BedrockAgentCoreControl / Client / create_payment_manager

create_payment_manager¶

BedrockAgentCoreControl.Client.create_payment_manager(**kwargs)¶

Creates a new payment manager in your Amazon Web Services account. A payment manager serves as the top-level resource for managing payment processing capabilities, including payment connectors that integrate with supported payment providers.

If you specify CUSTOM_JWT as the authorizerType, you must provide an authorizerConfiguration.

Request Syntax

response = client.create_payment_manager(
    name='string',
    description='string',
    authorizerType='CUSTOM_JWT'|'AWS_IAM',
    authorizerConfiguration={
        'customJWTAuthorizer': {
            'discoveryUrl': 'string',
            'allowedAudience': [
                'string',
            ],
            'allowedClients': [
                'string',
            ],
            'allowedScopes': [
                'string',
            ],
            'customClaims': [
                {
                    'inboundTokenClaimName': 'string',
                    'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
                    'authorizingClaimMatchValue': {
                        'claimMatchValue': {
                            'matchValueString': 'string',
                            'matchValueStringList': [
                                'string',
                            ]
                        },
                        'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
                    }
                },
            ],
            'privateEndpoint': {
                'selfManagedLatticeResource': {
                    'resourceConfigurationIdentifier': 'string'
                },
                'managedVpcResource': {
                    'vpcIdentifier': 'string',
                    'subnetIds': [
                        'string',
                    ],
                    'endpointIpAddressType': 'IPV4'|'IPV6',
                    'securityGroupIds': [
                        'string',
                    ],
                    'tags': {
                        'string': 'string'
                    },
                    'routingDomain': 'string'
                }
            },
            'privateEndpointOverrides': [
                {
                    'domain': 'string',
                    'privateEndpoint': {
                        'selfManagedLatticeResource': {
                            'resourceConfigurationIdentifier': 'string'
                        },
                        'managedVpcResource': {
                            'vpcIdentifier': 'string',
                            'subnetIds': [
                                'string',
                            ],
                            'endpointIpAddressType': 'IPV4'|'IPV6',
                            'securityGroupIds': [
                                'string',
                            ],
                            'tags': {
                                'string': 'string'
                            },
                            'routingDomain': 'string'
                        }
                    }
                },
            ]
        }
    },
    roleArn='string',
    clientToken='string',
    tags={
        'string': 'string'
    }
)

Parameters:

name (string) –
[REQUIRED]

The name of the payment manager.
description (string) – A description of the payment manager.
authorizerType (string) –
[REQUIRED]

The type of authorizer to use for the payment manager.
- CUSTOM_JWT - Authorize with a bearer token.
- AWS_IAM - Authorize with your Amazon Web Services IAM credentials.
authorizerConfiguration (dict) –
The authorizer configuration for the payment manager.

Note
This is a Tagged Union structure. Only one of the following top level keys can be set: customJWTAuthorizer.
- customJWTAuthorizer (dict) –
  
  The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
  - discoveryUrl (string) – [REQUIRED]
    
    This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
  - allowedAudience (list) –
    
    Represents individual audience values that are validated in the incoming JWT token validation process.
    - (string) –
  - allowedClients (list) –
    
    Represents individual client IDs that are validated in the incoming JWT token validation process.
    - (string) –
  - allowedScopes (list) –
    
    An array of scopes that are allowed to access the token.
    - (string) –
  - customClaims (list) –
    
    An array of objects that define a custom claim validation name, value, and operation
    - (dict) –
      
      Defines the name of a custom claim field and rules for finding matches to authenticate its value.
      - inboundTokenClaimName (string) – [REQUIRED]
        
        The name of the custom claim field to check.
      - inboundTokenClaimValueType (string) – [REQUIRED]
        
        The data type of the claim value to check for.
        
        Use STRING if you want to find an exact match to a string you define.
        
        Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
      - authorizingClaimMatchValue (dict) – [REQUIRED]
        
        Defines the value or values to match for and the relationship of the match.
        
        claimMatchValue (dict) – [REQUIRED]
        
        The value or values to match for.
        
        Note
        This is a Tagged Union structure. Only one of the following top level keys can be set: matchValueString, matchValueStringList.
        
        matchValueString (string) –
        
        The string value to match for.
        
        matchValueStringList (list) –
        
        An array of strings to check for a match.
        
        (string) –
        
        claimMatchOperator (string) – [REQUIRED]
        
        Defines the relationship between the claim field value and the value or values you’re matching for.
  - privateEndpoint (dict) –
    
    The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
    
    Note
    This is a Tagged Union structure. Only one of the following top level keys can be set: selfManagedLatticeResource, managedVpcResource.
    - selfManagedLatticeResource (dict) –
      
      Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
      
      Note
      This is a Tagged Union structure. Only one of the following top level keys can be set: resourceConfigurationIdentifier.
      - resourceConfigurationIdentifier (string) –
        
        The ARN or ID of the VPC Lattice resource configuration.
    - managedVpcResource (dict) –
      
      Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
      - vpcIdentifier (string) – [REQUIRED]
        
        The ID of the VPC that contains your private resource.
      - subnetIds (list) – [REQUIRED]
        
        The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
        
        (string) –
      - endpointIpAddressType (string) – [REQUIRED]
        
        The IP address type for the resource configuration endpoint.
      - securityGroupIds (list) –
        
        The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
        
        (string) –
      - tags (dict) –
        
        Tags to apply to the managed VPC Lattice resource gateway.
        
        (string) –
        
        (string) –
      - routingDomain (string) –
        
        An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
  - privateEndpointOverrides (list) –
    
    The private endpoint overrides for the custom JWT authorizer configuration.
    - (dict) –
      
      A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
      - domain (string) – [REQUIRED]
        
        The domain to override with a private endpoint.
      - privateEndpoint (dict) – [REQUIRED]
        
        The private endpoint configuration for the specified domain.
        
        Note
        This is a Tagged Union structure. Only one of the following top level keys can be set: selfManagedLatticeResource, managedVpcResource.
        
        selfManagedLatticeResource (dict) –
        
        Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
        
        Note
        This is a Tagged Union structure. Only one of the following top level keys can be set: resourceConfigurationIdentifier.
        
        resourceConfigurationIdentifier (string) –
        
        The ARN or ID of the VPC Lattice resource configuration.
        
        managedVpcResource (dict) –
        
        Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
        
        vpcIdentifier (string) – [REQUIRED]
        
        The ID of the VPC that contains your private resource.
        
        subnetIds (list) – [REQUIRED]
        
        The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
        
        (string) –
        
        endpointIpAddressType (string) – [REQUIRED]
        
        The IP address type for the resource configuration endpoint.
        
        securityGroupIds (list) –
        
        The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
        
        (string) –
        
        tags (dict) –
        
        Tags to apply to the managed VPC Lattice resource gateway.
        
        (string) –
        
        (string) –
        
        routingDomain (string) –
        
        An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
roleArn (string) –
[REQUIRED]

The Amazon Resource Name (ARN) of the IAM role that the payment manager assumes to access resources on your behalf.
clientToken (string) –
A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don’t specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn’t return an error. For more information, see Ensuring idempotency.

This field is autopopulated if not provided.
tags (dict) –
A map of tag keys and values to assign to the payment manager.
- (string) –
  - (string) –

Return type:

dict

Returns:

Response Syntax

{
    'paymentManagerArn': 'string',
    'paymentManagerId': 'string',
    'name': 'string',
    'authorizerType': 'CUSTOM_JWT'|'AWS_IAM',
    'authorizerConfiguration': {
        'customJWTAuthorizer': {
            'discoveryUrl': 'string',
            'allowedAudience': [
                'string',
            ],
            'allowedClients': [
                'string',
            ],
            'allowedScopes': [
                'string',
            ],
            'customClaims': [
                {
                    'inboundTokenClaimName': 'string',
                    'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
                    'authorizingClaimMatchValue': {
                        'claimMatchValue': {
                            'matchValueString': 'string',
                            'matchValueStringList': [
                                'string',
                            ]
                        },
                        'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
                    }
                },
            ],
            'privateEndpoint': {
                'selfManagedLatticeResource': {
                    'resourceConfigurationIdentifier': 'string'
                },
                'managedVpcResource': {
                    'vpcIdentifier': 'string',
                    'subnetIds': [
                        'string',
                    ],
                    'endpointIpAddressType': 'IPV4'|'IPV6',
                    'securityGroupIds': [
                        'string',
                    ],
                    'tags': {
                        'string': 'string'
                    },
                    'routingDomain': 'string'
                }
            },
            'privateEndpointOverrides': [
                {
                    'domain': 'string',
                    'privateEndpoint': {
                        'selfManagedLatticeResource': {
                            'resourceConfigurationIdentifier': 'string'
                        },
                        'managedVpcResource': {
                            'vpcIdentifier': 'string',
                            'subnetIds': [
                                'string',
                            ],
                            'endpointIpAddressType': 'IPV4'|'IPV6',
                            'securityGroupIds': [
                                'string',
                            ],
                            'tags': {
                                'string': 'string'
                            },
                            'routingDomain': 'string'
                        }
                    }
                },
            ]
        }
    },
    'roleArn': 'string',
    'workloadIdentityDetails': {
        'workloadIdentityArn': 'string'
    },
    'createdAt': datetime(2015, 1, 1),
    'status': 'CREATING'|'UPDATING'|'DELETING'|'READY'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED',
    'tags': {
        'string': 'string'
    }
}

Response Structure

(dict) –
- paymentManagerArn (string) –
  
  The Amazon Resource Name (ARN) of the created payment manager.
- paymentManagerId (string) –
  
  The unique identifier of the created payment manager.
- name (string) –
  
  The name of the created payment manager.
- authorizerType (string) –
  
  The type of authorizer for the created payment manager.
- authorizerConfiguration (dict) –
  
  Represents inbound authorization configuration options used to authenticate incoming requests.
  Note
  This is a Tagged Union structure. Only one of the following top level keys will be set: customJWTAuthorizer. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
  'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
  - customJWTAuthorizer (dict) –
    
    The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
    - discoveryUrl (string) –
      
      This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
    - allowedAudience (list) –
      
      Represents individual audience values that are validated in the incoming JWT token validation process.
      - (string) –
    - allowedClients (list) –
      
      Represents individual client IDs that are validated in the incoming JWT token validation process.
      - (string) –
    - allowedScopes (list) –
      
      An array of scopes that are allowed to access the token.
      - (string) –
    - customClaims (list) –
      
      An array of objects that define a custom claim validation name, value, and operation
      - (dict) –
        
        Defines the name of a custom claim field and rules for finding matches to authenticate its value.
        
        inboundTokenClaimName (string) –
        
        The name of the custom claim field to check.
        
        inboundTokenClaimValueType (string) –
        
        The data type of the claim value to check for.
        
        Use STRING if you want to find an exact match to a string you define.
        
        Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
        
        authorizingClaimMatchValue (dict) –
        
        Defines the value or values to match for and the relationship of the match.
        
        claimMatchValue (dict) –
        
        The value or values to match for.
        
        Note
        This is a Tagged Union structure. Only one of the following top level keys will be set: matchValueString, matchValueStringList. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
        
        'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
        
        matchValueString (string) –
        
        The string value to match for.
        
        matchValueStringList (list) –
        
        An array of strings to check for a match.
        
        (string) –
        
        claimMatchOperator (string) –
        
        Defines the relationship between the claim field value and the value or values you’re matching for.
    - privateEndpoint (dict) –
      
      The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
      Note
      This is a Tagged Union structure. Only one of the following top level keys will be set: selfManagedLatticeResource, managedVpcResource. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - selfManagedLatticeResource (dict) –
        
        Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
        
        Note
        This is a Tagged Union structure. Only one of the following top level keys will be set: resourceConfigurationIdentifier. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
        
        'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
        
        resourceConfigurationIdentifier (string) –
        
        The ARN or ID of the VPC Lattice resource configuration.
      - managedVpcResource (dict) –
        
        Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
        
        vpcIdentifier (string) –
        
        The ID of the VPC that contains your private resource.
        
        subnetIds (list) –
        
        The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
        
        (string) –
        
        endpointIpAddressType (string) –
        
        The IP address type for the resource configuration endpoint.
        
        securityGroupIds (list) –
        
        The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
        
        (string) –
        
        tags (dict) –
        
        Tags to apply to the managed VPC Lattice resource gateway.
        
        (string) –
        
        (string) –
        
        routingDomain (string) –
        
        An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
    - privateEndpointOverrides (list) –
      
      The private endpoint overrides for the custom JWT authorizer configuration.
      - (dict) –
        
        A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
        
        domain (string) –
        
        The domain to override with a private endpoint.
        
        privateEndpoint (dict) –
        
        The private endpoint configuration for the specified domain.
        
        Note
        This is a Tagged Union structure. Only one of the following top level keys will be set: selfManagedLatticeResource, managedVpcResource. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
        
        'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
        
        selfManagedLatticeResource (dict) –
        
        Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
        
        Note
        This is a Tagged Union structure. Only one of the following top level keys will be set: resourceConfigurationIdentifier. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
        
        'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
        
        resourceConfigurationIdentifier (string) –
        
        The ARN or ID of the VPC Lattice resource configuration.
        
        managedVpcResource (dict) –
        
        Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
        
        vpcIdentifier (string) –
        
        The ID of the VPC that contains your private resource.
        
        subnetIds (list) –
        
        The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
        
        (string) –
        
        endpointIpAddressType (string) –
        
        The IP address type for the resource configuration endpoint.
        
        securityGroupIds (list) –
        
        The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
        
        (string) –
        
        tags (dict) –
        
        Tags to apply to the managed VPC Lattice resource gateway.
        
        (string) –
        
        (string) –
        
        routingDomain (string) –
        
        An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
- roleArn (string) –
  
  The Amazon Resource Name (ARN) of the IAM role associated with the created payment manager.
- workloadIdentityDetails (dict) –
  
  The information about the workload identity.
  - workloadIdentityArn (string) –
    
    The ARN associated with the workload identity.
- createdAt (datetime) –
  
  The timestamp when the payment manager was created.
- status (string) –
  
  The current status of the payment manager. Possible values include CREATING, READY, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, and DELETE_FAILED.
- tags (dict) –
  
  The tags associated with the created payment manager.
  - (string) –
    - (string) –

Exceptions

BedrockAgentCoreControl.Client.exceptions.ServiceQuotaExceededException
BedrockAgentCoreControl.Client.exceptions.AccessDeniedException
BedrockAgentCoreControl.Client.exceptions.ConflictException
BedrockAgentCoreControl.Client.exceptions.ValidationException
BedrockAgentCoreControl.Client.exceptions.ThrottlingException
BedrockAgentCoreControl.Client.exceptions.InternalServerException