com.amazonaws.services.iamrolesanywhere

Interface AWSIAMRolesAnywhere

All Known Subinterfaces:

AWSIAMRolesAnywhereAsync

All Known Implementing Classes:

AbstractAWSIAMRolesAnywhere, AbstractAWSIAMRolesAnywhereAsync, AWSIAMRolesAnywhereAsyncClient, AWSIAMRolesAnywhereClient

@Generated(value="com.amazonaws:aws-java-sdk-code-generator")
public interface AWSIAMRolesAnywhere

Interface for accessing IAM Roles Anywhere.

Note: Do not directly implement this interface, new methods are added to it regularly. Extend from AbstractAWSIAMRolesAnywhere instead.

Identity and Access Management Roles Anywhere provides a secure way for your workloads such as servers, containers, and applications that run outside of Amazon Web Services to obtain temporary Amazon Web Services credentials. Your workloads can use the same IAM policies and roles you have for native Amazon Web Services applications to access Amazon Web Services resources. Using IAM Roles Anywhere eliminates the need to manage long-term credentials for workloads running outside of Amazon Web Services.

To use IAM Roles Anywhere, your workloads must use X.509 certificates issued by their certificate authority (CA). You register the CA with IAM Roles Anywhere as a trust anchor to establish trust between your public key infrastructure (PKI) and IAM Roles Anywhere. If you don't manage your own PKI system, you can use Private Certificate Authority to create a CA and then use that to establish trust with IAM Roles Anywhere.

This guide describes the IAM Roles Anywhere operations that you can call programmatically. For more information about IAM Roles Anywhere, see the IAM Roles Anywhere User Guide.

Field Summary

Fields

Modifier and Type	Field and Description
static String	ENDPOINT_PREFIX The region metadata service name for computing region endpoints.

Method Summary

Modifier and Type	Method and Description
CreateProfileResult	createProfile(CreateProfileRequest createProfileRequest) Creates a profile, a list of the roles that Roles Anywhere service is trusted to assume.
CreateTrustAnchorResult	createTrustAnchor(CreateTrustAnchorRequest createTrustAnchorRequest) Creates a trust anchor to establish trust between IAM Roles Anywhere and your certificate authority (CA).
DeleteAttributeMappingResult	deleteAttributeMapping(DeleteAttributeMappingRequest deleteAttributeMappingRequest) Delete an entry from the attribute mapping rules enforced by a given profile.
DeleteCrlResult	deleteCrl(DeleteCrlRequest deleteCrlRequest) Deletes a certificate revocation list (CRL).
DeleteProfileResult	deleteProfile(DeleteProfileRequest deleteProfileRequest) Deletes a profile.
DeleteTrustAnchorResult	deleteTrustAnchor(DeleteTrustAnchorRequest deleteTrustAnchorRequest) Deletes a trust anchor.
DisableCrlResult	disableCrl(DisableCrlRequest disableCrlRequest) Disables a certificate revocation list (CRL).
DisableProfileResult	disableProfile(DisableProfileRequest disableProfileRequest) Disables a profile.
DisableTrustAnchorResult	disableTrustAnchor(DisableTrustAnchorRequest disableTrustAnchorRequest) Disables a trust anchor.
EnableCrlResult	enableCrl(EnableCrlRequest enableCrlRequest) Enables a certificate revocation list (CRL).
EnableProfileResult	enableProfile(EnableProfileRequest enableProfileRequest) Enables temporary credential requests for a profile.
EnableTrustAnchorResult	enableTrustAnchor(EnableTrustAnchorRequest enableTrustAnchorRequest) Enables a trust anchor.
ResponseMetadata	getCachedResponseMetadata(AmazonWebServiceRequest request) Returns additional metadata for a previously executed successful request, typically used for debugging issues where a service isn't acting as expected.
GetCrlResult	getCrl(GetCrlRequest getCrlRequest) Gets a certificate revocation list (CRL).
GetProfileResult	getProfile(GetProfileRequest getProfileRequest) Gets a profile.
GetSubjectResult	getSubject(GetSubjectRequest getSubjectRequest) Gets a subject, which associates a certificate identity with authentication attempts.
GetTrustAnchorResult	getTrustAnchor(GetTrustAnchorRequest getTrustAnchorRequest) Gets a trust anchor.
ImportCrlResult	importCrl(ImportCrlRequest importCrlRequest) Imports the certificate revocation list (CRL).
ListCrlsResult	listCrls(ListCrlsRequest listCrlsRequest) Lists all certificate revocation lists (CRL) in the authenticated account and Amazon Web Services Region.
ListProfilesResult	listProfiles(ListProfilesRequest listProfilesRequest) Lists all profiles in the authenticated account and Amazon Web Services Region.
ListSubjectsResult	listSubjects(ListSubjectsRequest listSubjectsRequest) Lists the subjects in the authenticated account and Amazon Web Services Region.
ListTagsForResourceResult	listTagsForResource(ListTagsForResourceRequest listTagsForResourceRequest) Lists the tags attached to the resource.
ListTrustAnchorsResult	listTrustAnchors(ListTrustAnchorsRequest listTrustAnchorsRequest) Lists the trust anchors in the authenticated account and Amazon Web Services Region.
PutAttributeMappingResult	putAttributeMapping(PutAttributeMappingRequest putAttributeMappingRequest) Put an entry in the attribute mapping rules that will be enforced by a given profile.
PutNotificationSettingsResult	putNotificationSettings(PutNotificationSettingsRequest putNotificationSettingsRequest) Attaches a list of notification settings to a trust anchor.
ResetNotificationSettingsResult	resetNotificationSettings(ResetNotificationSettingsRequest resetNotificationSettingsRequest) Resets the custom notification setting to IAM Roles Anywhere default setting.
void	shutdown() Shuts down this client object, releasing any resources that might be held open.
TagResourceResult	tagResource(TagResourceRequest tagResourceRequest) Attaches tags to a resource.
UntagResourceResult	untagResource(UntagResourceRequest untagResourceRequest) Removes tags from the resource.
UpdateCrlResult	updateCrl(UpdateCrlRequest updateCrlRequest) Updates the certificate revocation list (CRL).
UpdateProfileResult	updateProfile(UpdateProfileRequest updateProfileRequest) Updates a profile, a list of the roles that IAM Roles Anywhere service is trusted to assume.
UpdateTrustAnchorResult	updateTrustAnchor(UpdateTrustAnchorRequest updateTrustAnchorRequest) Updates a trust anchor.

Field Detail

ENDPOINT_PREFIX

static final String ENDPOINT_PREFIX

The region metadata service name for computing region endpoints. You can use this value to retrieve metadata (such as supported regions) of the service.

See Also:

RegionUtils.getRegionsForService(String), Constant Field Values

Method Detail

createProfile

CreateProfileResult createProfile(CreateProfileRequest createProfileRequest)

Creates a profile, a list of the roles that Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies.

Required permissions: rolesanywhere:CreateProfile.

Parameters:

createProfileRequest -

Returns:

Result of the CreateProfile operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

createTrustAnchor

CreateTrustAnchorResult createTrustAnchor(CreateTrustAnchorRequest createTrustAnchorRequest)

Creates a trust anchor to establish trust between IAM Roles Anywhere and your certificate authority (CA). You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials.

Required permissions: rolesanywhere:CreateTrustAnchor.

Parameters:

createTrustAnchorRequest -

Returns:

Result of the CreateTrustAnchor operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

deleteAttributeMapping

DeleteAttributeMappingResult deleteAttributeMapping(DeleteAttributeMappingRequest deleteAttributeMappingRequest)

Delete an entry from the attribute mapping rules enforced by a given profile.

Parameters:

deleteAttributeMappingRequest -

Returns:

Result of the DeleteAttributeMapping operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

deleteCrl

DeleteCrlResult deleteCrl(DeleteCrlRequest deleteCrlRequest)

Deletes a certificate revocation list (CRL).

Required permissions: rolesanywhere:DeleteCrl.

Parameters:

deleteCrlRequest -

Returns:

Result of the DeleteCrl operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

deleteProfile

DeleteProfileResult deleteProfile(DeleteProfileRequest deleteProfileRequest)

Deletes a profile.

Required permissions: rolesanywhere:DeleteProfile.

Parameters:

deleteProfileRequest -

Returns:

Result of the DeleteProfile operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

deleteTrustAnchor

DeleteTrustAnchorResult deleteTrustAnchor(DeleteTrustAnchorRequest deleteTrustAnchorRequest)

Deletes a trust anchor.

Required permissions: rolesanywhere:DeleteTrustAnchor.

Parameters:

deleteTrustAnchorRequest -

Returns:

Result of the DeleteTrustAnchor operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

disableCrl

DisableCrlResult disableCrl(DisableCrlRequest disableCrlRequest)

Disables a certificate revocation list (CRL).

Required permissions: rolesanywhere:DisableCrl.

Parameters:

disableCrlRequest -

Returns:

Result of the DisableCrl operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

disableProfile

DisableProfileResult disableProfile(DisableProfileRequest disableProfileRequest)

Disables a profile. When disabled, temporary credential requests with this profile fail.

Required permissions: rolesanywhere:DisableProfile.

Parameters:

disableProfileRequest -

Returns:

Result of the DisableProfile operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

disableTrustAnchor

DisableTrustAnchorResult disableTrustAnchor(DisableTrustAnchorRequest disableTrustAnchorRequest)

Disables a trust anchor. When disabled, temporary credential requests specifying this trust anchor are unauthorized.

Required permissions: rolesanywhere:DisableTrustAnchor.

Parameters:

disableTrustAnchorRequest -

Returns:

Result of the DisableTrustAnchor operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

enableCrl

EnableCrlResult enableCrl(EnableCrlRequest enableCrlRequest)

Enables a certificate revocation list (CRL). When enabled, certificates stored in the CRL are unauthorized to receive session credentials.

Required permissions: rolesanywhere:EnableCrl.

Parameters:

enableCrlRequest -

Returns:

Result of the EnableCrl operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

enableProfile

EnableProfileResult enableProfile(EnableProfileRequest enableProfileRequest)

Enables temporary credential requests for a profile.

Required permissions: rolesanywhere:EnableProfile.

Parameters:

enableProfileRequest -

Returns:

Result of the EnableProfile operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

enableTrustAnchor

EnableTrustAnchorResult enableTrustAnchor(EnableTrustAnchorRequest enableTrustAnchorRequest)

Enables a trust anchor. When enabled, certificates in the trust anchor chain are authorized for trust validation.

Required permissions: rolesanywhere:EnableTrustAnchor.

Parameters:

enableTrustAnchorRequest -

Returns:

Result of the EnableTrustAnchor operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

getCrl

GetCrlResult getCrl(GetCrlRequest getCrlRequest)

Gets a certificate revocation list (CRL).

Required permissions: rolesanywhere:GetCrl.

Parameters:

getCrlRequest -

Returns:

Result of the GetCrl operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

See Also:

AWS API Documentation

getProfile

GetProfileResult getProfile(GetProfileRequest getProfileRequest)

Gets a profile.

Required permissions: rolesanywhere:GetProfile.

Parameters:

getProfileRequest -

Returns:

Result of the GetProfile operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

getSubject

GetSubjectResult getSubject(GetSubjectRequest getSubjectRequest)

Gets a subject, which associates a certificate identity with authentication attempts. The subject stores auditing information such as the status of the last authentication attempt, the certificate data used in the attempt, and the last time the associated identity attempted authentication.

Required permissions: rolesanywhere:GetSubject.

Parameters:

getSubjectRequest -

Returns:

Result of the GetSubject operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

getTrustAnchor

GetTrustAnchorResult getTrustAnchor(GetTrustAnchorRequest getTrustAnchorRequest)

Gets a trust anchor.

Required permissions: rolesanywhere:GetTrustAnchor.

Parameters:

getTrustAnchorRequest -

Returns:

Result of the GetTrustAnchor operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

importCrl

ImportCrlResult importCrl(ImportCrlRequest importCrlRequest)

Imports the certificate revocation list (CRL). A CRL is a list of certificates that have been revoked by the issuing certificate Authority (CA).In order to be properly imported, a CRL must be in PEM format. IAM Roles Anywhere validates against the CRL before issuing credentials.

Required permissions: rolesanywhere:ImportCrl.

Parameters:

importCrlRequest -

Returns:

Result of the ImportCrl operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

listCrls

ListCrlsResult listCrls(ListCrlsRequest listCrlsRequest)

Lists all certificate revocation lists (CRL) in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListCrls.

Parameters:

listCrlsRequest -

Returns:

Result of the ListCrls operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

listProfiles

ListProfilesResult listProfiles(ListProfilesRequest listProfilesRequest)

Lists all profiles in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListProfiles.

Parameters:

listProfilesRequest -

Returns:

Result of the ListProfiles operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

listSubjects

ListSubjectsResult listSubjects(ListSubjectsRequest listSubjectsRequest)

Lists the subjects in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListSubjects.

Parameters:

listSubjectsRequest -

Returns:

Result of the ListSubjects operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

listTagsForResource

ListTagsForResourceResult listTagsForResource(ListTagsForResourceRequest listTagsForResourceRequest)

Lists the tags attached to the resource.

Required permissions: rolesanywhere:ListTagsForResource.

Parameters:

listTagsForResourceRequest -

Returns:

Result of the ListTagsForResource operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

listTrustAnchors

ListTrustAnchorsResult listTrustAnchors(ListTrustAnchorsRequest listTrustAnchorsRequest)

Lists the trust anchors in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListTrustAnchors.

Parameters:

listTrustAnchorsRequest -

Returns:

Result of the ListTrustAnchors operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

putAttributeMapping

PutAttributeMappingResult putAttributeMapping(PutAttributeMappingRequest putAttributeMappingRequest)

Put an entry in the attribute mapping rules that will be enforced by a given profile. A mapping specifies a certificate field and one or more specifiers that have contextual meanings.

Parameters:

putAttributeMappingRequest -

Returns:

Result of the PutAttributeMapping operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

putNotificationSettings

PutNotificationSettingsResult putNotificationSettings(PutNotificationSettingsRequest putNotificationSettingsRequest)

Attaches a list of notification settings to a trust anchor.

A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify.

Required permissions: rolesanywhere:PutNotificationSettings.

Parameters:

putNotificationSettingsRequest -

Returns:

Result of the PutNotificationSettings operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

resetNotificationSettings

ResetNotificationSettingsResult resetNotificationSettings(ResetNotificationSettingsRequest resetNotificationSettingsRequest)

Resets the custom notification setting to IAM Roles Anywhere default setting.

Required permissions: rolesanywhere:ResetNotificationSettings.

Parameters:

resetNotificationSettingsRequest -

Returns:

Result of the ResetNotificationSettings operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

tagResource

TagResourceResult tagResource(TagResourceRequest tagResourceRequest)

Attaches tags to a resource.

Required permissions: rolesanywhere:TagResource.

Parameters:

tagResourceRequest -

Returns:

Result of the TagResource operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

TooManyTagsException - Too many tags.

See Also:

AWS API Documentation

untagResource

UntagResourceResult untagResource(UntagResourceRequest untagResourceRequest)

Removes tags from the resource.

Required permissions: rolesanywhere:UntagResource.

Parameters:

untagResourceRequest -

Returns:

Result of the UntagResource operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

updateCrl

UpdateCrlResult updateCrl(UpdateCrlRequest updateCrlRequest)

Updates the certificate revocation list (CRL). A CRL is a list of certificates that have been revoked by the issuing certificate authority (CA). IAM Roles Anywhere validates against the CRL before issuing credentials.

Required permissions: rolesanywhere:UpdateCrl.

Parameters:

updateCrlRequest -

Returns:

Result of the UpdateCrl operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

updateProfile

UpdateProfileResult updateProfile(UpdateProfileRequest updateProfileRequest)

Updates a profile, a list of the roles that IAM Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies.

Required permissions: rolesanywhere:UpdateProfile.

Parameters:

updateProfileRequest -

Returns:

Result of the UpdateProfile operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

updateTrustAnchor

UpdateTrustAnchorResult updateTrustAnchor(UpdateTrustAnchorRequest updateTrustAnchorRequest)

Updates a trust anchor. You establish trust between IAM Roles Anywhere and your certificate authority (CA) by configuring a trust anchor. You can define a trust anchor as a reference to an Private Certificate Authority (Private CA) or by uploading a CA certificate. Your Amazon Web Services workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary Amazon Web Services credentials.

Required permissions: rolesanywhere:UpdateTrustAnchor.

Parameters:

updateTrustAnchorRequest -

Returns:

Result of the UpdateTrustAnchor operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

shutdown

void shutdown()

Shuts down this client object, releasing any resources that might be held open. This is an optional method, and callers are not expected to call it, but can if they want to explicitly release any open resources. Once a client has been shutdown, it should not be used to make any more requests.

getCachedResponseMetadata

ResponseMetadata getCachedResponseMetadata(AmazonWebServiceRequest request)

Returns additional metadata for a previously executed successful request, typically used for debugging issues where a service isn't acting as expected. This data isn't considered part of the result data returned by an operation, so it's available through this separate, diagnostic interface.

Response metadata is only cached for a limited period of time, so if you need to access this extra diagnostic information for an executed request, you should use this method to retrieve it as soon as possible after executing a request.

Parameters:

request - The originally executed request.

Returns:

The response metadata for the specified request, or null if none is available.