AccountAccess / Client / get_entitlement

get_entitlement

AccountAccess.Client.get_entitlement(**kwargs)

Retrieves details about a specific entitlement for an account access manager application, including the principal, IAM role, and target account.

See also: AWS API Documentation

Request Syntax

response = client.get_entitlement(
    applicationArn='string',
    entitlementId='string'
)

Parameters:

• applicationArn (string) –

  [REQUIRED]

  Specifies the ARN of the application that the entitlement belongs to.

• entitlementId (string) –

  [REQUIRED]

  Specifies the unique identifier of the entitlement to retrieve.

Return type:

dict

Returns:

Response Syntax

{
    'applicationArn': 'string',
    'entitlementId': 'string',
    'entitlement': {
        'principalRole': {
            'principal': {
                'identityCenter': {
                    'userId': 'string',
                    'groupId': 'string'
                }
            },
            'roleArn': 'string',
            'account': 'string',
            'accountName': 'string'
        }
    },
    'createdAt': datetime(2015, 1, 1)
}

Response Structure

• (dict) –

  • applicationArn (string) –

    The ARN of the application that the entitlement belongs to.

  • entitlementId (string) –

    The unique identifier of the entitlement.

  • entitlement (dict) –

    The entitlement details, including the principal, IAM role, and target account.

    Note

    This is a Tagged Union structure. Only one of the following top level keys will be set: principalRole. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

    'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
    

    • principalRole (dict) –

      The principal-to-role mapping details for the entitlement, including the target account.

      • principal (dict) –

        The principal (user or group) that is granted access to assume the IAM role.

        Note

        This is a Tagged Union structure. Only one of the following top level keys will be set: identityCenter. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

        'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
        

        • identityCenter (dict) –

          The IAM Identity Center principal (user or group).

          Note

          This is a Tagged Union structure. Only one of the following top level keys will be set: userId, groupId. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

          'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
          

          • userId (string) –

            The unique identifier of a user in IAM Identity Center.

          • groupId (string) –

            The unique identifier of a group in IAM Identity Center.

      • roleArn (string) –

        The ARN of the IAM role that the principal can assume.

      • account (string) –

        The 12-digit Amazon Web Services account ID where the IAM role resides.

      • accountName (string) –

        The friendly name of the Amazon Web Services account where the IAM role resides.

  • createdAt (datetime) –

    The date and time when the entitlement was created.

Exceptions

• AccountAccess.Client.exceptions.AccessDeniedException

• AccountAccess.Client.exceptions.ResourceNotFoundException

• AccountAccess.Client.exceptions.ThrottlingException

• AccountAccess.Client.exceptions.ValidationException

• AccountAccess.Client.exceptions.InternalServerException