AwsIdentityCenterPermissionCapabilityArgs

interface AwsIdentityCenterPermissionCapabilityArgs extends Omit<AwsIdentityCenterPermissionSetCapabilityArgs, 'managedPolicies' | 'customerManagedPolicyReferences' | 'inlinePolicy'> {
assignments?: Record<string, AwsIdentityCenterPermissionAssignmentArgs>;
customerManagedPolicies?: AwsIdentityCenterCustomerManagedPolicyInput[];
description?: Input<string | undefined>;
identityStoreId?: Input<string>;
inlinePolicy?: unknown;
instanceArn: Input<string>;
managedPolicies?: AwsIdentityCenterManagedPolicyInput[];
name?: Input<string | undefined>;
permissionsBoundary?: Input<PermissionSetPermissionsBoundaryArgs | undefined>;
relayStateType?: Input<string | undefined>;
sessionDuration?: Input<string | undefined>;
tags?: Input<Input<TagArgs>[] | undefined>;
}

Capability arguments for composite permission orchestration.

Example

CODE

{
  name: 'PlatformReadOnly',
  instanceArn: 'arn:aws:sso:::instance/ssoins-1234567890abcdef',
  identityStoreId: 'd-1234567890',
  managedPolicies: ['ReadOnlyAccess'],
  assignments: { platformUser: { userEmail: 'user@example.com', targetId: '000000000000' } },
}

Hierarchy

Omit<AwsIdentityCenterPermissionSetCapabilityArgs, "managedPolicies" | "customerManagedPolicyReferences" | "inlinePolicy">
AwsIdentityCenterPermissionCapabilityArgs

Properties

`assignments: Record<string, AwsIdentityCenterPermissionAssignmentArgs>`

User or group assignments keyed by stable assignment identity.

`customerManagedPolicies: AwsIdentityCenterCustomerManagedPolicyInput[]`

Customer-managed policy names or name/path pairs to attach to the permission set.

`description: Input<string | undefined>`

Inherited from description

The permission set description.

`identityStoreId: Input<string>`

Identity Store ID. Required when user or group assignments are configured.

`inlinePolicy: unknown`

Inline policy template or JSON document using {{ var }} placeholders.

`instanceArn: Input<string>`

Inherited from instanceArn

The sso instance arn that the permission set is owned.

`managedPolicies: AwsIdentityCenterManagedPolicyInput[]`

Managed policy names or ARNs to attach to the permission set.

`name: Input<string | undefined>`

Inherited from name

The name you want to assign to this permission set.

`permissionsBoundary: Input<PermissionSetPermissionsBoundaryArgs | undefined>`

Inherited from permissionsBoundary

Specifies the configuration of the AWS managed or customer managed policy that you want to set as a permissions boundary. Specify either CustomerManagedPolicyReference to use the name and path of a customer managed policy, or ManagedPolicyArn to use the ARN of an AWS managed policy. A permissions boundary represents the maximum permissions that any policy can grant your role. For more information, see Permissions boundaries for IAM entities in the IAM User Guide .

Policies used as permissions boundaries don't provide permissions. You must also attach an IAM policy to the role. To learn how the effective permissions for a role are evaluated, see IAM JSON policy evaluation logic in the IAM User Guide .

`relayStateType: Input<string | undefined>`

Inherited from relayStateType

The relay state URL that redirect links to any service in the AWS Management Console.

`sessionDuration: Input<string | undefined>`

Inherited from sessionDuration

The length of time that a user can be signed in to an AWS account.

`tags: Input<Input<TagArgs>[] | undefined>`

Inherited from tags

The tags to attach to the new PermissionSet .