Skip to content

Commit b759a32

Browse files
aws-sdk-dotnet-automationaws-sdk-dotnet-automation
committed
Added support for App level authentication for QBusiness DataAccessor using AWS IAM Identity center Trusted Token issuer
1 parent 236dc08 commit b759a32

27 files changed

+1478
-4
lines changed

‎generator/ServiceModels/qbusiness/qbusiness-2023-11-27.api.json

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1711,6 +1711,7 @@
17111711
},
17121712
"statementId":{"shape":"StatementId"},
17131713
"actions":{"shape":"QIamActions"},
1714+
"conditions":{"shape":"PermissionConditions"},
17141715
"principal":{"shape":"PrincipalRoleArn"}
17151716
}
17161717
},
@@ -2474,6 +2475,7 @@
24742475
"idempotencyToken":true
24752476
},
24762477
"displayName":{"shape":"DataAccessorName"},
2478+
"authenticationDetail":{"shape":"DataAccessorAuthenticationDetail"},
24772479
"tags":{"shape":"Tags"}
24782480
}
24792481
},
@@ -2770,6 +2772,7 @@
27702772
"dataAccessorArn":{"shape":"DataAccessorArn"},
27712773
"idcApplicationArn":{"shape":"IdcApplicationArn"},
27722774
"principal":{"shape":"PrincipalRoleArn"},
2775+
"authenticationDetail":{"shape":"DataAccessorAuthenticationDetail"},
27732776
"createdAt":{"shape":"Timestamp"},
27742777
"updatedAt":{"shape":"Timestamp"}
27752778
}
@@ -2780,12 +2783,54 @@
27802783
"min":0,
27812784
"pattern":"arn:[a-z0-9-\\.]{1,63}:[a-z0-9-\\.]{0,63}:[a-z0-9-\\.]{0,63}:[a-z0-9-\\.]{0,63}:[^/].{0,1023}"
27822785
},
2786+
"DataAccessorAuthenticationConfiguration":{
2787+
"type":"structure",
2788+
"members":{
2789+
"idcTrustedTokenIssuerConfiguration":{"shape":"DataAccessorIdcTrustedTokenIssuerConfiguration"}
2790+
},
2791+
"union":true
2792+
},
2793+
"DataAccessorAuthenticationDetail":{
2794+
"type":"structure",
2795+
"required":["authenticationType"],
2796+
"members":{
2797+
"authenticationType":{"shape":"DataAccessorAuthenticationType"},
2798+
"authenticationConfiguration":{"shape":"DataAccessorAuthenticationConfiguration"},
2799+
"externalIds":{"shape":"DataAccessorExternalIds"}
2800+
}
2801+
},
2802+
"DataAccessorAuthenticationType":{
2803+
"type":"string",
2804+
"enum":[
2805+
"AWS_IAM_IDC_TTI",
2806+
"AWS_IAM_IDC_AUTH_CODE"
2807+
]
2808+
},
2809+
"DataAccessorExternalId":{
2810+
"type":"string",
2811+
"max":1000,
2812+
"min":1,
2813+
"pattern":"[a-zA-Z0-9][a-zA-Z0-9_-]*"
2814+
},
2815+
"DataAccessorExternalIds":{
2816+
"type":"list",
2817+
"member":{"shape":"DataAccessorExternalId"},
2818+
"max":1,
2819+
"min":1
2820+
},
27832821
"DataAccessorId":{
27842822
"type":"string",
27852823
"max":36,
27862824
"min":36,
27872825
"pattern":"[a-zA-Z0-9][a-zA-Z0-9-]{35}"
27882826
},
2827+
"DataAccessorIdcTrustedTokenIssuerConfiguration":{
2828+
"type":"structure",
2829+
"required":["idcTrustedTokenIssuerArn"],
2830+
"members":{
2831+
"idcTrustedTokenIssuerArn":{"shape":"IdcTrustedTokenIssuerArn"}
2832+
}
2833+
},
27892834
"DataAccessorName":{
27902835
"type":"string",
27912836
"max":100,
@@ -3716,6 +3761,7 @@
37163761
"idcApplicationArn":{"shape":"IdcApplicationArn"},
37173762
"principal":{"shape":"PrincipalRoleArn"},
37183763
"actionConfigurations":{"shape":"ActionConfigurationList"},
3764+
"authenticationDetail":{"shape":"DataAccessorAuthenticationDetail"},
37193765
"createdAt":{"shape":"Timestamp"},
37203766
"updatedAt":{"shape":"Timestamp"}
37213767
}
@@ -4134,6 +4180,12 @@
41344180
"roleArn":{"shape":"RoleArn"}
41354181
}
41364182
},
4183+
"IdcTrustedTokenIssuerArn":{
4184+
"type":"string",
4185+
"max":1284,
4186+
"min":0,
4187+
"pattern":"arn:aws:sso::[0-9]{12}:trustedTokenIssuer/(sso)?ins-[a-zA-Z0-9-.]{16}/tti-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
4188+
},
41374189
"IdentityProviderConfiguration":{
41384190
"type":"structure",
41394191
"members":{
@@ -5276,6 +5328,45 @@
52765328
"type":"string",
52775329
"sensitive":true
52785330
},
5331+
"PermissionCondition":{
5332+
"type":"structure",
5333+
"required":[
5334+
"conditionOperator",
5335+
"conditionKey",
5336+
"conditionValues"
5337+
],
5338+
"members":{
5339+
"conditionOperator":{"shape":"PermissionConditionOperator"},
5340+
"conditionKey":{"shape":"PermissionConditionKey"},
5341+
"conditionValues":{"shape":"PermissionConditionValues"}
5342+
}
5343+
},
5344+
"PermissionConditionKey":{
5345+
"type":"string",
5346+
"pattern":"aws:PrincipalTag/qbusiness-dataaccessor:[a-zA-Z]+.*"
5347+
},
5348+
"PermissionConditionOperator":{
5349+
"type":"string",
5350+
"enum":["StringEquals"]
5351+
},
5352+
"PermissionConditionValue":{
5353+
"type":"string",
5354+
"max":1000,
5355+
"min":1,
5356+
"pattern":"[a-zA-Z0-9][a-zA-Z0-9_-]*"
5357+
},
5358+
"PermissionConditionValues":{
5359+
"type":"list",
5360+
"member":{"shape":"PermissionConditionValue"},
5361+
"max":1,
5362+
"min":1
5363+
},
5364+
"PermissionConditions":{
5365+
"type":"list",
5366+
"member":{"shape":"PermissionCondition"},
5367+
"max":10,
5368+
"min":1
5369+
},
52795370
"PersonalizationConfiguration":{
52805371
"type":"structure",
52815372
"required":["personalizationControlMode"],
@@ -6304,6 +6395,7 @@
63046395
"locationName":"dataAccessorId"
63056396
},
63066397
"actionConfigurations":{"shape":"ActionConfigurationList"},
6398+
"authenticationDetail":{"shape":"DataAccessorAuthenticationDetail"},
63076399
"displayName":{"shape":"DataAccessorName"}
63086400
}
63096401
},

‎generator/ServiceModels/qbusiness/qbusiness-2023-11-27.docs.json

Lines changed: 82 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1062,6 +1062,39 @@
10621062
"GetDataAccessorResponse$dataAccessorArn": "<p>The Amazon Resource Name (ARN) of the data accessor.</p>"
10631063
}
10641064
},
1065+
"DataAccessorAuthenticationConfiguration": {
1066+
"base": "<p>A union type that contains the specific authentication configuration based on the authentication type selected.</p>",
1067+
"refs": {
1068+
"DataAccessorAuthenticationDetail$authenticationConfiguration": "<p>The specific authentication configuration based on the authentication type.</p>"
1069+
}
1070+
},
1071+
"DataAccessorAuthenticationDetail": {
1072+
"base": "<p>Contains the authentication configuration details for a data accessor. This structure defines how the ISV authenticates when accessing data through the data accessor.</p>",
1073+
"refs": {
1074+
"CreateDataAccessorRequest$authenticationDetail": "<p>The authentication configuration details for the data accessor. This specifies how the ISV will authenticate when accessing data through this data accessor.</p>",
1075+
"DataAccessor$authenticationDetail": "<p>The authentication configuration details for the data accessor. This specifies how the ISV authenticates when accessing data through this data accessor.</p>",
1076+
"GetDataAccessorResponse$authenticationDetail": "<p>The authentication configuration details for the data accessor. This specifies how the ISV authenticates when accessing data through this data accessor.</p>",
1077+
"UpdateDataAccessorRequest$authenticationDetail": "<p>The updated authentication configuration details for the data accessor. This specifies how the ISV will authenticate when accessing data through this data accessor.</p>"
1078+
}
1079+
},
1080+
"DataAccessorAuthenticationType": {
1081+
"base": "<p>The type of authentication mechanism used by the data accessor.</p>",
1082+
"refs": {
1083+
"DataAccessorAuthenticationDetail$authenticationType": "<p>The type of authentication to use for the data accessor. This determines how the ISV authenticates when accessing data. You can use one of two authentication types:</p> <ul> <li> <p> <code>AWS_IAM_IDC_TTI</code> - Authentication using IAM Identity Center Trusted Token Issuer (TTI). This authentication type allows the ISV to use a trusted token issuer to generate tokens for accessing the data.</p> </li> <li> <p> <code>AWS_IAM_IDC_AUTH_CODE</code> - Authentication using IAM Identity Center authorization code flow. This authentication type uses the standard OAuth 2.0 authorization code flow for authentication.</p> </li> </ul>"
1084+
}
1085+
},
1086+
"DataAccessorExternalId": {
1087+
"base": null,
1088+
"refs": {
1089+
"DataAccessorExternalIds$member": null
1090+
}
1091+
},
1092+
"DataAccessorExternalIds": {
1093+
"base": null,
1094+
"refs": {
1095+
"DataAccessorAuthenticationDetail$externalIds": "<p>A list of external identifiers associated with this authentication configuration. These are used to correlate the data accessor with external systems.</p>"
1096+
}
1097+
},
10651098
"DataAccessorId": {
10661099
"base": null,
10671100
"refs": {
@@ -1073,6 +1106,12 @@
10731106
"UpdateDataAccessorRequest$dataAccessorId": "<p>The unique identifier of the data accessor to update.</p>"
10741107
}
10751108
},
1109+
"DataAccessorIdcTrustedTokenIssuerConfiguration": {
1110+
"base": "<p>Configuration details for IAM Identity Center Trusted Token Issuer (TTI) authentication.</p>",
1111+
"refs": {
1112+
"DataAccessorAuthenticationConfiguration$idcTrustedTokenIssuerConfiguration": "<p>Configuration for IAM Identity Center Trusted Token Issuer (TTI) authentication used when the authentication type is <code>AWS_IAM_IDC_TTI</code>.</p>"
1113+
}
1114+
},
10761115
"DataAccessorName": {
10771116
"base": null,
10781117
"refs": {
@@ -1918,6 +1957,12 @@
19181957
"PluginAuthConfiguration$idcAuthConfiguration": "<p>Information about the IAM Identity Center Application used to configure authentication for a plugin.</p>"
19191958
}
19201959
},
1960+
"IdcTrustedTokenIssuerArn": {
1961+
"base": null,
1962+
"refs": {
1963+
"DataAccessorIdcTrustedTokenIssuerConfiguration$idcTrustedTokenIssuerArn": "<p>The Amazon Resource Name (ARN) of the IAM Identity Center Trusted Token Issuer that will be used for authentication.</p>"
1964+
}
1965+
},
19211966
"IdentityProviderConfiguration": {
19221967
"base": "<p>Provides information about the identity provider (IdP) used to authenticate end users of an Amazon Q Business web experience.</p>",
19231968
"refs": {
@@ -2111,7 +2156,7 @@
21112156
"LambdaArn": {
21122157
"base": null,
21132158
"refs": {
2114-
"HookConfiguration$lambdaArn": "<p>The Amazon Resource Name (ARN) of the Lambda function sduring ingestion. For more information, see <a href=\"https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/cde-lambda-operations.html\">Using Lambda functions for Amazon Q Business document enrichment</a>.</p>"
2159+
"HookConfiguration$lambdaArn": "<p>The Amazon Resource Name (ARN) of the Lambda function during ingestion. For more information, see <a href=\"https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/cde-lambda-operations.html\">Using Lambda functions for Amazon Q Business document enrichment</a>.</p>"
21152160
}
21162161
},
21172162
"LicenseNotFoundException": {
@@ -2696,6 +2741,42 @@
26962741
"APISchema$payload": "<p>The JSON or YAML-formatted payload defining the OpenAPI schema for a custom plugin. </p>"
26972742
}
26982743
},
2744+
"PermissionCondition": {
2745+
"base": "<p>Defines a condition that restricts when a permission is effective. Conditions allow you to control access based on specific attributes of the request.</p>",
2746+
"refs": {
2747+
"PermissionConditions$member": null
2748+
}
2749+
},
2750+
"PermissionConditionKey": {
2751+
"base": null,
2752+
"refs": {
2753+
"PermissionCondition$conditionKey": "<p>The key for the condition. This identifies the attribute that the condition applies to.</p>"
2754+
}
2755+
},
2756+
"PermissionConditionOperator": {
2757+
"base": null,
2758+
"refs": {
2759+
"PermissionCondition$conditionOperator": "<p>The operator to use for the condition evaluation. This determines how the condition values are compared.</p>"
2760+
}
2761+
},
2762+
"PermissionConditionValue": {
2763+
"base": null,
2764+
"refs": {
2765+
"PermissionConditionValues$member": null
2766+
}
2767+
},
2768+
"PermissionConditionValues": {
2769+
"base": null,
2770+
"refs": {
2771+
"PermissionCondition$conditionValues": "<p>The values to compare against using the specified condition operator.</p>"
2772+
}
2773+
},
2774+
"PermissionConditions": {
2775+
"base": null,
2776+
"refs": {
2777+
"AssociatePermissionRequest$conditions": "<p>The conditions that restrict when the permission is effective. These conditions can be used to limit the permission based on specific attributes of the request.</p>"
2778+
}
2779+
},
26992780
"PersonalizationConfiguration": {
27002781
"base": "<p>Configuration information about chat response personalization. For more information, see <a href=\"https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/personalizing-chat-responses.html\">Personalizing chat responses</a>.</p>",
27012782
"refs": {

0 commit comments

Comments
 (0)