AWS Identity Center

使用说明

Provision and revoke temporary access to AWS accounts via IAM Identity Center (SSO). Assign permission sets to users or groups, look up users by email, and list accounts and permission sets for access request workflows.

工具

`identity_center_list_instances`

List all AWS IAM Identity Center instances in your account

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`maxResults`	number	否	Maximum number of instances to return (1-100)
`nextToken`	string	否	Pagination token from a previous request

输出

参数	类型	描述
`instances`	json	List of Identity Center instances with instanceArn, identityStoreId, name, status, statusReason
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of instances returned

`identity_center_list_accounts`

List all AWS accounts in your organization

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`maxResults`	number	否	Maximum number of accounts to return
`nextToken`	string	否	Pagination token from a previous request

输出

参数	类型	描述
`accounts`	json	List of AWS accounts with id, arn, name, email, status
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of accounts returned

`identity_center_describe_account`

Retrieve details about a specific AWS account by its ID

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`accountId`	string	是	AWS account ID to describe

输出

参数	类型	描述
`id`	string	AWS account ID
`arn`	string	AWS account ARN
`name`	string	Account name
`email`	string	Root email address of the account
`status`	string	Account status (ACTIVE, SUSPENDED, etc.)
`joinedTimestamp`	string	Date the account joined the organization

`identity_center_list_permission_sets`

List all permission sets defined in an IAM Identity Center instance

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`instanceArn`	string	是	ARN of the Identity Center instance
`maxResults`	number	否	Maximum number of permission sets to return
`nextToken`	string	否	Pagination token from a previous request

输出

参数	类型	描述
`permissionSets`	json	List of permission sets with permissionSetArn, name, description, sessionDuration
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of permission sets returned

`identity_center_get_user`

Look up a user in the Identity Store by email address

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`identityStoreId`	string	是	Identity Store ID (from the Identity Center instance)
`email`	string	是	Email address of the user to look up

输出

参数	类型	描述
`userId`	string	Identity Store user ID (use as principalId)
`userName`	string	Username in the Identity Store
`displayName`	string	Display name of the user
`email`	string	Email address of the user

`identity_center_get_group`

Look up a group in the Identity Store by display name

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`identityStoreId`	string	是	Identity Store ID (from the Identity Center instance)
`displayName`	string	是	Display name of the group to look up

输出

参数	类型	描述
`groupId`	string	Identity Store group ID (use as principalId)
`displayName`	string	Display name of the group
`description`	string	Group description

`identity_center_list_groups`

List all groups in the Identity Store

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`identityStoreId`	string	是	Identity Store ID (from the Identity Center instance)
`maxResults`	number	否	Maximum number of groups to return
`nextToken`	string	否	Pagination token from a previous request

输出

参数	类型	描述
`groups`	json	List of groups with groupId, displayName, description
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of groups returned

`identity_center_create_account_assignment`

Grant a user or group access to an AWS account via a permission set (temporary elevated access)

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`instanceArn`	string	是	ARN of the Identity Center instance
`accountId`	string	是	AWS account ID to grant access to
`permissionSetArn`	string	是	ARN of the permission set to assign
`principalType`	string	是	Type of principal: USER or GROUP
`principalId`	string	是	Identity Store ID of the user or group

输出

参数	类型	描述
`message`	string	Status message
`status`	string	Provisioning status: IN_PROGRESS, FAILED, or SUCCEEDED
`requestId`	string	Request ID to use with Check Assignment Status
`accountId`	string	Target AWS account ID
`permissionSetArn`	string	Permission set ARN
`principalType`	string	Principal type (USER or GROUP)
`principalId`	string	Principal ID
`failureReason`	string	Reason for failure if status is FAILED
`createdDate`	string	Date the request was created

`identity_center_delete_account_assignment`

Revoke a user or group access to an AWS account by removing a permission set assignment

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`instanceArn`	string	是	ARN of the Identity Center instance
`accountId`	string	是	AWS account ID to revoke access from
`permissionSetArn`	string	是	ARN of the permission set to remove
`principalType`	string	是	Type of principal: USER or GROUP
`principalId`	string	是	Identity Store ID of the user or group

输出

参数	类型	描述
`message`	string	Status message
`status`	string	Deprovisioning status: IN_PROGRESS, FAILED, or SUCCEEDED
`requestId`	string	Request ID to use with Check Assignment Status
`accountId`	string	Target AWS account ID
`permissionSetArn`	string	Permission set ARN
`principalType`	string	Principal type (USER or GROUP)
`principalId`	string	Principal ID
`failureReason`	string	Reason for failure if status is FAILED
`createdDate`	string	Date the request was created

`identity_center_check_assignment_status`

Check the provisioning status of an account assignment creation request

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`instanceArn`	string	是	ARN of the Identity Center instance
`requestId`	string	是	Request ID returned from Create or Delete Account Assignment

输出

参数	类型	描述
`message`	string	Human-readable status message
`status`	string	Current status: IN_PROGRESS, FAILED, or SUCCEEDED
`requestId`	string	The request ID that was checked
`accountId`	string	Target AWS account ID
`permissionSetArn`	string	Permission set ARN
`principalType`	string	Principal type (USER or GROUP)
`principalId`	string	Principal ID
`failureReason`	string	Reason for failure if status is FAILED
`createdDate`	string	Date the request was created

`identity_center_check_assignment_deletion_status`

Check the deprovisioning status of an account assignment deletion request

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`instanceArn`	string	是	ARN of the Identity Center instance
`requestId`	string	是	Request ID returned from Delete Account Assignment

输出

参数	类型	描述
`message`	string	Human-readable status message
`status`	string	Current deletion status: IN_PROGRESS, FAILED, or SUCCEEDED
`requestId`	string	The deletion request ID that was checked
`accountId`	string	Target AWS account ID
`permissionSetArn`	string	Permission set ARN
`principalType`	string	Principal type (USER or GROUP)
`principalId`	string	Principal ID
`failureReason`	string	Reason for failure if status is FAILED
`createdDate`	string	Date the request was created

`identity_center_list_account_assignments`

List all account assignments for a specific user or group across all accounts

输入

参数	类型	必填	描述
`region`	string	是	AWS region (e.g., us-east-1)
`accessKeyId`	string	是	AWS access key ID
`secretAccessKey`	string	是	AWS secret access key
`instanceArn`	string	是	ARN of the Identity Center instance
`principalId`	string	是	Identity Store ID of the user or group
`principalType`	string	是	Type of principal: USER or GROUP
`maxResults`	number	否	Maximum number of assignments to return
`nextToken`	string	否	Pagination token from a previous request

输出

参数	类型	描述
`assignments`	json	List of account assignments with accountId, permissionSetArn, principalType, principalId
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of assignments returned

AWS Identity Center

On this page