SDK for PHP V3

Account Access Runtime 2018-05-10

Client: Aws\AccountAccessRuntime\AccountAccessRuntimeClient
Service ID: account-access-runtime
Version: 2018-05-10

This page describes the parameters and results for the operations of the Account Access Runtime (2018-05-10), and shows how to use the Aws\AccountAccessRuntime\AccountAccessRuntimeClient object to call the described operations. This documentation is specific to the 2018-05-10 API version of the service.

Operation Summary

Each of the following operations can be created from a client using $client->getCommand('CommandName'), where "CommandName" is the name of one of the following operations. Note: a command is a value that encapsulates an operation and the parameters used to create an HTTP request.

You can also create and send a command immediately using the magic methods available on a client object: $client->commandName(/* parameters */). You can send the command asynchronously (returning a promise) by appending the word "Async" to the operation name: $client->commandNameAsync(/* parameters */).

GetRoleCredentials ( array $params = [] )
Returns temporary Amazon Web Services credentials for a role that you are entitled to assume within a tenant.
ListRoles ( array $params = [] )
Returns the roles that you are entitled to access within a tenant.

Paginators

Paginators handle automatically iterating over paginated API results. Paginators are associated with specific API operations, and they accept the parameters that the corresponding API operation accepts. You can get a paginator from a client class using getPaginator($paginatorName, $operationParameters). This client supports the following paginators:

ListRoles

Operations

GetRoleCredentials 

$result = $client->getRoleCredentials([/* ... */]);
$promise = $client->getRoleCredentialsAsync([/* ... */]);

Returns temporary Amazon Web Services credentials for a role that you are entitled to assume within a tenant. You can use these credentials for programmatic access with the CLI or an Amazon Web Services SDK. If you aren't entitled to the role, the request fails with an AccessDeniedException error.

Parameter Syntax

$result = $client->getRoleCredentials([
    'accessType' => 'PROGRAMMATIC_ACCESS', // REQUIRED
    'roleArn' => '<string>', // REQUIRED
    'sessionDuration' => <integer>,
    'sessionName' => '<string>',
    'tenantId' => '<string>', // REQUIRED
]);

Parameter Details

Members
accessType
Required: Yes
Type: string

The type of access to request for the role. Specify PROGRAMMATIC_ACCESS to receive access key credentials for use with the CLI or an Amazon Web Services SDK.

roleArn
Required: Yes
Type: string

The Amazon Resource Name (ARN) of the role to retrieve credentials for. You must be entitled to assume this role.

sessionDuration
Type: int

The duration, in seconds, that the returned credentials remain valid. If you don't specify a value, the service uses the default session duration. The maximum value can't exceed the maximum session duration configured for the role.

sessionName
Type: string

An optional name for the role session. The name can be 2 to 64 characters and can contain alphanumeric characters and the following symbols: plus (+), equal (=), comma (,), period (.), at (@), and hyphen (-). The session name appears in CloudTrail logs for the assumed role session.

tenantId
Required: Yes
Type: string

The identifier of the tenant that the request applies to. A tenant ID begins with aa- and is 3 to 24 characters long. It can contain lowercase letters, numbers, and hyphens.

Result Syntax

[
    'credentialsDetails' => [
        'programmaticAccess' => [
            'accessKeyId' => '<string>',
            'expiresAt' => <DateTime>,
            'secretAccessKey' => '<string>',
            'sessionToken' => '<string>',
        ],
    ],
]

Result Details

Members
credentialsDetails
Type: CredentialsDetails structure

The temporary credentials that the service returns for the requested role.

Errors

AccessDeniedException:

You are authenticated but not authorized to perform the requested action, such as assuming a role that you aren't entitled to. This error returns an HTTP 403 status code.

ThrottlingException:

The request rate exceeded the allowed limit. Reduce your request rate, and then retry the request. This error returns an HTTP 429 status code.

UnauthorizedException:

The bearer token is missing, invalid, or expired. Obtain a new token, and then retry the request. This error returns an HTTP 401 status code.

ValidationException:

The request is missing a required parameter, or a parameter value doesn't satisfy its constraints, such as its length or pattern. Correct the input, and then retry the request. This error returns an HTTP 400 status code.

InternalServerException:

An internal server error occurred. Retry the request. If the problem persists, contact Amazon Web Services Support. This error returns an HTTP 500 status code.

ListRoles 

$result = $client->listRoles([/* ... */]);
$promise = $client->listRolesAsync([/* ... */]);

Returns the roles that you are entitled to access within a tenant. The results are paginated. Use a returned role with GetRoleCredentials to obtain temporary credentials.

Parameter Syntax

$result = $client->listRoles([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'tenantId' => '<string>', // REQUIRED
]);

Parameter Details

Members
maxResults
Type: int

The maximum number of roles to return in a single response. If more roles are available than the specified value, the response includes a nextToken value that you can use to retrieve the next page of results. If you don't specify a value, the service uses a default page size.

nextToken
Type: string

The pagination token from a previous ListRoles response. Use it to retrieve the next page of results. Omit this parameter on the first call.

tenantId
Required: Yes
Type: string

The identifier of the tenant whose roles you want to list. A tenant ID begins with aa- and is 3 to 24 characters long. It can contain lowercase letters, numbers, and hyphens.

Result Syntax

[
    'nextToken' => '<string>',
    'roles' => [
        [
            'accountId' => '<string>',
            'accountName' => '<string>',
            'roleArn' => '<string>',
        ],
        // ...
    ],
]

Result Details

Members
nextToken
Type: string

The pagination token to include in a subsequent ListRoles request to retrieve the next page of results. This value is absent when there are no more results to return.

roles
Required: Yes
Type: Array of AccessDetails structures

The list of roles that you can access in the tenant. Each entry describes an Amazon Web Services account and a role.

Errors

ThrottlingException:

The request rate exceeded the allowed limit. Reduce your request rate, and then retry the request. This error returns an HTTP 429 status code.

UnauthorizedException:

The bearer token is missing, invalid, or expired. Obtain a new token, and then retry the request. This error returns an HTTP 401 status code.

ValidationException:

The request is missing a required parameter, or a parameter value doesn't satisfy its constraints, such as its length or pattern. Correct the input, and then retry the request. This error returns an HTTP 400 status code.

InternalServerException:

An internal server error occurred. Retry the request. If the problem persists, contact Amazon Web Services Support. This error returns an HTTP 500 status code.

Shapes

AccessDeniedException

Description

You are authenticated but not authorized to perform the requested action, such as assuming a role that you aren't entitled to. This error returns an HTTP 403 status code.

Members
message
Required: Yes
Type: string

AccessDetails

Description

Describes a role that you can access, including the Amazon Web Services account that contains the role and the role's ARN.

Members
accountId
Required: Yes
Type: string

The 12-digit identifier of the Amazon Web Services account that contains the role.

accountName
Type: string

The display name of the Amazon Web Services account, if available. This value can be absent when the account name can't be resolved.

roleArn
Required: Yes
Type: string

The Amazon Resource Name (ARN) of the role that you can access.

CredentialsDetails

Description

The temporary credentials returned for a role. Only one member is set, depending on the type of access that you requested.

Members
programmaticAccess
Type: ProgrammaticAccessDetails structure

The access key credentials returned for programmatic access with the CLI or an Amazon Web Services SDK.

InternalServerException

Description

An internal server error occurred. Retry the request. If the problem persists, contact Amazon Web Services Support. This error returns an HTTP 500 status code.

Members
message
Required: Yes
Type: string

ProgrammaticAccessDetails

Description

A set of temporary Amazon Web Services credentials for programmatic access. Treat these values as sensitive.

Members
accessKeyId
Required: Yes
Type: string

The access key ID for the temporary credentials.

expiresAt
Required: Yes
Type: timestamp (string|DateTime or anything parsable by strtotime)

The date and time when the temporary credentials expire, after which they can no longer be used.

secretAccessKey
Required: Yes
Type: string

The secret access key for the temporary credentials. Treat this value as a secret.

sessionToken
Required: Yes
Type: string

The session token that you must include along with the access key ID and secret access key when you make requests with the temporary credentials.

ThrottlingException

Description

The request rate exceeded the allowed limit. Reduce your request rate, and then retry the request. This error returns an HTTP 429 status code.

Members
message
Required: Yes
Type: string

UnauthorizedException

Description

The bearer token is missing, invalid, or expired. Obtain a new token, and then retry the request. This error returns an HTTP 401 status code.

Members
message
Required: Yes
Type: string

ValidationException

Description

The request is missing a required parameter, or a parameter value doesn't satisfy its constraints, such as its length or pattern. Correct the input, and then retry the request. This error returns an HTTP 400 status code.

Members
message
Required: Yes
Type: string