CloudWatchOmni / Client / create_domain_for_organization

create_domain_for_organization

CloudWatchOmni.Client.create_domain_for_organization(**kwargs)

Creates an organization-scoped domain for the caller’s AWS Organization. Only the organization’s management account can call this operation.

See also: AWS API Documentation

Request Syntax

response = client.create_domain_for_organization(
    name='string',
    identityProviders=[
        'IAM'|'IDC',
    ],
    identityProviderConfiguration={
        'identityCenterConfiguration': {
            'identityCenterInstanceArn': 'string'
        }
    },
    domainAccessRoleArn='string',
    tags={
        'string': 'string'
    },
    clientToken='string'
)

Parameters:

• name (string) –

  [REQUIRED]

  A name that identifies the organization domain. Must be 3-63 characters: lowercase letters, numbers, and hyphens. It must begin and end with a letter or number and cannot contain consecutive hyphens.

• identityProviders (list) –

  [REQUIRED]

  The identity providers to configure for the domain.

  • (string) –

    Identity provider type for a domain. Determines which identity mechanisms are active for authentication.

• identityProviderConfiguration (dict) –

  Identity provider configuration for the domain.

  • identityCenterConfiguration (dict) –

    Identity Center configuration. Required when identityProviders includes IDC.

    • identityCenterInstanceArn (string) –

      Identity Center instance ARN

• domainAccessRoleArn (string) –

  [REQUIRED]

  The ARN of an IAM role in the management account used for domain access. You must create this role, and its trust policy must allow the service principal to assume it.

• tags (dict) –

  The tags to associate with the domain.

  • (string) –

    Tag key. Must be non-empty; AWS-standard maximum length. Constraining the key (rather than a bare String) rejects empty-key payloads at the edge with a 400 ValidationException instead of faulting downstream as a 500.

    • (string) –

      Tag value. AWS-standard maximum length; may be empty.

• clientToken (string) –

  Idempotency token for safe retries. Repeated requests with the same token return the original result instead of creating a duplicate.

  This field is autopopulated if not provided.

Return type:

dict

Returns:

Response Syntax

{
    'organizationDomain': {
        'domainId': 'string',
        'domainArn': 'string',
        'name': 'string',
        'domainEndpointUrl': 'string',
        'customEndpointUrls': [
            'string',
        ],
        'organizationId': 'string',
        'ownerAccountId': 'string',
        'identityProviders': [
            'IAM'|'IDC',
        ],
        'identityProviderConfiguration': {
            'identityCenterConfiguration': {
                'identityCenterInstanceArn': 'string'
            }
        },
        'identityCenterApplicationArn': 'string',
        'region': 'string',
        'status': 'ACTIVE',
        'domainAccessRoleArn': 'string',
        'createdAt': datetime(2015, 1, 1),
        'updatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

• (dict) –

  • organizationDomain (dict) –

    The details of the created organization domain.

    • domainId (string) –

      The unique ID of the organization domain.

    • domainArn (string) –

      The Amazon Resource Name (ARN) of the organization domain.

    • name (string) –

      A name that identifies the organization domain.

    • domainEndpointUrl (string) –

      The HTTPS endpoint URL for accessing the organization domain.

    • customEndpointUrls (list) –

      Additional endpoint URLs derived from the domain name.

      • (string) –

    • organizationId (string) –

      The ID of the AWS Organization that owns the domain.

    • ownerAccountId (string) –

      The AWS account ID that owns the organization domain.

    • identityProviders (list) –

      The identity providers configured for the organization domain.

      • (string) –

        Identity provider type for a domain. Determines which identity mechanisms are active for authentication.

    • identityProviderConfiguration (dict) –

      Identity provider configuration for the organization domain.

      • identityCenterConfiguration (dict) –

        Identity Center configuration. Required when identityProviders includes IDC.

        • identityCenterInstanceArn (string) –

          Identity Center instance ARN

    • identityCenterApplicationArn (string) –

      The ARN of the Identity Center application. Absent for IAM-only domains.

    • region (string) –

      The Region where this organization domain was created.

    • status (string) –

      Current status of the organization domain.

    • domainAccessRoleArn (string) –

      The ARN of the customer-provided IAM role in the management account used for domain access.

    • createdAt (datetime) –

      The timestamp when the organization domain was created.

    • updatedAt (datetime) –

      The timestamp when the organization domain was last updated.

Exceptions

• CloudWatchOmni.Client.exceptions.ThrottlingException

• CloudWatchOmni.Client.exceptions.ValidationException

• CloudWatchOmni.Client.exceptions.AccessDeniedException

• CloudWatchOmni.Client.exceptions.InternalServerException

• CloudWatchOmni.Client.exceptions.ConflictException