feat(client-ssm): This release adds support for cross account access in CreateOpsItem, UpdateOpsItem and GetOpsItem. It introduces new APIs to setup resource policies for SSM resources: PutResourcePolicy, GetResourcePolicies and DeleteResourcePolicy.

Author: awstools

clients/client-ssm/src/SSM.ts

@@ -116,6 +116,11 @@ import {
   DeleteResourceDataSyncCommandInput,
   DeleteResourceDataSyncCommandOutput,
 } from "./commands/DeleteResourceDataSyncCommand";
+import {
+  DeleteResourcePolicyCommand,
+  DeleteResourcePolicyCommandInput,
+  DeleteResourcePolicyCommandOutput,
+} from "./commands/DeleteResourcePolicyCommand";
 import {
   DeregisterManagedInstanceCommand,
   DeregisterManagedInstanceCommandInput,
@@ -408,6 +413,11 @@ import {
   GetPatchBaselineForPatchGroupCommandInput,
   GetPatchBaselineForPatchGroupCommandOutput,
 } from "./commands/GetPatchBaselineForPatchGroupCommand";
+import {
+  GetResourcePoliciesCommand,
+  GetResourcePoliciesCommandInput,
+  GetResourcePoliciesCommandOutput,
+} from "./commands/GetResourcePoliciesCommand";
 import {
   GetServiceSettingCommand,
   GetServiceSettingCommandInput,
@@ -518,6 +528,11 @@ import {
   PutParameterCommandInput,
   PutParameterCommandOutput,
 } from "./commands/PutParameterCommand";
+import {
+  PutResourcePolicyCommand,
+  PutResourcePolicyCommandInput,
+  PutResourcePolicyCommandOutput,
+} from "./commands/PutResourcePolicyCommand";
 import {
   RegisterDefaultPatchBaselineCommand,
   RegisterDefaultPatchBaselineCommandInput,
@@ -1564,6 +1579,41 @@ export class SSM extends SSMClient {
     }
   }
 
+  /**
+   * <p>Deletes a Systems Manager resource policy. A resource policy helps you to define the IAM entity (for example, an Amazon Web Services account) that can manage your Systems Manager resources. Currently,
+   *     <code>OpsItemGroup</code> is the only resource that supports Systems Manager resource policies. The
+   *    resource policy for <code>OpsItemGroup</code> enables Amazon Web Services accounts to view and interact with
+   *    OpsCenter operational work items (OpsItems).</p>
+   */
+  public deleteResourcePolicy(
+    args: DeleteResourcePolicyCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<DeleteResourcePolicyCommandOutput>;
+  public deleteResourcePolicy(
+    args: DeleteResourcePolicyCommandInput,
+    cb: (err: any, data?: DeleteResourcePolicyCommandOutput) => void
+  ): void;
+  public deleteResourcePolicy(
+    args: DeleteResourcePolicyCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: DeleteResourcePolicyCommandOutput) => void
+  ): void;
+  public deleteResourcePolicy(
+    args: DeleteResourcePolicyCommandInput,
+    optionsOrCb?: __HttpHandlerOptions | ((err: any, data?: DeleteResourcePolicyCommandOutput) => void),
+    cb?: (err: any, data?: DeleteResourcePolicyCommandOutput) => void
+  ): Promise<DeleteResourcePolicyCommandOutput> | void {
+    const command = new DeleteResourcePolicyCommand(args);
+    if (typeof optionsOrCb === "function") {
+      this.send(command, optionsOrCb);
+    } else if (typeof cb === "function") {
+      if (typeof optionsOrCb !== "object") throw new Error(`Expect http options but get ${typeof optionsOrCb}`);
+      this.send(command, optionsOrCb || {}, cb);
+    } else {
+      return this.send(command, optionsOrCb);
+    }
+  }
+
   /**
    * <p>Removes the server or virtual machine from the list of registered servers. You can
    *    reregister the node again at any time. If you don't plan to use Run Command on the server, we
@@ -3660,6 +3710,38 @@ export class SSM extends SSMClient {
     }
   }
 
+  /**
+   * <p>Returns an array of the <code>Policy</code> object.</p>
+   */
+  public getResourcePolicies(
+    args: GetResourcePoliciesCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<GetResourcePoliciesCommandOutput>;
+  public getResourcePolicies(
+    args: GetResourcePoliciesCommandInput,
+    cb: (err: any, data?: GetResourcePoliciesCommandOutput) => void
+  ): void;
+  public getResourcePolicies(
+    args: GetResourcePoliciesCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: GetResourcePoliciesCommandOutput) => void
+  ): void;
+  public getResourcePolicies(
+    args: GetResourcePoliciesCommandInput,
+    optionsOrCb?: __HttpHandlerOptions | ((err: any, data?: GetResourcePoliciesCommandOutput) => void),
+    cb?: (err: any, data?: GetResourcePoliciesCommandOutput) => void
+  ): Promise<GetResourcePoliciesCommandOutput> | void {
+    const command = new GetResourcePoliciesCommand(args);
+    if (typeof optionsOrCb === "function") {
+      this.send(command, optionsOrCb);
+    } else if (typeof cb === "function") {
+      if (typeof optionsOrCb !== "object") throw new Error(`Expect http options but get ${typeof optionsOrCb}`);
+      this.send(command, optionsOrCb || {}, cb);
+    } else {
+      return this.send(command, optionsOrCb);
+    }
+  }
+
   /**
    * <p>
    *             <code>ServiceSetting</code> is an account-level setting for an Amazon Web Services service. This setting
@@ -4489,6 +4571,42 @@ export class SSM extends SSMClient {
     }
   }
 
+  /**
+   * <p>Creates or updates a Systems Manager resource policy. A resource policy helps you to define the
+   *     IAM entity (for example, an Amazon Web Services account) that can manage your Systems Manager resources.
+   *    Currently, <code>OpsItemGroup</code> is the only resource that supports Systems Manager resource policies.
+   *    The resource policy for <code>OpsItemGroup</code> enables Amazon Web Services accounts to view and interact
+   *    with OpsCenter operational work items (OpsItems).</p>
+   */
+  public putResourcePolicy(
+    args: PutResourcePolicyCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<PutResourcePolicyCommandOutput>;
+  public putResourcePolicy(
+    args: PutResourcePolicyCommandInput,
+    cb: (err: any, data?: PutResourcePolicyCommandOutput) => void
+  ): void;
+  public putResourcePolicy(
+    args: PutResourcePolicyCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: PutResourcePolicyCommandOutput) => void
+  ): void;
+  public putResourcePolicy(
+    args: PutResourcePolicyCommandInput,
+    optionsOrCb?: __HttpHandlerOptions | ((err: any, data?: PutResourcePolicyCommandOutput) => void),
+    cb?: (err: any, data?: PutResourcePolicyCommandOutput) => void
+  ): Promise<PutResourcePolicyCommandOutput> | void {
+    const command = new PutResourcePolicyCommand(args);
+    if (typeof optionsOrCb === "function") {
+      this.send(command, optionsOrCb);
+    } else if (typeof cb === "function") {
+      if (typeof optionsOrCb !== "object") throw new Error(`Expect http options but get ${typeof optionsOrCb}`);
+      this.send(command, optionsOrCb || {}, cb);
+    } else {
+      return this.send(command, optionsOrCb);
+    }
+  }
+
   /**
    * <p>Defines the default patch baseline for the relevant operating system.</p>
    *          <p>To reset the Amazon Web Services-predefined patch baseline as the default, specify the full patch baseline

clients/client-ssm/src/SSMClient.ts

@@ -97,6 +97,10 @@ import {
   DeleteResourceDataSyncCommandInput,
   DeleteResourceDataSyncCommandOutput,
 } from "./commands/DeleteResourceDataSyncCommand";
+import {
+  DeleteResourcePolicyCommandInput,
+  DeleteResourcePolicyCommandOutput,
+} from "./commands/DeleteResourcePolicyCommand";
 import {
   DeregisterManagedInstanceCommandInput,
   DeregisterManagedInstanceCommandOutput,
@@ -295,6 +299,10 @@ import {
   GetPatchBaselineForPatchGroupCommandInput,
   GetPatchBaselineForPatchGroupCommandOutput,
 } from "./commands/GetPatchBaselineForPatchGroupCommand";
+import {
+  GetResourcePoliciesCommandInput,
+  GetResourcePoliciesCommandOutput,
+} from "./commands/GetResourcePoliciesCommand";
 import { GetServiceSettingCommandInput, GetServiceSettingCommandOutput } from "./commands/GetServiceSettingCommand";
 import {
   LabelParameterVersionCommandInput,
@@ -356,6 +364,7 @@ import {
 import { PutComplianceItemsCommandInput, PutComplianceItemsCommandOutput } from "./commands/PutComplianceItemsCommand";
 import { PutInventoryCommandInput, PutInventoryCommandOutput } from "./commands/PutInventoryCommand";
 import { PutParameterCommandInput, PutParameterCommandOutput } from "./commands/PutParameterCommand";
+import { PutResourcePolicyCommandInput, PutResourcePolicyCommandOutput } from "./commands/PutResourcePolicyCommand";
 import {
   RegisterDefaultPatchBaselineCommandInput,
   RegisterDefaultPatchBaselineCommandOutput,
@@ -484,6 +493,7 @@ export type ServiceInputTypes =
   | DeleteParametersCommandInput
   | DeletePatchBaselineCommandInput
   | DeleteResourceDataSyncCommandInput
+  | DeleteResourcePolicyCommandInput
   | DeregisterManagedInstanceCommandInput
   | DeregisterPatchBaselineForPatchGroupCommandInput
   | DeregisterTargetFromMaintenanceWindowCommandInput
@@ -544,6 +554,7 @@ export type ServiceInputTypes =
   | GetParametersCommandInput
   | GetPatchBaselineCommandInput
   | GetPatchBaselineForPatchGroupCommandInput
+  | GetResourcePoliciesCommandInput
   | GetServiceSettingCommandInput
   | LabelParameterVersionCommandInput
   | ListAssociationVersionsCommandInput
@@ -566,6 +577,7 @@ export type ServiceInputTypes =
   | PutComplianceItemsCommandInput
   | PutInventoryCommandInput
   | PutParameterCommandInput
+  | PutResourcePolicyCommandInput
   | RegisterDefaultPatchBaselineCommandInput
   | RegisterPatchBaselineForPatchGroupCommandInput
   | RegisterTargetWithMaintenanceWindowCommandInput
@@ -621,6 +633,7 @@ export type ServiceOutputTypes =
   | DeleteParametersCommandOutput
   | DeletePatchBaselineCommandOutput
   | DeleteResourceDataSyncCommandOutput
+  | DeleteResourcePolicyCommandOutput
   | DeregisterManagedInstanceCommandOutput
   | DeregisterPatchBaselineForPatchGroupCommandOutput
   | DeregisterTargetFromMaintenanceWindowCommandOutput
@@ -681,6 +694,7 @@ export type ServiceOutputTypes =
   | GetParametersCommandOutput
   | GetPatchBaselineCommandOutput
   | GetPatchBaselineForPatchGroupCommandOutput
+  | GetResourcePoliciesCommandOutput
   | GetServiceSettingCommandOutput
   | LabelParameterVersionCommandOutput
   | ListAssociationVersionsCommandOutput
@@ -703,6 +717,7 @@ export type ServiceOutputTypes =
   | PutComplianceItemsCommandOutput
   | PutInventoryCommandOutput
   | PutParameterCommandOutput
+  | PutResourcePolicyCommandOutput
   | RegisterDefaultPatchBaselineCommandOutput
   | RegisterPatchBaselineForPatchGroupCommandOutput
   | RegisterTargetWithMaintenanceWindowCommandOutput

clients/client-ssm/src/commands/DeleteResourcePolicyCommand.ts

@@ -0,0 +1,117 @@
+// smithy-typescript generated code
+import { EndpointParameterInstructions, getEndpointPlugin } from "@aws-sdk/middleware-endpoint";
+import { getSerdePlugin } from "@aws-sdk/middleware-serde";
+import { HttpRequest as __HttpRequest, HttpResponse as __HttpResponse } from "@aws-sdk/protocol-http";
+import { Command as $Command } from "@aws-sdk/smithy-client";
+import {
+  FinalizeHandlerArguments,
+  Handler,
+  HandlerExecutionContext,
+  HttpHandlerOptions as __HttpHandlerOptions,
+  MetadataBearer as __MetadataBearer,
+  MiddlewareStack,
+  SerdeContext as __SerdeContext,
+} from "@aws-sdk/types";
+
+import {
+  DeleteResourcePolicyRequest,
+  DeleteResourcePolicyRequestFilterSensitiveLog,
+  DeleteResourcePolicyResponse,
+  DeleteResourcePolicyResponseFilterSensitiveLog,
+} from "../models/models_0";
+import {
+  deserializeAws_json1_1DeleteResourcePolicyCommand,
+  serializeAws_json1_1DeleteResourcePolicyCommand,
+} from "../protocols/Aws_json1_1";
+import { ServiceInputTypes, ServiceOutputTypes, SSMClientResolvedConfig } from "../SSMClient";
+
+export interface DeleteResourcePolicyCommandInput extends DeleteResourcePolicyRequest {}
+export interface DeleteResourcePolicyCommandOutput extends DeleteResourcePolicyResponse, __MetadataBearer {}
+
+/**
+ * <p>Deletes a Systems Manager resource policy. A resource policy helps you to define the IAM entity (for example, an Amazon Web Services account) that can manage your Systems Manager resources. Currently,
+ *     <code>OpsItemGroup</code> is the only resource that supports Systems Manager resource policies. The
+ *    resource policy for <code>OpsItemGroup</code> enables Amazon Web Services accounts to view and interact with
+ *    OpsCenter operational work items (OpsItems).</p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { SSMClient, DeleteResourcePolicyCommand } from "@aws-sdk/client-ssm"; // ES Modules import
+ * // const { SSMClient, DeleteResourcePolicyCommand } = require("@aws-sdk/client-ssm"); // CommonJS import
+ * const client = new SSMClient(config);
+ * const command = new DeleteResourcePolicyCommand(input);
+ * const response = await client.send(command);
+ * ```
+ *
+ * @see {@link DeleteResourcePolicyCommandInput} for command's `input` shape.
+ * @see {@link DeleteResourcePolicyCommandOutput} for command's `response` shape.
+ * @see {@link SSMClientResolvedConfig | config} for SSMClient's `config` shape.
+ *
+ */
+export class DeleteResourcePolicyCommand extends $Command<
+  DeleteResourcePolicyCommandInput,
+  DeleteResourcePolicyCommandOutput,
+  SSMClientResolvedConfig
+> {
+  // Start section: command_properties
+  // End section: command_properties
+
+  public static getEndpointParameterInstructions(): EndpointParameterInstructions {
+    return {
+      UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
+      Endpoint: { type: "builtInParams", name: "endpoint" },
+      Region: { type: "builtInParams", name: "region" },
+      UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
+    };
+  }
+
+  constructor(readonly input: DeleteResourcePolicyCommandInput) {
+    // Start section: command_constructor
+    super();
+    // End section: command_constructor
+  }
+
+  /**
+   * @internal
+   */
+  resolveMiddleware(
+    clientStack: MiddlewareStack<ServiceInputTypes, ServiceOutputTypes>,
+    configuration: SSMClientResolvedConfig,
+    options?: __HttpHandlerOptions
+  ): Handler<DeleteResourcePolicyCommandInput, DeleteResourcePolicyCommandOutput> {
+    this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize));
+    this.middlewareStack.use(
+      getEndpointPlugin(configuration, DeleteResourcePolicyCommand.getEndpointParameterInstructions())
+    );
+
+    const stack = clientStack.concat(this.middlewareStack);
+
+    const { logger } = configuration;
+    const clientName = "SSMClient";
+    const commandName = "DeleteResourcePolicyCommand";
+    const handlerExecutionContext: HandlerExecutionContext = {
+      logger,
+      clientName,
+      commandName,
+      inputFilterSensitiveLog: DeleteResourcePolicyRequestFilterSensitiveLog,
+      outputFilterSensitiveLog: DeleteResourcePolicyResponseFilterSensitiveLog,
+    };
+    const { requestHandler } = configuration;
+    return stack.resolve(
+      (request: FinalizeHandlerArguments<any>) =>
+        requestHandler.handle(request.request as __HttpRequest, options || {}),
+      handlerExecutionContext
+    );
+  }
+
+  private serialize(input: DeleteResourcePolicyCommandInput, context: __SerdeContext): Promise<__HttpRequest> {
+    return serializeAws_json1_1DeleteResourcePolicyCommand(input, context);
+  }
+
+  private deserialize(output: __HttpResponse, context: __SerdeContext): Promise<DeleteResourcePolicyCommandOutput> {
+    return deserializeAws_json1_1DeleteResourcePolicyCommand(output, context);
+  }
+
+  // Start section: command_body_extra
+  // End section: command_body_extra
+}

clients/client-ssm/src/commands/DescribeOpsItemsCommand.ts

@@ -18,7 +18,7 @@ import {
   DescribeOpsItemsRequestFilterSensitiveLog,
   DescribeOpsItemsResponse,
   DescribeOpsItemsResponseFilterSensitiveLog,
-} from "../models/models_0";
+} from "../models/models_1";
 import {
   deserializeAws_json1_1DescribeOpsItemsCommand,
   serializeAws_json1_1DescribeOpsItemsCommand,