
    'entitlements' => [
        [
            'createdAt' => <DateTime>,
            'entitlement' => [
                'principalRole' => [
                    'account' => '<string>',
                    'accountName' => '<string>',
                    'principal' => [
                        'identityCenter' => [
                            'groupId' => '<string>',
                            'userId' => '<string>',
                        ],
                    ],
                    'roleArn' => '<string>',
                ],
            ],
            'entitlementId' => '<string>',
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Members
entitlements
Required: Yes
Type: Array of EntitlementsListMember structures

The list of entitlements for the specified application.

nextToken
Type: string

The pagination token to use in a subsequent request to retrieve the next set of results. This value is null when there are no more results to return.

Errors

AccessDeniedException:

You do not have sufficient access to perform this operation.

ResourceNotFoundException:

The specified resource does not exist. Verify that the resource identifier is correct and that the resource exists in the current Region.

ThrottlingException:

The request was denied due to request throttling. Try your request again later.

ValidationException:

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

InternalServerException:

An internal service error occurred. Try your request again later.

ListTagsForResource

$result = $client->listTagsForResource([/* ... */]);
$promise = $client->listTagsForResourceAsync([/* ... */]);

Lists the tags associated with an account access manager resource.

Parameter Syntax

$result = $client->listTagsForResource([
    'resourceArn' => '<string>', // REQUIRED
]);

Parameter Details

Members
resourceArn
Required: Yes
Type: string

Specifies the ARN of the resource to list tags for.

Result Syntax

[
    'tags' => ['<string>', ...],
]

Result Details

Members
tags
Type: Associative array of custom strings keys (String) to strings

The tags associated with the resource.

Errors

ResourceNotFoundException:

The specified resource does not exist. Verify that the resource identifier is correct and that the resource exists in the current Region.

ThrottlingException:

The request was denied due to request throttling. Try your request again later.

ValidationException:

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

InternalServerException:

An internal service error occurred. Try your request again later.

TagResource

$result = $client->tagResource([/* ... */]);
$promise = $client->tagResourceAsync([/* ... */]);

Adds tags to an account access manager resource.

Parameter Syntax

$result = $client->tagResource([
    'resourceArn' => '<string>', // REQUIRED
    'tags' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Members
resourceArn
Required: Yes
Type: string

Specifies the ARN of the resource to add tags to.

tags
Required: Yes
Type: Associative array of custom strings keys (String) to strings

Specifies the tags to add to the resource.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

ResourceNotFoundException:

The specified resource does not exist. Verify that the resource identifier is correct and that the resource exists in the current Region.

ThrottlingException:

The request was denied due to request throttling. Try your request again later.

ValidationException:

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

InternalServerException:

An internal service error occurred. Try your request again later.

UntagResource

$result = $client->untagResource([/* ... */]);
$promise = $client->untagResourceAsync([/* ... */]);

Removes tags from an account access manager resource.

Parameter Syntax

$result = $client->untagResource([
    'resourceArn' => '<string>', // REQUIRED
    'tagKeys' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Members
resourceArn
Required: Yes
Type: string

Specifies the ARN of the resource to remove tags from.

tagKeys
Required: Yes
Type: Array of strings

Specifies the tag keys to remove from the resource.

Result Syntax

[]

Result Details

The results for this operation are always empty.

Errors

ResourceNotFoundException:

The specified resource does not exist. Verify that the resource identifier is correct and that the resource exists in the current Region.

ThrottlingException:

The request was denied due to request throttling. Try your request again later.

ValidationException:

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

InternalServerException:

An internal service error occurred. Try your request again later.

Shapes

AccessDeniedException

Description

You do not have sufficient access to perform this operation.

Members
message
Type: string

AlreadyCreatedException

Description

The resource you are trying to create already exists. To retrieve the existing resource, use the corresponding Get operation.

Members
message
Type: string

ApplicationSummary

Description

Contains summary information about an account access manager application.

Members
applicationArn
Required: Yes
Type: string

The ARN of the application.

createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time when the application was created.

tenantId
Type: string

The tenant identifier associated with the application.

updatedAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time when the application was last updated.

ConflictException

Description

The request conflicts with the current state of the resource.

Members
message
Type: string

Entitlement

Description

Specifies the entitlement configuration for an account access manager application, defining which principal can assume which IAM role.

Members
principalRole
Type: PrincipalRoleEntitlement structure

The principal-to-role mapping for the entitlement.

EntitlementDetails

Description

Contains detailed information about an entitlement, including the principal, IAM role, and target account.

Members
principalRole

The principal-to-role mapping details for the entitlement, including the target account.

EntitlementFilter

Description

Specifies filter criteria for listing entitlements.

Members
principalRole

The principal-to-role filter criteria for narrowing entitlement results.

EntitlementSummary

Description

Contains summary information about an entitlement.

Members
principalRole

The principal-to-role mapping summary for the entitlement.

EntitlementsListMember

Description

Contains information about an entitlement in a list result.

Members
createdAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time when the entitlement was created.

entitlement
Required: Yes
Type: EntitlementSummary structure

The summary information for the entitlement.

entitlementId
Required: Yes
Type: string

The unique identifier of the entitlement.

ErrorDetails

Description

Contains information about an error that occurred during application processing.

Members
code
Required: Yes
Type: string

The error code that identifies the type of error.

message
Required: Yes
Type: string

A human-readable message that describes the error.

IdentityCenter

Description

Specifies the IAM Identity Center instance to use as the identity source for an application.

Members
instanceArn
Required: Yes
Type: string

The ARN of the IAM Identity Center instance.

IdentityCenterDetails

Description

Contains detailed information about the IAM Identity Center configuration for an application.

Members
applicationArn
Type: string

The ARN of the IAM Identity Center application created for this account access manager application.

instanceArn
Required: Yes
Type: string

The ARN of the IAM Identity Center instance.

IdentityCenterPrincipal

Description

Identifies a user or group from IAM Identity Center.

Members
groupId
Type: string

The unique identifier of a group in IAM Identity Center.

userId
Type: string

The unique identifier of a user in IAM Identity Center.

IdentityCenterPrincipalFilter

Description

Specifies filter criteria for an IAM Identity Center principal.

Members
groupId
Type: string

The unique identifier of a group in IAM Identity Center to filter by.

userId
Type: string

The unique identifier of a user in IAM Identity Center to filter by.

IdentitySource

Description

Specifies the identity source for an account access manager application.

Members
identityCenter
Type: IdentityCenter structure

The IAM Identity Center instance to use as the identity source.

IdentitySourceDetails

Description

Contains detailed information about the identity source for an application.

Members
identityCenter
Type: IdentityCenterDetails structure

The IAM Identity Center configuration details for the identity source.

InternalServerException

Description

An internal service error occurred. Try your request again later.

Members
message
Type: string

Principal

Description

Identifies a principal (user or group) that can be granted entitlements.

Members
identityCenter
Type: IdentityCenterPrincipal structure

The IAM Identity Center principal (user or group).

PrincipalFilter

Description

Specifies filter criteria for a principal.

Members
identityCenter

The IAM Identity Center principal filter criteria.

PrincipalRoleEntitlement

Description

Specifies a principal-to-role entitlement that grants an IAM Identity Center principal permission to assume an IAM role.

Members
principal
Required: Yes
Type: Principal structure

The principal (user or group) that is granted access to assume the IAM role.

roleArn
Required: Yes
Type: string

The ARN of the IAM role that the principal can assume.

PrincipalRoleEntitlementDetails

Description

Contains detailed information about a principal-to-role entitlement, including the target account.

Members
account
Required: Yes
Type: string

The 12-digit Amazon Web Services account ID where the IAM role resides.

accountName
Type: string

The friendly name of the Amazon Web Services account where the IAM role resides.

principal
Required: Yes
Type: Principal structure

The principal (user or group) that is granted access to assume the IAM role.

roleArn
Required: Yes
Type: string

The ARN of the IAM role that the principal can assume.

PrincipalRoleEntitlementFilter

Description

Specifies filter criteria for principal-to-role entitlements. All specified criteria must match for an entitlement to be returned.

Members
account
Type: string

The 12-digit Amazon Web Services account ID to filter entitlements by.

principal
Type: PrincipalFilter structure

The principal to filter entitlements by.

roleArn
Type: string

The IAM role ARN to filter entitlements by.

PrincipalRoleEntitlementSummary

Description

Contains summary information about a principal-to-role entitlement.

Members
account
Required: Yes
Type: string

The 12-digit Amazon Web Services account ID where the IAM role resides.

accountName
Type: string

The friendly name of the Amazon Web Services account where the IAM role resides.

principal
Required: Yes
Type: Principal structure

The principal (user or group) that is granted access to assume the IAM role.

roleArn
Required: Yes
Type: string

The ARN of the IAM role that the principal can assume.

ResourceNotFoundException

Description

The specified resource does not exist. Verify that the resource identifier is correct and that the resource exists in the current Region.

Members
message
Type: string

ServiceQuotaExceededException

Description

The request exceeds a service quota for your account.

Members
message
Type: string

ThrottlingException

Description

The request was denied due to request throttling. Try your request again later.

Members
message
Type: string

ValidationException

Description

The input does not satisfy the constraints specified by the service. Check your request parameters and retry the request.

Members
message
Type: string