feat(client-sso-admin): AWS SSO now supports attaching customer managed policies and a permissions boundary to your permission sets. This release adds new API operations to manage and view the customer managed policies and the permissions boundary for a given permission set.

Author: awstools

clients/client-sso-admin/README.md

@@ -9,14 +9,7 @@
 
 AWS SDK for JavaScript SSOAdmin Client for Node.js, Browser and React Native.
 
-<p>Amazon Web Services Single Sign On (SSO) is a cloud SSO service that makes it easy to centrally manage SSO
-access to multiple Amazon Web Services accounts and business applications. This guide provides information on
-SSO operations which could be used for access management of Amazon Web Services accounts. For information about
-Amazon Web Services SSO features, see the <a href="https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html">Amazon Web Services Single Sign-On User Guide</a>.</p>
-<p>Many operations in the SSO APIs rely on identifiers for users and groups, known as
-principals. For more information about how to work with principals and principal IDs in Amazon Web Services SSO,
-see the <a href="https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/welcome.html">Amazon Web Services SSO Identity Store API
-Reference</a>.</p>
+<p></p>
 
 ## Installing
 
@@ -33,16 +26,19 @@ using your favorite package manager:
 
 The AWS SDK is modulized by clients and commands.
 To send a request, you only need to import the `SSOAdminClient` and
-the commands you need, for example `AttachManagedPolicyToPermissionSetCommand`:
+the commands you need, for example `AttachCustomerManagedPolicyReferenceToPermissionSetCommand`:
 
 ```js
 // ES5 example
-const { SSOAdminClient, AttachManagedPolicyToPermissionSetCommand } = require("@aws-sdk/client-sso-admin");
+const {
+  SSOAdminClient,
+  AttachCustomerManagedPolicyReferenceToPermissionSetCommand,
+} = require("@aws-sdk/client-sso-admin");
 ```
 
 ```ts
 // ES6+ example
-import { SSOAdminClient, AttachManagedPolicyToPermissionSetCommand } from "@aws-sdk/client-sso-admin";
+import { SSOAdminClient, AttachCustomerManagedPolicyReferenceToPermissionSetCommand } from "@aws-sdk/client-sso-admin";
 ```
 
 ### Usage
@@ -61,7 +57,7 @@ const client = new SSOAdminClient({ region: "REGION" });
 const params = {
   /** input parameters */
 };
-const command = new AttachManagedPolicyToPermissionSetCommand(params);
+const command = new AttachCustomerManagedPolicyReferenceToPermissionSetCommand(params);
 ```
 
 #### Async/await
@@ -140,15 +136,15 @@ const client = new AWS.SSOAdmin({ region: "REGION" });
 
 // async/await.
 try {
-  const data = await client.attachManagedPolicyToPermissionSet(params);
+  const data = await client.attachCustomerManagedPolicyReferenceToPermissionSet(params);
   // process data.
 } catch (error) {
   // error handling.
 }
 
 // Promises.
 client
-  .attachManagedPolicyToPermissionSet(params)
+  .attachCustomerManagedPolicyReferenceToPermissionSet(params)
   .then((data) => {
     // process data.
   })
@@ -157,7 +153,7 @@ client
   });
 
 // callbacks.
-client.attachManagedPolicyToPermissionSet(params, (err, data) => {
+client.attachCustomerManagedPolicyReferenceToPermissionSet(params, (err, data) => {
   // process err and data.
 });
 ```

clients/client-sso-admin/src/SSOAdmin.ts

@@ -53,6 +53,10 @@ import {
   UserAgent as __UserAgent,
 } from "@aws-sdk/types";
 
+import {
+  AttachCustomerManagedPolicyReferenceToPermissionSetCommandInput,
+  AttachCustomerManagedPolicyReferenceToPermissionSetCommandOutput,
+} from "./commands/AttachCustomerManagedPolicyReferenceToPermissionSetCommand";
 import {
   AttachManagedPolicyToPermissionSetCommandInput,
   AttachManagedPolicyToPermissionSetCommandOutput,
@@ -81,6 +85,10 @@ import {
   DeleteInstanceAccessControlAttributeConfigurationCommandInput,
   DeleteInstanceAccessControlAttributeConfigurationCommandOutput,
 } from "./commands/DeleteInstanceAccessControlAttributeConfigurationCommand";
+import {
+  DeletePermissionsBoundaryFromPermissionSetCommandInput,
+  DeletePermissionsBoundaryFromPermissionSetCommandOutput,
+} from "./commands/DeletePermissionsBoundaryFromPermissionSetCommand";
 import {
   DeletePermissionSetCommandInput,
   DeletePermissionSetCommandOutput,
@@ -105,6 +113,10 @@ import {
   DescribePermissionSetProvisioningStatusCommandInput,
   DescribePermissionSetProvisioningStatusCommandOutput,
 } from "./commands/DescribePermissionSetProvisioningStatusCommand";
+import {
+  DetachCustomerManagedPolicyReferenceFromPermissionSetCommandInput,
+  DetachCustomerManagedPolicyReferenceFromPermissionSetCommandOutput,
+} from "./commands/DetachCustomerManagedPolicyReferenceFromPermissionSetCommand";
 import {
   DetachManagedPolicyFromPermissionSetCommandInput,
   DetachManagedPolicyFromPermissionSetCommandOutput,
@@ -113,6 +125,10 @@ import {
   GetInlinePolicyForPermissionSetCommandInput,
   GetInlinePolicyForPermissionSetCommandOutput,
 } from "./commands/GetInlinePolicyForPermissionSetCommand";
+import {
+  GetPermissionsBoundaryForPermissionSetCommandInput,
+  GetPermissionsBoundaryForPermissionSetCommandOutput,
+} from "./commands/GetPermissionsBoundaryForPermissionSetCommand";
 import {
   ListAccountAssignmentCreationStatusCommandInput,
   ListAccountAssignmentCreationStatusCommandOutput,
@@ -129,6 +145,10 @@ import {
   ListAccountsForProvisionedPermissionSetCommandInput,
   ListAccountsForProvisionedPermissionSetCommandOutput,
 } from "./commands/ListAccountsForProvisionedPermissionSetCommand";
+import {
+  ListCustomerManagedPolicyReferencesInPermissionSetCommandInput,
+  ListCustomerManagedPolicyReferencesInPermissionSetCommandOutput,
+} from "./commands/ListCustomerManagedPolicyReferencesInPermissionSetCommand";
 import { ListInstancesCommandInput, ListInstancesCommandOutput } from "./commands/ListInstancesCommand";
 import {
   ListManagedPoliciesInPermissionSetCommandInput,
@@ -155,6 +175,10 @@ import {
   PutInlinePolicyToPermissionSetCommandInput,
   PutInlinePolicyToPermissionSetCommandOutput,
 } from "./commands/PutInlinePolicyToPermissionSetCommand";
+import {
+  PutPermissionsBoundaryToPermissionSetCommandInput,
+  PutPermissionsBoundaryToPermissionSetCommandOutput,
+} from "./commands/PutPermissionsBoundaryToPermissionSetCommand";
 import { TagResourceCommandInput, TagResourceCommandOutput } from "./commands/TagResourceCommand";
 import { UntagResourceCommandInput, UntagResourceCommandOutput } from "./commands/UntagResourceCommand";
 import {
@@ -168,6 +192,7 @@ import {
 import { getRuntimeConfig as __getRuntimeConfig } from "./runtimeConfig";
 
 export type ServiceInputTypes =
+  | AttachCustomerManagedPolicyReferenceToPermissionSetCommandInput
   | AttachManagedPolicyToPermissionSetCommandInput
   | CreateAccountAssignmentCommandInput
   | CreateInstanceAccessControlAttributeConfigurationCommandInput
@@ -176,17 +201,21 @@ export type ServiceInputTypes =
   | DeleteInlinePolicyFromPermissionSetCommandInput
   | DeleteInstanceAccessControlAttributeConfigurationCommandInput
   | DeletePermissionSetCommandInput
+  | DeletePermissionsBoundaryFromPermissionSetCommandInput
   | DescribeAccountAssignmentCreationStatusCommandInput
   | DescribeAccountAssignmentDeletionStatusCommandInput
   | DescribeInstanceAccessControlAttributeConfigurationCommandInput
   | DescribePermissionSetCommandInput
   | DescribePermissionSetProvisioningStatusCommandInput
+  | DetachCustomerManagedPolicyReferenceFromPermissionSetCommandInput
   | DetachManagedPolicyFromPermissionSetCommandInput
   | GetInlinePolicyForPermissionSetCommandInput
+  | GetPermissionsBoundaryForPermissionSetCommandInput
   | ListAccountAssignmentCreationStatusCommandInput
   | ListAccountAssignmentDeletionStatusCommandInput
   | ListAccountAssignmentsCommandInput
   | ListAccountsForProvisionedPermissionSetCommandInput
+  | ListCustomerManagedPolicyReferencesInPermissionSetCommandInput
   | ListInstancesCommandInput
   | ListManagedPoliciesInPermissionSetCommandInput
   | ListPermissionSetProvisioningStatusCommandInput
@@ -195,12 +224,14 @@ export type ServiceInputTypes =
   | ListTagsForResourceCommandInput
   | ProvisionPermissionSetCommandInput
   | PutInlinePolicyToPermissionSetCommandInput
+  | PutPermissionsBoundaryToPermissionSetCommandInput
   | TagResourceCommandInput
   | UntagResourceCommandInput
   | UpdateInstanceAccessControlAttributeConfigurationCommandInput
   | UpdatePermissionSetCommandInput;
 
 export type ServiceOutputTypes =
+  | AttachCustomerManagedPolicyReferenceToPermissionSetCommandOutput
   | AttachManagedPolicyToPermissionSetCommandOutput
   | CreateAccountAssignmentCommandOutput
   | CreateInstanceAccessControlAttributeConfigurationCommandOutput
@@ -209,17 +240,21 @@ export type ServiceOutputTypes =
   | DeleteInlinePolicyFromPermissionSetCommandOutput
   | DeleteInstanceAccessControlAttributeConfigurationCommandOutput
   | DeletePermissionSetCommandOutput
+  | DeletePermissionsBoundaryFromPermissionSetCommandOutput
   | DescribeAccountAssignmentCreationStatusCommandOutput
   | DescribeAccountAssignmentDeletionStatusCommandOutput
   | DescribeInstanceAccessControlAttributeConfigurationCommandOutput
   | DescribePermissionSetCommandOutput
   | DescribePermissionSetProvisioningStatusCommandOutput
+  | DetachCustomerManagedPolicyReferenceFromPermissionSetCommandOutput
   | DetachManagedPolicyFromPermissionSetCommandOutput
   | GetInlinePolicyForPermissionSetCommandOutput
+  | GetPermissionsBoundaryForPermissionSetCommandOutput
   | ListAccountAssignmentCreationStatusCommandOutput
   | ListAccountAssignmentDeletionStatusCommandOutput
   | ListAccountAssignmentsCommandOutput
   | ListAccountsForProvisionedPermissionSetCommandOutput
+  | ListCustomerManagedPolicyReferencesInPermissionSetCommandOutput
   | ListInstancesCommandOutput
   | ListManagedPoliciesInPermissionSetCommandOutput
   | ListPermissionSetProvisioningStatusCommandOutput
@@ -228,6 +263,7 @@ export type ServiceOutputTypes =
   | ListTagsForResourceCommandOutput
   | ProvisionPermissionSetCommandOutput
   | PutInlinePolicyToPermissionSetCommandOutput
+  | PutPermissionsBoundaryToPermissionSetCommandOutput
   | TagResourceCommandOutput
   | UntagResourceCommandOutput
   | UpdateInstanceAccessControlAttributeConfigurationCommandOutput
@@ -387,14 +423,7 @@ type SSOAdminClientResolvedConfigType = __SmithyResolvedConfiguration<__HttpHand
 export interface SSOAdminClientResolvedConfig extends SSOAdminClientResolvedConfigType {}
 
 /**
- * <p>Amazon Web Services Single Sign On (SSO) is a cloud SSO service that makes it easy to centrally manage SSO
- *       access to multiple Amazon Web Services accounts and business applications. This guide provides information on
- *       SSO operations which could be used for access management of Amazon Web Services accounts. For information about
- *       Amazon Web Services SSO features, see the <a href="https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html">Amazon Web Services Single Sign-On User Guide</a>.</p>
- *          <p>Many operations in the SSO APIs rely on identifiers for users and groups, known as
- *       principals. For more information about how to work with principals and principal IDs in Amazon Web Services SSO,
- *       see the <a href="https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/welcome.html">Amazon Web Services SSO Identity Store API
- *         Reference</a>.</p>
+ * <p></p>
  */
 export class SSOAdminClient extends __Client<
   __HttpHandlerOptions,

clients/client-sso-admin/src/SSOAdminClient.ts

@@ -0,0 +1,111 @@
+// smithy-typescript generated code
+import { getSerdePlugin } from "@aws-sdk/middleware-serde";
+import { HttpRequest as __HttpRequest, HttpResponse as __HttpResponse } from "@aws-sdk/protocol-http";
+import { Command as $Command } from "@aws-sdk/smithy-client";
+import {
+  FinalizeHandlerArguments,
+  Handler,
+  HandlerExecutionContext,
+  HttpHandlerOptions as __HttpHandlerOptions,
+  MetadataBearer as __MetadataBearer,
+  MiddlewareStack,
+  SerdeContext as __SerdeContext,
+} from "@aws-sdk/types";
+
+import {
+  AttachCustomerManagedPolicyReferenceToPermissionSetRequest,
+  AttachCustomerManagedPolicyReferenceToPermissionSetResponse,
+} from "../models/models_0";
+import {
+  deserializeAws_json1_1AttachCustomerManagedPolicyReferenceToPermissionSetCommand,
+  serializeAws_json1_1AttachCustomerManagedPolicyReferenceToPermissionSetCommand,
+} from "../protocols/Aws_json1_1";
+import { ServiceInputTypes, ServiceOutputTypes, SSOAdminClientResolvedConfig } from "../SSOAdminClient";
+
+export interface AttachCustomerManagedPolicyReferenceToPermissionSetCommandInput
+  extends AttachCustomerManagedPolicyReferenceToPermissionSetRequest {}
+export interface AttachCustomerManagedPolicyReferenceToPermissionSetCommandOutput
+  extends AttachCustomerManagedPolicyReferenceToPermissionSetResponse,
+    __MetadataBearer {}
+
+/**
+ * <p>Attaches the specified IAM customer managed policy to the specified <a>PermissionSet</a>.</p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { SSOAdminClient, AttachCustomerManagedPolicyReferenceToPermissionSetCommand } from "@aws-sdk/client-sso-admin"; // ES Modules import
+ * // const { SSOAdminClient, AttachCustomerManagedPolicyReferenceToPermissionSetCommand } = require("@aws-sdk/client-sso-admin"); // CommonJS import
+ * const client = new SSOAdminClient(config);
+ * const command = new AttachCustomerManagedPolicyReferenceToPermissionSetCommand(input);
+ * const response = await client.send(command);
+ * ```
+ *
+ * @see {@link AttachCustomerManagedPolicyReferenceToPermissionSetCommandInput} for command's `input` shape.
+ * @see {@link AttachCustomerManagedPolicyReferenceToPermissionSetCommandOutput} for command's `response` shape.
+ * @see {@link SSOAdminClientResolvedConfig | config} for SSOAdminClient's `config` shape.
+ *
+ */
+export class AttachCustomerManagedPolicyReferenceToPermissionSetCommand extends $Command<
+  AttachCustomerManagedPolicyReferenceToPermissionSetCommandInput,
+  AttachCustomerManagedPolicyReferenceToPermissionSetCommandOutput,
+  SSOAdminClientResolvedConfig
+> {
+  // Start section: command_properties
+  // End section: command_properties
+
+  constructor(readonly input: AttachCustomerManagedPolicyReferenceToPermissionSetCommandInput) {
+    // Start section: command_constructor
+    super();
+    // End section: command_constructor
+  }
+
+  /**
+   * @internal
+   */
+  resolveMiddleware(
+    clientStack: MiddlewareStack<ServiceInputTypes, ServiceOutputTypes>,
+    configuration: SSOAdminClientResolvedConfig,
+    options?: __HttpHandlerOptions
+  ): Handler<
+    AttachCustomerManagedPolicyReferenceToPermissionSetCommandInput,
+    AttachCustomerManagedPolicyReferenceToPermissionSetCommandOutput
+  > {
+    this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize));
+
+    const stack = clientStack.concat(this.middlewareStack);
+
+    const { logger } = configuration;
+    const clientName = "SSOAdminClient";
+    const commandName = "AttachCustomerManagedPolicyReferenceToPermissionSetCommand";
+    const handlerExecutionContext: HandlerExecutionContext = {
+      logger,
+      clientName,
+      commandName,
+      inputFilterSensitiveLog: AttachCustomerManagedPolicyReferenceToPermissionSetRequest.filterSensitiveLog,
+      outputFilterSensitiveLog: AttachCustomerManagedPolicyReferenceToPermissionSetResponse.filterSensitiveLog,
+    };
+    const { requestHandler } = configuration;
+    return stack.resolve(
+      (request: FinalizeHandlerArguments<any>) =>
+        requestHandler.handle(request.request as __HttpRequest, options || {}),
+      handlerExecutionContext
+    );
+  }
+
+  private serialize(
+    input: AttachCustomerManagedPolicyReferenceToPermissionSetCommandInput,
+    context: __SerdeContext
+  ): Promise<__HttpRequest> {
+    return serializeAws_json1_1AttachCustomerManagedPolicyReferenceToPermissionSetCommand(input, context);
+  }
+
+  private deserialize(
+    output: __HttpResponse,
+    context: __SerdeContext
+  ): Promise<AttachCustomerManagedPolicyReferenceToPermissionSetCommandOutput> {
+    return deserializeAws_json1_1AttachCustomerManagedPolicyReferenceToPermissionSetCommand(output, context);
+  }
+
+  // Start section: command_body_extra
+  // End section: command_body_extra
+}

clients/client-sso-admin/src/commands/AttachCustomerManagedPolicyReferenceToPermissionSetCommand.ts

@@ -28,7 +28,7 @@ export interface AttachManagedPolicyToPermissionSetCommandOutput
     __MetadataBearer {}
 
 /**
- * <p>Attaches an IAM managed policy ARN to a permission set.</p>
+ * <p>Attaches an Amazon Web Services managed IAM policy ARN to a permission set.</p>
  *          <note>
  *             <p>If the permission set is already referenced by one or more account assignments, you will
  *         need to call <code>