Continuum / Client / update_integration

update_integration

Continuum.Client.update_integration(**kwargs)

Rotates the credentials used by an Amazon S3 integration. Only S3 integrations can be updated; GitHub integrations cannot be modified. The integration’s name, provider type, and bucket remain fixed.

The caller must have iam:PassRole permission for the supplied role, including when only the external ID changes. Continuum verifies that the role can be assumed with the requested external ID and can access the existing bucket before saving both credentials atomically. Omitting externalId preserves its current value. Repeating both current credentials leaves updatedAt unchanged, but still requires authorization and access validation.

See also: AWS API Documentation

Request Syntax

response = client.update_integration(
    integrationId='string',
    providerConfiguration={
        's3': {
            'roleArn': 'string',
            'externalId': 'string'
        }
    }
)
Parameters:

  • integrationId (string) –

    [REQUIRED]

    The unique identifier of the S3 integration to update.

  • providerConfiguration (dict) –

    [REQUIRED]

    The provider-specific changes to apply. The member must match the integration’s provider type, and only S3 integrations can be updated.

    Note

    This is a Tagged Union structure. Only one of the following top level keys can be set: s3.

    • s3 (dict) –

      Replacement credentials for a customer-managed S3 integration.

      • roleArn (string) – [REQUIRED]

        The role to use. Supply the current role when rotating only the external ID. The caller must be allowed to pass this exact role to Continuum.

      • externalId (string) –

        The replacement external ID used when assuming the supplied role. If omitted, the existing external ID is preserved. This value is sensitive and is never included in the public integration response.

Return type:

dict

Returns:

Response Syntax

{
    'integrationId': 'string',
    'integrationArn': 'string',
    'name': 'string',
    'integrationType': 'GITHUB'|'GITLAB'|'S3',
    'providerDetails': {
        'github': {
            'organizationName': 'string'
        },
        'gitlab': {
            'instanceUrl': 'string',
            'targetType': 'GROUP'|'PROJECT',
            'targetPath': 'string',
            'tokenRotation': 'AUTOMATIC'|'NONE',
            'expiresAt': datetime(2015, 1, 1)
        },
        's3': {
            'bucket': 'string',
            'roleArn': 'string'
        }
    },
    'createdAt': datetime(2015, 1, 1),
    'updatedAt': datetime(2015, 1, 1)
}

Response Structure

  • (dict) –

    Contains the current state of the updated S3 integration. The sensitive external ID is omitted.

    • integrationId (string) –

      The unique identifier for an Integration resource.

    • integrationArn (string) –

      The Amazon Resource Name (ARN) of an Integration resource, of the form arn:{partition}:continuum:{region}:{account}:integrations/{integrationId}.

    • name (string) –

      The name for an integration.

    • integrationType (string) –

      The immutable provider type for an integration.

    • providerDetails (dict) –

      Provider-specific details for an integration. Only one member will be present.

      Note

      This is a Tagged Union structure. Only one of the following top level keys will be set: github, gitlab, s3. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}

      • github (dict) –

        Details for a GitHub.com integration.

        • organizationName (string) –

          The name of the GitHub organization associated with the integration.

      • gitlab (dict) –

        Details for a GitLab integration.

        • instanceUrl (string) –

          The HTTPS base URL of the GitLab instance.

        • targetType (string) –

          Whether the integration targets a group or a single project.

        • targetPath (string) –

          The group or project path the integration targets.

        • tokenRotation (string) –

          How the integration’s access token is rotated. AUTOMATIC only when the pasted token had the self-rotate scope and rotation was opted in at installation time.

        • expiresAt (datetime) –

          The expiry of the stored access token, for non-rotating tokens only. A rotated token’s original expiry is stale, so this is omitted when tokenRotation is AUTOMATIC.

      • s3 (dict) –

        Public details for a customer-managed S3 integration.

        • bucket (string) –

          Customer-managed S3 bucket name.

        • roleArn (string) –

          IAM role assumed by Continuum to read a customer-managed S3 integration.

    • createdAt (datetime) –

      When the integration was created.

    • updatedAt (datetime) –

      When the integration was last updated.

Exceptions