Skip to content

Commit 3de63f6

Browse files
waleedlatif1claude
waleedlatif1
and
claude
committed
fix(identity-center): resolve Organizations partition and add audit tools
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LJV2dCcAYvf1JuxquCMZAd
1 parent 8c2f206 commit 3de63f6

46 files changed

Lines changed: 2005 additions & 275 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎apps/docs/content/docs/integrations/identity_center.mdx‎

Lines changed: 150 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,14 @@ List all AWS IAM Identity Center instances in your account
5353

5454
| Parameter | Type | Description |
5555
| --------- | ---- | ----------- |
56-
| `instances` | json | List of Identity Center instances with instanceArn, identityStoreId, name, status, statusReason |
56+
| `instances` | array | Identity Center instances in the region |
57+
| ↳ `instanceArn` | string | ARN of the Identity Center instance |
58+
| ↳ `identityStoreId` | string | Identity Store ID backing the instance |
59+
| ↳ `name` | string | Instance name |
60+
| ↳ `status` | string | Instance status |
61+
| ↳ `statusReason` | string | Explanation when the instance is not ACTIVE |
62+
| ↳ `ownerAccountId` | string | AWS account that owns the instance |
63+
| ↳ `createdDate` | string | ISO 8601 date the instance was created |
5764
| `nextToken` | string | Pagination token for the next page of results |
5865
| `count` | number | Number of instances returned |
5966

@@ -68,14 +75,20 @@ List all AWS accounts in your organization
6875
| `region` | string | Yes | AWS region \(e.g., us-east-1\) |
6976
| `accessKeyId` | string | Yes | AWS access key ID |
7077
| `secretAccessKey` | string | Yes | AWS secret access key |
71-
| `maxResults` | number | No | Maximum number of accounts to return |
78+
| `maxResults` | number | No | Maximum number of accounts to return \(1-20; the AWS Organizations ceiling\) |
7279
| `nextToken` | string | No | Pagination token from a previous request |
7380

7481
#### Output
7582

7683
| Parameter | Type | Description |
7784
| --------- | ---- | ----------- |
78-
| `accounts` | json | List of AWS accounts with id, arn, name, email, status |
85+
| `accounts` | array | Accounts in the AWS organization |
86+
| ↳ `id` | string | AWS account ID |
87+
| ↳ `arn` | string | AWS account ARN |
88+
| ↳ `name` | string | Account name |
89+
| ↳ `email` | string | Root email address of the account |
90+
| ↳ `status` | string | Account status \(e.g., ACTIVE, SUSPENDED\) |
91+
| ↳ `joinedTimestamp` | string | ISO 8601 date the account joined the organization |
7992
| `nextToken` | string | Pagination token for the next page of results |
8093
| `count` | number | Number of accounts returned |
8194

@@ -115,14 +128,19 @@ List all permission sets defined in an IAM Identity Center instance
115128
| `accessKeyId` | string | Yes | AWS access key ID |
116129
| `secretAccessKey` | string | Yes | AWS secret access key |
117130
| `instanceArn` | string | Yes | ARN of the Identity Center instance |
118-
| `maxResults` | number | No | Maximum number of permission sets to return |
131+
| `maxResults` | number | No | Maximum number of permission sets to return \(1-100\) |
119132
| `nextToken` | string | No | Pagination token from a previous request |
120133

121134
#### Output
122135

123136
| Parameter | Type | Description |
124137
| --------- | ---- | ----------- |
125-
| `permissionSets` | json | List of permission sets with permissionSetArn, name, description, sessionDuration |
138+
| `permissionSets` | array | Permission sets defined on the instance |
139+
| ↳ `permissionSetArn` | string | ARN of the permission set |
140+
| ↳ `name` | string | Permission set name |
141+
| ↳ `description` | string | Permission set description |
142+
| ↳ `sessionDuration` | string | ISO 8601 session duration \(e.g., PT1H\) |
143+
| ↳ `createdDate` | string | ISO 8601 date the permission set was created |
126144
| `nextToken` | string | Pagination token for the next page of results |
127145
| `count` | number | Number of permission sets returned |
128146

@@ -149,6 +167,34 @@ Look up a user in the Identity Store by email address
149167
| `displayName` | string | Display name of the user |
150168
| `email` | string | Email address of the user |
151169

170+
### Identity Center Describe User
171+
172+
Resolve an Identity Store user ID to the user behind it. Use to turn the principalId on an account assignment into a name and email.
173+
174+
#### Input
175+
176+
| Parameter | Type | Required | Description |
177+
| --------- | ---- | -------- | ----------- |
178+
| `region` | string | Yes | AWS region \(e.g., us-east-1\) |
179+
| `accessKeyId` | string | Yes | AWS access key ID |
180+
| `secretAccessKey` | string | Yes | AWS secret access key |
181+
| `identityStoreId` | string | Yes | Identity Store ID \(e.g., d-1234567890\) |
182+
| `userId` | string | Yes | Identity Store user ID, such as the principalId on a USER account assignment |
183+
184+
#### Output
185+
186+
| Parameter | Type | Description |
187+
| --------- | ---- | ----------- |
188+
| `userId` | string | Identity Store user ID |
189+
| `userName` | string | Username in the Identity Store |
190+
| `displayName` | string | Display name of the user |
191+
| `email` | string | Primary email address |
192+
| `userStatus` | string | Account status: ENABLED or DISABLED |
193+
| `title` | string | Job title |
194+
| `externalIds` | array | External identity provider IDs linked to the user |
195+
| ↳ `issuer` | string | Identity provider that issued the ID |
196+
| ↳ `id` | string | Identifier at the issuer |
197+
152198
### Identity Center Get Group
153199

154200
Look up a group in the Identity Store by display name
@@ -171,6 +217,31 @@ Look up a group in the Identity Store by display name
171217
| `displayName` | string | Display name of the group |
172218
| `description` | string | Group description |
173219

220+
### Identity Center Describe Group
221+
222+
Resolve an Identity Store group ID to the group behind it. Use to turn the principalId on an account assignment into a group name.
223+
224+
#### Input
225+
226+
| Parameter | Type | Required | Description |
227+
| --------- | ---- | -------- | ----------- |
228+
| `region` | string | Yes | AWS region \(e.g., us-east-1\) |
229+
| `accessKeyId` | string | Yes | AWS access key ID |
230+
| `secretAccessKey` | string | Yes | AWS secret access key |
231+
| `identityStoreId` | string | Yes | Identity Store ID \(e.g., d-1234567890\) |
232+
| `groupId` | string | Yes | Identity Store group ID, such as the principalId on a GROUP account assignment |
233+
234+
#### Output
235+
236+
| Parameter | Type | Description |
237+
| --------- | ---- | ----------- |
238+
| `groupId` | string | Identity Store group ID |
239+
| `displayName` | string | Display name of the group |
240+
| `description` | string | Group description |
241+
| `externalIds` | array | External identity provider IDs linked to the group |
242+
| ↳ `issuer` | string | Identity provider that issued the ID |
243+
| ↳ `id` | string | Identifier at the issuer |
244+
174245
### Identity Center List Groups
175246

176247
List all groups in the Identity Store
@@ -183,17 +254,50 @@ List all groups in the Identity Store
183254
| `accessKeyId` | string | Yes | AWS access key ID |
184255
| `secretAccessKey` | string | Yes | AWS secret access key |
185256
| `identityStoreId` | string | Yes | Identity Store ID \(from the Identity Center instance\) |
186-
| `maxResults` | number | No | Maximum number of groups to return |
257+
| `maxResults` | number | No | Maximum number of groups to return \(1-100\) |
187258
| `nextToken` | string | No | Pagination token from a previous request |
188259

189260
#### Output
190261

191262
| Parameter | Type | Description |
192263
| --------- | ---- | ----------- |
193-
| `groups` | json | List of groups with groupId, displayName, description |
264+
| `groups` | array | Groups in the Identity Store |
265+
| ↳ `groupId` | string | Identity Store group ID \(use as principalId\) |
266+
| ↳ `displayName` | string | Group display name |
267+
| ↳ `description` | string | Group description |
268+
| ↳ `externalIds` | array | External identity provider IDs linked to the group |
269+
| ↳ `issuer` | string | Identity provider that issued the ID |
270+
| ↳ `id` | string | Identifier at the issuer |
194271
| `nextToken` | string | Pagination token for the next page of results |
195272
| `count` | number | Number of groups returned |
196273

274+
### Identity Center List Group Memberships
275+
276+
List the users who belong to an Identity Store group
277+
278+
#### Input
279+
280+
| Parameter | Type | Required | Description |
281+
| --------- | ---- | -------- | ----------- |
282+
| `region` | string | Yes | AWS region \(e.g., us-east-1\) |
283+
| `accessKeyId` | string | Yes | AWS access key ID |
284+
| `secretAccessKey` | string | Yes | AWS secret access key |
285+
| `identityStoreId` | string | Yes | Identity Store ID \(e.g., d-1234567890\) |
286+
| `groupId` | string | Yes | Identity Store group ID whose members to list |
287+
| `maxResults` | number | No | Maximum number of memberships to return \(1-100\) |
288+
| `nextToken` | string | No | Pagination token from a previous request |
289+
290+
#### Output
291+
292+
| Parameter | Type | Description |
293+
| --------- | ---- | ----------- |
294+
| `memberships` | array | Members of the group |
295+
| ↳ `membershipId` | string | Identity Store membership ID |
296+
| ↳ `groupId` | string | Identity Store group ID |
297+
| ↳ `userId` | string | Identity Store user ID of the member — resolve with Describe User. Null when the member is not a user. |
298+
| `nextToken` | string | Pagination token for the next page of results |
299+
| `count` | number | Number of memberships returned |
300+
197301
### Identity Center Create Account Assignment
198302

199303
Grant a user or group access to an AWS account via a permission set (temporary elevated access)
@@ -248,7 +352,7 @@ Revoke a user or group access to an AWS account by removing a permission set ass
248352
| --------- | ---- | ----------- |
249353
| `message` | string | Status message |
250354
| `status` | string | Deprovisioning status: IN_PROGRESS, FAILED, or SUCCEEDED |
251-
| `requestId` | string | Request ID to use with Check Assignment Status |
355+
| `requestId` | string | Request ID to use with Check Assignment Deletion Status |
252356
| `accountId` | string | Target AWS account ID |
253357
| `permissionSetArn` | string | Permission set ARN |
254358
| `principalType` | string | Principal type \(USER or GROUP\) |
@@ -268,7 +372,7 @@ Check the provisioning status of an account assignment creation request
268372
| `accessKeyId` | string | Yes | AWS access key ID |
269373
| `secretAccessKey` | string | Yes | AWS secret access key |
270374
| `instanceArn` | string | Yes | ARN of the Identity Center instance |
271-
| `requestId` | string | Yes | Request ID returned from Create or Delete Account Assignment |
375+
| `requestId` | string | Yes | Request ID returned from Create Account Assignment. Deletion request IDs are not accepted — use Check Assignment Deletion Status for those. |
272376

273377
#### Output
274378

@@ -312,9 +416,9 @@ Check the deprovisioning status of an account assignment deletion request
312416
| `failureReason` | string | Reason for failure if status is FAILED |
313417
| `createdDate` | string | Date the request was created |
314418

315-
### Identity Center List Account Assignments
419+
### Identity Center List Account Assignments For Principal
316420

317-
List all account assignments for a specific user or group across all accounts
421+
List every account and permission set a specific user or group is assigned. Use List Assignments For Account to go the other way, from an account to its principals.
318422

319423
#### Input
320424

@@ -326,14 +430,47 @@ List all account assignments for a specific user or group across all accounts
326430
| `instanceArn` | string | Yes | ARN of the Identity Center instance |
327431
| `principalId` | string | Yes | Identity Store ID of the user or group |
328432
| `principalType` | string | Yes | Type of principal: USER or GROUP |
329-
| `maxResults` | number | No | Maximum number of assignments to return |
433+
| `maxResults` | number | No | Maximum number of assignments to return \(1-100\) |
434+
| `nextToken` | string | No | Pagination token from a previous request |
435+
436+
#### Output
437+
438+
| Parameter | Type | Description |
439+
| --------- | ---- | ----------- |
440+
| `assignments` | array | Accounts and permission sets the principal is assigned |
441+
| ↳ `accountId` | string | AWS account ID |
442+
| ↳ `permissionSetArn` | string | Permission set ARN |
443+
| ↳ `principalType` | string | Principal type \(USER or GROUP\) |
444+
| ↳ `principalId` | string | Identity Store user or group ID |
445+
| `nextToken` | string | Pagination token for the next page of results |
446+
| `count` | number | Number of assignments returned |
447+
448+
### Identity Center List Assignments For Account
449+
450+
List every principal assigned a specific permission set on a specific AWS account. Use for per-account access reviews.
451+
452+
#### Input
453+
454+
| Parameter | Type | Required | Description |
455+
| --------- | ---- | -------- | ----------- |
456+
| `region` | string | Yes | AWS region \(e.g., us-east-1\) |
457+
| `accessKeyId` | string | Yes | AWS access key ID |
458+
| `secretAccessKey` | string | Yes | AWS secret access key |
459+
| `instanceArn` | string | Yes | ARN of the Identity Center instance |
460+
| `accountId` | string | Yes | AWS account ID to list assignments for \(12 digits\) |
461+
| `permissionSetArn` | string | Yes | ARN of the permission set to list assignments for |
462+
| `maxResults` | number | No | Maximum number of assignments to return \(1-100\) |
330463
| `nextToken` | string | No | Pagination token from a previous request |
331464

332465
#### Output
333466

334467
| Parameter | Type | Description |
335468
| --------- | ---- | ----------- |
336-
| `assignments` | json | List of account assignments with accountId, permissionSetArn, principalType, principalId |
469+
| `assignments` | array | Principals assigned this permission set on the account |
470+
| ↳ `accountId` | string | AWS account ID |
471+
| ↳ `permissionSetArn` | string | Permission set ARN |
472+
| ↳ `principalType` | string | Principal type \(USER or GROUP\) |
473+
| ↳ `principalId` | string | Identity Store user or group ID — resolve with Describe User or Describe Group |
337474
| `nextToken` | string | Pagination token for the next page of results |
338475
| `count` | number | Number of assignments returned |
339476

0 commit comments

Comments
 (0)