com.amazonaws.services.iamrolesanywhere

Interface AWSIAMRolesAnywhere

All Known Subinterfaces:

AWSIAMRolesAnywhereAsync

All Known Implementing Classes:

AbstractAWSIAMRolesAnywhere, AbstractAWSIAMRolesAnywhereAsync, AWSIAMRolesAnywhereAsyncClient, AWSIAMRolesAnywhereClient

@Generated(value="com.amazonaws:aws-java-sdk-code-generator")
public interface AWSIAMRolesAnywhere

Interface for accessing IAM Roles Anywhere.

Note: Do not directly implement this interface, new methods are added to it regularly. Extend from AbstractAWSIAMRolesAnywhere instead.

AWS Identity and Access Management Roles Anywhere provides a secure way for your workloads such as servers, containers, and applications running outside of AWS to obtain Temporary AWS credentials. Your workloads can use the same IAM policies and roles that you have configured with native AWS applications to access AWS resources. Using IAM Roles Anywhere will eliminate the need to manage long term credentials for workloads running outside of AWS.

To use IAM Roles Anywhere customer workloads will need to use X.509 certificates issued by their Certificate Authority (CA) . The Certificate Authority (CA) needs to be registered with IAM Roles Anywhere as a trust anchor to establish trust between customer PKI and IAM Roles Anywhere. Customers who do not manage their own PKI system can use AWS Certificate Manager Private Certificate Authority (ACM PCA) to create a Certificate Authority and use that to establish trust with IAM Roles Anywhere

This guide describes the IAM rolesanywhere operations that you can call programmatically. For general information about IAM Roles Anywhere see https://docs.aws.amazon.com/

Field Summary

Fields

Modifier and Type	Field and Description
static String	ENDPOINT_PREFIX The region metadata service name for computing region endpoints.

Method Summary

Modifier and Type	Method and Description
CreateProfileResult	createProfile(CreateProfileRequest createProfileRequest) Creates a profile.
CreateTrustAnchorResult	createTrustAnchor(CreateTrustAnchorRequest createTrustAnchorRequest) Creates a trust anchor.
DeleteCrlResult	deleteCrl(DeleteCrlRequest deleteCrlRequest) Deletes a certificate revocation list (CRL).
DeleteProfileResult	deleteProfile(DeleteProfileRequest deleteProfileRequest) Deletes a profile.
DeleteTrustAnchorResult	deleteTrustAnchor(DeleteTrustAnchorRequest deleteTrustAnchorRequest) Deletes a trust anchor.
DisableCrlResult	disableCrl(DisableCrlRequest disableCrlRequest) Disables a certificate revocation list (CRL).
DisableProfileResult	disableProfile(DisableProfileRequest disableProfileRequest) Disables a profile.
DisableTrustAnchorResult	disableTrustAnchor(DisableTrustAnchorRequest disableTrustAnchorRequest) Disables a trust anchor.
EnableCrlResult	enableCrl(EnableCrlRequest enableCrlRequest) Enables a certificate revocation list (CRL).
EnableProfileResult	enableProfile(EnableProfileRequest enableProfileRequest) Enables the roles in a profile to receive session credentials in CreateSession.
EnableTrustAnchorResult	enableTrustAnchor(EnableTrustAnchorRequest enableTrustAnchorRequest) Enables a trust anchor.
ResponseMetadata	getCachedResponseMetadata(AmazonWebServiceRequest request) Returns additional metadata for a previously executed successful request, typically used for debugging issues where a service isn't acting as expected.
GetCrlResult	getCrl(GetCrlRequest getCrlRequest) Gets a certificate revocation list (CRL).
GetProfileResult	getProfile(GetProfileRequest getProfileRequest) Gets a profile.
GetSubjectResult	getSubject(GetSubjectRequest getSubjectRequest) Gets a Subject.
GetTrustAnchorResult	getTrustAnchor(GetTrustAnchorRequest getTrustAnchorRequest) Gets a trust anchor.
ImportCrlResult	importCrl(ImportCrlRequest importCrlRequest) Imports the certificate revocation list (CRL).
ListCrlsResult	listCrls(ListCrlsRequest listCrlsRequest) Lists all Crls in the authenticated account and Amazon Web Services Region.
ListProfilesResult	listProfiles(ListProfilesRequest listProfilesRequest) Lists all profiles in the authenticated account and Amazon Web Services Region.
ListSubjectsResult	listSubjects(ListSubjectsRequest listSubjectsRequest) Lists the subjects in the authenticated account and Amazon Web Services Region.
ListTagsForResourceResult	listTagsForResource(ListTagsForResourceRequest listTagsForResourceRequest) Lists the tags attached to the resource.
ListTrustAnchorsResult	listTrustAnchors(ListTrustAnchorsRequest listTrustAnchorsRequest) Lists the trust anchors in the authenticated account and Amazon Web Services Region.
void	shutdown() Shuts down this client object, releasing any resources that might be held open.
TagResourceResult	tagResource(TagResourceRequest tagResourceRequest) Attaches tags to a resource.
UntagResourceResult	untagResource(UntagResourceRequest untagResourceRequest) Removes tags from the resource.
UpdateCrlResult	updateCrl(UpdateCrlRequest updateCrlRequest) Updates the certificate revocation list (CRL).
UpdateProfileResult	updateProfile(UpdateProfileRequest updateProfileRequest) Updates the profile.
UpdateTrustAnchorResult	updateTrustAnchor(UpdateTrustAnchorRequest updateTrustAnchorRequest) Updates the trust anchor.You establish trust between IAM Roles Anywhere and your certificate authority (CA) by configuring a trust anchor.

Field Detail

ENDPOINT_PREFIX

static final String ENDPOINT_PREFIX

The region metadata service name for computing region endpoints. You can use this value to retrieve metadata (such as supported regions) of the service.

See Also:

RegionUtils.getRegionsForService(String), Constant Field Values

Method Detail

createProfile

CreateProfileResult createProfile(CreateProfileRequest createProfileRequest)

Creates a profile. A profile is configuration resource to list the roles that RolesAnywhere service is trusted to assume. In addition, by applying a profile you can intersect permissions with IAM managed policies.

Required permissions: rolesanywhere:CreateProfile.

Parameters:

createProfileRequest -

Returns:

Result of the CreateProfile operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

createTrustAnchor

CreateTrustAnchorResult createTrustAnchor(CreateTrustAnchorRequest createTrustAnchorRequest)

Creates a trust anchor. You establish trust between IAM Roles Anywhere and your certificate authority (CA) by configuring a trust anchor. A Trust Anchor is defined either as a reference to a AWS Certificate Manager Private Certificate Authority (ACM PCA), or by uploading a Certificate Authority (CA) certificate. Your AWS workloads can authenticate with the trust anchor using certificates issued by the trusted Certificate Authority (CA) in exchange for temporary AWS credentials.

Required permissions: rolesanywhere:CreateTrustAnchor.

Parameters:

createTrustAnchorRequest -

Returns:

Result of the CreateTrustAnchor operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

deleteCrl

DeleteCrlResult deleteCrl(DeleteCrlRequest deleteCrlRequest)

Deletes a certificate revocation list (CRL).

Required permissions: rolesanywhere:DeleteCrl.

Parameters:

deleteCrlRequest -

Returns:

Result of the DeleteCrl operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

deleteProfile

DeleteProfileResult deleteProfile(DeleteProfileRequest deleteProfileRequest)

Deletes a profile.

Required permissions: rolesanywhere:DeleteProfile.

Parameters:

deleteProfileRequest -

Returns:

Result of the DeleteProfile operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

deleteTrustAnchor

DeleteTrustAnchorResult deleteTrustAnchor(DeleteTrustAnchorRequest deleteTrustAnchorRequest)

Deletes a trust anchor.

Required permissions: rolesanywhere:DeleteTrustAnchor.

Parameters:

deleteTrustAnchorRequest -

Returns:

Result of the DeleteTrustAnchor operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

disableCrl

DisableCrlResult disableCrl(DisableCrlRequest disableCrlRequest)

Disables a certificate revocation list (CRL).

Required permissions: rolesanywhere:DisableCrl.

Parameters:

disableCrlRequest -

Returns:

Result of the DisableCrl operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

disableProfile

DisableProfileResult disableProfile(DisableProfileRequest disableProfileRequest)

Disables a profile. When disabled, CreateSession requests with this profile fail.

Required permissions: rolesanywhere:DisableProfile.

Parameters:

disableProfileRequest -

Returns:

Result of the DisableProfile operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

disableTrustAnchor

DisableTrustAnchorResult disableTrustAnchor(DisableTrustAnchorRequest disableTrustAnchorRequest)

Disables a trust anchor. When disabled, CreateSession requests specifying this trust anchor are unauthorized.

Required permissions: rolesanywhere:DisableTrustAnchor.

Parameters:

disableTrustAnchorRequest -

Returns:

Result of the DisableTrustAnchor operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

enableCrl

EnableCrlResult enableCrl(EnableCrlRequest enableCrlRequest)

Enables a certificate revocation list (CRL). When enabled, certificates stored in the CRL are unauthorized to receive session credentials.

Required permissions: rolesanywhere:EnableCrl.

Parameters:

enableCrlRequest -

Returns:

Result of the EnableCrl operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

enableProfile

EnableProfileResult enableProfile(EnableProfileRequest enableProfileRequest)

Enables the roles in a profile to receive session credentials in CreateSession.

Required permissions: rolesanywhere:EnableProfile.

Parameters:

enableProfileRequest -

Returns:

Result of the EnableProfile operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

enableTrustAnchor

EnableTrustAnchorResult enableTrustAnchor(EnableTrustAnchorRequest enableTrustAnchorRequest)

Enables a trust anchor. When enabled, certificates in the trust anchor chain are authorized for trust validation.

Required permissions: rolesanywhere:EnableTrustAnchor.

Parameters:

enableTrustAnchorRequest -

Returns:

Result of the EnableTrustAnchor operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

getCrl

GetCrlResult getCrl(GetCrlRequest getCrlRequest)

Gets a certificate revocation list (CRL).

Required permissions: rolesanywhere:GetCrl.

Parameters:

getCrlRequest -

Returns:

Result of the GetCrl operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

See Also:

AWS API Documentation

getProfile

GetProfileResult getProfile(GetProfileRequest getProfileRequest)

Gets a profile.

Required permissions: rolesanywhere:GetProfile.

Parameters:

getProfileRequest -

Returns:

Result of the GetProfile operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

getSubject

GetSubjectResult getSubject(GetSubjectRequest getSubjectRequest)

Gets a Subject. A Subject associates a certificate identity with authentication attempts by CreateSession. The Subject resources stores audit information such as status of the last authentication attempt, the certificate data used in the attempt, and the last time the associated identity attempted authentication.

Required permissions: rolesanywhere:GetSubject.

Parameters:

getSubjectRequest -

Returns:

Result of the GetSubject operation returned by the service.

Throws:

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

getTrustAnchor

GetTrustAnchorResult getTrustAnchor(GetTrustAnchorRequest getTrustAnchorRequest)

Gets a trust anchor.

Required permissions: rolesanywhere:GetTrustAnchor.

Parameters:

getTrustAnchorRequest -

Returns:

Result of the GetTrustAnchor operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

importCrl

ImportCrlResult importCrl(ImportCrlRequest importCrlRequest)

Imports the certificate revocation list (CRL). CRl is a list of certificates that have been revoked by the issuing certificate Authority (CA). IAM Roles Anywhere validates against the crl list before issuing credentials.

Required permissions: rolesanywhere:ImportCrl.

Parameters:

importCrlRequest -

Returns:

Result of the ImportCrl operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

listCrls

ListCrlsResult listCrls(ListCrlsRequest listCrlsRequest)

Lists all Crls in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListCrls.

Parameters:

listCrlsRequest -

Returns:

Result of the ListCrls operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

listProfiles

ListProfilesResult listProfiles(ListProfilesRequest listProfilesRequest)

Lists all profiles in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListProfiles.

Parameters:

listProfilesRequest -

Returns:

Result of the ListProfiles operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

listSubjects

ListSubjectsResult listSubjects(ListSubjectsRequest listSubjectsRequest)

Lists the subjects in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListSubjects.

Parameters:

listSubjectsRequest -

Returns:

Result of the ListSubjects operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

listTagsForResource

ListTagsForResourceResult listTagsForResource(ListTagsForResourceRequest listTagsForResourceRequest)

Lists the tags attached to the resource.

Required permissions: rolesanywhere:ListTagsForResource.

Parameters:

listTagsForResourceRequest -

Returns:

Result of the ListTagsForResource operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

listTrustAnchors

ListTrustAnchorsResult listTrustAnchors(ListTrustAnchorsRequest listTrustAnchorsRequest)

Lists the trust anchors in the authenticated account and Amazon Web Services Region.

Required permissions: rolesanywhere:ListTrustAnchors.

Parameters:

listTrustAnchorsRequest -

Returns:

Result of the ListTrustAnchors operation returned by the service.

Throws:

ValidationException - Validation exception error.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

tagResource

TagResourceResult tagResource(TagResourceRequest tagResourceRequest)

Attaches tags to a resource.

Required permissions: rolesanywhere:TagResource.

Parameters:

tagResourceRequest -

Returns:

Result of the TagResource operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

TooManyTagsException - Too many tags.

See Also:

AWS API Documentation

untagResource

UntagResourceResult untagResource(UntagResourceRequest untagResourceRequest)

Removes tags from the resource.

Required permissions: rolesanywhere:UntagResource.

Parameters:

untagResourceRequest -

Returns:

Result of the UntagResource operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

updateCrl

UpdateCrlResult updateCrl(UpdateCrlRequest updateCrlRequest)

Updates the certificate revocation list (CRL). CRl is a list of certificates that have been revoked by the issuing certificate Authority (CA). IAM Roles Anywhere validates against the crl list before issuing credentials.

Required permissions: rolesanywhere:UpdateCrl.

Parameters:

updateCrlRequest -

Returns:

Result of the UpdateCrl operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

updateProfile

UpdateProfileResult updateProfile(UpdateProfileRequest updateProfileRequest)

Updates the profile. A profile is configuration resource to list the roles that RolesAnywhere service is trusted to assume. In addition, by applying a profile you can scope-down permissions with IAM managed policies.

Required permissions: rolesanywhere:UpdateProfile.

Parameters:

updateProfileRequest -

Returns:

Result of the UpdateProfile operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

updateTrustAnchor

UpdateTrustAnchorResult updateTrustAnchor(UpdateTrustAnchorRequest updateTrustAnchorRequest)

Updates the trust anchor.You establish trust between IAM Roles Anywhere and your certificate authority (CA) by configuring a trust anchor. A Trust Anchor is defined either as a reference to a AWS Certificate Manager Private Certificate Authority (ACM PCA), or by uploading a Certificate Authority (CA) certificate. Your AWS workloads can authenticate with the trust anchor using certificates issued by the trusted Certificate Authority (CA) in exchange for temporary AWS credentials.

Required permissions: rolesanywhere:UpdateTrustAnchor.

Parameters:

updateTrustAnchorRequest -

Returns:

Result of the UpdateTrustAnchor operation returned by the service.

Throws:

ValidationException - Validation exception error.

ResourceNotFoundException - The resource could not be found.

AccessDeniedException - You do not have sufficient access to perform this action.

See Also:

AWS API Documentation

shutdown

void shutdown()

Shuts down this client object, releasing any resources that might be held open. This is an optional method, and callers are not expected to call it, but can if they want to explicitly release any open resources. Once a client has been shutdown, it should not be used to make any more requests.

getCachedResponseMetadata

ResponseMetadata getCachedResponseMetadata(AmazonWebServiceRequest request)

Returns additional metadata for a previously executed successful request, typically used for debugging issues where a service isn't acting as expected. This data isn't considered part of the result data returned by an operation, so it's available through this separate, diagnostic interface.

Response metadata is only cached for a limited period of time, so if you need to access this extra diagnostic information for an executed request, you should use this method to retrieve it as soon as possible after executing a request.

Parameters:

request - The originally executed request.

Returns:

The response metadata for the specified request, or null if none is available.