Skip to content

Commit 9e4179e

Browse files
author
AWS
committed
Amazon Verified Permissions Update: Amazon Verified Permissions / Features : Adds support for tagging policy stores.
1 parent a926af0 commit 9e4179e

File tree

2 files changed

+188
-6
lines changed

2 files changed

+188
-6
lines changed

‎.changes/next-release/feature-AmazonVerifiedPermissions-9a76b6e.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "feature",
3+
"category": "Amazon Verified Permissions",
4+
"contributor": "",
5+
"description": "Amazon Verified Permissions / Features : Adds support for tagging policy stores."
6+
}

‎services/verifiedpermissions/src/main/resources/codegen-resources/service-2.json

Lines changed: 182 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -405,6 +405,23 @@
405405
],
406406
"documentation":"<p>Returns a paginated list of all policy templates in the specified policy store.</p>"
407407
},
408+
"ListTagsForResource":{
409+
"name":"ListTagsForResource",
410+
"http":{
411+
"method":"POST",
412+
"requestUri":"/"
413+
},
414+
"input":{"shape":"ListTagsForResourceInput"},
415+
"output":{"shape":"ListTagsForResourceOutput"},
416+
"errors":[
417+
{"shape":"ValidationException"},
418+
{"shape":"AccessDeniedException"},
419+
{"shape":"ResourceNotFoundException"},
420+
{"shape":"ThrottlingException"},
421+
{"shape":"InternalServerException"}
422+
],
423+
"documentation":"<p>Returns the tags associated with the specified Amazon Verified Permissions resource. In Verified Permissions, policy stores can be tagged.</p>"
424+
},
408425
"PutSchema":{
409426
"name":"PutSchema",
410427
"http":{
@@ -425,6 +442,41 @@
425442
"documentation":"<p>Creates or updates the policy schema in the specified policy store. The schema is used to validate any Cedar policies and policy templates submitted to the policy store. Any changes to the schema validate only policies and templates submitted after the schema change. Existing policies and templates are not re-evaluated against the changed schema. If you later update a policy, then it is evaluated against the new schema at that time.</p> <note> <p>Verified Permissions is <i> <a href=\"https://wikipedia.org/wiki/Eventual_consistency\">eventually consistent</a> </i>. It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.</p> </note>",
426443
"idempotent":true
427444
},
445+
"TagResource":{
446+
"name":"TagResource",
447+
"http":{
448+
"method":"POST",
449+
"requestUri":"/"
450+
},
451+
"input":{"shape":"TagResourceInput"},
452+
"output":{"shape":"TagResourceOutput"},
453+
"errors":[
454+
{"shape":"ValidationException"},
455+
{"shape":"TooManyTagsException"},
456+
{"shape":"AccessDeniedException"},
457+
{"shape":"ResourceNotFoundException"},
458+
{"shape":"ThrottlingException"},
459+
{"shape":"InternalServerException"}
460+
],
461+
"documentation":"<p>Assigns one or more tags (key-value pairs) to the specified Amazon Verified Permissions resource. Tags can help you organize and categorize your resources. You can also use them to scope user permissions by granting a user permission to access or change only resources with certain tag values. In Verified Permissions, policy stores can be tagged.</p> <p>Tags don't have any semantic meaning to Amazon Web Services and are interpreted strictly as strings of characters.</p> <p>You can use the TagResource action with a resource that already has tags. If you specify a new tag key, this tag is appended to the list of tags associated with the resource. If you specify a tag key that is already associated with the resource, the new tag value that you specify replaces the previous value for that tag.</p> <p>You can associate as many as 50 tags with a resource.</p>"
462+
},
463+
"UntagResource":{
464+
"name":"UntagResource",
465+
"http":{
466+
"method":"POST",
467+
"requestUri":"/"
468+
},
469+
"input":{"shape":"UntagResourceInput"},
470+
"output":{"shape":"UntagResourceOutput"},
471+
"errors":[
472+
{"shape":"ValidationException"},
473+
{"shape":"AccessDeniedException"},
474+
{"shape":"ResourceNotFoundException"},
475+
{"shape":"ThrottlingException"},
476+
{"shape":"InternalServerException"}
477+
],
478+
"documentation":"<p>Removes one or more tags from the specified Amazon Verified Permissions resource. In Verified Permissions, policy stores can be tagged.</p>"
479+
},
428480
"UpdateIdentitySource":{
429481
"name":"UpdateIdentitySource",
430482
"http":{
@@ -549,6 +601,12 @@
549601
"pattern":"Action$|^.+::Action",
550602
"sensitive":true
551603
},
604+
"AmazonResourceName":{
605+
"type":"string",
606+
"documentation":"<p>An Amazon Resource Name (ARN) uniquely identifies an AWS resource.</p>",
607+
"max":2048,
608+
"min":1
609+
},
552610
"AttributeValue":{
553611
"type":"structure",
554612
"members":{
@@ -744,7 +802,7 @@
744802
},
745803
"entities":{
746804
"shape":"EntitiesDefinition",
747-
"documentation":"<p>Specifies the list of resources and principals and their associated attributes that Verified Permissions can examine when evaluating the policies. </p> <note> <p>You can include only principal and resource entities in this parameter; you can't include actions. You must specify actions in the schema.</p> </note>"
805+
"documentation":"<p>(Optional) Specifies the list of resources and principals and their associated attributes that Verified Permissions can examine when evaluating the policies. These additional entities and their attributes can be referenced and checked by conditional elements in the policies in the specified policy store.</p> <note> <p>You can include only principal and resource entities in this parameter; you can't include actions. You must specify actions in the schema.</p> </note>"
748806
},
749807
"requests":{
750808
"shape":"BatchIsAuthorizedInputList",
@@ -842,7 +900,7 @@
842900
},
843901
"entities":{
844902
"shape":"EntitiesDefinition",
845-
"documentation":"<p>Specifies the list of resources and their associated attributes that Verified Permissions can examine when evaluating the policies. </p> <important> <p>You can't include principals in this parameter, only resource and action entities. This parameter can't include any entities of a type that matches the user or group entity types that you defined in your identity source.</p> <ul> <li> <p>The <code>BatchIsAuthorizedWithToken</code> operation takes principal attributes from <b> <i>only</i> </b> the <code>identityToken</code> or <code>accessToken</code> passed to the operation.</p> </li> <li> <p>For action entities, you can include only their <code>Identifier</code> and <code>EntityType</code>. </p> </li> </ul> </important>"
903+
"documentation":"<p>(Optional) Specifies the list of resources and their associated attributes that Verified Permissions can examine when evaluating the policies. These additional entities and their attributes can be referenced and checked by conditional elements in the policies in the specified policy store.</p> <important> <p>You can't include principals in this parameter, only resource and action entities. This parameter can't include any entities of a type that matches the user or group entity types that you defined in your identity source.</p> <ul> <li> <p>The <code>BatchIsAuthorizedWithToken</code> operation takes principal attributes from <b> <i>only</i> </b> the <code>identityToken</code> or <code>accessToken</code> passed to the operation.</p> </li> <li> <p>For action entities, you can include only their <code>Identifier</code> and <code>EntityType</code>. </p> </li> </ul> </important>"
846904
},
847905
"requests":{
848906
"shape":"BatchIsAuthorizedWithTokenInputList",
@@ -932,6 +990,13 @@
932990
"type":"string",
933991
"sensitive":true
934992
},
993+
"CedarVersion":{
994+
"type":"string",
995+
"enum":[
996+
"CEDAR_2",
997+
"CEDAR_4"
998+
]
999+
},
9351000
"Claim":{
9361001
"type":"string",
9371002
"min":1,
@@ -1279,6 +1344,10 @@
12791344
"deletionProtection":{
12801345
"shape":"DeletionProtection",
12811346
"documentation":"<p>Specifies whether the policy store can be deleted. If enabled, the policy store can't be deleted.</p> <p>The default state is <code>DISABLED</code>.</p>"
1347+
},
1348+
"tags":{
1349+
"shape":"TagMap",
1350+
"documentation":"<p>The list of key-value pairs to associate with the policy store.</p>"
12821351
}
12831352
}
12841353
},
@@ -1733,6 +1802,10 @@
17331802
"policyStoreId":{
17341803
"shape":"PolicyStoreId",
17351804
"documentation":"<p>Specifies the ID of the policy store that you want information about.</p>"
1805+
},
1806+
"tags":{
1807+
"shape":"Boolean",
1808+
"documentation":"<p>Specifies whether to return the tags that are attached to the policy store. If this parameter is included in the API call, the tags are returned, otherwise they are not returned.</p> <note> <p>If this parameter is included in the API call but there are no tags attached to the policy store, the <code>tags</code> response parameter is omitted from the response.</p> </note>"
17361809
}
17371810
}
17381811
},
@@ -1773,6 +1846,14 @@
17731846
"deletionProtection":{
17741847
"shape":"DeletionProtection",
17751848
"documentation":"<p>Specifies whether the policy store can be deleted. If enabled, the policy store can't be deleted.</p> <p>The default state is <code>DISABLED</code>.</p>"
1849+
},
1850+
"cedarVersion":{
1851+
"shape":"CedarVersion",
1852+
"documentation":"<p>The version of the Cedar language used with policies, policy templates, and schemas in this policy store. For more information, see <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/cedar4-faq.html\">Amazon Verified Permissions upgrade to Cedar v4 FAQ</a>.</p>"
1853+
},
1854+
"tags":{
1855+
"shape":"TagMap",
1856+
"documentation":"<p>The list of tags associated with the policy store.</p>"
17761857
}
17771858
}
17781859
},
@@ -2069,7 +2150,7 @@
20692150
},
20702151
"entities":{
20712152
"shape":"EntitiesDefinition",
2072-
"documentation":"<p>Specifies the list of resources and principals and their associated attributes that Verified Permissions can examine when evaluating the policies. </p> <note> <p>You can include only principal and resource entities in this parameter; you can't include actions. You must specify actions in the schema.</p> </note>"
2153+
"documentation":"<p>(Optional) Specifies the list of resources and principals and their associated attributes that Verified Permissions can examine when evaluating the policies. These additional entities and their attributes can be referenced and checked by conditional elements in the policies in the specified policy store.</p> <note> <p>You can include only principal and resource entities in this parameter; you can't include actions. You must specify actions in the schema.</p> </note>"
20732154
}
20742155
}
20752156
},
@@ -2125,7 +2206,7 @@
21252206
},
21262207
"entities":{
21272208
"shape":"EntitiesDefinition",
2128-
"documentation":"<p>Specifies the list of resources and their associated attributes that Verified Permissions can examine when evaluating the policies. </p> <important> <p>You can't include principals in this parameter, only resource and action entities. This parameter can't include any entities of a type that matches the user or group entity types that you defined in your identity source.</p> <ul> <li> <p>The <code>IsAuthorizedWithToken</code> operation takes principal attributes from <b> <i>only</i> </b> the <code>identityToken</code> or <code>accessToken</code> passed to the operation.</p> </li> <li> <p>For action entities, you can include only their <code>Identifier</code> and <code>EntityType</code>. </p> </li> </ul> </important>"
2209+
"documentation":"<p>(Optional) Specifies the list of resources and their associated attributes that Verified Permissions can examine when evaluating the policies. These additional entities and their attributes can be referenced and checked by conditional elements in the policies in the specified policy store.</p> <important> <p>You can't include principals in this parameter, only resource and action entities. This parameter can't include any entities of a type that matches the user or group entity types that you defined in your identity source.</p> <ul> <li> <p>The <code>IsAuthorizedWithToken</code> operation takes principal attributes from <b> <i>only</i> </b> the <code>identityToken</code> or <code>accessToken</code> passed to the operation.</p> </li> <li> <p>For action entities, you can include only their <code>Identifier</code> and <code>EntityType</code>. </p> </li> </ul> </important>"
21292210
}
21302211
}
21312212
},
@@ -2297,6 +2378,25 @@
22972378
}
22982379
}
22992380
},
2381+
"ListTagsForResourceInput":{
2382+
"type":"structure",
2383+
"required":["resourceArn"],
2384+
"members":{
2385+
"resourceArn":{
2386+
"shape":"AmazonResourceName",
2387+
"documentation":"<p>The ARN of the resource for which you want to view tags.</p>"
2388+
}
2389+
}
2390+
},
2391+
"ListTagsForResourceOutput":{
2392+
"type":"structure",
2393+
"members":{
2394+
"tags":{
2395+
"shape":"TagMap",
2396+
"documentation":"<p>The list of tags associated with the resource.</p>"
2397+
}
2398+
}
2399+
},
23002400
"LongAttribute":{
23012401
"type":"long",
23022402
"box":true,
@@ -2747,7 +2847,7 @@
27472847
"type":"string",
27482848
"max":200,
27492849
"min":1,
2750-
"pattern":"[a-zA-Z0-9-]*"
2850+
"pattern":"[a-zA-Z0-9-/_]*"
27512851
},
27522852
"PolicyStoreItem":{
27532853
"type":"structure",
@@ -2794,7 +2894,7 @@
27942894
"type":"string",
27952895
"max":200,
27962896
"min":1,
2797-
"pattern":"[a-zA-Z0-9-]*"
2897+
"pattern":"[a-zA-Z0-9-/_]*"
27982898
},
27992899
"PolicyTemplateItem":{
28002900
"type":"structure",
@@ -3053,6 +3153,51 @@
30533153
"type":"string",
30543154
"sensitive":true
30553155
},
3156+
"TagKey":{
3157+
"type":"string",
3158+
"max":128,
3159+
"min":1
3160+
},
3161+
"TagKeyList":{
3162+
"type":"list",
3163+
"member":{"shape":"TagKey"},
3164+
"max":200,
3165+
"min":1
3166+
},
3167+
"TagMap":{
3168+
"type":"map",
3169+
"key":{"shape":"TagKey"},
3170+
"value":{"shape":"TagValue"},
3171+
"max":200,
3172+
"min":0
3173+
},
3174+
"TagResourceInput":{
3175+
"type":"structure",
3176+
"required":[
3177+
"resourceArn",
3178+
"tags"
3179+
],
3180+
"members":{
3181+
"resourceArn":{
3182+
"shape":"AmazonResourceName",
3183+
"documentation":"<p>The ARN of the resource that you're adding tags to.</p>"
3184+
},
3185+
"tags":{
3186+
"shape":"TagMap",
3187+
"documentation":"<p>The list of key-value pairs to associate with the resource.</p>"
3188+
}
3189+
}
3190+
},
3191+
"TagResourceOutput":{
3192+
"type":"structure",
3193+
"members":{
3194+
}
3195+
},
3196+
"TagValue":{
3197+
"type":"string",
3198+
"max":256,
3199+
"min":0
3200+
},
30563201
"TemplateLinkedPolicyDefinition":{
30573202
"type":"structure",
30583203
"required":["policyTemplateId"],
@@ -3139,6 +3284,37 @@
31393284
"pattern":"[A-Za-z0-9-_=]+.[A-Za-z0-9-_=]+.[A-Za-z0-9-_=]+",
31403285
"sensitive":true
31413286
},
3287+
"TooManyTagsException":{
3288+
"type":"structure",
3289+
"members":{
3290+
"message":{"shape":"String"},
3291+
"resourceName":{"shape":"AmazonResourceName"}
3292+
},
3293+
"documentation":"<p>No more tags be added because the limit (50) has been reached. To add new tags, use <code>UntagResource</code> to remove existing tags.</p>",
3294+
"exception":true
3295+
},
3296+
"UntagResourceInput":{
3297+
"type":"structure",
3298+
"required":[
3299+
"resourceArn",
3300+
"tagKeys"
3301+
],
3302+
"members":{
3303+
"resourceArn":{
3304+
"shape":"AmazonResourceName",
3305+
"documentation":"<p>The ARN of the resource from which you are removing tags.</p>"
3306+
},
3307+
"tagKeys":{
3308+
"shape":"TagKeyList",
3309+
"documentation":"<p>The list of tag keys to remove from the resource.</p>"
3310+
}
3311+
}
3312+
},
3313+
"UntagResourceOutput":{
3314+
"type":"structure",
3315+
"members":{
3316+
}
3317+
},
31423318
"UpdateCognitoGroupConfiguration":{
31433319
"type":"structure",
31443320
"required":["groupEntityType"],

0 commit comments

Comments
 (0)