AccountAccessRuntime / Client / get_role_credentials

get_role_credentials

AccountAccessRuntime.Client.get_role_credentials(**kwargs)

Returns temporary Amazon Web Services credentials for a role that you are entitled to assume within a tenant. You can use these credentials for programmatic access with the CLI or an Amazon Web Services SDK. If you aren’t entitled to the role, the request fails with an AccessDeniedException error.

See also: AWS API Documentation

Request Syntax

response = client.get_role_credentials(
    tenantId='string',
    roleArn='string',
    accessType='PROGRAMMATIC_ACCESS',
    sessionName='string',
    sessionDuration=123
)
Parameters:

  • tenantId (string) –

    [REQUIRED]

    The identifier of the tenant that the request applies to. A tenant ID begins with aa- and is 3 to 24 characters long. It can contain lowercase letters, numbers, and hyphens.

  • roleArn (string) –

    [REQUIRED]

    The Amazon Resource Name (ARN) of the role to retrieve credentials for. You must be entitled to assume this role.

  • accessType (string) –

    [REQUIRED]

    The type of access to request for the role. Specify PROGRAMMATIC_ACCESS to receive access key credentials for use with the CLI or an Amazon Web Services SDK.

  • sessionName (string) – An optional name for the role session. The name can be 2 to 64 characters and can contain alphanumeric characters and the following symbols: plus (+), equal (=), comma (,), period (.), at (@), and hyphen (-). The session name appears in CloudTrail logs for the assumed role session.

  • sessionDuration (integer) – The duration, in seconds, that the returned credentials remain valid. If you don’t specify a value, the service uses the default session duration. The maximum value can’t exceed the maximum session duration configured for the role.

Return type:

dict

Returns:

Response Syntax

{
    'credentialsDetails': {
        'programmaticAccess': {
            'accessKeyId': 'string',
            'secretAccessKey': 'string',
            'sessionToken': 'string',
            'expiresAt': datetime(2015, 1, 1)
        }
    }
}

Response Structure

  • (dict) –

    • credentialsDetails (dict) –

      The temporary credentials that the service returns for the requested role.

      Note

      This is a Tagged Union structure. Only one of the following top level keys will be set: programmaticAccess. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}

      • programmaticAccess (dict) –

        The access key credentials returned for programmatic access with the CLI or an Amazon Web Services SDK.

        • accessKeyId (string) –

          The access key ID for the temporary credentials.

        • secretAccessKey (string) –

          The secret access key for the temporary credentials. Treat this value as a secret.

        • sessionToken (string) –

          The session token that you must include along with the access key ID and secret access key when you make requests with the temporary credentials.

        • expiresAt (datetime) –

          The date and time when the temporary credentials expire, after which they can no longer be used.

Exceptions