CloudWatchOmni / Client / list_domain_access_grants_for_organization

list_domain_access_grants_for_organization

CloudWatchOmni.Client.list_domain_access_grants_for_organization(**kwargs)

Returns organization-level domain access grants, with optional filtering by domain, principal, or permission. A grant is returned only when it matches every filter supplied. With no filters, returns the grants for the caller’s organization.

See also: AWS API Documentation

Request Syntax

response = client.list_domain_access_grants_for_organization(
    domainId='string',
    principalId='string',
    principalType='IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT',
    permission='ADMIN',
    nextToken='string',
    maxResults=123
)
Parameters:

  • domainId (string) – Filter by domain ID.

  • principalId (string) – Filter by principal ID.

  • principalType (string) – Filter by principal type.

  • permission (string) – Filter by permission level.

  • nextToken (string) – A token to retrieve the next page of results. Supply the same filters used on the request that returned it. Tokens expire after 24 hours.

  • maxResults (integer) – The maximum number of access grants to return per page. Defaults to 100. A page can contain fewer results than this value even when more results remain; continue while nextToken is present.

Return type:

dict

Returns:

Response Syntax

{
    'items': [
        {
            'grantId': 'string',
            'grantArn': 'string',
            'name': 'string',
            'domainId': 'string',
            'principal': {
                'principalType': 'IDC_USER'|'IDC_GROUP'|'IAM_USER'|'IAM_ROLE'|'IAM_ROOT',
                'principalId': 'string',
                'principalAttributes': [
                    {
                        'key': 'string',
                        'value': 'string'
                    },
                ]
            },
            'permission': 'ADMIN',
            'grantType': 'SERVICE_MANAGED'|'CUSTOMER_MANAGED',
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1)
        },
    ],
    'nextToken': 'string'
}

Response Structure

  • (dict) –

    • items (list) –

      The list of organization access grant summaries.

      • (dict) –

        Summary of an organization access grant. Call GetDomainAccessGrantForOrganization for the full grant.

        • grantId (string) –

          The unique ID of the access grant.

        • grantArn (string) –

          The Amazon Resource Name (ARN) of the access grant.

        • name (string) –

          A name that identifies the access grant.

        • domainId (string) –

          The ID of the organization domain the grant belongs to.

        • principal (dict) –

          The principal receiving the grant.

          • principalType (string) –

            The type of principal receiving the grant.

          • principalId (string) –

            The ID of the principal receiving the grant.

          • principalAttributes (list) –

            Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.

            • (dict) –

              A single attribute condition used to match principals for attribute-based access.

              • key (string) –

                The Identity Center user attribute to match on. One of userName, active, userStatus, displayName, email, name.givenName, name.familyName, enterprise.department, enterprise.division, enterprise.organization, enterprise.costCenter, or enterprise.employeeNumber. Each key may appear only once per grant.

              • value (string) –

                The attribute value.

        • permission (string) –

          The permission granted.

        • grantType (string) –

          Who manages the grant.

        • createdAt (datetime) –

          The timestamp when the access grant was created.

        • updatedAt (datetime) –

          The timestamp when the access grant was last updated.

    • nextToken (string) –

      A token to retrieve the next page of results, or null if there are no more results.

Exceptions