<a id="cli-aws-ram-create-permission"></a>

# create-permission

## Description

Creates a customer managed permission for a specified resource type that you can attach to resource shares. It is created in the Amazon Web Services Region in which you call the operation.

See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ram-2018-01-04/CreatePermission)

## Synopsis

```
  create-permission
--name <value>
--resource-type <value>
--policy-template <value>
[--permission-template-parameters <value>]
[--client-token <value>]
[--tags <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]
[--cli-error-format <value>]
[--help]
```

## Options

`--name` (string) [required]

> Specifies the name of the customer managed permission. The name must be unique within the Amazon Web Services Region.

> Constraints:

> * min: `1`
> * max: `36`
> * pattern: `[\w.-]*`

`--resource-type` (string) [required]

> Specifies the name of the resource type that this customer managed permission applies to.

> The format is \`\`  *<service-code>* : *<resource-type>* \`\` and is case sensitive. For example, to specify an Amazon EC2 Subnet, you can use the string `ec2:Subnet` . To see the list of valid values for this parameter, query the  ListResourceTypes operation. This value must match the display name of the resource (available in `ListResourceTypes` ).

`--policy-template` (string) [required]

> A string in JSON format string that contains the following elements of a resource-based policy:

> * **Effect** : must be set to `ALLOW` .
> * **Action** : specifies the actions that are allowed by this customer managed permission. The list must contain only actions that are supported by the specified resource type. For a list of all actions supported by each resource type, see [Actions, resources, and condition keys for Amazon Web Services services](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html) in the *Identity and Access Management User Guide* .
> * **Condition** : (optional) specifies conditional parameters that must evaluate to true when a user attempts an action for that action to be allowed. For more information about the Condition element, see [IAM policies: Condition element](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) in the *Identity and Access Management User Guide* .

> This template can’t include either the `Resource` or `Principal` elements. Those are both filled in by RAM when it instantiates the resource-based policy on each resource shared using this managed permission. The `Resource` comes from the ARN of the specific resource that you are sharing. The `Principal` comes from the list of identities added to the resource share.

`--permission-template-parameters` (list)

> Specifies a list of template parameter declarations for this permission. Each declaration defines a named placeholder that can be used in the policy template using the syntax `@{parameterName}` . Template parameters can only appear in Condition Key and Condition Value fields of the policy. When you associate this permission with a resource share, you must provide values for all declared parameters.

> Constraints:

> * max: `100`

> (structure)

> > Describes a template parameter declaration for a customer managed permission. Each declaration defines a named placeholder that can be used in the permission’s policy template.

> > name -> (string)

> > > The name of the template parameter. This name is used as the placeholder in the policy template using the syntax `@{parameterName}` .

> > type -> (string)

> > > The type of the template parameter. This can be one of the following values:

> > > * `STRING` – A single string value that is substituted directly into the template.
> > > * `STRING_LIST` – One or more string values that expand to an array in the rendered policy.

> > > Possible values:

> > > * `STRING`
> > > * `STRING_LIST`

> > description -> (string)

> > > A description of the template parameter that helps consumers understand what value to provide.

Shorthand Syntax:

```
name=string,type=string,description=string ...
```

JSON Syntax:

```json
[
  {
    "name": "string",
    "type": "STRING"|"STRING_LIST",
    "description": "string"
  }
  ...
]
```

`--client-token` (string)

> Specifies a unique, case-sensitive identifier that you provide to ensure the idempotency of the request. This lets you safely retry the request without accidentally performing the same operation a second time. Passing the same value to a later call to an operation requires that you also pass the same value for all other parameters. We recommend that you use a [UUID type of value.](https://wikipedia.org/wiki/Universally_unique_identifier) .

> If you don’t provide this value, then Amazon Web Services generates a random one for you.

> If you retry the operation with the same `ClientToken` , but with different parameters, the retry fails with an `IdempotentParameterMismatch` error.

`--tags` (list)

> Specifies a list of one or more tag key and value pairs to attach to the permission.

> (structure)

> > A structure containing a tag. A tag is metadata that you can attach to your resources to help organize and categorize them. You can also use them to help you secure your resources. For more information, see [Controlling access to Amazon Web Services resources using tags](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html) .

> > For more information about tags, see [Tagging Amazon Web Services resources](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html) in the *Amazon Web Services General Reference Guide* .

> > key -> (string)

> > > The key, or name, attached to the tag. Every tag must have a key. Key names are case sensitive.

> > value -> (string)

> > > The string value attached to the tag. The value can be an empty string. Key values are case sensitive.

Shorthand Syntax:

```
key=string,value=string ...
```

JSON Syntax:

```json
[
  {
    "key": "string",
    "value": "string"
  }
  ...
]
```

`--cli-input-json` | `--cli-input-yaml` (string)
Reads arguments from the JSON string provided. The JSON string follows the format provided by `--generate-cli-skeleton`. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with `--cli-input-yaml`.

`--generate-cli-skeleton` (string)
Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value `input`, prints a sample input JSON that can be used as an argument for `--cli-input-json`. Similarly, if provided `yaml-input` it will print a sample input YAML that can be used with `--cli-input-yaml`. If provided with the value `output`, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

## Global Options

`--debug` (boolean)

Turn on debug logging.

`--endpoint-url` (string)

Override command’s default URL with the given URL.

`--no-verify-ssl` (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

`--no-paginate` (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

`--output` (string)

The formatting style for command output.

* json
* text
* table
* yaml
* yaml-stream
* off

`--query` (string)

A JMESPath query to use in filtering the response data.

`--profile` (string)

Use a specific profile from your credential file.

`--region` (string)

The region to use. Overrides config/env settings.

`--version` (string)

Display the version of this tool.

`--color` (string)

Turn on/off color output.

* on
* off
* auto

`--no-sign-request` (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

`--ca-bundle` (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

`--cli-read-timeout` (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

`--cli-connect-timeout` (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

`--cli-binary-format` (string)

The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob `fileb://` will always be treated as binary and use the file contents directly regardless of the `cli-binary-format` setting. When using `file://` the file contents will need to properly formatted for the configured `cli-binary-format`.

* base64
* raw-in-base64-out

`--no-cli-pager` (boolean)

Disable cli pager for output.

`--cli-auto-prompt` (boolean)

Automatically prompt for CLI input parameters.

`--no-cli-auto-prompt` (boolean)

Disable automatically prompt for CLI input parameters.

`--cli-error-format` (string)

The formatting style for error output. By default, errors are displayed in enhanced format.

* legacy
* json
* yaml
* text
* table
* enhanced

`--help` (boolean)

Display help for the command/subcommand.

## Output

permission -> (structure)

> A structure with information about this customer managed permission.

> arn -> (string)

> > The [Amazon Resource Name (ARN)](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) of the permission you want information about.

> version -> (string)

> > The version of the permission associated with this resource share.

> defaultVersion -> (boolean)

> > Specifies whether the version of the managed permission used by this resource share is the default version for this managed permission.

> name -> (string)

> > The name of this managed permission.

> resourceType -> (string)

> > The type of resource to which this permission applies. This takes the form of: `service-code` :`resource-code` , and is case-insensitive. For example, an Amazon EC2 Subnet would be represented by the string `ec2:subnet` .

> status -> (string)

> > The current status of the permission.

> creationTime -> (timestamp)

> > The date and time when the permission was created.

> lastUpdatedTime -> (timestamp)

> > The date and time when the permission was last updated.

> isResourceTypeDefault -> (boolean)

> > Specifies whether the managed permission associated with this resource share is the default managed permission for all resources of this resource type.

> permissionType -> (string)

> > The type of managed permission. This can be one of the following values:

> > * `AWS_MANAGED` – Amazon Web Services created and manages this managed permission. You can associate it with your resource shares, but you can’t modify it.
> > * `CUSTOMER_MANAGED` – You, or another principal in your account created this managed permission. You can associate it with your resource shares and create new versions that have different permissions.

> > Possible values:

> > * `CUSTOMER_MANAGED`
> > * `AWS_MANAGED`

> featureSet -> (string)

> > Indicates what features are available for this resource share. This parameter can have one of the following values:

> > * **STANDARD** – A resource share that supports all functionality. These resource shares are visible to all principals you share the resource share with. You can modify these resource shares in RAM using the console or APIs. This resource share might have been created by RAM, or it might have been **CREATED_FROM_POLICY** and then promoted.
> > * **CREATED_FROM_POLICY** – The customer manually shared a resource by attaching a resource-based policy. That policy did not match any existing managed permissions, so RAM created this customer managed permission automatically on the customer’s behalf based on the attached policy document. This type of resource share is visible only to the Amazon Web Services account that created it. You can’t modify it in RAM unless you promote it. For more information, see  PromoteResourceShareCreatedFromPolicy .
> > * **PROMOTING_TO_STANDARD** – This resource share was originally `CREATED_FROM_POLICY` , but the customer ran the  PromoteResourceShareCreatedFromPolicy and that operation is still in progress. This value changes to `STANDARD` when complete.

> > Possible values:

> > * `CREATED_FROM_POLICY`
> > * `PROMOTING_TO_STANDARD`
> > * `STANDARD`

> permissionTemplateParameters -> (list)

> > The list of template parameters defined for this permission, including their names, types, descriptions, and values. This field is present only if the permission is a template with declared parameters. When returned in the context of a permission association, the values are also included.

> > (structure)

> > > Contains the declaration of a template parameter for a customer managed permission. When returned in the context of a permission association, it also includes the values assigned to that parameter.

> > > name -> (string)

> > > > The name of the template parameter.

> > > type -> (string)

> > > > The type of the template parameter. This can be one of the following values:

> > > > * `STRING` – A single string value.
> > > > * `STRING_LIST` – One or more string values.

> > > > Possible values:

> > > > * `STRING`
> > > > * `STRING_LIST`

> > > description -> (string)

> > > > A description of the template parameter.

> > > values -> (list)

> > > > The values assigned to this template parameter in the context of a permission association. This field is present only when the parameter has been assigned values (for example, in the response from  ListPermissionAssociations or  ListResourceSharePermissions ).

> > > > (string)

> tags -> (list)

> > A list of the tag key value pairs currently attached to the permission.

> > (structure)

> > > A structure containing a tag. A tag is metadata that you can attach to your resources to help organize and categorize them. You can also use them to help you secure your resources. For more information, see [Controlling access to Amazon Web Services resources using tags](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html) .

> > > For more information about tags, see [Tagging Amazon Web Services resources](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html) in the *Amazon Web Services General Reference Guide* .

> > > key -> (string)

> > > > The key, or name, attached to the tag. Every tag must have a key. Key names are case sensitive.

> > > value -> (string)

> > > > The string value attached to the tag. The value can be an empty string. Key values are case sensitive.

> resourceOwner -> (string)

> > The owner of the permission. This can be one of the following values:

> > * `SELF` – The permission is owned by the current account.
> > * `OTHER-ACCOUNTS` – The permission is owned by another account and shared with the current account.

> > Possible values:

> > * `SELF`
> > * `OTHER-ACCOUNTS`

clientToken -> (string)

> The idempotency identifier associated with this request. If you want to repeat the same operation in an idempotent manner then you must include this value in the `clientToken` request parameter of that later call. All other parameters must also have the same values that you used in the first call.