Class: AWS.SSOAdmin

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  ManagedPolicyArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE' /* required */
};
ssoadmin.attachManagedPolicyToPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • PermissionSetArn — (String)

    The ARN of the PermissionSet that the managed policy should be attached to.

  • ManagedPolicyArn — (String)

    The AWS managed policy ARN to be attached to a permission set.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE', /* required */
  PrincipalId: 'STRING_VALUE', /* required */
  PrincipalType: USER | GROUP, /* required */
  TargetId: 'STRING_VALUE', /* required */
  TargetType: AWS_ACCOUNT /* required */
};
ssoadmin.createAccountAssignment(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • TargetId — (String)

    TargetID is an AWS account identifier, typically a 10-12 digit string (For example, 123456789012).

  • TargetType — (String)

    The entity type for which the assignment will be created.

    Possible values include:
    • "AWS_ACCOUNT"
  • PermissionSetArn — (String)

    The ARN of the permission set that the admin wants to grant the principal access to.

  • PrincipalType — (String)

    The entity type for which the assignment will be created.

    Possible values include:
    • "USER"
    • "GROUP"
  • PrincipalId — (String)

    An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • AccountAssignmentCreationStatus — (map)

      The status object for the account assignment creation operation.

      • Status — (String)

        The status of the permission set provisioning process.

        Possible values include:
        • "IN_PROGRESS"
        • "FAILED"
        • "SUCCEEDED"
      • RequestId — (String)

        The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

      • FailureReason — (String)

        The message that contains an error or exception in case of an operation failure.

      • TargetId — (String)

        TargetID is an AWS account identifier, typically a 10-12 digit string (For example, 123456789012).

      • TargetType — (String)

        The entity type for which the assignment will be created.

        Possible values include:
        • "AWS_ACCOUNT"
      • PermissionSetArn — (String)

        The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

      • PrincipalType — (String)

        The entity type for which the assignment will be created.

        Possible values include:
        • "USER"
        • "GROUP"
      • PrincipalId — (String)

        An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

      • CreatedDate — (Date)

        The date that the permission set was created.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceAccessControlAttributeConfiguration: { /* required */
    AccessControlAttributes: [ /* required */
      {
        Key: 'STRING_VALUE', /* required */
        Value: { /* required */
          Source: [ /* required */
            'STRING_VALUE',
            /* more items */
          ]
        }
      },
      /* more items */
    ]
  },
  InstanceArn: 'STRING_VALUE' /* required */
};
ssoadmin.createInstanceAccessControlAttributeConfiguration(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed.

  • InstanceAccessControlAttributeConfiguration — (map)

    Specifies the IAM Identity Center identity store attributes to add to your ABAC configuration. When using an external identity provider as an identity source, you can pass attributes through the SAML assertion. Doing so provides an alternative to configuring attributes from the IAM Identity Center identity store. If a SAML assertion passes any of these attributes, IAM Identity Center will replace the attribute value with the value from the IAM Identity Center identity store.

    • AccessControlAttributes — required — (Array<map>)

      Lists the attributes that are configured for ABAC in the specified IAM Identity Center instance.

      • Key — required — (String)

        The name of the attribute associated with your identities in your identity source. This is used to map a specified attribute in your identity source with an attribute in IAM Identity Center.

      • Value — required — (map)

        The value used for mapping a specified attribute to an identity source.

        • Source — required — (Array<String>)

          The identity source to use when mapping a specified attribute to IAM Identity Center.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  Name: 'STRING_VALUE', /* required */
  Description: 'STRING_VALUE',
  RelayState: 'STRING_VALUE',
  SessionDuration: 'STRING_VALUE',
  Tags: [
    {
      Key: 'STRING_VALUE', /* required */
      Value: 'STRING_VALUE' /* required */
    },
    /* more items */
  ]
};
ssoadmin.createPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • Name — (String)

    The name of the PermissionSet.

  • Description — (String)

    The description of the PermissionSet.

  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • SessionDuration — (String)

    The length of time that the application user sessions are valid in the ISO-8601 standard.

  • RelayState — (String)

    Used to redirect users within the application during the federation authentication process.

  • Tags — (Array<map>)

    The tags to attach to the new PermissionSet.

    • Key — required — (String)

      The key for the tag.

    • Value — required — (String)

      The value of the tag.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • PermissionSet — (map)

      Defines the level of access on an AWS account.

      • Name — (String)

        The name of the permission set.

      • PermissionSetArn — (String)

        The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

      • Description — (String)

        The description of the PermissionSet.

      • CreatedDate — (Date)

        The date that the permission set was created.

      • SessionDuration — (String)

        The length of time that the application user sessions are valid for in the ISO-8601 standard.

      • RelayState — (String)

        Used to redirect users within the application during the federation authentication process.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE', /* required */
  PrincipalId: 'STRING_VALUE', /* required */
  PrincipalType: USER | GROUP, /* required */
  TargetId: 'STRING_VALUE', /* required */
  TargetType: AWS_ACCOUNT /* required */
};
ssoadmin.deleteAccountAssignment(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • TargetId — (String)

    TargetID is an AWS account identifier, typically a 10-12 digit string (For example, 123456789012).

  • TargetType — (String)

    The entity type for which the assignment will be deleted.

    Possible values include:
    • "AWS_ACCOUNT"
  • PermissionSetArn — (String)

    The ARN of the permission set that will be used to remove access.

  • PrincipalType — (String)

    The entity type for which the assignment will be deleted.

    Possible values include:
    • "USER"
    • "GROUP"
  • PrincipalId — (String)

    An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • AccountAssignmentDeletionStatus — (map)

      The status object for the account assignment deletion operation.

      • Status — (String)

        The status of the permission set provisioning process.

        Possible values include:
        • "IN_PROGRESS"
        • "FAILED"
        • "SUCCEEDED"
      • RequestId — (String)

        The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

      • FailureReason — (String)

        The message that contains an error or exception in case of an operation failure.

      • TargetId — (String)

        TargetID is an AWS account identifier, typically a 10-12 digit string (For example, 123456789012).

      • TargetType — (String)

        The entity type for which the assignment will be created.

        Possible values include:
        • "AWS_ACCOUNT"
      • PermissionSetArn — (String)

        The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

      • PrincipalType — (String)

        The entity type for which the assignment will be created.

        Possible values include:
        • "USER"
        • "GROUP"
      • PrincipalId — (String)

        An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

      • CreatedDate — (Date)

        The date that the permission set was created.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE' /* required */
};
ssoadmin.deleteInlinePolicyFromPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • PermissionSetArn — (String)

    The ARN of the permission set that will be used to remove access.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE' /* required */
};
ssoadmin.deleteInstanceAccessControlAttributeConfiguration(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE' /* required */
};
ssoadmin.deletePermissionsBoundaryFromPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed.

  • PermissionSetArn — (String)

    The ARN of the PermissionSet.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE' /* required */
};
ssoadmin.deletePermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • PermissionSetArn — (String)

    The ARN of the permission set that should be deleted.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  AccountAssignmentCreationRequestId: 'STRING_VALUE', /* required */
  InstanceArn: 'STRING_VALUE' /* required */
};
ssoadmin.describeAccountAssignmentCreationStatus(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • AccountAssignmentCreationRequestId — (String)

    The identifier that is used to track the request operation progress.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • AccountAssignmentCreationStatus — (map)

      The status object for the account assignment creation operation.

      • Status — (String)

        The status of the permission set provisioning process.

        Possible values include:
        • "IN_PROGRESS"
        • "FAILED"
        • "SUCCEEDED"
      • RequestId — (String)

        The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

      • FailureReason — (String)

        The message that contains an error or exception in case of an operation failure.

      • TargetId — (String)

        TargetID is an AWS account identifier, typically a 10-12 digit string (For example, 123456789012).

      • TargetType — (String)

        The entity type for which the assignment will be created.

        Possible values include:
        • "AWS_ACCOUNT"
      • PermissionSetArn — (String)

        The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

      • PrincipalType — (String)

        The entity type for which the assignment will be created.

        Possible values include:
        • "USER"
        • "GROUP"
      • PrincipalId — (String)

        An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

      • CreatedDate — (Date)

        The date that the permission set was created.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  AccountAssignmentDeletionRequestId: 'STRING_VALUE', /* required */
  InstanceArn: 'STRING_VALUE' /* required */
};
ssoadmin.describeAccountAssignmentDeletionStatus(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • AccountAssignmentDeletionRequestId — (String)

    The identifier that is used to track the request operation progress.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • AccountAssignmentDeletionStatus — (map)

      The status object for the account assignment deletion operation.

      • Status — (String)

        The status of the permission set provisioning process.

        Possible values include:
        • "IN_PROGRESS"
        • "FAILED"
        • "SUCCEEDED"
      • RequestId — (String)

        The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

      • FailureReason — (String)

        The message that contains an error or exception in case of an operation failure.

      • TargetId — (String)

        TargetID is an AWS account identifier, typically a 10-12 digit string (For example, 123456789012).

      • TargetType — (String)

        The entity type for which the assignment will be created.

        Possible values include:
        • "AWS_ACCOUNT"
      • PermissionSetArn — (String)

        The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

      • PrincipalType — (String)

        The entity type for which the assignment will be created.

        Possible values include:
        • "USER"
        • "GROUP"
      • PrincipalId — (String)

        An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

      • CreatedDate — (Date)

        The date that the permission set was created.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE' /* required */
};
ssoadmin.describeInstanceAccessControlAttributeConfiguration(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Status — (String)

      The status of the attribute configuration process.

      Possible values include:
      • "ENABLED"
      • "CREATION_IN_PROGRESS"
      • "CREATION_FAILED"
    • StatusReason — (String)

      Provides more details about the current status of the specified attribute.

    • InstanceAccessControlAttributeConfiguration — (map)

      Gets the list of IAM Identity Center identity store attributes that have been added to your ABAC configuration.

      • AccessControlAttributes — required — (Array<map>)

        Lists the attributes that are configured for ABAC in the specified IAM Identity Center instance.

        • Key — required — (String)

          The name of the attribute associated with your identities in your identity source. This is used to map a specified attribute in your identity source with an attribute in IAM Identity Center.

        • Value — required — (map)

          The value used for mapping a specified attribute to an identity source.

          • Source — required — (Array<String>)

            The identity source to use when mapping a specified attribute to IAM Identity Center.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE' /* required */
};
ssoadmin.describePermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • PermissionSetArn — (String)

    The ARN of the permission set.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • PermissionSet — (map)

      Describes the level of access on an AWS account.

      • Name — (String)

        The name of the permission set.

      • PermissionSetArn — (String)

        The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

      • Description — (String)

        The description of the PermissionSet.

      • CreatedDate — (Date)

        The date that the permission set was created.

      • SessionDuration — (String)

        The length of time that the application user sessions are valid for in the ISO-8601 standard.

      • RelayState — (String)

        Used to redirect users within the application during the federation authentication process.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  ProvisionPermissionSetRequestId: 'STRING_VALUE' /* required */
};
ssoadmin.describePermissionSetProvisioningStatus(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • ProvisionPermissionSetRequestId — (String)

    The identifier that is provided by the ProvisionPermissionSet call to retrieve the current status of the provisioning workflow.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • PermissionSetProvisioningStatus — (map)

      The status object for the permission set provisioning operation.

      • Status — (String)

        The status of the permission set provisioning process.

        Possible values include:
        • "IN_PROGRESS"
        • "FAILED"
        • "SUCCEEDED"
      • RequestId — (String)

        The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

      • AccountId — (String)

        The identifier of the AWS account from which to list the assignments.

      • PermissionSetArn — (String)

        The ARN of the permission set that is being provisioned. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

      • FailureReason — (String)

        The message that contains an error or exception in case of an operation failure.

      • CreatedDate — (Date)

        The date that the permission set was created.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  CustomerManagedPolicyReference: { /* required */
    Name: 'STRING_VALUE', /* required */
    Path: 'STRING_VALUE'
  },
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE' /* required */
};
ssoadmin.detachCustomerManagedPolicyReferenceFromPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed.

  • PermissionSetArn — (String)

    The ARN of the PermissionSet.

  • CustomerManagedPolicyReference — (map)

    Specifies the name and path of a customer managed policy. You must have an IAM policy that matches the name and path in each AWS account where you want to deploy your permission set.

    • Name — required — (String)

      The name of the IAM policy that you have configured in each account where you want to deploy your permission set.

    • Path — (String)

      The path to the IAM policy that you have configured in each account where you want to deploy your permission set. The default is /. For more information, see Friendly names and paths in the IAM User Guide.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  ManagedPolicyArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE' /* required */
};
ssoadmin.detachManagedPolicyFromPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • PermissionSetArn — (String)

    The ARN of the PermissionSet from which the policy should be detached.

  • ManagedPolicyArn — (String)

    The AWS managed policy ARN to be detached from a permission set.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE' /* required */
};
ssoadmin.getInlinePolicyForPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • PermissionSetArn — (String)

    The ARN of the permission set.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • InlinePolicy — (String)

      The inline policy that is attached to the permission set.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE' /* required */
};
ssoadmin.getPermissionsBoundaryForPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed.

  • PermissionSetArn — (String)

    The ARN of the PermissionSet.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • PermissionsBoundary — (map)

      The permissions boundary attached to the specified permission set.

      • CustomerManagedPolicyReference — (map)

        Specifies the name and path of a customer managed policy. You must have an IAM policy that matches the name and path in each AWS account where you want to deploy your permission set.

        • Name — required — (String)

          The name of the IAM policy that you have configured in each account where you want to deploy your permission set.

        • Path — (String)

          The path to the IAM policy that you have configured in each account where you want to deploy your permission set. The default is /. For more information, see Friendly names and paths in the IAM User Guide.

      • ManagedPolicyArn — (String)

        The AWS managed policy ARN that you want to attach to a permission set as a permissions boundary.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  Filter: {
    Status: IN_PROGRESS | FAILED | SUCCEEDED
  },
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE'
};
ssoadmin.listAccountAssignmentCreationStatus(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • MaxResults — (Integer)

    The maximum number of results to display for the assignment.

  • NextToken — (String)

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

  • Filter — (map)

    Filters results based on the passed attribute value.

    • Status — (String)

      Filters the list operations result based on the status attribute.

      Possible values include:
      • "IN_PROGRESS"
      • "FAILED"
      • "SUCCEEDED"

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • AccountAssignmentsCreationStatus — (Array<map>)

      The status object for the account assignment creation operation.

      • Status — (String)

        The status of the permission set provisioning process.

        Possible values include:
        • "IN_PROGRESS"
        • "FAILED"
        • "SUCCEEDED"
      • RequestId — (String)

        The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

      • CreatedDate — (Date)

        The date that the permission set was created.

    • NextToken — (String)

      The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  Filter: {
    Status: IN_PROGRESS | FAILED | SUCCEEDED
  },
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE'
};
ssoadmin.listAccountAssignmentDeletionStatus(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • MaxResults — (Integer)

    The maximum number of results to display for the assignment.

  • NextToken — (String)

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

  • Filter — (map)

    Filters results based on the passed attribute value.

    • Status — (String)

      Filters the list operations result based on the status attribute.

      Possible values include:
      • "IN_PROGRESS"
      • "FAILED"
      • "SUCCEEDED"

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • AccountAssignmentsDeletionStatus — (Array<map>)

      The status object for the account assignment deletion operation.

      • Status — (String)

        The status of the permission set provisioning process.

        Possible values include:
        • "IN_PROGRESS"
        • "FAILED"
        • "SUCCEEDED"
      • RequestId — (String)

        The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

      • CreatedDate — (Date)

        The date that the permission set was created.

    • NextToken — (String)

      The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  AccountId: 'STRING_VALUE', /* required */
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE', /* required */
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE'
};
ssoadmin.listAccountAssignments(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • AccountId — (String)

    The identifier of the AWS account from which to list the assignments.

  • PermissionSetArn — (String)

    The ARN of the permission set from which to list assignments.

  • MaxResults — (Integer)

    The maximum number of results to display for the assignment.

  • NextToken — (String)

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • AccountAssignments — (Array<map>)

      The list of assignments that match the input AWS account and permission set.

      • AccountId — (String)

        The identifier of the AWS account.

      • PermissionSetArn — (String)

        The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

      • PrincipalType — (String)

        The entity type for which the assignment will be created.

        Possible values include:
        • "USER"
        • "GROUP"
      • PrincipalId — (String)

        An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

    • NextToken — (String)

      The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE', /* required */
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE',
  ProvisioningStatus: LATEST_PERMISSION_SET_PROVISIONED | LATEST_PERMISSION_SET_NOT_PROVISIONED
};
ssoadmin.listAccountsForProvisionedPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • PermissionSetArn — (String)

    The ARN of the PermissionSet from which the associated AWS accounts will be listed.

  • ProvisioningStatus — (String)

    The permission set provisioning status for an AWS account.

    Possible values include:
    • "LATEST_PERMISSION_SET_PROVISIONED"
    • "LATEST_PERMISSION_SET_NOT_PROVISIONED"
  • MaxResults — (Integer)

    The maximum number of results to display for the PermissionSet.

  • NextToken — (String)

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • AccountIds — (Array<String>)

      The list of AWS AccountIds.

    • NextToken — (String)

      The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE', /* required */
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE'
};
ssoadmin.listCustomerManagedPolicyReferencesInPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed.

  • PermissionSetArn — (String)

    The ARN of the PermissionSet.

  • MaxResults — (Integer)

    The maximum number of results to display for the list call.

  • NextToken — (String)

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • CustomerManagedPolicyReferences — (Array<map>)

      Specifies the names and paths of the customer managed policies that you have attached to your permission set.

      • Name — required — (String)

        The name of the IAM policy that you have configured in each account where you want to deploy your permission set.

      • Path — (String)

        The path to the IAM policy that you have configured in each account where you want to deploy your permission set. The default is /. For more information, see Friendly names and paths in the IAM User Guide.

    • NextToken — (String)

      The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE'
};
ssoadmin.listInstances(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • MaxResults — (Integer)

    The maximum number of results to display for the instance.

  • NextToken — (String)

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Instances — (Array<map>)

      Lists the IAM Identity Center instances that the caller has access to.

      • InstanceArn — (String)

        The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

      • IdentityStoreId — (String)

        The identifier of the identity store that is connected to the IAM Identity Center instance.

    • NextToken — (String)

      The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE', /* required */
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE'
};
ssoadmin.listManagedPoliciesInPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • PermissionSetArn — (String)

    The ARN of the PermissionSet whose managed policies will be listed.

  • MaxResults — (Integer)

    The maximum number of results to display for the PermissionSet.

  • NextToken — (String)

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • AttachedManagedPolicies — (Array<map>)

      An array of the AttachedManagedPolicy data type object.

      • Name — (String)

        The name of the AWS managed policy.

      • Arn — (String)

        The ARN of the AWS managed policy. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

    • NextToken — (String)

      The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  Filter: {
    Status: IN_PROGRESS | FAILED | SUCCEEDED
  },
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE'
};
ssoadmin.listPermissionSetProvisioningStatus(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • MaxResults — (Integer)

    The maximum number of results to display for the assignment.

  • NextToken — (String)

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

  • Filter — (map)

    Filters results based on the passed attribute value.

    • Status — (String)

      Filters the list operations result based on the status attribute.

      Possible values include:
      • "IN_PROGRESS"
      • "FAILED"
      • "SUCCEEDED"

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • PermissionSetsProvisioningStatus — (Array<map>)

      The status object for the permission set provisioning operation.

      • Status — (String)

        The status of the permission set provisioning process.

        Possible values include:
        • "IN_PROGRESS"
        • "FAILED"
        • "SUCCEEDED"
      • RequestId — (String)

        The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

      • CreatedDate — (Date)

        The date that the permission set was created.

    • NextToken — (String)

      The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE'
};
ssoadmin.listPermissionSets(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • NextToken — (String)

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

  • MaxResults — (Integer)

    The maximum number of results to display for the assignment.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • PermissionSets — (Array<String>)

      Defines the level of access on an AWS account.

    • NextToken — (String)

      The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  AccountId: 'STRING_VALUE', /* required */
  InstanceArn: 'STRING_VALUE', /* required */
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE',
  ProvisioningStatus: LATEST_PERMISSION_SET_PROVISIONED | LATEST_PERMISSION_SET_NOT_PROVISIONED
};
ssoadmin.listPermissionSetsProvisionedToAccount(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • AccountId — (String)

    The identifier of the AWS account from which to list the assignments.

  • ProvisioningStatus — (String)

    The status object for the permission set provisioning operation.

    Possible values include:
    • "LATEST_PERMISSION_SET_PROVISIONED"
    • "LATEST_PERMISSION_SET_NOT_PROVISIONED"
  • MaxResults — (Integer)

    The maximum number of results to display for the assignment.

  • NextToken — (String)

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • NextToken — (String)

      The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    • PermissionSets — (Array<String>)

      Defines the level of access that an AWS account has.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  ResourceArn: 'STRING_VALUE', /* required */
  NextToken: 'STRING_VALUE'
};
ssoadmin.listTagsForResource(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • ResourceArn — (String)

    The ARN of the resource with the tags to be listed.

  • NextToken — (String)

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Tags — (Array<map>)

      A set of key-value pairs that are used to manage the resource.

      • Key — required — (String)

        The key for the tag.

      • Value — required — (String)

        The value of the tag.

    • NextToken — (String)

      The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE', /* required */
  TargetType: AWS_ACCOUNT | ALL_PROVISIONED_ACCOUNTS, /* required */
  TargetId: 'STRING_VALUE'
};
ssoadmin.provisionPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • PermissionSetArn — (String)

    The ARN of the permission set.

  • TargetId — (String)

    TargetID is an AWS account identifier, typically a 10-12 digit string (For example, 123456789012).

  • TargetType — (String)

    The entity type for which the assignment will be created.

    Possible values include:
    • "AWS_ACCOUNT"
    • "ALL_PROVISIONED_ACCOUNTS"

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • PermissionSetProvisioningStatus — (map)

      The status object for the permission set provisioning operation.

      • Status — (String)

        The status of the permission set provisioning process.

        Possible values include:
        • "IN_PROGRESS"
        • "FAILED"
        • "SUCCEEDED"
      • RequestId — (String)

        The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

      • AccountId — (String)

        The identifier of the AWS account from which to list the assignments.

      • PermissionSetArn — (String)

        The ARN of the permission set that is being provisioned. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

      • FailureReason — (String)

        The message that contains an error or exception in case of an operation failure.

      • CreatedDate — (Date)

        The date that the permission set was created.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InlinePolicy: 'STRING_VALUE', /* required */
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE' /* required */
};
ssoadmin.putInlinePolicyToPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • PermissionSetArn — (String)

    The ARN of the permission set.

  • InlinePolicy — (String)

    The inline policy to attach to a PermissionSet.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE', /* required */
  PermissionsBoundary: { /* required */
    CustomerManagedPolicyReference: {
      Name: 'STRING_VALUE', /* required */
      Path: 'STRING_VALUE'
    },
    ManagedPolicyArn: 'STRING_VALUE'
  }
};
ssoadmin.putPermissionsBoundaryToPermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed.

  • PermissionSetArn — (String)

    The ARN of the PermissionSet.

  • PermissionsBoundary — (map)

    The permissions boundary that you want to attach to a PermissionSet.

    • CustomerManagedPolicyReference — (map)

      Specifies the name and path of a customer managed policy. You must have an IAM policy that matches the name and path in each AWS account where you want to deploy your permission set.

      • Name — required — (String)

        The name of the IAM policy that you have configured in each account where you want to deploy your permission set.

      • Path — (String)

        The path to the IAM policy that you have configured in each account where you want to deploy your permission set. The default is /. For more information, see Friendly names and paths in the IAM User Guide.

    • ManagedPolicyArn — (String)

      The AWS managed policy ARN that you want to attach to a permission set as a permissions boundary.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  ResourceArn: 'STRING_VALUE', /* required */
  Tags: [ /* required */
    {
      Key: 'STRING_VALUE', /* required */
      Value: 'STRING_VALUE' /* required */
    },
    /* more items */
  ]
};
ssoadmin.tagResource(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • ResourceArn — (String)

    The ARN of the resource with the tags to be listed.

  • Tags — (Array<map>)

    A set of key-value pairs that are used to manage the resource.

    • Key — required — (String)

      The key for the tag.

    • Value — required — (String)

      The value of the tag.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  ResourceArn: 'STRING_VALUE', /* required */
  TagKeys: [ /* required */
    'STRING_VALUE',
    /* more items */
  ]
};
ssoadmin.untagResource(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • ResourceArn — (String)

    The ARN of the resource with the tags to be listed.

  • TagKeys — (Array<String>)

    The keys of tags that are attached to the resource.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceAccessControlAttributeConfiguration: { /* required */
    AccessControlAttributes: [ /* required */
      {
        Key: 'STRING_VALUE', /* required */
        Value: { /* required */
          Source: [ /* required */
            'STRING_VALUE',
            /* more items */
          ]
        }
      },
      /* more items */
    ]
  },
  InstanceArn: 'STRING_VALUE' /* required */
};
ssoadmin.updateInstanceAccessControlAttributeConfiguration(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed.

  • InstanceAccessControlAttributeConfiguration — (map)

    Updates the attributes for your ABAC configuration.

    • AccessControlAttributes — required — (Array<map>)

      Lists the attributes that are configured for ABAC in the specified IAM Identity Center instance.

      • Key — required — (String)

        The name of the attribute associated with your identities in your identity source. This is used to map a specified attribute in your identity source with an attribute in IAM Identity Center.

      • Value — required — (map)

        The value used for mapping a specified attribute to an identity source.

        • Source — required — (Array<String>)

          The identity source to use when mapping a specified attribute to IAM Identity Center.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  InstanceArn: 'STRING_VALUE', /* required */
  PermissionSetArn: 'STRING_VALUE', /* required */
  Description: 'STRING_VALUE',
  RelayState: 'STRING_VALUE',
  SessionDuration: 'STRING_VALUE'
};
ssoadmin.updatePermissionSet(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • InstanceArn — (String)

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

  • PermissionSetArn — (String)

    The ARN of the permission set.

  • Description — (String)

    The description of the PermissionSet.

  • SessionDuration — (String)

    The length of time that the application user sessions are valid for in the ISO-8601 standard.

  • RelayState — (String)

    Used to redirect users within the application during the federation authentication process.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.