NetworkSecurityManagerCustomerAPI / Client / put_admin_account

put_admin_account¶

NetworkSecurityManagerCustomerAPI.Client.put_admin_account(**kwargs)¶

Sets the AWS account that serves as an AWS Network Security Manager administrator account, and optionally configures the scope of resources that the administrator can manage.

You can’t set an administrator account again immediately after you remove it, or while the service creates its service-linked role. Retry the request after a few minutes.

Request Syntax

response = client.put_admin_account(
    accountId='string',
    priority=123,
    adminScope={
        'scopeFilter': {
            'includeAll': {}
            ,
            'includeOnly': {
                'accounts': [
                    'string',
                ],
                'organizationalUnits': [
                    'string',
                ]
            },
            'excludeOnly': {
                'accounts': [
                    'string',
                ],
                'organizationalUnits': [
                    'string',
                ]
            }
        },
        'firewallTypeScope': {
            'allFirewallTypesEnabled': True|False,
            'firewallTypes': [
                'WAF'|'SHIELD_ADVANCED',
            ]
        }
    }
)

Parameters:

accountId (string) –
[REQUIRED]

The AWS account ID to set as the AWS Network Security Manager administrator account.
priority (integer) –
[REQUIRED]

The priority to assign to the administrator account.
adminScope (dict) –
The scope of accounts, organizational units, and firewall types that the administrator can manage.
- scopeFilter (dict) –
  
  The filter that determines which accounts and organizational units are in the administrator’s scope.
  
  Note
  This is a Tagged Union structure. Only one of the following top level keys can be set: includeAll, includeOnly, excludeOnly.
  - includeAll (dict) –
    
    All accounts and organizational units are in scope.
  - includeOnly (dict) –
    
    Only the specified accounts and organizational units are in the administrator’s scope.
    - accounts (list) –
      
      The AWS accounts in the selection.
      - (string) –
    - organizationalUnits (list) –
      
      The AWS Organizations organizational units (OUs) in the selection.
      - (string) –
  - excludeOnly (dict) –
    
    The accounts and organizational units to exclude from the administrator’s scope. All others are in scope.
    - accounts (list) –
      
      The AWS accounts in the selection.
      - (string) –
    - organizationalUnits (list) –
      
      The AWS Organizations organizational units (OUs) in the selection.
      - (string) –
- firewallTypeScope (dict) –
  
  The firewall types that the administrator can create and manage.
  - allFirewallTypesEnabled (boolean) –
    
    Specifies whether the administrator can manage all firewall types, except for third-party firewall types.
  - firewallTypes (list) –
    
    The list of firewall types that the administrator can manage.
    - (string) –

Return type:

dict

Returns:

Response Syntax

{
    'adminAccountDetails': {
        'adminAccount': 'string',
        'priority': 123,
        'adminScope': {
            'scopeFilter': {
                'includeAll': {},
                'includeOnly': {
                    'accounts': [
                        {
                            'accountId': 'string',
                            'name': 'string',
                            'email': 'string'
                        },
                    ],
                    'organizationalUnits': [
                        {
                            'ouId': 'string',
                            'name': 'string'
                        },
                    ]
                },
                'excludeOnly': {
                    'accounts': [
                        {
                            'accountId': 'string',
                            'name': 'string',
                            'email': 'string'
                        },
                    ],
                    'organizationalUnits': [
                        {
                            'ouId': 'string',
                            'name': 'string'
                        },
                    ]
                }
            },
            'firewallTypeScope': {
                'allFirewallTypesEnabled': True|False,
                'firewallTypes': [
                    'WAF'|'SHIELD_ADVANCED',
                ]
            }
        },
        'status': 'ONBOARDED'|'OFFBOARDED'
    }
}

Response Structure

(dict) –
- adminAccountDetails (dict) –
  
  The details of the administrator account that was set.
  - adminAccount (string) –
    
    The AWS account ID of the administrator account.
  - priority (integer) –
    
    The priority assigned to the administrator account.
  - adminScope (dict) –
    
    The administrative scope, which defines the accounts, organizational units, and firewall types that the administrator can manage.
    - scopeFilter (dict) –
      
      The filter that determines which accounts and organizational units are in the administrator’s scope.
      Note
      This is a Tagged Union structure. Only one of the following top level keys will be set: includeAll, includeOnly, excludeOnly. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - includeAll (dict) –
        
        All accounts and organizational units are in scope.
      - includeOnly (dict) –
        
        Only the specified accounts and organizational units are in the administrator’s scope.
        
        accounts (list) –
        
        The AWS accounts in the selection.
        
        (dict) –
        
        A reference to an AWS account, with optional display metadata.
        
        accountId (string) –
        
        The AWS account ID.
        
        name (string) –
        
        The display name of the account.
        
        email (string) –
        
        The email address associated with the account.
        
        organizationalUnits (list) –
        
        The AWS Organizations organizational units (OUs) in the selection.
        
        (dict) –
        
        A reference to an AWS Organizations organizational unit (OU), with optional display metadata.
        
        ouId (string) –
        
        The ID of the AWS Organizations organizational unit (OU).
        
        name (string) –
        
        The display name of the organizational unit.
      - excludeOnly (dict) –
        
        The accounts and organizational units to exclude from the administrator’s scope. All others are in scope.
        
        accounts (list) –
        
        The AWS accounts in the selection.
        
        (dict) –
        
        A reference to an AWS account, with optional display metadata.
        
        accountId (string) –
        
        The AWS account ID.
        
        name (string) –
        
        The display name of the account.
        
        email (string) –
        
        The email address associated with the account.
        
        organizationalUnits (list) –
        
        The AWS Organizations organizational units (OUs) in the selection.
        
        (dict) –
        
        A reference to an AWS Organizations organizational unit (OU), with optional display metadata.
        
        ouId (string) –
        
        The ID of the AWS Organizations organizational unit (OU).
        
        name (string) –
        
        The display name of the organizational unit.
    - firewallTypeScope (dict) –
      
      The firewall types that the administrator can create and manage.
      - allFirewallTypesEnabled (boolean) –
        
        Specifies whether the administrator can manage all firewall types, except for third-party firewall types.
      - firewallTypes (list) –
        
        The list of firewall types that the administrator can manage.
        
        (string) –
  - status (string) –
    
    The status of the administrator account, either ONBOARDED or OFFBOARDED.

Exceptions

NetworkSecurityManagerCustomerAPI.Client.exceptions.ValidationException
NetworkSecurityManagerCustomerAPI.Client.exceptions.ServiceQuotaExceededException
NetworkSecurityManagerCustomerAPI.Client.exceptions.ConflictException
NetworkSecurityManagerCustomerAPI.Client.exceptions.ServiceUnavailableException
NetworkSecurityManagerCustomerAPI.Client.exceptions.InternalServerException
NetworkSecurityManagerCustomerAPI.Client.exceptions.AccessDeniedException
NetworkSecurityManagerCustomerAPI.Client.exceptions.ThrottlingException